v1.8.0 — native dev server, fewer dependencies, hardening

The dev server drops connect, serve-static and portscanner for a native node:http handler (with Range support for video seeking), search keywords go Unicode-aware, config typos get warned, and a batch of correctness and Windows fixes land.

Added

• Native node:http dev server. The local server no longer depends on connect + serve-static, and free-port selection no longer depends on portscanner. Three dependencies gone (five packages, still 0 audit vulnerabilities). The replacement handler keeps the behavior you rely on and adds a few things the old stack didn't:
  • Range request support — single-range 206 Partial Content (and 416 for unsatisfiable ranges), so <video>/<audio> seeking works against the dev server.
  • directory → index.html, with a /dir → /dir/ redirect,
  • path-traversal containment and null-byte rejection,
  • 405 for non-GET/HEAD methods,
  • your existing 404.html fallback, unchanged.
• Unknown config-key warnings. A typo in a top-level poops.json key (stlyes, marckup, …) was silently ignored before. Startup now warns per unknown key so the most common config mistake surfaces immediately.
• Declared Node floor. package.json now sets "engines": { "node": ">=20" }, and CI runs a Node 20/22/24 × ubuntu/windows matrix so the real floor is tested, not assumed.

Changed

• Search keywords are Unicode-aware. extractKeywords no longer strips all non-Latin characters — non-English sites now get real keywords instead of empty ones (regex switched to \p{L}\p{N} with the u flag).

Fixed

• Liquid {% image %} no longer breaks on commas in values. A standard responsive sizes value — sizes: "(max-width: 600px) 100vw, 50vw" — was split mid-value by a naive split(','), producing broken attributes. Argument parsing is now quote-aware, so the documented responsive-image examples work in Liquid as they already did in Nunjucks.
• Index artifacts write to subdirectory outputs. Search index, sitemap, nav and robots.txt now mkdir -p their target directory first, so "output": "meta/nav.json" no longer throws ENOENT.
• Path matching respects segment boundaries. An in: "src" config no longer false-matches mysrc2/file.js or dist/src-maps/x. This previously could skip a rebuild — or, on the copy path, delete the wrong output file.
• Windows dev fixes. CSS hot-swap paths are now posix-normalized (live CSS swap stopped degrading on Windows), and npm test is cross-platform (no more POSIX-only NODE_OPTIONS= prefix).
• Better data-file diagnostics. A YAML/JSON parse error now logs the real message instead of a misleading "Data file not found", and two data files with the same basename warn before the global collides.
• No reactor rebuild loop. The chokidar watcher now ignores the *.reactor-tmp-* / *.reactor-bundle-* scratch files, closing a potential self-sustaining rebuild loop.
• Clean startup failures. Errors during startServer() and the livereload-only path now exit with a message instead of surfacing as an unhandled promise rejection (a hard crash on current Node).
• Free-port selection can't return a busy port. When every candidate port in the range is occupied, the server now exits with a clear "no free port in range" error instead of crashing later with EADDRINUSE.

---