docs.plus 2.2.0

docs.plus 2.2.0 is here: you can now draw diagrams in your documents, and more AI apps can work with them. docs.plus is an open-source editor where every heading has its own chat. If you write and read on docs.plus, nothing breaks.

📊 9 days in numbers

🔨 103 commits	about 11 a day since 2.1.0
✅ 53 issues closed	12 bugs and 20 security fixes among them
✨ 13 feature commits, 25 fix commits	plus 19 commits that improve the docs
🧪 1,401 tests pass	880 server tests, 390 webapp unit tests, and 131 for the new diagram extension
🗄️ 14 database migrations	all for Supabase, all live on docs.plus
📱 3 devices	the diagram size limits were measured on a real iPhone and a real Android phone
🧩 6 extensions, 1 version	a new member joins the family

All of it is open source and built in public. Try it on docs.plus.

🚀 The big three

• 📈 You can now draw diagrams with text. Write a ```mermaid code block, and the diagram appears under it, in the pad and in History. Flowcharts, sequence diagrams, Gantt charts, pie charts, mind maps and more: 33 types in all. Pele draws them, the Mermaid renderer by Steph Ango (@kepano), CEO of Obsidian.
  • The diagram follows your text. It redraws 300 ms after you stop typing, and a mistake names its line while the last good drawing stays on screen.
  • Hide source folds the text away, so readers see only the picture. A read-only document starts folded. Copy copies the source, and Syntax opens the Mermaid guide.
  • A diagram prints as a picture, keeps your theme in light and dark, and is read once by a screen reader, with its type.
  • Type /diagram on an empty line to insert one. (#521, #528)
• 🤖 You can now connect more AI apps, and start from one page. docs.plus/mcp gives the server URL and the steps for each app. Settings › Connected apps adds a terminal grid for Claude Code, Codex, Copilot CLI and Cline, Add to LM Studio, Add to Replit, and a setup prompt for any other agent.
  • Your AI app can write diagrams too. docs.plus checks each one before the write, and tells the app why it refused one.
  • Many people on one hosted AI app no longer share one rate limit. (#458, #548, #551)
• 🔔 You no longer miss chat because docs.plus thought you were online. Some people showed as Online for good, even months after they left. A plain chat message then sent them no bell, push or email. Now "online" means a recent heartbeat, and nobody is stuck.
  • A chat email is skipped when you already read the message in the chat. (#489, #490, #497)

✨ Smaller things that add up

• The @ picker agrees with the avatars. Someone who is typing now shows as present in the mention list too. (#493)
• Your status follows your tabs. A reload, a second tab or a quick switch no longer leaves you shown as away. (#492)
• Cursor shows by name on the consent page when you connect it.
• The community link works again. The Discord invite in the app and the docs is new. (#480)

🔒 Safer by default

• A Private document's images now load only for its owner. Before, anyone with an image link could open it. (#439)
• New database tables and functions start closed, and the old open grants are removed. A guard now checks the grants after each database update. (#316, #317)
• An AI app reads document titles inside a safe frame, so a title cannot pass itself off as an instruction. (#457)
• The security reporting address now receives mail. (#481)

That is 20 security issues closed in this release.

🛠️ If you self-host, read this first

The stack does not start without two new secrets. Set both before you deploy:

Set this	Why
REDIS_PASSWORD (32 characters or more), in .env.production and .env.observability	Redis now requires a password, so other containers on the Docker network cannot read or write its queues.
MEDIA_COOKIE_SECRET (32 characters or more)	Without it, nobody can load a Private document's images.

openssl rand -hex 32 makes a good value for each. Deploy the new apps first, then recreate Redis with docker compose … up -d redis, so it starts asking for the password. The other order leaves the old apps locked out for a moment. Then run the new Supabase migrations in order, and run packages/supabase/scripts/check-grants.sql. It returns no rows when the grants are right. If you run your own proxy instead of the bundled Traefik, route /.well-known/oauth-protected-resource to the REST API too.

These are config changes only, so this release stays 2.2.0 and not 3.0.0. Follow the hocuspocus Migration in order. The self-hosting guide has the details, and its runbook now covers a "Postgres down" alert that fires while the database is up.

🧩 Extensions: one family, one version

Package	What you get in 2.2.0
@docs.plus/extension-mermaid	New. Draws a mermaid code block as a live SVG diagram under its source, with Pele. No new node: a diagram is a plain codeBlock, and removing the extension leaves plain code
@docs.plus/extension-hyperlink	No behaviour change; aligned to the family
@docs.plus/extension-hypermultimedia	No behaviour change; aligned to the family
@docs.plus/extension-inline-code	No behaviour change; aligned to the family
@docs.plus/extension-indent	No behaviour change; aligned to the family
@docs.plus/extension-placeholder	No behaviour change; aligned to the family

All six ship 2.2.0 together, so any two of them at the same version were tested together.

npm install @docs.plus/extension-mermaid@2.2.0

Also works with pnpm add, yarn add and bun add.

🙏 Drawn by Pele

Every diagram in docs.plus is drawn by Pele, the open-source Mermaid renderer by Steph Ango (@kepano), CEO of Obsidian. Pele turns Mermaid text into SVG with no dependencies and its own layout engine, and it loads one small piece per diagram type. That is why a diagram draws in a few milliseconds on a laptop.

Thank you, Steph, for building it in the open, under the MIT licence. Pele's own home is pele.run, and its source is github.com/obsidianmd/pele. docs.plus 2.2.0 ships pele 1.8.0, released on 20 October 2026.

docs.plus is not made by or affiliated with Obsidian. Bugs in drawing go to Pele upstream.

🤯 The surprise

To choose the diagram size limits, we first timed Pele on a laptop slowed down 6×, as a stand-in for a phone. Under our 200 ms rule, that test allowed 15,000 characters and 500 arrows. We called it provisional. Then we ran the same test on a real Android phone. At 15,000 characters, the slowest of 50 draws took 1.1 seconds, more than five times our 200 ms budget. The iPhone stayed within budget at that size. So the limits are 10,000 characters and 250 arrows. These are the largest sizes that drew within 200 ms on both a real iPhone and a real Android phone. This was one run on 21 October 2026, with Pele 1.7.0. The numbers are in Measured on real phones.

---

Full details: CHANGELOG.md · webapp · hocuspocus · extension-mermaid