v3.0.0

Release

August 17, 2026

[email protected] — 2026-08-17

Security pins, ecto 5 template escaping, dependency upgrades, and CI/release hardening.

⚠ BREAKING CHANGES

upgrade ecto to 5.0.0 — Handlebars now HTML-escapes {{ }} by default (96f791a, #462) Migration: In custom templates, replace {{generatedHtml}} with {{{generatedHtml}}} so document HTML is not double-escaped. The bundled classic template already includes this change.

Bug Fixes

pin liquidjs to 10.27.1 for memoryLimit DoS advisories (f0e4548, #480)
pin undici to patched releases for SOCKS5 TLS bypass (eb4ddbf, #463)

Documentation

scaffold security docs (29d7a34, #464)

Internal

add standalone binary validation harness (ac4808c, #479)
bootstrap Aikido Safe Chain in cloud agents (c0fe7c7, #478)
reconcile checklist after lockdown tweaks (f139ce3, #477)
wrap CI installs with Socket Firewall (b5e916f, #476)
disable setup-node cache poisoning (913a9ea, #475)
record repository lockdown (fb953c3, #474)
add CODEOWNERS for high-risk paths (55e7b9d, #473)
add Aikido release gate (4a2fa0f, #471)
stage npm publishes via OIDC (8d4ab34, #470)
lint workflows with zizmor (ca3d677, #469)
add Socket Firewall to every job (4f05fb7, #468)
disable checkout credential persistence (6059b10, #467)
set contents: read workflow permissions (8a9fc23, #466)
install with a frozen lockfile (a3a4d68, #465)
upgrade undici (94c05d8, #461)
use caret range for ipaddr.js (41a973c, #460)
upgrade ipaddr.js (2508e4b, #459)
upgrade AI SDK dependencies to ai@7 and @ai-sdk/*@4 (14c75ee, #458)
upgrade GitHub Actions (c87fd16, #457)
upgrade pnpm to 11.20.0 (f8e7e83, #456)
upgrade TypeScript and build tooling (933fafb, #455)
upgrade code quality dependencies (06325ff, #454)
dependency maintenance (2026-07-19) (1aaa59c, #453)

Contributors

@jaredwray (22)

Full List of Changes

chore: dependency maintenance (2026-07-19) by @jaredwray in #453
root - chore: upgrade code quality dependencies by @jaredwray in #454
root - chore: upgrade TypeScript and build tooling by @jaredwray in #455
root - chore: upgrade pnpm by @jaredwray in #456
root - chore: upgrade GitHub Actions (breaking) by @jaredwray in #457
root - chore: upgrade AI SDK dependencies (breaking) by @jaredwray in #458
root - chore: upgrade ipaddr.js by @jaredwray in #459
root - chore: use caret range for ipaddr.js by @jaredwray in #460
root - chore: upgrade undici by @jaredwray in #461
root - chore: upgrade ecto (breaking) by @jaredwray in #462
fix: pin undici to patched releases for SOCKS5 TLS bypass by @jaredwray in #463
root - chore: defense - scaffold security docs by @jaredwray in #464
root - chore: defense - install with a frozen lockfile by @jaredwray in #465
root - chore: defense - set contents: read workflow permissions by @jaredwray in #466
root - chore: defense - disable checkout credential persistence by @jaredwray in #467
root - chore: defense - add Socket Firewall to every job by @jaredwray in #468
root - chore: defense - lint workflows with zizmor by @jaredwray in #469
root - chore: defense - stage npm publishes via OIDC by @jaredwray in #470
root - chore: defense - add Aikido release gate by @jaredwray in #471
root - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #473
root - chore: defense - disable setup-node cache poisoning by @jaredwray in #475
root - chore: defense - record repository lockdown by @jaredwray in #474
root - chore: defense - wrap CI installs with Socket Firewall by @jaredwray in #476
root - chore: defense - reconcile checklist after lockdown tweaks by @jaredwray in #477
root - chore: defense - bootstrap Aikido Safe Chain in cloud agents by @jaredwray in #478
Add standalone binary validation harness by @jaredwray in #479
fix: pin liquidjs to 10.27.1 for memoryLimit DoS advisories by @jaredwray in #480

Full diff: https://github.com/jaredwray/docula/compare/v2.2.0...v3.0.0