Upgrade to 1.0.0-rc871

Draft links are restored from pw_auth, not from an auth probe

The unpublished-link restorer reads the pw_auth=1 cookie instead of fetching /_pushword/auth-check, so anonymous visitors no longer trigger the 401 that browsers log as a console error and Lighthouse counts against best-practices.

Affects sites using Unpublished Links. Rebuild your front assets (yarn build) for it to take effect — until then the old bundle keeps probing, and the endpoint keeps answering. Only ROLE_EDITOR gets draft links back now, where the probe answered to any fully authenticated user of the firewall covering it.

image() takes a sizes argument, and the default is 100vw

sizes now goes on the element that carries the srcset, the modern <source> — passed through attr it only ever reached the <img>, which no webp-capable browser reads, and arrived concatenated with the default. The default itself was a ladder announcing the breakpoint’s width rather than the viewport’s, which made phones download a candidate one or two steps too large; it is 100vw now. The <img> behind a webp <source> no longer carries a srcset (it rendered empty, and the ladder does not exist in the source format).

Affects every site rendering image(). Nothing breaks unchanged, but 100vw still over-serves anything narrower than the viewport: pass sizes: the width the element really occupies — image(media, sizes: '(max-width: 1023px) 100vw, 773px') — wherever an image is not full-bleed. A caller already passing attr: {sizes: …} keeps working and should move the value to the argument.