Beautiful Website for Your Projects

[email protected] — 2026-09-20

Fixes npm tarball staging in the release workflow, plus dependency upgrades and supply-chain hardening.

Bug Fixes

• prefix staged tarball path so npm does not treat it as git (#482)

Internal

• migrate biome recommended rules to preset (#483)
• make onReleaseChangelog hook error test robust (#484)
• stage npm releases with pnpm (#485)
• drop tilde range preference (#486)
• remove undici 8.x override (#487)
• remove undici 7.x override (#488)
• remove liquidjs override (#489)
• upgrade code quality dependencies (#490)
• upgrade TypeScript and build tooling to typescript@7, vitest@5, and [email protected] (#491)
• upgrade GitHub Actions (#492)
• pin Dev Container images (#493)
• upgrade AI SDK dependencies (#494)
• upgrade hashery (#495)
• upgrade undici (#496)
• upgrade ecto to 5.1.0 (#497)
• upgrade writr (#498)
• cover .vscode in CODEOWNERS (#499)
• drop first-party cooldown excludes (#500)
• set trustPolicy no-downgrade (#501)
• kebab-case workflow and job names (#502)
• record repository lockdown (#503)

Contributors

• @jaredwray (22)

Full List of Changes

• fix: prefix staged tarball path so npm does not treat it as git by @jaredwray in #482
• chore: migrate Biome recommended rules to preset by @jaredwray in #483
• test: make onReleaseChangelog hook error test robust by @jaredwray in #484
• root - chore: defense - stage npm releases with pnpm by @jaredwray in #485
• root - chore: defense - drop tilde range preference by @jaredwray in #486
• mono - chore: remove undici 8.x override by @jaredwray in #487
• mono - chore: remove undici 7.x override by @jaredwray in #488
• mono - chore: remove liquidjs override by @jaredwray in #489
• mono - chore: upgrade code quality dependencies by @jaredwray in #490
• mono - chore: upgrade TypeScript and build tooling by @jaredwray in #491
• mono - chore: upgrade GitHub Actions by @jaredwray in #492
• mono - chore: pin Dev Container images by @jaredwray in #493
• mono - chore: upgrade AI SDK dependencies by @jaredwray in #494
• mono - chore: upgrade hashery by @jaredwray in #495
• mono - chore: upgrade undici by @jaredwray in #496
• mono - chore: upgrade ecto by @jaredwray in #497
• mono - chore: upgrade writr by @jaredwray in #498
• root - chore: defense - cover .vscode in CODEOWNERS by @jaredwray in #499
• root - chore: defense - drop first-party cooldown excludes by @jaredwray in #500
• root - chore: defense - set trustPolicy no-downgrade by @jaredwray in #501
• root - chore: defense - kebab-case workflow and job names by @jaredwray in #502
• root - chore: defense - record repository lockdown by @jaredwray in #503

Full diff: https://github.com/jaredwray/docula/compare/v3.0.0...v3.0.1

[email protected] — 2026-08-17

Security pins, ecto 5 template escaping, dependency upgrades, and CI/release hardening.

⚠ BREAKING CHANGES

• upgrade ecto to 5.0.0 — Handlebars now HTML-escapes `{{ }}` by default (96f791a, #462)
  Migration: In custom templates, replace `{{generatedHtml}}` with `{{{generatedHtml}}}` so document HTML is not double-escaped. The bundled classic template already includes this change.

Bug Fixes

• pin liquidjs to 10.27.1 for memoryLimit DoS advisories (f0e4548, #480)
• pin undici to patched releases for SOCKS5 TLS bypass (eb4ddbf, #463)

Documentation

• scaffold security docs (29d7a34, #464)

Internal

• add standalone binary validation harness (ac4808c, #479)
• bootstrap Aikido Safe Chain in cloud agents (c0fe7c7, #478)
• reconcile checklist after lockdown tweaks (f139ce3, #477)
• wrap CI installs with Socket Firewall (b5e916f, #476)
• disable setup-node cache poisoning (913a9ea, #475)
• record repository lockdown (fb953c3, #474)
• add CODEOWNERS for high-risk paths (55e7b9d, #473)
• add Aikido release gate (4a2fa0f, #471)
• stage npm publishes via OIDC (8d4ab34, #470)
• lint workflows with zizmor (ca3d677, #469)
• add Socket Firewall to every job (4f05fb7, #468)
• disable checkout credential persistence (6059b10, #467)
• set contents: read workflow permissions (8a9fc23, #466)
• install with a frozen lockfile (a3a4d68, #465)
• upgrade undici (94c05d8, #461)
• use caret range for ipaddr.js (41a973c, #460)
• upgrade ipaddr.js (2508e4b, #459)
• upgrade AI SDK dependencies to ai@7 and @ai-sdk/*@4 (14c75ee, #458)
• upgrade GitHub Actions (c87fd16, #457)
• upgrade pnpm to 11.20.0 (f8e7e83, #456)
• upgrade TypeScript and build tooling (933fafb, #455)
• upgrade code quality dependencies (06325ff, #454)
• dependency maintenance (2026-07-19) (1aaa59c, #453)

