chore: release 1.2.3

.github/PULL_REQUEST_TEMPLATE/release.md

@@ -5,7 +5,8 @@ Open it from the dev...main compare with:
   ?expand=1&template=release.md
 (base: main, compare: dev)
 
-Bump manifest.json + versions.json + CHANGELOG.md on `dev` BEFORE opening this
+Bump manifest.json + package.json/package-lock.json + versions.json +
+CHANGELOG.md on `dev` BEFORE opening this
 PR. On merge, the Release workflow auto-tags `main` and publishes the release.
 -->
 
@@ -21,6 +22,7 @@ PR. On merge, the Release workflow auto-tags `main` and publishes the release.
 ## Pre-merge checklist
 
 - [ ] `manifest.json` `version` is set to **X.Y.Z**
+- [ ] `package.json` / `package-lock.json` `version` is **X.Y.Z** (`npm version X.Y.Z --no-git-tag-version`)
 - [ ] `versions.json` has `"X.Y.Z": "<minAppVersion>"` (matches `manifest.minAppVersion`)
 - [ ] `CHANGELOG.md` has a dated `## [X.Y.Z]` section (moved out of *Unreleased*)
 - [ ] `node --check main.js` and `node scripts/validate.mjs` pass locally

.github/dependabot.yml

@@ -1,7 +1,8 @@
 version: 2
 updates:
-  # Keep GitHub Actions used in workflows up to date. (The plugin itself has
-  # no runtime dependencies — it ships as plain CommonJS with no build step.)
+  # Keep GitHub Actions used in workflows up to date. (The plugin has no
+  # runtime dependencies — `obsidian` is host-provided and never bundled — so
+  # npm only gets Dependabot *security* updates for the dev toolchain.)
   - package-ecosystem: github-actions
     directory: "/"
     schedule:

CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.3] - 2026-11-02
+
+Development-toolchain security and release-hygiene maintenance. No change in
+behaviour; the shipped `main.js` / `styles.css` are byte-identical to 1.2.2.
+
+### Security — dev toolchain only
+
+- `moment` is pinned to `^2.31.0` via npm `overrides` (GHSA-4p3w-j4w9-5jqw).
+  `obsidian` pins 2.29.4 exactly, so Dependabot could not update it; it is used
+  only for type declarations and is never bundled.
+- `minimatch` is pinned to `^11.0.1` under ESLint, `@eslint/config-array`,
+  `@eslint/eslintrc`, `@typescript-eslint/typescript-estree` and
+  `eslint-plugin-n` (GHSA-g3hv-75wg-m249), replacing every copy that contains
+  the vulnerable code. The 3.x / 8.x copies used by eslint-plugin-import / -react
+  / -json-schema-validator stay because 11 would break them; see
+  `docs/DEVELOPMENT.md`.
+- Lockfile security bumps: `js-yaml` 4.3.2, `brace-expansion` 1.1.21 / 2.1.7 /
+  5.0.12, `fast-uri` 3.1.9 (#43, #44, #45).
+
+### Internal — recurrence prevention
+
+- `package.json` / `package-lock.json` carry the release version again (they
+  were stuck at 1.1.5 since 1.2.0), and `scripts/validate.mjs` now fails CI when
+  they disagree with `manifest.json`.
+
 ## [1.2.2] - 2026-07-28
 
 The remaining warning from Obsidian's plugin review. No change in behaviour.
@@ -236,7 +261,8 @@ Initial public release.
   mode), not only in Reading view. The table being actively edited is left
   untouched.
 
-[Unreleased]: https://github.com/Post-Math/Lookout/compare/1.2.2...HEAD
+[Unreleased]: https://github.com/Post-Math/Lookout/compare/1.2.3...HEAD
+[1.2.3]: https://github.com/Post-Math/Lookout/compare/1.2.2...1.2.3
 [1.2.2]: https://github.com/Post-Math/Lookout/compare/1.2.1...1.2.2
 [1.2.1]: https://github.com/Post-Math/Lookout/compare/1.2.0...1.2.1
 [1.2.0]: https://github.com/Post-Math/Lookout/compare/1.1.7...1.2.0

CLAUDE.md

@@ -43,7 +43,7 @@ A note containing a wide Mermaid diagram and a wide table exercises both feature
 
 ## Architecture
 
-Everything lives in `src/main.ts` (~900 lines), three classes:
+Everything lives in `src/main.ts` (~1,850 lines), three classes:
 
 - **`LookoutPlugin`** (the `default` export) — lifecycle and **discovery**. It finds rendered Mermaid `<svg>`s (`.mermaid svg, svg[id^="mermaid-"]`) and `<table>`s anywhere in the document and wraps each in a view. Discovery is driven by several overlapping triggers because Mermaid renders asynchronously and Obsidian re-renders panes on navigation: `onLayoutReady`, workspace events (`layout-change`, `active-leaf-change`, `file-open`), a `registerMarkdownPostProcessor`, and a `MutationObserver` on `document.body`. All of these funnel through `queueScan()` (debounced ~120ms) → `scan()` → `scanWithin(root)` → `process()` / `processTable()`.
 - **`DiagramView`** — one pan/zoom controller per diagram. The same class serves both the **inline** frame (wraps the live svg in place) and **full-screen** (wraps a *clone* in a fixed overlay). It owns the transform math: `_measure`, `fit`, `actualSize`, `zoomTo`/`zoomBy`, `_panBounds`/`_clampPan`, and `_render`.
@@ -71,4 +71,4 @@ Lookout moves Obsidian-owned nodes (the svg, the table) into its own wrappers an
 
