create-zudo-doc 5.24.2 → 5.26.0

package/CHANGELOG.md

@@ -8,6 +8,23 @@ The format is based on Keep a Changelog, and release notes are generated from th
 
 No unreleased changes.
 
+## [5.26.0] - 2026-09-20
+
+### Other Changes
+
+- Generated projects now pin `@takazudo/zfb`, `@takazudo/zfb-runtime`, and `@takazudo/zfb-md-wasm` to `2.19.0`. zfb 2.19 adds the opt-in `ZFB_KEEP_BUILD_SHADOW=1` build-diagnostics mode and adopts a YAML parser patch verified equivalent across all 18 upstream baseline cases. The runtime has no package-specific behavior change; md-wasm rebuilds its artifacts without changing exports or public APIs. Existing projects need no config migration. (4c2048528)
+
+## [5.25.0] - 2026-09-16
+
+### Bug Fixes
+
+- The generated `scripts/check-links.js`'s MDX id scan no longer lets an escaped `\<` in prose start a fake tag that swallows a later element's static `id` across a blank line, wrongly reporting a valid anchor as broken. Projects that copied `scripts/check-links.js` from the template can re-copy it to pick up the fix. (0ea5eeae6)
+
+### Other Changes
+
+- New scaffolds no longer add a `.zudo-doc/` entry to the generated `.gitignore`. The staging step it was for was removed from `@takazudo/zudo-doc`'s route injection — see that package's changelog. (54a3f12a9)
+- Generated projects now pin `@takazudo/zfb`, `@takazudo/zfb-runtime`, and `@takazudo/zfb-md-wasm` to `2.18.0` (e4d4b64b3). That release reworks package-injected routes and plugin virtual modules and changes no API, export, or config default, so existing projects need no migration.
+
 ## [5.24.2] - 2026-09-15
 
 ### Bug Fixes

package/dist/scaffold.d.ts

@@ -31,5 +31,5 @@ export declare function deriveDocSkillName(projectName: string): string;
  *
  * Bumped in lockstep by scripts/release-create-zudo-doc.sh.
  */
-export declare const ZUDO_DOC_PIN = "^5.24.2";
+export declare const ZUDO_DOC_PIN = "^5.26.0";
 export declare function scaffold(choices: UserChoices): Promise<void>;

package/dist/scaffold.js

@@ -47,7 +47,7 @@ export function deriveDocSkillName(projectName) {
  *
  * Bumped in lockstep by scripts/release-create-zudo-doc.sh.
  */
-export const ZUDO_DOC_PIN = "^5.24.2";
+export const ZUDO_DOC_PIN = "^5.26.0";
 /**
  * Files in `templates/base/**` that must not be copied by the unconditional
  * base mirror. Each entry is matched against the path relative to
@@ -466,9 +466,6 @@ export async function scaffold(choices) {
         "# Cloudflare Wrangler",
         ".wrangler/",
         "",
-        "# zudo-doc build artifact (routes-src/ staged here at build time)",
-        ".zudo-doc/",
-        "",
     ];
     // The doc-lookup skill is only generated when skillSymlinker is selected
     // (the setup-doc-skill.sh script and `setup:doc-skill` npm script are gated
@@ -778,9 +775,24 @@ function generatePackageJson(choices, localePlan) {
         // moved sizes; zfb-runtime and zfb-adapter-cloudflare change only their
         // README/description. No public API, export, config default, or engine
         // requirement moves, so a fresh scaffold needs no migration.
-        "@takazudo/zfb": "2.17.0",
-        "@takazudo/zfb-runtime": "2.17.0",
-        "@takazudo/zfb-md-wasm": "2.17.0",
+        // 2.18.0: zfb reworks package-injected routes and plugin virtual modules —
+        // the islands scanner now resolves plugin virtual modules and is seeded with
+        // package-route entrypoints, dev CSS content globs are seeded from injected
+        // routes, injected-route entrypoints and their import closure are staged as
+        // exact files, and SSR virtual modules may import those canonical files while
+        // the hidden-path guard still holds. zfb-runtime, zfb-adapter-cloudflare, and
+        // md-wasm carry no package-specific change. No public API, export, config
+        // default, or engine requirement moves, so a fresh scaffold needs no migration.
+        // 2.19.0: zfb adds the opt-in `ZFB_KEEP_BUILD_SHADOW=1` diagnostic flag and
+        // moves its YAML parser to noyalib-serde-yaml 0.0.44, which upstream verified
+        // as equivalent across all 18 baseline cases. zfb-runtime and
+        // zfb-adapter-cloudflare have no package-specific change. md-wasm rebuilds
+        // its four artifacts with that parser patch, changing byte sizes and digests
+        // without changing exports or public APIs. A fresh scaffold needs no config
+        // migration.
+        "@takazudo/zfb": "2.19.0",
+        "@takazudo/zfb-runtime": "2.19.0",
+        "@takazudo/zfb-md-wasm": "2.19.0",
         // @takazudo/zudo-doc — published from this monorepo via
         // .github/workflows/publish-zudo-doc.yml. The pin here is bumped in
         // lockstep by scripts/release-create-zudo-doc.sh whenever zudo-doc's
@@ -913,7 +925,7 @@ function generatePackageJson(choices, localePlan) {
         // `/exclude` at module scope from the always-bundled chrome graph; #3110
         // moved compileExclude into @takazudo/zudo-doc, so projects with both
         // docHistory and assetViewer off no longer need the package at all.
-        deps["@takazudo/zudo-doc-history-server"] = "^5.24.2";
+        deps["@takazudo/zudo-doc-history-server"] = "^5.26.0";
         // tsx is no longer needed here: the relocated package plugin imports the
         // runner directly (no `tsx -e` spawn) since the package ships compiled
         // dist/ — package-first migration #2321 (#2337).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-zudo-doc",
-  "version": "5.24.2",
+  "version": "5.26.0",
   "description": "Create a new zudo-doc documentation site",
   "license": "MIT",
   "author": "Takeshi Takatsudo",

