Docula

v3.0.0 August 17, 2026

[email protected] — 2026-08-17

Security pins, ecto 5 template escaping, dependency upgrades, and CI/release hardening.

⚠ BREAKING CHANGES

upgrade ecto to 5.0.0 — Handlebars now HTML-escapes `{{ }}` by default (96f791a, #462)
Migration: In custom templates, replace `{{generatedHtml}}` with `{{{generatedHtml}}}` so document HTML is not double-escaped. The bundled classic template already includes this change.

Bug Fixes

pin liquidjs to 10.27.1 for memoryLimit DoS advisories (f0e4548, #480)
pin undici to patched releases for SOCKS5 TLS bypass (eb4ddbf, #463)

Documentation

scaffold security docs (29d7a34, #464)

Internal

add standalone binary validation harness (ac4808c, #479)
bootstrap Aikido Safe Chain in cloud agents (c0fe7c7, #478)
reconcile checklist after lockdown tweaks (f139ce3, #477)
wrap CI installs with Socket Firewall (b5e916f, #476)
disable setup-node cache poisoning (913a9ea, #475)
record repository lockdown (fb953c3, #474)
add CODEOWNERS for high-risk paths (55e7b9d, #473)
add Aikido release gate (4a2fa0f, #471)
stage npm publishes via OIDC (8d4ab34, #470)
lint workflows with zizmor (ca3d677, #469)
add Socket Firewall to every job (4f05fb7, #468)
disable checkout credential persistence (6059b10, #467)
set contents: read workflow permissions (8a9fc23, #466)
install with a frozen lockfile (a3a4d68, #465)
upgrade undici (94c05d8, #461)
use caret range for ipaddr.js (41a973c, #460)
upgrade ipaddr.js (2508e4b, #459)
upgrade AI SDK dependencies to ai@7 and @ai-sdk/*@4 (14c75ee, #458)
upgrade GitHub Actions (c87fd16, #457)
upgrade pnpm to 11.20.0 (f8e7e83, #456)
upgrade TypeScript and build tooling (933fafb, #455)
upgrade code quality dependencies (06325ff, #454)
dependency maintenance (2026-07-19) (1aaa59c, #453)

Contributors

@jaredwray (22)

Full List of Changes

chore: dependency maintenance (2026-07-19) by @jaredwray in #453
root - chore: upgrade code quality dependencies by @jaredwray in #454
root - chore: upgrade TypeScript and build tooling by @jaredwray in #455
root - chore: upgrade pnpm by @jaredwray in #456
root - chore: upgrade GitHub Actions (breaking) by @jaredwray in #457
root - chore: upgrade AI SDK dependencies (breaking) by @jaredwray in #458
root - chore: upgrade ipaddr.js by @jaredwray in #459
root - chore: use caret range for ipaddr.js by @jaredwray in #460
root - chore: upgrade undici by @jaredwray in #461
root - chore: upgrade ecto (breaking) by @jaredwray in #462
fix: pin undici to patched releases for SOCKS5 TLS bypass by @jaredwray in #463
root - chore: defense - scaffold security docs by @jaredwray in #464
root - chore: defense - install with a frozen lockfile by @jaredwray in #465
root - chore: defense - set contents: read workflow permissions by @jaredwray in #466
root - chore: defense - disable checkout credential persistence by @jaredwray in #467
root - chore: defense - add Socket Firewall to every job by @jaredwray in #468
root - chore: defense - lint workflows with zizmor by @jaredwray in #469
root - chore: defense - stage npm publishes via OIDC by @jaredwray in #470
root - chore: defense - add Aikido release gate by @jaredwray in #471
root - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #473
root - chore: defense - disable setup-node cache poisoning by @jaredwray in #475
root - chore: defense - record repository lockdown by @jaredwray in #474
root - chore: defense - wrap CI installs with Socket Firewall by @jaredwray in #476
root - chore: defense - reconcile checklist after lockdown tweaks by @jaredwray in #477
root - chore: defense - bootstrap Aikido Safe Chain in cloud agents by @jaredwray in #478
Add standalone binary validation harness by @jaredwray in #479
fix: pin liquidjs to 10.27.1 for memoryLimit DoS advisories by @jaredwray in #480

Full diff: https://github.com/jaredwray/docula/compare/v2.2.0...v3.0.0

v2.2.0 July 08, 2026

[email protected] — 2026-07-08

Google Tag Manager environment support, plus a nav-highlight fix and release/deploy CI fixes.

Features

add support for Google Tag Manager environments (70a3fac, #451)

```ts
// docula.config.ts — target a specific GTM environment (staging, QA, …)
export const options: Partial = {
googleTagManager: 'GTM-XXXXXX',
googleTagManagerAuth: 'abc123', // → gtm_auth
googleTagManagerEnv: 'env-3', // → gtm_preview
};
```

Bug Fixes

documentation nav link staying highlighted when embedded under a base path (2952de4, #450)

Internal

ci: pass Cloudflare accountId to wrangler pages deploy (310aef9, #449)
ci: give release binaries unique asset filenames (ea462c7, #448)
ci: approve sharp and workerd build scripts for wrangler deploy (dc08718, #447)

Contributors

@jaredwray (5)
@Terryda (3)

Full List of Changes

Fix deploy: approve sharp and workerd build scripts for wrangler by @jaredwray in #447
fix(ci): give release binaries unique asset filenames by @jaredwray in #448
fix: pass Cloudflare accountId to wrangler pages deploy by @jaredwray in #449
Fix Documentation nav link staying highlighted when embedded under a base path by @jaredwray in #450
feat: add support for google tag manager environments by @Terryda in #451 (first-time contributor)

Full diff: https://github.com/jaredwray/docula/compare/v2.1.0...v2.2.0

v2.1.0 June 19, 2026

[email protected] — 2026-06-19

Client-side search (⌘K), SSRF hardening, SEA binary fixes, and a dependency refresh.

