Claudux 2.0.7 — security-fixed source release

Security-corrective source release.

• Resolves the documentation toolchain to PostCSS 8.5.23, above the affected range for GHSA-r28c-9q8g-f849.
• Adds the maintained CodeQL and anti-slop documentation checks to the released tip.
• Passes the tagged CI suite, docs production build, release-readiness gate, and a clean docs install with zero npm audit vulnerabilities.

Install the exact release:

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.7/install.sh | CLAUDUX_REF=v2.0.7 sh

v2.0.6 remains intact as historical release truth but is superseded because its docs lockfile resolves an affected PostCSS version. Claudux is distributed from GitHub source; there is no npm publication or attached binary.

v2.0.6

Superseded by v2.0.7. This historical tag resolves PostCSS 8.5.15 in the documentation lockfile, which falls inside the affected range for GHSA-r28c-9q8g-f849. Use v2.0.7 or current main.

Fixed

• SECURITY.md documents shared-temp / multi-user threat class and XDG locks, Codex stderr, and TMPDIR-aware claudux_mktemp (#141).
• README/docs install pins point at v2.0.6.

Historical install only:

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.6/install.sh | CLAUDUX_REF=v2.0.6 sh

claudux 2.0.5

claudux 2.0.5

Fixed

• ARCHITECTURE documents XDG locks/Codex stderr and TMPDIR-aware temps — #139

Install

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.5/install.sh | CLAUDUX_REF=v2.0.5 sh

claudux 2.0.4

claudux 2.0.4

Fixed

• Docs-generation temps honor TMPDIR via claudux_mktemp — #137

Install

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.4/install.sh | CLAUDUX_REF=v2.0.4 sh

claudux 2.0.3

claudux 2.0.3

Fixed

• Codex stderr log under ${XDG_STATE_HOME:-~/.local/state}/claudux/codex-stderr.log — #135

Install

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.3/install.sh | CLAUDUX_REF=v2.0.3 sh

claudux 2.0.2

claudux 2.0.2

Fixed

• Project lock PID files under ${XDG_STATE_HOME:-~/.local/state}/claudux/locks/ (not shared TMPDIR) — #133

Install

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.2/install.sh | CLAUDUX_REF=v2.0.2 sh

claudux 2.0.1

claudux 2.0.1

Patch release so strangers can pin a tip that includes the post-2.0.0 honesty + install-pin docs.

Install

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.1/install.sh | CLAUDUX_REF=v2.0.1 sh

What's in

• Install pin examples on README/docs (CLAUDUX_REF=v2.0.1)
• Honesty follow-ups: #127–#131 (write-boundary README, counter-defect, public-ready gate, residual oversell, pin copy)

Changelog: CHANGELOG.md

claudux 2.0.0

claudux 2.0.0

Minimal, open-source-ready surface: generate a VitePress docs site from your codebase, preview it locally, and update it in place.

Install (pin this release)

curl -fsSL https://raw.githubusercontent.com/firstbitelabsllc/claudux/v2.0.0/install.sh | CLAUDUX_REF=v2.0.0 sh

Or: npx github:firstbitelabsllc/claudux / clone and run bin/claudux.

Highlights

• Write boundaries — with a checked-in docs-structure.json, the model proposes section-scoped patches; path boundaries, all-or-nothing validation, and sha256 hashes refuse silent edits to protected sections.
• Small CLI — claudux, update, serve, check, help, --version (standalone audit/drift/diff/status/validate/recreate/template commands removed from the public surface).
• Install without npm registry — git/tarball install script; no NPM_TOKEN publish path.
• Public-ready gate — content + HEAD commit-identity scan in CI (npm run public-ready / verify).

Honesty follow-ups on this tag tip

• README + rails diagram (#127)
• Counter-defect for section-patch “Processed 0 changes” (#128)
• Public-ready identity gate (#129)
• Residual docs oversell cleanup (smart-cleanup stub, accuracy/privacy) (#130)

Not claims

• Not a prose “deterministic doc-diff”
• Not automatic smart cleanup with confidence scores
• Not “no source code leaves your machine” — prompt context goes through your authenticated Claude/Codex CLI

Full changelog: CHANGELOG.md