diff --git a/.github/PULL_REQUEST_TEMPLATE/release.md b/.github/PULL_REQUEST_TEMPLATE/release.md index bd257a1..f007de2 100644 --- a/.github/PULL_REQUEST_TEMPLATE/release.md +++ b/.github/PULL_REQUEST_TEMPLATE/release.md @@ -5,7 +5,8 @@ Open it from the dev...main compare with: ?expand=1&template=release.md (base: main, compare: dev) -Bump manifest.json + versions.json + CHANGELOG.md on `dev` BEFORE opening this +Bump manifest.json + package.json/package-lock.json + versions.json + +CHANGELOG.md on `dev` BEFORE opening this PR. On merge, the Release workflow auto-tags `main` and publishes the release. --> @@ -21,6 +22,7 @@ PR. On merge, the Release workflow auto-tags `main` and publishes the release. ## Pre-merge checklist - [ ] `manifest.json` `version` is set to **X.Y.Z** +- [ ] `package.json` / `package-lock.json` `version` is **X.Y.Z** (`npm version X.Y.Z --no-git-tag-version`) - [ ] `versions.json` has `"X.Y.Z": ""` (matches `manifest.minAppVersion`) - [ ] `CHANGELOG.md` has a dated `## [X.Y.Z]` section (moved out of *Unreleased*) - [ ] `node --check main.js` and `node scripts/validate.mjs` pass locally diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 302f1e6..ea7a7e2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,8 @@ version: 2 updates: - # Keep GitHub Actions used in workflows up to date. (The plugin itself has - # no runtime dependencies — it ships as plain CommonJS with no build step.) + # Keep GitHub Actions used in workflows up to date. (The plugin has no + # runtime dependencies — `obsidian` is host-provided and never bundled — so + # npm only gets Dependabot *security* updates for the dev toolchain.) - package-ecosystem: github-actions directory: "/" schedule: diff --git a/CHANGELOG.md b/CHANGELOG.md index 33690c2..c54ea4b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.2.3] - 2026-11-02 + +Development-toolchain security and release-hygiene maintenance. No change in +behaviour; the shipped `main.js` / `styles.css` are byte-identical to 1.2.2. + +### Security — dev toolchain only + +- `moment` is pinned to `^2.31.0` via npm `overrides` (GHSA-4p3w-j4w9-5jqw). + `obsidian` pins 2.29.4 exactly, so Dependabot could not update it; it is used + only for type declarations and is never bundled. +- `minimatch` is pinned to `^11.0.1` under ESLint, `@eslint/config-array`, + `@eslint/eslintrc`, `@typescript-eslint/typescript-estree` and + `eslint-plugin-n` (GHSA-g3hv-75wg-m249), replacing every copy that contains + the vulnerable code. The 3.x / 8.x copies used by eslint-plugin-import / -react + / -json-schema-validator stay because 11 would break them; see + `docs/DEVELOPMENT.md`. +- Lockfile security bumps: `js-yaml` 4.3.2, `brace-expansion` 1.1.21 / 2.1.7 / + 5.0.12, `fast-uri` 3.1.9 (#43, #44, #45). + +### Internal — recurrence prevention + +- `package.json` / `package-lock.json` carry the release version again (they + were stuck at 1.1.5 since 1.2.0), and `scripts/validate.mjs` now fails CI when + they disagree with `manifest.json`. + ## [1.2.2] - 2026-07-28 The remaining warning from Obsidian's plugin review. No change in behaviour. @@ -236,7 +261,8 @@ Initial public release. mode), not only in Reading view. The table being actively edited is left untouched. -[Unreleased]: https://github.com/Post-Math/Lookout/compare/1.2.2...HEAD +[Unreleased]: https://github.com/Post-Math/Lookout/compare/1.2.3...HEAD +[1.2.3]: https://github.com/Post-Math/Lookout/compare/1.2.2...1.2.3 [1.2.2]: https://github.com/Post-Math/Lookout/compare/1.2.1...1.2.2 [1.2.1]: https://github.com/Post-Math/Lookout/compare/1.2.0...1.2.1 [1.2.0]: https://github.com/Post-Math/Lookout/compare/1.1.7...1.2.0 diff --git a/CLAUDE.md b/CLAUDE.md index 070e628..10c5a8d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -43,7 +43,7 @@ A note containing a wide Mermaid diagram and a wide table exercises both feature ## Architecture -Everything lives in `src/main.ts` (~900 lines), three classes: +Everything lives in `src/main.ts` (~1,850 lines), three classes: - **`LookoutPlugin`** (the `default` export) — lifecycle and **discovery**. It finds rendered Mermaid ``s (`.mermaid svg, svg[id^="mermaid-"]`) and ``s anywhere in the document and wraps each in a view. Discovery is driven by several overlapping triggers because Mermaid renders asynchronously and Obsidian re-renders panes on navigation: `onLayoutReady`, workspace events (`layout-change`, `active-leaf-change`, `file-open`), a `registerMarkdownPostProcessor`, and a `MutationObserver` on `document.body`. All of these funnel through `queueScan()` (debounced ~120ms) → `scan()` → `scanWithin(root)` → `process()` / `processTable()`. - **`DiagramView`** — one pan/zoom controller per diagram. The same class serves both the **inline** frame (wraps the live svg in place) and **full-screen** (wraps a *clone* in a fixed overlay). It owns the transform math: `_measure`, `fit`, `actualSize`, `zoomTo`/`zoomBy`, `_panBounds`/`_clampPan`, and `_render`. @@ -71,4 +71,4 @@ Lookout moves Obsidian-owned nodes (the svg, the table) into its own wrappers an - Default branch is **`dev`** — branch off it (`feat/*`, `fix/*`, `docs/*`, `chore/*`) and open PRs against `dev`, never `main`. Use Conventional