chore: bump version to 0.28.4

fix(deps): patch high/critical security advisories
Bumps runtime- and build-reachable dependencies to patched versions and adds pnpm overrides for transitive advisories. Clears all high/critical findings (1 critical + 12 high -> 0); remaining moderates/lows are dev-tooling only and stripped from the production image by pnpm prune. Direct bumps: - drizzle-orm ^0.44.7 -> ^0.45.2 (SQL injection via unescaped identifiers, GHSA-gpj5-g38j-94v9) - @sveltejs/kit ^2.53.4 -> ^2.63.1 (adapter-node BODY_SIZE_LIMIT bypass, GHSA-2crg-3p73-43xp) - vite ^7.3.1 -> ^7.3.5, vitest/@vitest/coverage-v8 ^3.2.4 -> ^3.2.6 (dev-server file read; vitest UI RCE) Transitive overrides: - devalue >=5.8.1 (DoS via sparse-array deserialization, GHSA-77vg-94rm-hx3p) - path-to-regexp@8 >=8.4.0 (ReDoS via express/router under @modelcontextprotocol/sdk, GHSA-j3q9-mxjg-w52f) - fast-uri >=3.1.2 (path traversal / host confusion via ajv, GHSA-q3j6-qgpj-74h6) Verified: pnpm check (0 errors), 264 unit tests pass, production build succeeds.
2026-10-12 20:06:57 +02:00 · 2026-06-09 19:10:42 +00:00 · 2026-06-09 21:08:39 +02:00 · 2026-06-09 20:58:58 +02:00 · 2026-06-09 20:54:29 +02:00 · 2026-06-09 20:50:22 +02:00
8 changed files with 1562 additions and 1024 deletions
@@ -2,7 +2,7 @@ name: CI

 on:
  push:
-    branches: [main, 'claude/**']
+    branches: [main]
  pull_request:
    branches: [main]
  workflow_call:
@@ -19,8 +19,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: latest

      - uses: actions/setup-node@v4
        with:
@@ -37,8 +35,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: latest

      - uses: actions/setup-node@v4
        with:
@@ -68,8 +64,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: latest

      - uses: actions/setup-node@v4
        with:
@@ -14,8 +14,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: latest

      - uses: actions/setup-node@v4
        with:
@@ -146,7 +146,7 @@ A `Makefile` wraps all common tasks for tool-agnostic usage. Run `make help` to

 GitHub Actions with two workflows:

-**CI** (`.github/workflows/ci.yml`) — runs on push to `main`/`claude/**` and PRs to `main`:
+**CI** (`.github/workflows/ci.yml`) — runs on push to `main` and PRs to `main` (branch work is validated once via the PR event, avoiding duplicate push+PR runs):
 1. **Lint & Type Check** — `pnpm check`
 2. **Unit Tests** — `pnpm test:unit`
 3. **Build** — `pnpm build` (depends on steps 1+2)
@@ -2,7 +2,7 @@
 FROM node:22-slim AS build