Contributors

• @jaredwray (22)

Full List of Changes

• chore: dependency maintenance (2026-07-19) by @jaredwray in #453
• root - chore: upgrade code quality dependencies by @jaredwray in #454
• root - chore: upgrade TypeScript and build tooling by @jaredwray in #455
• root - chore: upgrade pnpm by @jaredwray in #456
• root - chore: upgrade GitHub Actions (breaking) by @jaredwray in #457
• root - chore: upgrade AI SDK dependencies (breaking) by @jaredwray in #458
• root - chore: upgrade ipaddr.js by @jaredwray in #459
• root - chore: use caret range for ipaddr.js by @jaredwray in #460
• root - chore: upgrade undici by @jaredwray in #461
• root - chore: upgrade ecto (breaking) by @jaredwray in #462
• fix: pin undici to patched releases for SOCKS5 TLS bypass by @jaredwray in #463
• root - chore: defense - scaffold security docs by @jaredwray in #464
• root - chore: defense - install with a frozen lockfile by @jaredwray in #465
• root - chore: defense - set contents: read workflow permissions by @jaredwray in #466
• root - chore: defense - disable checkout credential persistence by @jaredwray in #467
• root - chore: defense - add Socket Firewall to every job by @jaredwray in #468
• root - chore: defense - lint workflows with zizmor by @jaredwray in #469
• root - chore: defense - stage npm publishes via OIDC by @jaredwray in #470
• root - chore: defense - add Aikido release gate by @jaredwray in #471
• root - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #473
• root - chore: defense - disable setup-node cache poisoning by @jaredwray in #475
• root - chore: defense - record repository lockdown by @jaredwray in #474
• root - chore: defense - wrap CI installs with Socket Firewall by @jaredwray in #476
• root - chore: defense - reconcile checklist after lockdown tweaks by @jaredwray in #477
• root - chore: defense - bootstrap Aikido Safe Chain in cloud agents by @jaredwray in #478
• Add standalone binary validation harness by @jaredwray in #479
• fix: pin liquidjs to 10.27.1 for memoryLimit DoS advisories by @jaredwray in #480

Full diff: https://github.com/jaredwray/docula/compare/v2.2.0...v3.0.0

[email protected] — 2026-07-08

Google Tag Manager environment support, plus a nav-highlight fix and release/deploy CI fixes.

Features

• add support for Google Tag Manager environments (70a3fac, #451)

  ```ts
  // docula.config.ts — target a specific GTM environment (staging, QA, …)
  export const options: Partial<DoculaOptions> = {
  googleTagManager: 'GTM-XXXXXX',
  googleTagManagerAuth: 'abc123', // → gtm_auth
  googleTagManagerEnv: 'env-3', // → gtm_preview
  };
  ```

Bug Fixes

• documentation nav link staying highlighted when embedded under a base path (2952de4, #450)

Internal

• ci: pass Cloudflare accountId to wrangler pages deploy (310aef9, #449)
• ci: give release binaries unique asset filenames (ea462c7, #448)
• ci: approve sharp and workerd build scripts for wrangler deploy (dc08718, #447)

Contributors

• @jaredwray (5)
• @Terryda (3)

Full List of Changes

• Fix deploy: approve sharp and workerd build scripts for wrangler by @jaredwray in #447
• fix(ci): give release binaries unique asset filenames by @jaredwray in #448
• fix: pass Cloudflare accountId to wrangler pages deploy by @jaredwray in #449
• Fix Documentation nav link staying highlighted when embedded under a base path by @jaredwray in #450
• feat: add support for google tag manager environments by @Terryda in #451 (first-time contributor)

Full diff: https://github.com/jaredwray/docula/compare/v2.1.0...v2.2.0