edgepress 2026.9.10 → 2026.10.1

package/README.md

@@ -30,12 +30,13 @@ Each page has a folder under content/pages/ and one lowercase locale Markdown fi
 - Choose element types inside each cell.
 - Edit each element's copy, media, links, and presentation options in that page file.
 
-Posts under content/posts/ use the Markdown renderer. Themes own shared head, navigation, footer, error-page layout, and their CSS color palettes.
+Put images and other page media in content/assets/, preserving their public URL path. For example, content/assets/images/diagram.svg is published as /images/diagram.svg. Posts under content/posts/ use the Markdown renderer. Themes own shared head, navigation, footer, error-page layout, and their CSS color palettes.
 
 ## Project files
 
 - content/posts/<post-id>/: Markdown articles with one file per locale.
 - content/pages/<page-id>/: page layouts and all page element content.
+- content/assets/: page images and other content media, copied to the output root with matching paths.
 - themes/default/, themes/atelier/, themes/signal/: shared HTML layouts, partials, and theme styles. Themes installed from npm or created as a blank scaffold live here too.
 - config.yml: site metadata, navigation, privacy settings, and consent-gated browser services.
 - edgepress.config.mjs: paths, permalink, locales, and trusted build-time plugins.
@@ -67,6 +68,6 @@ The main navigation includes a Posts entry to the localized article archive. The
 
 Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The starter config uses `https://edgepress.js.gripe` and credits `toewpq`. Before production use, confirm that the configured operator name identifies the responsible person or organization and complete any applicable representative or data protection officer details.
 
-Version 2026.9.10 records the tenth requested release update for September 2026. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/), [request 9 notes](content/posts/2026-09-26-edgepress-release-2026-9-9/), and [request 10 notes](content/posts/2026-09-27-edgepress-release-2026-9-10/).
+Version 2026.10.1 starts the October 2026 release series. Read the [October release notes](content/posts/2026-10-01-edgepress-release-2026-10-1/). The September updates are recorded in the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/), [request 9 notes](content/posts/2026-09-26-edgepress-release-2026-9-9/), and [request 10 notes](content/posts/2026-09-27-edgepress-release-2026-9-10/).
 
-This release keeps privacy choices across locale changes, adds localized page-block links, improves article tag links, loads search code only on search pages, redraws two SVG icons, and simplifies privacy wording. Optional services remain disabled until a visitor makes an explicit choice.
+This release publishes page media from content/assets/, updates Wrangler to 4.144.0, and adds scheduled dependency checks and version-scoped Codex Security scans. Optional services remain disabled until a visitor makes an explicit choice.

package/content/pages/theme-development/en.md

@@ -40,6 +40,7 @@ blocks:
                 - Use double-brace placeholders for escaped values. The approved raw placeholders are generated page content, JSON-LD, and EdgePress-generated navigation markup. Keep the skip link, one main landmark, labeled navigation, visible focus, and one page-level h1.
                 - Page-block links can use /[launge]/quick-start/. The generated page replaces [launge] with the current language path and removes the segment for the default language, so the same link works in both locales.
                 - Keep the body as a full-height vertical layout and let main grow so the footer stays at the bottom on short pages.
+                - Put page images and downloads in content/assets/. EdgePress publishes each file at its matching site-root path. For example, content/assets/images/diagram.svg becomes /images/diagram.svg. Keep themes/<name>/assets/ for shared CSS and JavaScript.
                 - Style shared code blocks, copy buttons, and article contents in the theme. Code lines wrap on small viewports, copy controls have visible keyboard focus, and the generated post contents list links to heading anchors.
       -
         - type: section
@@ -128,4 +129,4 @@ blocks:
                 - title: Posts use Markdown
                   icon: file-text
                   text: Write and publish an article.
----
+---

package/content/pages/theme-development/zh-cn.md

@@ -40,6 +40,7 @@ blocks:
                 - 使用双花括号占位符输出经过转义的值。唯一允许的原样占位符是生成的页面内容、JSON-LD 和 EdgePress 生成的导航标记。保留跳转链接、唯一 main 主区域、带标签的导航、可见焦点和一个页面级 h1。
                 - 页面块中的站内链接可写成 /[launge]/quick-start/。生成页面会把 [launge] 替换为当前语言路径；默认语言会移除该段，因此同一链接可用于中英文页面。
                 - 将 body 保持为全高纵向布局，并让 main 延伸，这样短页面的页脚也会留在视口底部。
+                - 将页面图片和下载文件放在 content/assets/。EdgePress 会按原相对路径发布到站点根目录，例如 content/assets/images/diagram.svg 对应 /images/diagram.svg。themes/<name>/assets/ 用于共享 CSS 和 JavaScript。
                 - 在主题中统一设计代码块、复制按钮和文章目录。窄屏代码行会自动折行，复制控件具有清晰的键盘焦点，生成的文章目录会链接到标题锚点。
       -
         - type: section
@@ -128,4 +129,4 @@ blocks:
                 - title: 文章使用 Markdown
                   icon: file-text
                   text: 撰写并发布文章。
----
+---