Features

add built-in client-side search (⌘K) to the modern template (a3d3c1c, #445)

```jsonc
// docula.config.json — search is on by default for the modern template;
// build emits search-index.json and renders the ⌘K / Ctrl-K modal.
{ "enableSearch": true } // set to false to disable
```

Bug Fixes

search: robust HTML stripping and Enter-key race in client search (5d4392c, #445)
search: match lenient script/style end tags; enable search for changelog-only sites (d6ac6e9, #445)
api: mitigate SSRF in remote OpenAPI spec fetch (1ca11c5, #431)
safe-fetch: handle both lookup signatures; destroy dispatcher inline on redirect (396618c, #431)
binary: support docula.config.json; SEA mode loads JSON only (083ed53, #428)
binary: load .mjs configs without dynamic import() in SEA mode (6fcecc5, #428)
binary: use createRequire instead of new Function; preserve aliases and scope (10edf8b, #428)
binary: dedupe require() calls and verify multi-line import handling (1d2e758, #428)
binary: build SEA as ESM to enable dynamic import of file URLs (eef80ee, #426)
binary: drop githubPath from smoke fixture to skip GH API call (eabbada, #429)
binary: skip site config loading for version command (077f4cd, #425)
release: grant id-token: write for npm OIDC trusted publishing (7ae3269, #424)

Documentation

security: add Aikido badge and expand SECURITY.md (6352d7e, #432)
security: qualify PR scan coverage to main branch (7b55ddd, #432)
readme: move Aikido badge into dedicated Security section (c2eabf7, #433)
security: switch vulnerability reports to private email only (4690e60, #433)
readme: drop vulnerability reporting line from summary (4cb858f, #433)
add Binary Download page documenting JSON-only SEA config (985cc1f, #428)
add rel="noopener noreferrer" to Aikido badge link (1f6d5a6, #427)
add Aikido security audit report badge to README (b5d2d2d, #427)
re-add Aikido Security Audit badge (1d96c29, #435)

Internal

upgrade hashery to 3 — no public API change; Node ≥22.18 already satisfied (dfd72a1, #443)
upgrade undici to 8; bump engines.node to ^22.19.0 (0f38083, #442)
upgrade ipaddr.js (1721a15, #441)
upgrade ecto (5eae9fd, #440)
upgrade @cacheable/net (9e0e5b0, #439)
upgrade AI SDK dependencies (211bb19, #438)
upgrade GitHub Actions — checkout v7, codecov v7 (e8e0d3b, #437)
upgrade TypeScript and build tooling (b9cc26d, #436)
upgrade code quality dependencies — biome, vitest (5880166, #435)
test: rebuild test harness for isolation, determinism, and 100% coverage (bcd6d9c, #444)
test: harden harness per review — no failure-hiding, no env leaks, safer cloneSite (4f72069, #444)
test: address Codex review findings on the migrated tests (b78007a, #444)
ci(binary): drop macOS x64 build, keep only macos-latest arm64 (33619a6, #430)
ci(binary): replace deprecated macos-13 runner with macos-15-intel (c8308d2, #430)
ci(release): drop NPM_TOKEN fallback now that OIDC publishes (21607ac, #424)

Contributors

@jaredwray (21)

Full List of Changes

fix(release): grant id-token: write so pnpm OIDC publish succeeds by @jaredwray in #424
fix(binary): skip site config loading for `version` command by @jaredwray in #425
fix(binary): build SEA as ESM to enable dynamic import of file URLs by @jaredwray in #426
docs: add Aikido security audit report badge to README by @jaredwray in #427
fix(binary): load .mjs configs without dynamic import() in SEA mode by @jaredwray in #428
fix(binary): drop githubPath from smoke fixture to skip GH API call by @jaredwray in #429
ci(binary): drop macOS x64 build, keep only macos-latest (arm64) by @jaredwray in #430
fix(api): mitigate SSRF in remote OpenAPI spec fetch by @jaredwray in #431
docs(security): add Aikido badge and expand SECURITY.md by @jaredwray in #432
docs(readme): move Aikido badge into dedicated Security section by @jaredwray in #433
root - chore: upgrade code quality dependencies by @jaredwray in #435
root - chore: upgrade TypeScript and build tooling by @jaredwray in #436
root - chore: upgrade GitHub Actions (breaking) by @jaredwray in #437
root - chore: upgrade AI SDK dependencies by @jaredwray in #438
root - chore: upgrade @cacheable/net by @jaredwray in #439
root - chore: upgrade ecto by @jaredwray in #440
root - chore: upgrade ipaddr.js by @jaredwray in #441
root - chore: upgrade undici to 8 (breaking) by @jaredwray in #442
root - chore: upgrade hashery to 3 (breaking) by @jaredwray in #443
test: rebuild test harness for isolation, determinism, and 100% coverage by @jaredwray in #444
feat: built-in client-side search (⌘K) for the modern template by @jaredwray in #445

Full diff: https://github.com/jaredwray/docula/compare/v2.0.0...v2.1.0

Beautiful Website for Your Projects

Contributors

Changelog

[email protected] — 2026-08-17

⚠ BREAKING CHANGES

Bug Fixes

Documentation

Internal

Contributors

Full List of Changes

[email protected] — 2026-07-08

Features

Bug Fixes

Internal

Contributors

Full List of Changes

[email protected] — 2026-06-19

Features

Bug Fixes

Documentation

Internal

Contributors

Full List of Changes