InsightSite 1.7–1.9: a safer admin, configurable bot protection and scheduling without cron

The last few releases tackled the problems we saw most often while running sites in production. Here is what changed in each, and how to upgrade.

1.7: a hardened admin

• Safer uploads: the file type is detected from the file's content; only images, PDF, audio/video, Office documents, archives and text are accepted, and SVG with scripts is rejected.
• Revocable sessions: signing out invalidates the token at once, and changing a password signs out every other device.
• Login protection: a per-account rate limit on top of the per-IP one, against password spraying.
• nuxtcms doctor: lists the framework files a site overrides and which newer features those copies are missing.

1.8: bot protection you configure in the admin

A new Admin → Security page switches between a built-in image captcha, Cloudflare Turnstile and Google reCAPTCHA, with a toggle per form: admin login, contact form, comments, newsletter and checkout. New settings must pass one live check before they are saved, so a wrong key cannot lock you out.

1.9: scheduled publishing without cron

Scheduled content used to rely on a cron job. Now ordinary traffic also checks for content that is due (at most every five minutes per instance, in the background), so sites without a cron job publish on time as well.

How to upgrade

Run this in your site project:

node node_modules/nuxtcms/scripts/upgrade.mjs --deploy

It pins the new version, installs, migrates the database, builds and deploys. Afterwards, npx nuxtcms doctor tells you whether any customized files should pick up new features. See the changelog for every detail.