[thobed]

Summary

Access Analyzer 26.1 pages now take their version numbers from one file, src/config/releases/accessanalyzer-26.1.js. To publish a release, add its entry at the top of that list. Every page that shows a version, and the new versions table, picks it up at build time.

Until now the pages used made-up examples (1.5.0, 1.6.0, 1.1.2) and never named an installer version. They now show the latest release, 1.2.0, and its installer, 1.0.21.

How it works

src/config/docVariables.js is wired in as markdown.preprocessor in docusaurus.config.js. For pages under docs/accessanalyzer/26.1 only, it replaces these tokens before MDX parses the page, so they work in prose, inline code and code blocks:

Token	Value today
{{appVersion}}	1.2.0
{{installerVersion}}	1.0.21
{{k3sVersion}}	v1.33.4+k3s1
{{argocdVersion}}	3.2.0
{{previousAppVersion}}	1.1.10
{{releaseTable}}	the table on the new page

An unknown token fails the build and names the page and the known tokens. Pages in other products pass through unchanged.

The release list is a JS module that the config imports, not a file read at runtime. CI restores the Rspack persistent cache, and Docusaurus evicts it only when the config or something it imports changes. I checked this locally: with a warm cache, changing only the list updated every page that uses it.

Page changes

• installer-reference: the --target-revision example, and the k3s and ArgoCD defaults
• run-the-installer: the air-gapped VERSION= line is set to the latest release, and both "confirm it runs" steps show the expected dspm-installer version output
• upgrade-to-a-new-version: the --target-revision and VERSION= examples, the expected installer version, and the latest release to compare dspmctl version with
• roll-back-to-a-previous-version: the examples use the previous release, since a rollback goes back one release
• New What's New page, Release and Installer Versions: one row per release with its installer, k3s and ArgoCD versions, linked from the What's New index and the upgrade page. It starts at 1.2.0, the first release that pins a stable installer for in-app upgrades.

Some version numbers stay literal on purpose. The "Upgrade to 1.2.0" section and the "earlier than 1.1.7" note describe those specific releases. The registry dspmctl set-revision example now reads <version>, because 1.2.0 is the one upgrade dspmctl can't make from an earlier release, and filling in the latest version there would contradict the warning at the top of the page.

Where the values come from

The access-analyzer release tags. The installer is config.mediaUpgrade.image.tag in deploy/helm/apps/values.yaml at v1.2.0. k3s and ArgoCD are the defaults in deploy/installer/internal/config/config.go, which are the same at installer/v1.0.21 and at v1.2.0, where the media build reads them.

Testing

• src/config/docVariables.test.mjs, added to test:scripts, covers the replacement, unknown tokens, scoping and the table, and checks that no 26.1 page puts a token in front matter or a heading.
• DOCS_PRODUCT=accessanalyzer DOCS_PRODUCT_LATEST_ONLY=true npm run build passes. The rendered pages show the values above, with no {{ left.
• Vale is clean on the changed pages.
• scripts/test-heading-skip.sh fails on my Mac, on an untouched dev checkout too. The rest of test:scripts passes.

[github-actions]

Auto-Fix Summary

1 issues fixed, 1 skipped across 6 files

Category	Fixes
Dale: idioms	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/release-notes/index.md:6 — Dale: passive-voice | Passive 'are published' has no actor stated in the sentence; rewriting would need to introduce one |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

docs/accessanalyzer/26.1/release-notes/versions.md

• Completeness: Line 7 and the table: the page links to and from pages that promise k3s and ArgoCD versions (see release-notes/index.md line 10), but the generated table has only Release, Released, and Installer columns. Either add k3s and ArgoCD columns to releaseTable(), or change the link text on index.md (see that file below).
• Clarity: Line 11: "the installer the release pins" and "{{appVersion}} pins {{installerVersion}}" use "pins" without defining it. The sentence also separates two ideas a reader can mix up: the installer in the table (the newest stable installer on the release date) and the installer an in-app upgrade runs (the pinned one). The source file says these can differ (1.1.10 pins 1.0.20-alpha.9, not 1.0.20). Suggested fix: "The Installer column shows the newest stable dspm-installer release on the date each release shipped. Upgrades from the Settings page and automatic updates use the installer version built into the release, which can differ from this column. {{appVersion}} uses {{installerVersion}}."
• Structure: Line 11: this is a one-item bulleted list. Because it explains a table column, a plain paragraph right after the table reads better. Suggested fix: remove the leading - .
• Completeness: Line 11: "{{appVersion}} pins {{installerVersion}}" is true now only because installerVersion comes from the table's Installer value for the latest release. The release file's comment says only 1.2.0 pins the same installer the table lists. When the next release pins a different installer, this sentence will be wrong without any warning. Suggested fix: drop the sentence, or add a separate pinnedInstaller field to the release data and use that.
• Clarity: Line 13: "so you never pick an installer version yourself" doesn't fit with the table, which lists installer versions per release, and with upgrade-to-a-new-version.md, which asks the reader to check for "{{installerVersion}} or later". Suggested fix: "The download always returns the newest stable installer, which works with every release in the table."
• Clarity: Line 15: the link text "What's new" doesn't say that the target page only points to the Netwrix Community. Suggested fix: "For the new features and fixes in each release, see the Access Analyzer release notes on the Netwrix Community."

