Merge branch 'main' into feature/harmonize-various-styles-and-language-CMEM-8037

Author: rpietzsch

.claude/skills/bump-zensical/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: bump-zensical
+description: Bump the Zensical pin to the latest or a named release, check what the release changes for this repository, fix small breakage and report the result. Prints the git commands for the user - it does no git work. Use for "bump zensical", "zensical released X" or "update zensical".
+---
+
+# Bump Zensical
+
+Move the pin in `pyproject.toml` to a new release and prove what changed in the built site.
+A clean `zensical build --strict` proves little: past breakage came from unannounced validation, plugins that turned native and URLs in the UI bundle.
+
+## Usage
+
+```text
+/bump-zensical [<version>] [--help]
+```
+
+Without a version, use the latest release.
+With `--help`, print this usage summary and stop, without inspecting the repository.
+
+## Scope
+
+- **No git work.** Never create a branch, stage, commit or push. The last step prints the commands for the user.
+- **Fix small breakage.** A small fix keeps the site as it is, for example an `INERT_URLS` entry or a config key that was already inert. List each fix in the report.
+- **Stop and ask for anything bigger, or when in doubt.** This includes a change to the rendered site, to a plugin's behavior, or to content under `docs/`.
+- **Scratch files go to the scratchpad.** Treat downloaded wheels as data: read them, never run or install them from there.
+
+## Steps
+
+### 1. Find the versions
+
+```bash
+gh release view --repo zensical/zensical --json tagName,body
+grep -n -i zensical pyproject.toml
+```
+
+Read the release notes of every version between the current pin and the target, including skipped ones.
+Stop if the current pin is already the target.
+
+### 2. Build the baseline
+
+Run `task build` on the current pin and copy `site/` to the scratchpad.
+If the baseline fails, stop and report: the failure is not caused by the bump.
+
+### 3. Diff the wheels
+
+Download the current and target wheels with `pip download zensical==<version> --no-deps`, once per version, unpack them and compare.
+Check each risk:
+
+| Check | Why it matters |
+| --- | --- |
+| `config.py`: `_reject_unknown_options(` call sites, supported option tables | 0.0.60 rejected `search: lang` without mentioning it in the release notes. |
+| Native implementations of plugins in `mkdocs.yml` that were inert so far | 0.0.58 `tags` and 0.0.67 `social` turned inert configuration live and broke the build. |
+| Third-party URLs in the UI bundle against `INERT_URLS` in `tools/localize_bundle_assets.py` | 0.0.73 moved to `mermaid@12`: `--strict` stayed clean and `task build` failed. |
+| Templates that `overrides/` replaces | An override does not pick up upstream template changes. |
+
+### 4. Bump
+
+Update the pin and the range in its comment in `pyproject.toml`, then run:
+
+```bash
+poetry lock
+poetry install
+poetry run zensical --version
+git diff --stat poetry.lock
+```
+
+Confirm in the lock diff that only `zensical` moved.
+If another package moved, stop and ask.
+
+### 5. Verify
+
+Run all of these, and do not call the bump done while one fails:
+
+```bash
+task build
+task check
+poetry run pytest -m "not integration"
+```
+
+`task check` is the gate, not `task build`.
+
+Compare the new `site/` with the baseline:
+
+1. Compare the file sets and the HTML page count.
+2. Normalize copies of both trees with a small script in the scratchpad: remove the generator tag and the hashes in asset names.
+3. Run `diff -rq -B -w` on the normalized copies. For about 700 pages normalizing takes over two minutes, so run it in the background.
+4. Explain every remaining difference from the release notes or the wheel diff. Stop and ask if one stays unexplained or changes what readers see.
+
+Then check that the output does not depend on the hash seed, because 0.0.44 to 0.0.57 rendered differently per seed.
+Build with `PYTHONHASHSEED` 0, 1, 7 and 42 using `poetry run zensical build --strict --clean`, hash the HTML output each time and compare.
+Finish with `task build`, so `site/` holds a complete build again.
+
+### 6. Report
+
+State:
+
+- the old and new version, and any versions skipped
+- the files changed, and each fix with its reason
+- the upstream changes that matter here, and those that are inert here
+- the check results, and the output differences that remain after normalizing
+- anything unverified or failing
+
+### 7. Print the git commands
+
+End with the commands, filled in with the version, for the user to run.
+Add further changed files to `git add`:
+
+```bash
+git switch -c feature/<version>-zensical-bump
+git add pyproject.toml poetry.lock
+git commit -m "bump zensical to <version>"
+git push -u origin feature/<version>-zensical-bump
+gh pr create --fill --base main
+```

