Skip to content

docmd@0.9.7 – Python Engine & Security Hardening

Choose a tag to compare

View all tags
@mgks mgks released this 27 Sep 13:40
· 30 commits to main since this release
0.9.7
fdae951

docmd logo

Python Engine & Security Hardening

Release v0.9.7 introduces the Python engine, unifies engine lifecycle management, fixes `.gitignore` and MCP exclusion regressions, and hardens CLI and development server security.

Added

  • Python engine through @docmd/engine-python, adding Python 3.8+ as an engine option alongside JavaScript and Rust.
  • The Python engine uses a persistent stdio worker for file discovery, Git history parsing, and search indexing, avoiding repeated subprocess startup costs.
  • Setting "engine": "python" automatically uses Python when available and falls back to the JavaScript engine when it is not.
  • Added standard shutdown() and destroy() hooks across the JavaScript, Rust, and Python engine implementations.
  • Added automatic idle cleanup for Python engine workers to prevent orphaned background processes.

Improved

  • Engine lifecycle management is now handled consistently across build and development workflows, ensuring subprocesses, native bindings, and worker resources are released cleanly.
  • Updated search integration and plugin peer dependencies to require docmd-search >=0.1.6, including Python engine support.
  • Git history extraction, search indexing, and batch file scanning can now use the Python engine directly.
  • Build and MCP file discovery now share the same exclusion behaviour, reducing differences between published documentation and content exposed through tooling.

Fixed

  • Fixed anchored .gitignore patterns introduced in v0.9.6 (#244).

    Patterns such as /airo are now matched relative to the project root instead of the absolute filesystem path. Previously, an ancestor directory with the same name could cause every documentation page to be excluded and result in Generated 0 pages.

  • Fixed config.exclude handling in MCP tools (#245).

    search_docs, list_docs, and validate_docs now honour the same config.exclude, .gitignore, and standard skip rules used by the build pipeline. Excluded drafts, archived pages, and other unpublished files are no longer exposed through these MCP tools.

Security

  • Replaced shell-interpolated execSync calls with spawnSync and explicit argument arrays in doctor and search indexing.
  • Escaped reflected request URLs in development server 404 and 500 pages to prevent reflected XSS.
  • Added stricter redirect target validation in docmd dev.
  • Live server asset paths now pass through canonical path validation, preventing traversal outside the generated output directory.

Links

Documentation: https://docs.docmd.io/
Cloud Platform: https://cloud.docmd.io
Dev & Writing Skills: https://github.com/docmd-io/docmd-skills

Full Changelog: https://github.com/docmd-io/docmd/commits/0.9.7

Assets 2
Loading