release: v5.0.0 (breaking)

[jaredwray]

Release summary

Major release: raises the minimum Node.js to 22.18.0 and upgrades the EJS (v6) and hookified (v3) engines across major versions.

Packages

Package	Current	New	Bump	Rationale	Commits
ecto	4.8.7	5.0.0	major	breaking: Node floor + ejs v6; 1 fix; 6 internal	10

ecto@5.0.0 — 2026-06-25

Major release: raises the minimum Node.js to 22.18.0 and upgrades the EJS and hookified engines across major versions.

⚠ BREAKING CHANGES

• Minimum Node.js is now >=22.18.0. Driven by the hookified v3 upgrade; engines.node now declares the floor so older runtimes are warned at install time. (d628ef2, 5f72cd3, root - chore: upgrade hookified to v3 (breaking) #385)
  Migration: upgrade your runtime to Node.js 22.18.0 or newer. Node 20 reached end-of-life in April 2026.

• EJS upgraded to v6 — template locals no longer resolve through the prototype chain by default. (5f9bba4, root - chore: upgrade ejs to v6 (breaking) #384)
  Migration: if your EJS templates rely on inherited (prototype-chain) properties from class-instance or Object.create() locals, opt back in via the ejs option:

  import { Ecto } from "ecto";
  
  // ecto 4.x (ejs 5): inherited locals resolved automatically
  // ecto 5.x (ejs 6): opt back in for prototype-chain locals
  const ecto = new Ecto({ engineOptions: { ejs: { unsafePrototypeLocals: true } } });

  Plain-object locals (the common case) need no change.

Bug Fixes

• remove post-render entity decoding on Handlebars output — {{var}} / {{{var}}} now follow standard Handlebars escaping semantics; the previous blanket decode could corrupt legitimately escaped content such as < inside pre-rendered code blocks. (b32cc50, fix: remove post-render entity on handlebars #379)

Internal

• upgrade GitHub Actions to latest majors: actions/checkout v7, codecov/codecov-action v7 (6cab886, root - chore: upgrade GitHub Actions (breaking) #382)
• upgrade build tooling: vite 8.0.14 → 8.0.16 (0147b61, root - chore: upgrade build tooling (vite) #381)
• upgrade code-quality tooling: vitest 4.1.9, @biomejs/biome 2.5.0, @faker-js/faker 10.5.0 (30c366f, root - chore: upgrade code quality dependencies #380)
• upgrade wrangler 4.92.0 → 4.102.0 for the docs-site deploy (e623c9e, root - chore: upgrade wrangler #383)
• add CLOUDFLARE_ACCOUNT_ID to the deploy-site workflow (52d9fe3, ecto - fix: add CLOUDFLARE_ACCOUNT_ID to deploy workflow #378)
• add wrangler as a devDependency for the deploy workflow (396ad11, ecto - fix: add wrangler as devDependency for deploy workflow #377)

Contributors

• @jaredwray (9 PRs)

Full List of Changes

• ecto - fix: add wrangler as devDependency for deploy workflow by @jaredwray in ecto - fix: add wrangler as devDependency for deploy workflow #377
• ecto - fix: add CLOUDFLARE_ACCOUNT_ID to deploy workflow by @jaredwray in ecto - fix: add CLOUDFLARE_ACCOUNT_ID to deploy workflow #378
• fix: remove post-render entity on handlebars by @jaredwray in fix: remove post-render entity on handlebars #379
• root - chore: upgrade code quality dependencies by @jaredwray in root - chore: upgrade code quality dependencies #380
• root - chore: upgrade build tooling (vite) by @jaredwray in root - chore: upgrade build tooling (vite) #381
• root - chore: upgrade GitHub Actions (breaking) by @jaredwray in root - chore: upgrade GitHub Actions (breaking) #382
• root - chore: upgrade wrangler by @jaredwray in root - chore: upgrade wrangler #383
• root - chore: upgrade ejs to v6 (breaking) by @jaredwray in root - chore: upgrade ejs to v6 (breaking) #384
• root - chore: upgrade hookified to v3 (breaking) by @jaredwray in root - chore: upgrade hookified to v3 (breaking) #385

Full diff: v4.8.7...v5.0.0

Verification

• pnpm install --frozen-lockfile succeeds (lockfile unchanged by the version bump)
• pnpm build succeeds (target node22.18.0)
• pnpm test:ci passes locally — 239 tests, 100% coverage
• No uncommitted changes outside the package.json version bump

Post-merge

• Merge, then create a GitHub Release at tag v5.0.0 — the release.yaml workflow publishes to npm with pnpm publish --provenance. (deploy-site.yaml also redeploys the docs on release.)

🤖 Generated with Claude Code

https://claude.ai/code/session_01HwRkk2BtZPFT5iTYVfdcEU

---

Generated by Claude Code

[gemini-code-assist]

Code Review

This pull request updates the version of the ecto package in package.json from 4.8.7 to 5.0.0. There are no review comments, and I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e818163) to head (748036d).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #386   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          409       409           
  Branches        96        96           
=========================================
  Hits           409       409           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.