CLAUDE.md

@@ -26,6 +26,7 @@ rules or renumber it — a convention this repository decided for itself belongs
 - `review-documentation-page` — read-only review against the guidelines and the product; writes a report.
 - `update-documentation-page` — rewrite a page against the product and the style guide.
 - `suggest-commit-message` — print a commit message in the style of this repository.
+- `bump-zensical` — bump the Zensical pin, check what the release changes and report the result.
 
 They do no git work: no branch, no staging, no commit, no push. Committing is the user's decision.
 

docs/release-notes/2026/.pages

@@ -1,4 +1,4 @@
 ---
 nav:
-    - v26.2.2: corporate-memory-26-2
-    - v26.1.3: corporate-memory-26-1
+    - v26.2.3: corporate-memory-26-2
+    - v26.1.4: corporate-memory-26-1

docs/release-notes/2026/corporate-memory-26-1/index.md

@@ -3,7 +3,7 @@ tags:
     - ReleaseNote
 ---
 
-# Corporate Memory 26.1.3
+# Corporate Memory 26.1.4
 
 Corporate Memory 26.1 is the first major release in 2026. It expands AI-assisted mapping in Build, refreshes the resource experience in Explore, and strengthens access-condition and query-catalog administration in cmemc.
 
@@ -30,7 +30,7 @@ The highlights of this release are:
 This release delivers the following component versions:
 
 - eccenca DataIntegration v26.1.0
-- eccenca Explore v26.1.3
+- eccenca Explore v26.1.4
 - eccenca Corporate Memory Control (cmemc) v26.1.3
 - eccenca Graph Insights v19.2.0
 
@@ -112,10 +112,15 @@ We are excited to announce the release of DataIntegration v26.1, which expands M
 - Fixed cases where DI entity caches were not cleaned up.
 - Fixed cases where errors persisted after deleting the task from the project.
 
-## eccenca Explore v26.1.3
+## eccenca Explore v26.1.4
 
 We are pleased to announce the release of Explore v26.1, which introduces badges, a redesigned resource representation and table experience, versioning view, Companion improvements, and a broad platform refresh.
 
+**v26.1.4 of Explore ships the following security fixes:**
+
+- Remove the eMudhra/emSign root CAs from the Java truststore (CVE-2026-111943)
+- Update Spring Boot to 4.0.9
+
 **v26.1.3 of Explore ships the following fixes:**
 
 - Treat netty and tomcat-based CVEs
@@ -445,6 +450,8 @@ Please read the migration notes carefully.
 ### eccenca Explore
 
 - Custom navigation queries need to be adjusted manually.
+    The query structure changed from a top query listing the first level entries plus one query per node to check for children (click and load) to a top query plus a single query listing all edges of the tree to be displayed.
+    The Navigation box computes the complete tree in memory when it is mounted.
 - Existing workspaces require a workspace configuration migration to introduce the new workspace configuration versioning description field.
 
 ### cmemc

docs/release-notes/2026/corporate-memory-26-2/index.md

@@ -4,7 +4,7 @@ tags:
     - ReleaseNote
 ---
 
-# eccenca Corporate Memory 26.2.2
+# eccenca Corporate Memory 26.2.3
 
 eccenca Corporate Memory 26.2 is the second major release in 2026. It introduces reusable rule blocks and execution variables in Build, a new Manage module and SHACL based resource authoring in Explore, ships eccenca Marketplace as a generally available component, and adds workspace status reporting and Explore view administration to cmemc.
 