 - Default branch is **`dev`** — branch off it (`feat/*`, `fix/*`, `docs/*`, `chore/*`) and open PRs against `dev`, never `main`. Use Conventional Commits.
 - `main` only receives merges from `dev` or `hotfix/*`. **Releases are automatic on merge to `main`**: the workflow reads `version` from `manifest.json` and pushes a bare-version tag (no `v` prefix — Obsidian convention).
-- A version bump must touch three files in lockstep (validated by `scripts/validate.mjs`): `manifest.json` (`version`), `versions.json` (`"<version>": "<minAppVersion>"`, which must equal `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` notes into a dated section).
+- A version bump must touch these files in lockstep: `manifest.json` (`version`), `package.json` + `package-lock.json` (`version`, must equal the manifest — use `npm version <x.y.z> --no-git-tag-version`), `versions.json` (`"<version>": "<minAppVersion>"`, which must equal `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` notes into a dated section). `scripts/validate.mjs` enforces all but the CHANGELOG.

CONTRIBUTING.md

@@ -111,6 +111,8 @@ The version bump lands on `dev` first:
 
 1. On a branch off `dev`, prepare the release:
    - bump `version` in `manifest.json`,
+   - bump `package.json` / `package-lock.json` to the same version
+     (`npm version <x.y.z> --no-git-tag-version`),
    - add the matching entry to `versions.json` (`"<version>": "<minAppVersion>"`),
    - move the `Unreleased` notes in [`CHANGELOG.md`](CHANGELOG.md) into a dated
      `## [<version>]` section.

docs/DEVELOPMENT.md

@@ -121,6 +121,30 @@ relaxation: **`strictPropertyInitialization` is off**, because the view classes
 initialize their fields in `_build()` / `_buildToolbar()` rather than the
 constructor body. `strictNullChecks`, `noImplicitAny`, etc. remain on.
 
+### Dependency `overrides` (dev toolchain security pins)
+
+`package.json` `overrides` force patched versions that upstream ranges block.
+None of them reach `main.js` — they only affect the lint/type-check toolchain.
+
+- **`moment` → `^2.31.0`** (GHSA-4p3w-j4w9-5jqw). `obsidian` pins `moment` to
+  exactly `2.29.4`; it is only used for the type declarations.
+- **`minimatch` → `^11.0.1`** under `eslint`, `@eslint/config-array`,
+  `@eslint/eslintrc`, `@typescript-eslint/typescript-estree` and
+  `eslint-plugin-n` (GHSA-g3hv-75wg-m249 — only 11.0.1+ is patched, and no
+  upstream release accepts 11 yet). These consumers only use the named
+  `Minimatch` / `minimatch` exports, which 11 keeps.
+
+  The override is **not** applied to `eslint-plugin-import` / `eslint-plugin-react`
+  (minimatch 3.x) or `eslint-plugin-json-schema-validator` (8.x): they call the
+  module itself (`minimatch(…)` / default import), and minimatch ≥ 10 exports a
+  plain object, so 11 would crash them. 3.x predates the vulnerable
+  `globParts` preprocessing entirely, and the `json-schema-validator` rules are not
+  enabled for `src/`. That is why the GitHub alert for this advisory can still
+  list those copies.
+
+Drop an override once the upstream range covers the patched version
+(`npm ls <pkg> --all` shows the tree). After changing one, re-run the full CI gate.
+
 ## Code guidelines (Obsidian)
 
 Keep changes within Obsidian's plugin guidelines:
@@ -171,8 +195,9 @@ Summarised here; the authoritative version is in
   on merge to `main`**: the workflow installs deps, builds `main.js`, reads
   `version` from `manifest.json`, pushes a bare-version tag (no `v` prefix —
   Obsidian convention), and uploads `main.js` / `manifest.json` / `styles.css`.
-- A version bump touches three files in lockstep (checked by
-  `scripts/validate.mjs`): `manifest.json` (`version`) — keep `package.json`'s
-  `version` in sync — `versions.json` (`"<version>": "<minAppVersion>"`, equal to
-  `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` into a dated
-  section).
+- A version bump touches these files in lockstep: `manifest.json` (`version`),
+  `package.json` + `package-lock.json` (`version`, equal to the manifest — run
+  `npm version <x.y.z> --no-git-tag-version`), `versions.json`
+  (`"<version>": "<minAppVersion>"`, equal to `manifest.minAppVersion`), and
+  `CHANGELOG.md` (move `Unreleased` into a dated section).
+  `scripts/validate.mjs` checks every one of these except the CHANGELOG.

manifest.json

@@ -1,7 +1,7 @@
 {
   "id": "lookout",
   "name": "Lookout",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "minAppVersion": "1.6.6",
   "description": "Survey wide content instead of scrolling sideways. Pan and zoom Mermaid diagrams (wheel, Ctrl+wheel, or buttons), fit them to the frame, and open diagrams or wide tables full-screen.",
   "author": "Post-Math",