From 75d57d7f607298c41c1355c45248ece9a5bcc88f Mon Sep 17 00:00:00 2001 From: Diederik Siderius Date: Mon, 27 Jul 2026 13:28:20 +0200 Subject: [PATCH] Upgrade to React 19 and release v1.0.5 - Bump react/react-dom to 19.2, react-konva to 19.2, and matching @types. No code changes needed: the app already used createRoot, has no defaultProps / string refs / legacy context, and typed refs are React-19-clean. - Verified: typecheck (browser + node), 53 unit tests, prettier, production build, and a runtime smoke test (UI + Konva canvas render, zero console errors) all pass on React 19. - Bump version to 1.0.5. - Remove CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md (re-applying a removal that was lost when #22 merged at a stale head) and correct the CHANGELOG accordingly. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 29 ++++++++-- CODE_OF_CONDUCT.md | 75 ------------------------- CONTRIBUTING.md | 51 ----------------- SECURITY.md | 35 ------------ package-lock.json | 134 +++++++++++++++++++-------------------------- package.json | 12 ++-- 6 files changed, 84 insertions(+), 252 deletions(-) delete mode 100644 CODE_OF_CONDUCT.md delete mode 100644 CONTRIBUTING.md delete mode 100644 SECURITY.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 87bd7ad..5f34347 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,12 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.0.5] - 2026-07-27 + ### Changed -- Licensed the project under Apache License 2.0 (previously MIT). -- Added open-source project hygiene: `CHANGELOG.md`, `CONTRIBUTING.md`, - `CODE_OF_CONDUCT.md`, `SECURITY.md`, README status badges, and Dependabot - update configuration. +- Upgraded the frontend to **React 19** (`react`/`react-dom` 19.2, `react-konva` + 19.2, and the matching `@types`). +- Relicensed the project under **Apache License 2.0** (previously MIT). +- Derive the WebSocket URL from the page's scheme/host so the app works behind an + HTTPS reverse proxy (`wss://`). +- Dependency maintenance: `ws` 8.21.1, `tsx` 4.23.1, and the CI actions + (`actions/checkout` 7, `actions/setup-node` 7, `docker/setup-qemu-action` 4.2). + +### Added + +- Project docs and automation: `CHANGELOG.md`, README status badges, and a + Dependabot configuration for weekly dependency and GitHub Actions updates. + +### Security + +- Bumped `postcss` to resolve [GHSA-r28c-9q8g-f849](https://github.com/advisories/GHSA-r28c-9q8g-f849) + (dev-only transitive dependency). ## [1.0.4] - 2026-06-25 @@ -38,7 +53,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - The gateway daemon binds to `0.0.0.0` by default in the `.deb` so the app is reachable on the LAN with no tunnel. **Note:** the daemon has no built-in - authentication — see [`SECURITY.md`](SECURITY.md) before exposing it. + authentication — see the **Access** section of the [README](README.md) before + exposing it. ## [1.0.0] - 2026-06-23 @@ -67,7 +83,8 @@ First feature-complete release. - **In-app self-update** — install newer releases from the latest GitHub Release directly from the browser. -[Unreleased]: https://github.com/Lab271/labs-pen-plotter/compare/v1.0.4...HEAD +[Unreleased]: https://github.com/Lab271/labs-pen-plotter/compare/v1.0.5...HEAD +[1.0.5]: https://github.com/Lab271/labs-pen-plotter/compare/v1.0.4...v1.0.5 [1.0.4]: https://github.com/Lab271/labs-pen-plotter/compare/v1.0.3...v1.0.4 [1.0.3]: https://github.com/Lab271/labs-pen-plotter/compare/v1.0.2...v1.0.3 [1.0.2]: https://github.com/Lab271/labs-pen-plotter/compare/v1.0.1...v1.0.2 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md deleted file mode 100644 index 79879b7..0000000 --- a/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,75 +0,0 @@ -# Contributor Covenant Code of Conduct - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in our -community a harassment-free experience for everyone, regardless of age, body -size, visible or invisible disability, ethnicity, sex characteristics, gender -identity and expression, level of experience, education, socio-economic status, -nationality, personal appearance, race, caste, color, religion, or sexual -identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, -diverse, inclusive, and healthy community. - -## Our Standards - -Examples of behavior that contributes to a positive environment for our -community include: - -- Demonstrating empathy and kindness toward other people -- Being respectful of differing opinions, viewpoints, and experiences -- Giving and gracefully accepting constructive feedback -- Accepting responsibility and apologizing to those affected by our mistakes, - and learning from the experience -- Focusing on what is best not just for us as individuals, but for the overall - community - -Examples of unacceptable behavior include: - -- The use of sexualized language or imagery, and sexual attention or advances of - any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Publishing others' private information, such as a physical or email address, - without their explicit permission -- Other conduct which could reasonably be considered inappropriate in a - professional setting - -## Enforcement Responsibilities - -Community leaders are responsible for clarifying and enforcing our standards of -acceptable behavior and will take appropriate and fair corrective action in -response to any behavior that they deem inappropriate, threatening, offensive, -or harmful. - -Community leaders have the right and responsibility to remove, edit, or reject -comments, commits, code, wiki edits, issues, and other contributions that are -not aligned to this Code of Conduct, and will communicate reasons for moderation -decisions when appropriate. - -## Scope - -This Code of Conduct applies within all community spaces, and also applies when -an individual is officially representing the community in public spaces. - -## Enforcement - -Instances of abusive, harassing, or otherwise unacceptable behavior may be -reported to the community leaders responsible for enforcement at -**dsiderius@schubergphilis.com**. All complaints will be reviewed and -investigated promptly and fairly. - -All community leaders are obligated to respect the privacy and security of the -reporter of any incident. - -## Attribution - -This Code of Conduct is adapted from the [Contributor Covenant][homepage], -version 2.1, available at -https://www.contributor-covenant.org/version/2/1/code_of_conduct.html. - -[homepage]: https://www.contributor-covenant.org - -For answers to common questions about this code of conduct, see the FAQ at -https://www.contributor-covenant.org/faq. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md deleted file mode 100644 index aaf5fad..0000000 --- a/CONTRIBUTING.md +++ /dev/null @@ -1,51 +0,0 @@ -# Contributing - -Thanks for your interest in improving PenPlotter271! This is a small project for a -specific machine (a GRBL-style **UUNA TEK 3.0** with an A0 bed), so please open an -issue to discuss anything non-trivial before you start — it saves everyone time. - -## Ground rules - -- Be respectful. This project follows the [Code of Conduct](CODE_OF_CONDUCT.md). -- Found a security issue? Do **not** open a public issue — see [SECURITY.md](SECURITY.md). - -## Development setup - -```bash -npm install # installs deps and builds the native serialport binding -npm run build # typecheck + build the GUI -npm test # run the unit test suite (Vitest) -``` - -See the [README](README.md) for how to run the gateway daemon and the dev server. - -## Making a change - -1. Fork and create a branch off `main`. -2. Make your change. Keep it focused — one logical change per PR. -3. Add or update tests for anything in the pure core (`src/grbl`, `src/plot`). -4. Run the full local check set before pushing — the same checks CI runs: - - ```bash - npm run typecheck # browser sources - npm run typecheck:node # gateway sources - npm test # unit tests - npm run format # Prettier (or `npx prettier --check ...