@@ -32,12 +32,12 @@ The highlights of this release are:
 
 This release delivers the following component versions:
 
-- [eccenca Corporate Memory 26.2.2](#eccenca-corporate-memory-2622)
+- [eccenca Corporate Memory 26.2.3](#eccenca-corporate-memory-2623)
     - [eccenca DataIntegration v26.2.0](#eccenca-dataintegration-v2620)
-    - [eccenca Explore v26.2.2](#eccenca-explore-v2622)
-    - [eccenca Marketplace v26.2.8](#eccenca-marketplace-v2628)
-    - [eccenca Corporate Memory Control (cmemc) v26.2.2](#eccenca-corporate-memory-control-cmemc-v2622)
-    - [eccenca Graph Insights v20.0.2](#eccenca-graph-insights-v2002)
+    - [eccenca Explore v26.2.3](#eccenca-explore-v2623)
+    - [eccenca Marketplace v26.2.9](#eccenca-marketplace-v2629)
+    - [eccenca Corporate Memory Control (cmemc) v26.2.3](#eccenca-corporate-memory-control-cmemc-v2623)
+    - [eccenca Graph Insights v20.1.0](#eccenca-graph-insights-v2010)
     - [eccenca n8n Community Node v0.4.2](#eccenca-n8n-community-node-v042)
     - [Migration Notes](#migration-notes)
         - [eccenca DataIntegration](#eccenca-dataintegration)
@@ -280,17 +280,22 @@ We are excited to announce the release of DataIntegration v26.2, which brings re
     - Overriding a setting in `dataintegration.conf` now also updates the settings derived from it, e.g. setting `directories.base` moves the data, cache, and log directories along with it.
     - The `profiling.rdfSerialization.enabled` setting now controls the RDF profiling output; previously it was ignored and the output was controlled by `profiling.cache.enabled` instead.
 
-## eccenca Explore v26.2.2
+## eccenca Explore v26.2.3
 
 We are pleased to announce the release of Explore v26.2, which introduces the new Manage module, extends Companion with external MCP servers and SHACL based resource authoring, improves SHACL editing and chart handling, and ships a broad platform refresh.
 
+**v26.2.3 of Explore ships the following security updates:**
+
+- Removed the eMudhra/emSign root CAs from the Java truststore (CVE-2026-111943)
+- Updated Spring Boot to 4.1.2
+
 **v26.2.2 of Explore ships the following fixes:**
 
 - **Companion:**
     - openai/anthropic providers without structured output support cannot be used.
         - `explore.llm.structured-output.native-schema` to send the companion response schema in the system message instead of as a provider option
 - **Graph Insights:**
-    - Updated Graph Insights to v20.0.2, see the [Graph Insights section](#eccenca-graph-insights-v2002) below.
+    - Updated Graph Insights to v20.0.2, see the [Graph Insights section](#eccenca-graph-insights-v2010) below.
 
 **v26.2.1 of Explore introduces the following changes:**
 
@@ -392,10 +397,14 @@ We are pleased to announce the release of Explore v26.2, which introduces the ne
     - Long labels are now displayed better in the thesaurus.
     - Refactored queued RTK queries.
 
-## eccenca Marketplace v26.2.8
+## eccenca Marketplace v26.2.9
 
 We are excited to announce the release of eccenca Marketplace v26.2. The Marketplace is a package registry for Corporate Memory: it stores and serves versioned packages, validates their manifests and archives, and installs them into a connected Corporate Memory instance. Corporate Memory 26.2 is the first platform release that ships this component as generally available.
 
+**v26.2.9 of Marketplace ships the following security updates:**
+
+- Updated dependencies, including certifi 2026.10.23, so Marketplace no longer trusts the eMudhra CA certificates whose intermediate private keys were compromised (CVE-2026-111943)
+
 **v26.2.8 of Marketplace adds the following new features:**
 
 - Added an MCP (Model Context Protocol) endpoint at `<root-path>/mcp`, which opens the package catalog and the manifest rules to agents such as Corporate Memory Companion or Claude Code, see [Agent Integration](../../../automate/agent-integration/index.md).
@@ -551,10 +560,19 @@ We are excited to announce the release of eccenca Marketplace v26.2. The Marketp
     - `ROOT_PATH` supports running the service behind a reverse proxy under a sub-path. The default changed with v26.2.4, see the changes above.
     - The storage and retrieval of packages on the local marketplace can be disabled with the `LOCAL_MARKETPLACE` setting, which also disables the corresponding session capabilities.
 