Commits. - `main` only receives merges from `dev` or `hotfix/*`. **Releases are automatic on merge to `main`**: the workflow reads `version` from `manifest.json` and pushes a bare-version tag (no `v` prefix — Obsidian convention). -- A version bump must touch three files in lockstep (validated by `scripts/validate.mjs`): `manifest.json` (`version`), `versions.json` (`"": ""`, which must equal `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` notes into a dated section). +- A version bump must touch these files in lockstep: `manifest.json` (`version`), `package.json` + `package-lock.json` (`version`, must equal the manifest — use `npm version --no-git-tag-version`), `versions.json` (`"": ""`, which must equal `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` notes into a dated section). `scripts/validate.mjs` enforces all but the CHANGELOG. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ebd13bf..dc5b822 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -111,6 +111,8 @@ The version bump lands on `dev` first: 1. On a branch off `dev`, prepare the release: - bump `version` in `manifest.json`, + - bump `package.json` / `package-lock.json` to the same version + (`npm version --no-git-tag-version`), - add the matching entry to `versions.json` (`"": ""`), - move the `Unreleased` notes in [`CHANGELOG.md`](CHANGELOG.md) into a dated `## []` section. diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md index 7c2e097..09ab52b 100644 --- a/docs/DEVELOPMENT.md +++ b/docs/DEVELOPMENT.md @@ -121,6 +121,30 @@ relaxation: **`strictPropertyInitialization` is off**, because the view classes initialize their fields in `_build()` / `_buildToolbar()` rather than the constructor body. `strictNullChecks`, `noImplicitAny`, etc. remain on. +### Dependency `overrides` (dev toolchain security pins) + +`package.json` `overrides` force patched versions that upstream ranges block. +None of them reach `main.js` — they only affect the lint/type-check toolchain. + +- **`moment` → `^2.31.0`** (GHSA-4p3w-j4w9-5jqw). `obsidian` pins `moment` to + exactly `2.29.4`; it is only used for the type declarations. +- **`minimatch` → `^11.0.1`** under `eslint`, `@eslint/config-array`, + `@eslint/eslintrc`, `@typescript-eslint/typescript-estree` and + `eslint-plugin-n` (GHSA-g3hv-75wg-m249 — only 11.0.1+ is patched, and no + upstream release accepts 11 yet). These consumers only use the named + `Minimatch` / `minimatch` exports, which 11 keeps. + + The override is **not** applied to `eslint-plugin-import` / `eslint-plugin-react` + (minimatch 3.x) or `eslint-plugin-json-schema-validator` (8.x): they call the + module itself (`minimatch(…)` / default import), and minimatch ≥ 10 exports a + plain object, so 11 would crash them. 3.x predates the vulnerable + `globParts` preprocessing entirely, and the `json-schema-validator` rules are not + enabled for `src/`. That is why the GitHub alert for this advisory can still + list those copies. + +Drop an override once the upstream range covers the patched version +(`npm ls --all` shows the tree). After changing one, re-run the full CI gate. + ## Code guidelines (Obsidian) Keep changes within Obsidian's plugin guidelines: @@ -171,8 +195,9 @@ Summarised here; the authoritative version is in on merge to `main`**: the workflow installs deps, builds `main.js`, reads `version` from `manifest.json`, pushes a bare-version tag (no `v` prefix — Obsidian convention), and uploads `main.js` / `manifest.json` / `styles.css`. -- A version bump touches three files in lockstep (checked by - `scripts/validate.mjs`): `manifest.json` (`version`) — keep `package.json`'s - `version` in sync — `versions.json` (`"": ""`, equal to - `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` into a dated - section). +- A version bump touches these files in lockstep: `manifest.json` (`version`), + `package.json` + `package-lock.json` (`version`, equal to the manifest — run + `npm version --no-git-tag-version`), `versions.json` + (`"": ""`, equal to `manifest.minAppVersion`), and + `CHANGELOG.md` (move `Unreleased` into a dated section). + `scripts/validate.mjs` checks every one of these except the CHANGELOG. diff --git a/manifest.json b/manifest.json index 06f31f8..9c7ac94 100644 --- a/manifest.json +++ b/manifest.json @@ -1,7 +1,7 @@ { "id": "lookout", "name": "Lookout", - "version": "1.2.2", + "version": "1.2.3", "minAppVersion": "1.6.6", "description": "Survey wide content instead of scrolling sideways. Pan and zoom Mermaid diagrams (wheel, Ctrl+wheel, or buttons), fit them to the frame, and open diagrams or wide tables full-screen.", "author": "Post-Math", diff --git a/package-lock.json b/package-lock.json index 97f4ed4..0e47c33 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "lookout", - "version": "1.1.5", + "version": "1.2.