v3.0.0

docula@3.0.0 — 2026-08-17

Security pins, ecto 5 template escaping, dependency upgrades, and CI/release hardening.

⚠ BREAKING CHANGES

• upgrade ecto to 5.0.0 — Handlebars now HTML-escapes {{ }} by default (96f791a, #462)
  Migration: In custom templates, replace {{generatedHtml}} with {{{generatedHtml}}} so document HTML is not double-escaped. The bundled classic template already includes this change.

Bug Fixes

• pin liquidjs to 10.27.1 for memoryLimit DoS advisories (f0e4548, #480)
• pin undici to patched releases for SOCKS5 TLS bypass (eb4ddbf, #463)

Documentation

• scaffold security docs (29d7a34, #464)

Internal

• add standalone binary validation harness (ac4808c, #479)
• bootstrap Aikido Safe Chain in cloud agents (c0fe7c7, #478)
• reconcile checklist after lockdown tweaks (f139ce3, #477)
• wrap CI installs with Socket Firewall (b5e916f, #476)
• disable setup-node cache poisoning (913a9ea, #475)
• record repository lockdown (fb953c3, #474)
• add CODEOWNERS for high-risk paths (55e7b9d, #473)
• add Aikido release gate (4a2fa0f, #471)
• stage npm publishes via OIDC (8d4ab34, #470)
• lint workflows with zizmor (ca3d677, #469)
• add Socket Firewall to every job (4f05fb7, #468)
• disable checkout credential persistence (6059b10, #467)
• set contents: read workflow permissions (8a9fc23, #466)
• install with a frozen lockfile (a3a4d68, #465)
• upgrade undici (94c05d8, #461)
• use caret range for ipaddr.js (41a973c, #460)
• upgrade ipaddr.js (2508e4b, #459)
• upgrade AI SDK dependencies to ai@7 and @ai-sdk/*@4 (14c75ee, #458)
• upgrade GitHub Actions (c87fd16, #457)
• upgrade pnpm to 11.20.0 (f8e7e83, #456)
• upgrade TypeScript and build tooling (933fafb, #455)
• upgrade code quality dependencies (06325ff, #454)
• dependency maintenance (2026-07-19) (1aaa59c, #453)

Contributors

• @jaredwray (22)

Full List of Changes

• chore: dependency maintenance (2026-07-19) by @jaredwray in #453
• root - chore: upgrade code quality dependencies by @jaredwray in #454
• root - chore: upgrade TypeScript and build tooling by @jaredwray in #455
• root - chore: upgrade pnpm by @jaredwray in #456
• root - chore: upgrade GitHub Actions (breaking) by @jaredwray in #457
• root - chore: upgrade AI SDK dependencies (breaking) by @jaredwray in #458
• root - chore: upgrade ipaddr.js by @jaredwray in #459
• root - chore: use caret range for ipaddr.js by @jaredwray in #460
• root - chore: upgrade undici by @jaredwray in #461
• root - chore: upgrade ecto (breaking) by @jaredwray in #462
• fix: pin undici to patched releases for SOCKS5 TLS bypass by @jaredwray in #463
• root - chore: defense - scaffold security docs by @jaredwray in #464
• root - chore: defense - install with a frozen lockfile by @jaredwray in #465
• root - chore: defense - set contents: read workflow permissions by @jaredwray in #466
• root - chore: defense - disable checkout credential persistence by @jaredwray in #467
• root - chore: defense - add Socket Firewall to every job by @jaredwray in #468
• root - chore: defense - lint workflows with zizmor by @jaredwray in #469
• root - chore: defense - stage npm publishes via OIDC by @jaredwray in #470
• root - chore: defense - add Aikido release gate by @jaredwray in #471
• root - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #473
• root - chore: defense - disable setup-node cache poisoning by @jaredwray in #475
• root - chore: defense - record repository lockdown by @jaredwray in #474
• root - chore: defense - wrap CI installs with Socket Firewall by @jaredwray in #476
• root - chore: defense - reconcile checklist after lockdown tweaks by @jaredwray in #477
• root - chore: defense - bootstrap Aikido Safe Chain in cloud agents by @jaredwray in #478
• Add standalone binary validation harness by @jaredwray in #479
• fix: pin liquidjs to 10.27.1 for memoryLimit DoS advisories by @jaredwray in #480

Full diff: v2.2.0...v3.0.0