 WORKDIR /app
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@9 --activate

 # Copy package files
 COPY package.json pnpm-lock.yaml ./
@@ -1,6 +1,6 @@
 services:
  crumbs:
-    image: ghcr.io/bretzel-app/crumbs:0.28.2
+    image: ghcr.io/bretzel-app/crumbs:0.28.3
    container_name: crumbs
    ports:
      - "3000:3000"
@@ -1,8 +1,9 @@
 {
  "name": "crumbs",
  "private": true,
-  "version": "0.28.3",
+  "version": "0.28.4",
  "type": "module",
+  "packageManager": "pnpm@9.15.9",
  "license": "MIT",
  "author": "Bretzel (https://bretzel.app)",
  "homepage": "https://crumbs.bretzel.app",
@@ -51,7 +52,7 @@
    "arctic": "^3.7.0",
    "argon2": "^0.43.1",
    "better-sqlite3": "^11.10.0",
-    "drizzle-orm": "^0.44.7",
+    "drizzle-orm": "^0.45.2",
    "idb": "^8.0.3",
    "lucide-svelte": "^0.577.0",
    "markdown-it": "^14.1.1",
@@ -66,7 +67,7 @@
  },
  "devDependencies": {
    "@playwright/test": "^1.58.2",
-    "@sveltejs/kit": "^2.53.4",
+    "@sveltejs/kit": "^2.63.1",
    "@sveltejs/vite-plugin-svelte": "^6.2.4",
    "@tailwindcss/typography": "^0.5.19",
    "@tailwindcss/vite": "^4.2.1",
@@ -76,7 +77,7 @@
    "@types/uuid": "^10.0.0",
    "@types/zxcvbn": "^4.4.5",
    "@vite-pwa/sveltekit": "^1.1.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.6",
    "drizzle-kit": "^0.31.9",
    "jsdom": "^29.0.1",
    "nyc": "^18.0.0",
@@ -85,10 +86,10 @@
    "tailwindcss": "^4.2.1",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3",
-    "vite": "^7.3.1",
+    "vite": "^7.3.5",
    "vite-plugin-istanbul": "^7.2.1",
    "vite-plugin-pwa": "^1.2.0",
-    "vitest": "^3.2.4",
+    "vitest": "^3.2.6",
    "workbox-window": "^7.4.0",
    "yaml": "^2.8.2"
  },
@@ -102,7 +103,10 @@
      "serialize-javascript": ">=7.0.3",
      "esbuild@<0.25.0": "0.25.12",
      "cookie": ">=0.7.0",
-      "hono": ">=4.12.7"
+      "hono": ">=4.12.7",
+      "devalue": ">=5.8.1",
+      "path-to-regexp@8": ">=8.4.0",
+      "fast-uri": ">=3.1.2"
    }
  }
 }
@@ -292,7 +292,7 @@
 				<li><a href="https://github.com/bretzel-app/crumbs/blob/main/docs/DEPLOYMENT.md" target="_blank" rel="noopener">Docs</a></li>
 				<li><a href="https://github.com/bretzel-app/crumbs/blob/main/LICENSE" target="_blank" rel="noopener">License</a></li>
 			</ul>
-			<span class="footer-version">v0.28.3</span>
+			<span class="footer-version">v0.28.4</span>
 		</div>
 	</footer>
Author	SHA1	Message	Date
github-actions[bot]	760235e667	chore: bump version to 0.28.4	2026-06-09 19:10:42 +00:00
Claude	0cc64fd8f3	fix(deps): patch high/critical security advisories Bumps runtime- and build-reachable dependencies to patched versions and adds pnpm overrides for transitive advisories. Clears all high/critical findings (1 critical + 12 high -> 0); remaining moderates/lows are dev-tooling only and stripped from the production image by pnpm prune. Direct bumps: - drizzle-orm ^0.44.7 -> ^0.45.2 (SQL injection via unescaped identifiers, GHSA-gpj5-g38j-94v9) - @sveltejs/kit ^2.53.4 -> ^2.63.1 (adapter-node BODY_SIZE_LIMIT bypass, GHSA-2crg-3p73-43xp) - vite ^7.3.1 -> ^7.3.5, vitest/@vitest/coverage-v8 ^3.2.4 -> ^3.2.6 (dev-server file read; vitest UI RCE) Transitive overrides: - devalue >=5.8.1 (DoS via sparse-array deserialization, GHSA-77vg-94rm-hx3p) - path-to-regexp@8 >=8.4.0 (ReDoS via express/router under @modelcontextprotocol/sdk, GHSA-j3q9-mxjg-w52f) - fast-uri >=3.1.2 (path traversal / host confusion via ajv, GHSA-q3j6-qgpj-74h6) Verified: pnpm check (0 errors), 264 unit tests pass, production build succeeds.	2026-06-09 21:08:39 +02:00
Claude	dbade3595e	ci: run on push to main only to avoid duplicate PR runs A push to a claude/ branch with an open PR triggered both the push and pull_request events. The concurrency group keys on github.ref, which differs between the two (refs/heads/... vs refs/pull/N/merge), so neither run was cancelled and the whole pipeline (including E2E) ran twice. Drop claude/ from the push trigger; branch work is now validated once via the pull_request event.	2026-06-09 20:58:58 +02:00
Claude	585be91be5	chore: pin pnpm via packageManager field for CI and tooling Adds a packageManager field (pnpm@9.15.9) to package.json so corepack and pnpm/action-setup@v4 resolve a single pinned pnpm 9 version that matches lockfileVersion 9.0. Removes the floating 'version: latest' from the CI and screenshots workflows so they honor the packageManager field instead of pulling pnpm 10+, which breaks native module builds. Follow-up to #63.	2026-06-09 20:54:29 +02:00
Romain LE DISEZandGoogle Gemini	c2bb6ef75a	fix(docker): pin pnpm version to 9 to match lockfile and fix build errors Co-authored-by: Google Gemini <gemini@google.com>	2026-06-09 20:50:22 +02:00
github-actions[bot]	2fb1237f04	chore: pin docker-compose to v0.28.3 [skip ci]	2026-04-22 19:52:23 +00:00