` to verify) - ``` - -5. Update [`CHANGELOG.md`](CHANGELOG.md) under `## [Unreleased]`. -6. Open a pull request. CI must pass before a PR can be merged. - -## Coding conventions - -- **TypeScript**, formatted with **Prettier** (config in `.prettierrc.json`). -- Keep the GRBL engine and the plot pipeline **UI-free** — they depend only on the - `Transport` interface, never on the DOM, React, or Web Serial. This is what lets the - same engine run in the browser and on the Pi. Please preserve that boundary. -- Match the style of the surrounding code. - -## Releases - -Releases follow [Semantic Versioning](https://semver.org). Maintainers cut a release by -bumping `version` in `package.json` and pushing a matching `v*` tag; CI builds the arm64 -`.deb` and attaches it to the GitHub Release (see `.github/workflows/release.yml`). diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index 716d808..0000000 --- a/SECURITY.md +++ /dev/null @@ -1,35 +0,0 @@ -# Security Policy - -## Reporting a vulnerability - -Please report security issues **privately** — do not open a public GitHub issue. - -- Preferred: open a [private security advisory](https://github.com/Lab271/labs-pen-plotter/security/advisories/new) - on this repository, **or** -- Email **dsiderius@schubergphilis.com** with the details. - -Please include a description, reproduction steps, and the affected version. You'll get an -acknowledgement, and we'll keep you posted as we work on a fix. Please give us reasonable -time to address the issue before any public disclosure. - -## Supported versions - -This project moves fast and only the latest release is supported. Fixes ship in a new -release rather than being backported. - -## Important: the gateway has no built-in authentication - -This is a design property, not a bug, but it has real security implications you must -understand before deploying. - -The gateway daemon exposes **unauthenticated** control over HTTP/WebSocket. Anyone who can -reach the daemon's address can jog the gantry and start or stop plots — a physical-safety -concern, not just a data one. - -- The Debian package ships bound to `0.0.0.0` (the whole LAN) so the app works with no - tunnel. **This is only acceptable on a fully trusted LAN.** -- On any network with untrusted devices, set `GATEWAY_HOST=127.0.0.1` (loopback only) in - `/etc/penplotter271/penplotter271.env` and reach the app over an SSH tunnel, a VPN - (e.g. Tailscale), or a reverse proxy that adds its own authentication. - -See the **Access** section of the [README](README.md) for the full details. diff --git a/package-lock.json b/package-lock.json index b9bc612..a77e959 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,17 +10,17 @@ "dependencies": { "@types/ws": "^8.18.1", "konva": "^10.3.0", - "react": "^18.3.1", - "react-dom": "^18.3.1", - "react-konva": "^18.2.16", + "react": "^19.2.8", + "react-dom": "^19.2.8", + "react-konva": "^19.2.5", "serialport": "^13.0.0", "tsx": "^4.23.1", "ws": "^8.21.1" }, "devDependencies": { "@tailwindcss/vite": "^4.3.1", - "@types/react": "^18.3.3", - "@types/react-dom": "^18.3.0", + "@types/react": "^19.2.17", + "@types/react-dom": "^19.2.3", "@types/w3c-web-serial": "^1.0.6", "@vitejs/plugin-react": "^6.0.2", "esbuild": "^0.28.1", @@ -1417,36 +1417,29 @@ "undici-types": ">=7.24.0 <7.24.7" } }, - "node_modules/@types/prop-types": { - "version": "15.7.15", - "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz", - "integrity": "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==", - "license": "MIT" - }, "node_modules/@types/react": { - "version": "18.3.31", - "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.31.tgz", - "integrity": "sha512-vfEqpXTvwT91yhmwdfouStN2hSKwTvyRs8qpLfADyrq/kxDw0hZM7Wk9Ug1FELj8hIby+S/+kQCSRFF32nv2Qw==", + "version": "19.2.17", + "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz", + "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==", "license": "MIT", "dependencies": { - "@types/prop-types": "*", "csstype": "^3.2.2" } }, "node_modules/@types/react-dom": { - "version": "18.3.7", - "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.7.tgz", - "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==", + "version": "19.2.3", + "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz", + "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==", "dev": true, "license": "MIT", "peerDependencies": { - "@types/react": "^18.0.0" + "@types/react": "^19.2.0" } }, "node_modules/@types/react-reconciler": { - "version": "0.28.9", - "resolved": "https://registry.npmjs.org/@types/react-reconciler/-/react-reconciler-0.28.9.tgz", - "integrity": "sha512-HHM3nxyUZ3zAylX8ZEyrDNd2XZOnQ0D5XfunJF5FLQnZbHHYq4UWvW1QfelQNXv1ICNkwYhfxjwfnqivYB6bFg==", + "version": "0.33.0", + "resolved": "https://registry.npmjs.org/@types/react-reconciler/-/react-reconciler-0.33.0.tgz", + "integrity": "sha512-HZOXsKT0tGI9LlUw2LuedXsVeB88wFa536vVL0M6vE8zN63nI+sSr1ByxmPToP5K5bukaVscyeCJcF9guVNJ1g==", "license": "MIT", "peerDependencies": { "@types/react": "*" @@ -1789,15 +1782,24 @@ "license": "ISC" }, "node_modules/its-fine": { - "version": "1.2.5", - "resolved": "https://registry.npmjs.org/its-fine/-/its-fine-1.2.5.tgz", - "integrity": "sha512-fXtDA0X0t0eBYAGLVM5YsgJGsJ5jEmqZEPrGbzdf5awjv0xE7nqv3TVnvtUF060Tkes15DbDAKW/I48vsb6SyA==", + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/its-fine/-/its-fine-2.0.0.tgz", + "integrity": "sha512-KLViCmWx94zOvpLwSlsx6yOCeMhZYaxrJV87Po5k/FoZzcPSahvK5qJ7fYhS61sZi5ikmh2S3Hz55A2l3U69ng==", "license": "MIT", "dependencies": { - "@types/react-reconciler": "^0.28.0" + "@types/react-reconciler": "^0.28.9" }, "peerDependencies": { - "react": ">=18.0" + "react": "^19.0.0" + } + }, + "node_modules/its-fine/node_modules/@types/react-reconciler": { + "version": "0.28.9", + "resolved": "https://registry.npmjs.org/@types/react-reconciler/-/react-reconciler-0.28.9.tgz", + "integrity": "sha512-HHM3nxyUZ3zAylX8ZEyrDNd2XZOnQ0D5XfunJF5FLQnZbHHYq4UWvW1QfelQNXv1ICNkwYhfxjwfnqivYB6bFg==", + "license": "MIT", + "peerDependencies": { + "@types/react": "*" } }, "node_modules/jiti": { @@ -1810,12 +1812,6 @@ "jiti": "lib/jiti-cli.mjs" } }, - "node_modules/js-tokens": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz", - "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==", - "license": "MIT" - }, "node_modules/konva": { "version": "10.3.0", "resolved": "https://registry.npmjs.org/konva/-/konva-10.3.0.tgz", @@ -2109,18 +2105,6 @@ "url": "https://opencollective.com/parcel" } }, - "node_modules/loose-envify": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz", - "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==", - "license": "MIT", - "dependencies": { - "js-tokens": "^3.0.0 || ^4.0.0" - }, - "bin": { - "loose-envify": "cli.js" - } - }, "node_modules/magic-string": { "version": "0.30.21", "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz", @@ -2263,34 +2247,30 @@ } }, "node_modules/react": { - "version": "18.3.1", - "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz", - "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==", + "version": "19.2.8", + "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz", + "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==", "license": "MIT", - "dependencies": { - "loose-envify": "^1.1.0" - }, "engines": { "node": ">=0.10.0" } }, "node_modules/react-dom": { - "version": "18.3.1", - "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz", - "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==", + "version": "19.2.8", + "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz", + "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==", "license": "MIT", "dependencies": { - "loose-envify": "^1.1.0", - "scheduler": "^0.23.2" + "scheduler": "^0.27.0" }, "peerDependencies": { - "react": "^18.3.1" + "react": "^19.2.8" } }, "node_modules/react-konva": { - "version": "18.2.16", - "resolved": "https://registry.npmjs.org/react-konva/-/react-konva-18.2.16.tgz", - "integrity": "sha512-bYs5TuTpaSSxBTZ79btaSXjDvLaQIZOVgBEg2ITMyc2p3jwbdIJDh7kOuK4ivxY8uZHWxmQP32bLxlwA17EgXQ==", + "version": "19.2.5", + "resolved": "https://registry.npmjs.org/react-konva/-/react-konva-19.2.5.tgz", + "integrity": "sha512-AdsuDB59GdB86QdenTAqRzr6Tfw3z9x9Opxo4BoqDjdNLsjekF9a1VhN4FlMPvg0qtrMl3d4dNmagaUTGH7fSA==", "funding": [ { "type": "patreon", @@ -2307,31 +2287,30 @@ ], "license": "MIT", "dependencies": { - "@types/react-reconciler": "^0.28.2", - "its-fine": "^1.1.1", - "react-reconciler": "~0.29.0", - "scheduler": "^0.23.0" + "@types/react-reconciler": "^0.33.0", + "its-fine": "^2.0.0", + "react-reconciler": "0.33.0", + "scheduler": "0.27.0" }, "peerDependencies": { "konva": "^8.0.1 || ^7.2.5 || ^9.0.0 || ^10.0.0", - "react": ">=18.0.0", - "react-dom": ">=18.0.0" + "react": "^19.2.0", + "react-dom": "^19.2.0" } }, "node_modules/react-reconciler": { - "version": "0.29.2", - "resolved": "https://registry.npmjs.org/react-reconciler/-/react-reconciler-0.29.2.tgz", - "integrity": "sha512-zZQqIiYgDCTP/f1N/mAR10nJGrPD2ZR+jDSEsKWJHYC7Cm2wodlwbR3upZRdC3cjIjSlTLNVyO7Iu0Yy7t2AYg==", + "version": "0.33.0", + "resolved": "https://registry.npmjs.org/react-reconciler/-/react-reconciler-0.33.0.tgz", + "integrity": "sha512-KetWRytFv1epdpJc3J4G75I4WrplZE5jOL7Yq0p34+OVOKF4Se7WrdIdVC45XsSSmUTlht2FM/fM1FZb1mfQeA==", "license": "MIT", "dependencies": { - "loose-envify": "^1.1.0", - "scheduler": "^0.23.2" + "scheduler": "^0.27.0" }, "engines": { "node": ">=0.10.0" }, "peerDependencies": { - "react": "^18.3.1" + "react": "^19.2.0" } }, "node_modules/rolldown": { @@ -2369,13 +2348,10 @@ } }, "node_modules/scheduler": { - "version": "0.23.2", - "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz", - "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==", - "license": "MIT", - "dependencies": { - "loose-envify": "^1.1.0" - } + "version": "0.27.0", + "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz", + "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==", + "license": "MIT" }, "node_modules/serialport": { "version": "13.0.0", diff --git a/package.json b/package.json index 853d57f..554b2f7 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "penplotter271", "private": true, - "version": "1.0.4", + "version": "1.0.5", "type": "module", "scripts": { "dev": "vite", @@ -19,17 +19,17 @@ "dependencies": { "@types/ws": "^8.18.1", "konva": "^10.3.0", - "react": "^18.3.1", - "react-dom": "^18.3.1", - "react-konva": "^18.2.16", + "react": "^19.2.8", + "react-dom": "^19.2.8", + "react-konva": "^19.2.5", "serialport": "^13.0.0", "tsx": "^4.23.1", "ws": "^8.21.1" }, "devDependencies": { "@tailwindcss/vite": "^4.3.1", - "@types/react": "^18.3.3", - "@types/react-dom": "^18.3.0", + "@types/react": "^19.2.17", + "@types/react-dom": "^19.2.3", "@types/w3c-web-serial": "^1.0.6", "@vitejs/plugin-react": "^6.0.2", "esbuild": "^0.28.1",