docs/accessanalyzer/26.1/release-notes/index.md

• Completeness: Line 10: "which installer, k3s, and ArgoCD versions ship with each release". The linked page lists only installer versions. Suggested fix: "To see which dspm-installer version shipped with each release, see Release and installer versions." Alternatively, add k3s and ArgoCD columns to the table.

docs/accessanalyzer/26.1/install/upgrade-to-a-new-version.md

• Completeness: Line 136 (sudo dspmctl set-revision netwrix <version> --wait): the concrete example 1.1.2 is gone, and the step doesn't say what <version> is or how to format it. The rollback page says the format depends on install type (a v prefix on air-gapped installs). Suggested fix: add after the code block: "Replace <version> with the release to upgrade to, for example {{appVersion}}."
• Clarity: Line 109: "Compare the output with the latest release, {{appVersion}}." Readers who open the page long after a build may wonder whether this value is current. That's acceptable because the page rebuilds with each release, but the link to the versions page in the same paragraph covers it. No change needed unless you want to stress "at the time of publishing".

docs/accessanalyzer/26.1/install/run-the-installer.md

No issues found. The new "Output such as dspm-installer version {{installerVersion}}" lines (69, 87) and the air-gapped VERSION comment (line 77) are clear.

docs/accessanalyzer/26.1/install/installer-reference.md

No issues found.

docs/accessanalyzer/26.1/install/roll-back-to-a-previous-version.md

No issues found.

Summary

8 editorial suggestions across 3 files. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues: fix all editorial issues
• @claude help improve the flow of this document: get writing assistance
• @claude explain the voice issues: understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

1 issues fixed, 1 skipped across 6 files

Category	Fixes
Dale: idioms	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/release-notes/index.md:6 — Dale: passive-voice | 'Release notes ... are published on the Netwrix Community' does not state the actor in the sentence; the rule only flags passives whose actor is already stated |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Code Review

No blocking issues. The preprocessor is scoped to docs/accessanalyzer/26.1/ (other products pass through unchanged), every {{…}} token in the 26.1 pages is a known variable, and 26.1 has kb: false in products.js, so the KB copy step can't bring in unknown tokens. (docs/kb/privilegesecure/... uses {{user}}/{{host}}, but it's outside the scoped directory.) A release that names an installer missing from the list throws when docusaurus.config.js loads, so a bad edit to src/config/releases/accessanalyzer-26.1.js fails the build early instead of rendering wrong data.

Two non-blocking notes:

1. CI won't run the new guard test when it matters. node --test src/config/docVariables.test.mjs was added to test:scripts, but script-tests.yml only triggers on scripts/**, src/plugins/**, package.json, and the lint paths. A change to src/config/** or docs/accessanalyzer/26.1/** won't run it. The build catches unknown tokens and missing installers, but it doesn't catch the case the test exists for. If a writer puts a token in front matter or a heading, the build still passes. The preprocessor never sees front matter, so the literal {{appVersion}} shows up in the page title or description. For a heading, the anchor check slugifies the raw text. Consider adding 'src/config/**' (and possibly 'docs/accessanalyzer/26.1/**') to the workflow's paths.

2. The generated table doesn't match what release-notes/index.md says. That page says the versions page shows "which installer, k3s, and ArgoCD versions ship with each release". But releaseTable() only outputs Release, Released, and Installer columns. Either add k3s/argocd columns to releaseTable() (the data is already in the installer list) or change the sentence.