package/content/posts/2026-10-01-edgepress-release-2026-10-1/en.md

@@ -0,0 +1,26 @@
+---
+title: "EdgePress October 2026 update"
+author: toewpq
+date: 2026-10-01
+lang: en
+slug: edgepress-release-2026-10-1
+tags:
+  - release
+  - assets
+  - security
+description: Publish page media from content/assets, update Wrangler, and add automated dependency and release security checks.
+---
+
+This release starts the October 2026 update series.
+
+## Publish page media from content/assets
+
+Files under `content/assets/` are now published at matching site-root paths. For example, `content/assets/images/diagram.svg` becomes `/images/diagram.svg`. Shared theme CSS and JavaScript remain in each theme's `assets/` directory.
+
+## Update build dependencies
+
+Wrangler is updated to 4.144.0 along with its Cloudflare runtime dependencies. Dependabot now checks npm packages and GitHub Actions weekly, and a scheduled workflow runs `npm audit` and the project build.
+
+## Scan version builds
+
+The Codex Security workflow can scan a version build when manually started or when an enabled version tag is pushed. Completed findings are uploaded to GitHub Code Scanning. Tag scans require the `CODEX_SECURITY_ENABLED` repository variable, and every scan requires the `OPENAI_API_KEY` Actions secret.

package/content/posts/2026-10-01-edgepress-release-2026-10-1/zh-cn.md

@@ -0,0 +1,26 @@
+---
+title: EdgePress 2026 年 10 月更新
+author: toewpq
+date: 2026-10-01
+lang: zh-cn
+slug: edgepress-release-2026-10-1
+tags:
+  - 发布
+  - 资源
+  - 安全
+description: 发布 content/assets 中的页面资源，更新 Wrangler，并加入自动依赖检查和版本安全扫描。
+---
+
+本次更新开启 EdgePress 2026 年 10 月更新系列。
+
+## 从 content/assets 发布页面资源
+
+现在，`content/assets/` 中的文件会按相同路径发布到站点根目录。例如，`content/assets/images/diagram.svg` 会生成 `/images/diagram.svg`。共享主题 CSS 和 JavaScript 仍放在各主题的 `assets/` 目录中。
+
+## 更新构建依赖
+
+Wrangler 更新至 4.144.0，并同步更新 Cloudflare 运行时依赖。Dependabot 现在每周检查 npm 包和 GitHub Actions；定时工作流会运行 `npm audit` 和项目构建。
+
+## 扫描版本构建
+
+手动启动或推送已启用的版本标签时，Codex Security 工作流可以扫描版本构建，并将完成的发现上传到 GitHub Code Scanning。标签扫描需要仓库变量 `CODEX_SECURITY_ENABLED`，所有扫描都需要 Actions 密钥 `OPENAI_API_KEY`。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edgepress",
-  "version": "2026.9.10",
+  "version": "2026.10.1",
   "description": "A static website builder for Cloudflare Workers with editable pages, Markdown posts, local search, themes, and consent-gated integrations.",
   "type": "module",
   "bin": {
@@ -54,6 +54,6 @@
   },
   "devDependencies": {
     "playwright": "^1.63.0",
-    "wrangler": "^4.129.1"
+    "wrangler": "^4.144.0"
   }
 }

package/src/assets.js

@@ -79,16 +79,17 @@ function rewriteCodeReferences(item, text, outputByOriginal) {
 
 export async function collectAssets(config) {
   const sources = [];
-  for (const source of await walk(config.resolvedPaths.static)) {
-    const path = relative(config.resolvedPaths.static, source).split(sep).join('/');
-    if (path.split('/').includes('.gitkeep')) continue;
-    sources.push({ source, path });
-  }
-  const themeAssets = resolve(config.resolvedPaths.theme, 'assets');
-  for (const source of await walk(themeAssets)) {
-    const path = relative(themeAssets, source).split(sep).join('/');
-    if (path.split('/').includes('.gitkeep')) continue;
-    sources.push({ source, path });
+  const directories = [
+    { root: config.resolvedPaths.static, name: 'static' },
+    { root: resolve(config.resolvedPaths.content, 'assets'), name: 'content/assets' },
+    { root: resolve(config.resolvedPaths.theme, 'assets'), name: 'theme assets' }
+  ];
+  for (const { root, name } of directories) {
+    for (const source of await walk(root)) {
+      const path = relative(root, source).split(sep).join('/');
+      if (path.split('/').includes('.gitkeep')) continue;
+      sources.push({ source, path, sourceName: name });
+    }
   }
 
   const headers = [];
@@ -104,11 +105,14 @@ export async function collectAssets(config) {
       content: isCodeAsset(item.path) ? await readFile(item.source) : null
     }))
   ]);
-  const originals = new Set();
+  const originals = new Map();
   for (const item of items) {
     const normalized = item.path.toLowerCase();
-    if (originals.has(normalized)) throw new Error('Static and theme assets have the same output path: ' + item.path);
-    originals.add(normalized);
+    const previousSource = originals.get(normalized);
+    if (previousSource) {
+      throw new Error(previousSource + ' and ' + item.sourceName + ' assets have the same output path: ' + item.path);
+    }
+    originals.set(normalized, item.sourceName);
   }
   const byOriginal = new Map(items.map((item) => [item.path, item]));
   const dependencies = new Map();