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "lookout", - "version": "1.1.5", + "version": "1.2.3", "license": "MIT", "devDependencies": { "@types/node": "^20.14.0", @@ -574,6 +574,46 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, + "node_modules/@eslint/config-array/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/@eslint/config-array/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/@eslint/config-array/node_modules/minimatch": { + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" + }, + "engines": { + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, "node_modules/@eslint/config-helpers": { "version": "0.4.2", "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz", @@ -624,6 +664,46 @@ "url": "https://opencollective.com/eslint" } }, + "node_modules/@eslint/eslintrc/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/@eslint/eslintrc/node_modules/minimatch": { + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" + }, + "engines": { + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, "node_modules/@eslint/js": { "version": "9.39.4", "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz", @@ -753,6 +833,13 @@ "url": "https://github.com/sponsors/nzakas" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", + "dev": true, + "license": "BlueOak-1.0.0" + }, "node_modules/@marijn/find-cluster-break": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.2.tgz", @@ -1080,26 +1167,27 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { - "version": "10.2.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz", - "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==", + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.5" + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" }, "engines": { "node": "18 || 20 || >=22" @@ -1420,9 +1508,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -2238,9 +2326,9 @@ } }, "node_modules/eslint-plugin-json-schema-validator/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -2296,14 +2384,27 @@ "eslint": ">=8.23.0" } }, + "node_modules/eslint-plugin-n/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, "node_modules/eslint-plugin-n/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { - "balanced-match": "^1.0.0" + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" } }, "node_modules/eslint-plugin-n/node_modules/globals": { @@ -2320,16 +2421,17 @@ } }, "node_modules/eslint-plugin-n/node_modules/minimatch": { - "version": "9.0.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", - "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", "dev": true, - "license": "ISC", + "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^2.0.2" + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" }, "engines": { - "node": ">=16 || 14 >=14.17" + "node": "18 || 20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" @@ -2516,6 +2618,46 @@ "url": "https://opencollective.com/eslint" } }, + "node_modules/eslint/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/eslint/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/eslint/node_modules/minimatch": { + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" + }, + "engines": { + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", @@ -2602,9 +2744,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "dev": true, "funding": [ { @@ -3474,9 +3616,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { @@ -3731,9 +3873,9 @@ "license": "MIT" }, "node_modules/moment": { - "version": "2.29.4", - "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz", - "integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==", + "version": "2.31.0", + "resolved": "https://registry.npmjs.org/moment/-/moment-2.31.0.tgz", + "integrity": "sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 477f200..b03539d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "lookout", - "version": "1.1.5", + "version": "1.2.3", "description": "Survey wide content instead of scrolling sideways — pan/zoom Mermaid diagrams and open wide tables full-screen in Obsidian.", "main": "main.js", "private": true, @@ -33,5 +33,23 @@ "tslib": "^2.6.0", "typescript": "^5.6.3", "typescript-eslint": "^8.62.0" + }, + "overrides": { + "moment": "^2.31.0", + "eslint": { + "minimatch": "^11.0.1" + }, + "@eslint/config-array": { + "minimatch": "^11.0.1" + }, + "@eslint/eslintrc": { + "minimatch": "^11.0.1" + }, + "@typescript-eslint/typescript-estree": { + "minimatch": "^11.0.1" + }, + "eslint-plugin-n": { + "minimatch": "^11.0.1" + } } } diff --git a/scripts/validate.mjs b/scripts/validate.mjs index dd088e9..8a58b9b 100644 --- a/scripts/validate.mjs +++ b/scripts/validate.mjs @@ -56,6 +56,21 @@ if (manifest && versions) { } } +// package.json / package-lock.json carry the same version. Nothing reads it at +// runtime, which is exactly why it drifted unnoticed (stuck at 1.1.5 through +// 1.2.0–1.2.2); check it so a release bump can't forget it again. +if (manifest) { + for (const f of ["package.json", "package-lock.json"]) { + try { + const v = JSON.parse(readFileSync(f, "utf8")).version; + if (v === manifest.version) ok(`${f} version matches manifest (${v})`); + else fail(`${f} version "${v}" != manifest.version "${manifest.version}"`); + } catch (e) { + fail(`${f} unreadable: ${e.message}`); + } + } +} + /* * styles.css: properties Obsidian's plugin CSS check rejects. * diff --git a/versions.json b/versions.json index 5193ec6..6937ce1 100644 --- a/versions.json +++ b/versions.json @@ -8,5 +8,6 @@ "1.1.7": "1.0.0", "1.2.0": "1.6.6", "1.2.1": "1.6.6", - "1.2.2": "1.6.6" + "1.2.2": "1.6.6", + "1.2.3": "1.6.6" }