One package and a public feed
Cendia now installs and updates from its own NuGet feed, and a site references a single package. The image and rich-text components have been replaced with MIT-licensed ones, and Settings gains a page that lists every piece of third-party software a site is running.
Contains breaking changes. Read the upgrade notes before taking this version.
This release is about what a developer meets first: how Cendia arrives, what it is called in a project file, and what comes with it.
- A public feed. Cendia is published at
https://nuget.cendia.com/index.json. Add it as a package source and new releases appear in Manage NuGet Packages like any other update. The feed’s own page lists every release and package. No key and no sign-in. - One package:
Cendia.CMS. A site names one Cendia package and everything else arrives with it, the content-type generator included. An update is one version number in one place. - A site stays on its release until you move it. A project made from the Starter is pinned to the exact release it was made from. Nothing updates it for you.
- Namespaces that say what things are.
using Cendia.Schema;,Cendia.FieldTypes,Cendia.Content,Cendia.Rendering, and plainCendiaforAddCendiaandMapCendia. - Images are handled by SkiaSharp. Thumbnails, the WebP copy made for delivery, the image editor and profile photos all run on it. Photos taken on a phone are now stored upright, and no generated image carries the original’s metadata, such as where it was taken.
- The image editor works on JPG and PNG. GIF, WebP and AVIF files upload and display as before; they are not opened for editing. TIFF files are not accepted for upload, because browsers cannot show them.
- The rich-text editor is HugeRTE. It is the MIT-licensed continuation of the editor Cendia already used, so toolbars, the Styles menu and WYSIWYG Templates are unchanged, and existing content is untouched.
- Settings > Third-Party Software. A read-only page listing every third-party package and browser library in the installation, with its version and licence. The package list is read from the running site, so it is always current.
- Draft saves are steadier. The editor sends one save at a time, and two saves of the same page arriving together no longer produce an error.
Upgrading
Take the packages. Two settings may need attention.
If you have a headless front end that sends the roles segment, it has stopped being honoured, and your ACL-restricted pages are being served as anonymous — which means 404. Turn it back on only if the Delivery API is not reachable by browsers:
"Cendia": { "AllowSuppliedRolesOnDelivery": true }
Every environment that is not Development now needs a preview signing key. Generate one with openssl rand -base64 48 and supply it as Cendia__PreviewSigningKey through your environment or secret store. The host will not start without it.
Full detail is in Releases and upgrading → Security hardening.