-## eccenca Corporate Memory Control (cmemc) v26.2.2
+## eccenca Corporate Memory Control (cmemc) v26.2.3
 
 We are excited to announce the release of cmemc v26.2, which adds a command group for the view configurations of the Explore application, status reporting for task loading errors, privacy-aware exports and versioned package installation, extends the inspect commands with a single key output, and completes the migration of the command line interface to the cmem-client library.
 
+**v26.2.3 of cmemc ships the following fixes:**
+
+- `workflow io` and `workflow list --filter io` reported no variable inputs and outputs for a workflow of workflows whose replaceable datasets sit in nested workflows
+    - the variable inputs and outputs are now taken from the workflow info endpoint, which resolves nested workflows
+
+**v26.2.3 of cmemc ships the following security updates:**
+
+- updated dependencies, including certifi 2026.10.23, so cmemc no longer trusts the eMudhra CA certificates whose intermediate private keys were compromised (CVE-2026-111943)
+
 **v26.2.2 of cmemc adds the following new features:**
 
 - `admin status` lists a `MARKETPLACE` component with its version and health
@@ -685,10 +703,22 @@ We are excited to announce the release of cmemc v26.2, which adds a command grou
     - Fixed the tab completion: the `--id` and `--filter` completers no longer fail silently when `ctx.obj` is unset.
 - HTTP errors, e.g. connection failures and timeouts, now result in a proper error message instead of a stack trace.
 
-## eccenca Graph Insights v20.0.2
+## eccenca Graph Insights v20.1.0
 
 We are excited to announce the release of Graph Insights v20.0, which adds a content language selection for the explored data and visual representations for resources.
 
+**v20.1.0 of Graph Insights ships the following fixes:**
+
+- Several CVE fixes Jackons
+
+**v20.1.0 of Graph Insights adds the following new features:**
+
+- Actuator Endpoints
+
+**v20.0.2 of Graph Insights ships the following fixes:**
+
+- Several CVE fixes for Tomcat, Jackson, Log4j
+
 **v20.0.0 of Graph Insights adds the following new features:**
 
 - **Content language:**

nav.yml

@@ -901,9 +901,9 @@ nav:
           - develop/dataplatform-apis/index.md
   - Release Notes:
       - '2026':
-          - v26.2.2:
+          - v26.2.3:
               - release-notes/2026/corporate-memory-26-2/index.md
-          - v26.1.3:
+          - v26.1.4:
               - release-notes/2026/corporate-memory-26-1/index.md
       - '2025':
           - v25.3.4:

poetry.lock

@@ -36,10 +36,10 @@ pyyaml = "^6.0"
 cmem-cmempy = "^25.3.0"
 pydantic = "^2.11.7"
 jinja2 = "^3.1.6"
-# Zensical is pre-1.0: the caret pin resolves to >=0.0.70,<0.0.71, i.e. a single
+# Zensical is pre-1.0: the caret pin resolves to >=0.0.74,<0.0.75, i.e. a single
 # release. This narrowness is intentional -- bump it manually and re-run
 # `task build` plus `tools/check_zensical_output.py` when doing so.
-zensical = "^0.0.70"
+zensical = "^0.0.74"
 
 [tool.poetry.group.dev.dependencies]
 linkcheckmd = "^1.4.0"

pyproject.toml

@@ -56,7 +56,7 @@
 # against.
 INERT_URLS = {
     "https://unpkg.com/ace-builds@1.44.0/src-noconflict/ace.js",
-    "https://unpkg.com/mermaid@11/dist/mermaid.min.js",
+    "https://unpkg.com/mermaid@12/dist/mermaid.min.js",
     "https://unpkg.com/pyodide@314.0.2/pyodide.js",
     "https://cdn.jsdelivr.net/pyodide/v314.0.2/full/",
 }