package/templates/base/scripts/check-links.js

@@ -663,8 +663,27 @@ function extractStaticMdxIds(body) {
   // (#4048). The rest of this pattern keeps its own semantics — `\bid` also
   // accepts `data-id`, and only non-empty quoted values count, unlike the
   // built-HTML id scan.
+  //
+  // Two extra guards, scoped to this MDX scan only (the shared
+  // HTML_ATTRIBUTE_RUN above is untouched — the built-HTML scans still rely on
+  // multi-line quoted attributes):
+  //
+  // - MDX_UNESCAPED_LT_LOOKBEHIND: an escaped `\<` in prose is valid MDX and
+  //   must not start a fake tag. Parity matters, not just "preceded by a
+  //   backslash" — `\\<` is an escaped backslash followed by an active `<`.
+  //   The lookbehind is anchored at the run's start (`(?<!\\)`) so it judges
+  //   the whole contiguous backslash run, not a suffix of it.
+  // - MDX_ID_ATTRIBUTE_RUN: without this, a fake tag opened by an escaped `<`
+  //   can have prose apostrophes read as a `'...'` quoted value that crosses
+  //   a real `>` and swallows a real element's id on a later line (#4218).
+  //   Disallowing a blank line inside a quoted value bounds the damage to a
+  //   single paragraph while still letting a real JSX tag — including a
+  //   quoted value spanning one newline — match.
+  const MDX_UNESCAPED_LT_LOOKBEHIND = /(?<!(?<!\\)(?:\\\\)*\\)/.source;
+  const MDX_ID_ATTRIBUTE_RUN =
+    /(?:"(?:(?!\r?\n[ \t]*\r?\n)[^"])*"|'(?:(?!\r?\n[ \t]*\r?\n)[^'])*'|[^>"'])/.source;
   const regex = new RegExp(
-    `<[A-Za-z]${HTML_ATTRIBUTE_RUN}*?\\bid\\s*=\\s*(?:"([^"]+)"|'([^']+)')${HTML_ATTRIBUTE_RUN}*>`,
+    `${MDX_UNESCAPED_LT_LOOKBEHIND}<[A-Za-z]${MDX_ID_ATTRIBUTE_RUN}*?\\bid\\s*=\\s*(?:"([^"]+)"|'([^']+)')${MDX_ID_ATTRIBUTE_RUN}*>`,
     "gs",
   );
   let match;