Repository navigation
chore(release): v1.2.0 - #367
Merged
Merged
Conversation
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.63.0 to 1.64.1. - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.63.0...v1.64.1) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.64.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
chore: merge main into develop after v1.1.7
template-nextjs and template-nextjs-esm pin next and eslint-config-next to exactly 16.3.8, which is affected by three new Next.js advisories, all fixed in 16.4.1: two critical unauthenticated remote code executions (GHSA-2464-fhr4-w9xw in the Image Optimization API with SVG files, GHSA-673q-mjm6-r5xr in `use cache` functions returning typed arrays) and a high denial of service in App Router Server Actions (GHSA-p3m5-59mp-jv5r). Every project scaffolded from them got it. Dependabot raises no alert, because the templates have no lockfile. Pin both to 16.4.2, published 2026-10-15; 16.4.3 is too new to take.
fix(deps): move the Next.js templates to next 16.4.2
Bumps the templates group with 2 updates in the /template-nextjs directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Bumps the templates group with 2 updates in the /template-nextjs-esm directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.2...v16.4.3) Updates `eslint-config-next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next) Updates `next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.2...v16.4.3) Updates `eslint-config-next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next) Updates `next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.2...v16.4.3) Updates `eslint-config-next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next) Updates `next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.2...v16.4.3) Updates `eslint-config-next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: templates - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: templates - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: templates - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: templates - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: templates - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: templates - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: templates - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: templates ... Signed-off-by: dependabot[bot] <support@github.com>
pp-dev 1.5.0 is the first minor since 1.4.7: working as other MI users, server.allowedHosts for tunnels, sync.maxBackups / sync.buildTimeoutMs, the host check and CSRF protection on the dev server's own routes, the pp-dev next restart-on-config-change fix and the security updates of its runtime dependencies. Raise the floor in every template so new projects start on it. Nothing else in the templates has to change for 1.5.0: the grouped pp-dev.config schema, withPPDev() in next.config.* and the scripts are unchanged.
pp-dev reads MI_ACCESS_TOKEN from .env / .env.<mode> (Vite's loadEnv) and its README tells users to keep the token there, but no template ignored those files: the Vite templates ignored only *.local, the Next templates only .env*.local. The first `git add .` in a new project committed the token. Every _gitignore now ignores .env and .env.*, keeping .env.example. The Next templates also never ignored dist (their next.config distDir and the pp-dev next-build output), dist-zip or backups (the backups pp-dev pulls from MI), unlike the Vite templates. The scaffold tests now check that _gitignore was renamed and that the generated .gitignore of every template lists .env, .env.*, dist, dist-zip and backups. Refs: PP-4792
The Next templates built image URLs from a hard-coded `ASSETS_PREFIX = /pt/<package name>`. That is the production prefix only: under `apiVersion: 7`, withPPDev() serves the dev app at /pl/<name>, so on a fresh project `pp-dev next` answered /pt/<name>/pp-dev.svg with 404 and both logos on the start page (and the favicon) were broken. The SVGs move from public/ to src/assets/img/ and are imported as static assets. Next emits them under _next/static/media with the configured assetPrefix, so the same code resolves to /pl/<name>/... in development and /pt/<name>/... in the exported build; constants.ts no longer needs package.json. Verified on pp-dev 1.5.0: all four images and the favicon are 200 under `next dev` and `pp-dev next`, and `pp-dev next-build` writes /pt/<name>/_next/static/media/... into dist/index.html. Refs: PP-4792
…ing file Next 16 rewrote the Next templates' tsconfig.json on the first `pp-dev next`: `jsx` to react-jsx (a "mandatory change") and dist/dev/types/**/*.ts into include (pp-dev's development distDir). A fresh project started with a modified tsconfig. Ship both values; the file is now left alone by `next dev` and `pp-dev next`. template-vanilla-ts/tsconfig.node.json included a vite.config.ts the template does not have. Refs: PP-4792
- vanilla README showed an internal instance (640.metricinsights.com) as the mi.url example; use example.metricinsights.com like the others - vanilla, vanilla-ts and react READMEs said "To learn more about Next.js" - the Next READMEs linked the scaffolder at a path in pp-dev-js that no longer exists - the React README's "Expanding the ESLint configuration" described the legacy .eslintrc options; rewritten for the flat config the template ships - the React start page said "Edit src/App.tsx" for src/app.tsx Refs: PP-4792
The CLI accepted any unknown flag (`strict: false`), had no --help or --version (both opened the "Project name:" prompt), declared -y/--yes without reading it, and with stdin closed rendered the prompt, took the cancel and exited 0 having created nothing. The target directory was emptied before --template and --package-name were checked, a failed `npm install` still ended in "Project created successfully!", and the registry lookup for pp-components had no timeout and no fallback, so offline it crashed after the project files were written. - parseArgs runs strict; an unknown flag or a missing value exits 1 with the option name and a pointer to --help - --help prints the usage (every flag, the template list, examples); --version prints the package version - --yes asks nothing: the default project name, the files of a non-empty directory are kept, the package name is derived from the directory, packages are installed, no Cursor rules, no pp-components; it needs --template, since that has no default - without a terminal, a question that has no flag to answer it exits 1 and names the flag instead of cancelling itself - --template and --package-name are validated before anything is asked or written - a failed install reports the exit code or spawn error, says how to retry and exits 1; the project files stay - the pp-components version comes from the registry npm is configured with (npm_config_registry), with a 10 s timeout; any failure is a warning and the dependency is written as ^1.0.0 - the package name derived from the target is the directory's own name for ".", relative and absolute paths alike (an absolute path used to be mangled into the suggestion) - init().catch exits 1; the dead customCommand/isYarn1 branch is gone; formatTargetDir strips a trailing backslash too; one packageRoot instead of three resolve() calls - src/types/clack-prompts.d.ts is removed: @clack/prompts ships its own types, the shim made every prompt result `any` Refs: PP-4793
…the suite - new cases: --help, --version, unknown flag, no arguments without a terminal, unknown template and invalid --package-name against a non-empty directory (left untouched), --yes without --template, a non-empty directory without a terminal, "." as target, a scoped package name, --yes defaults, --pp-components against an unreachable registry (^1.0.0 and a warning), a failing npm install (exit 1, files kept) - the registry failures use npm_config_registry=http://127.0.0.1:9 with no fetch retries, so they need no network - tests that never reach the network carry the @offline tag: `npx playwright test --grep @offline` runs 22 of them in under 20 s - the dev-server test and the install test get a 300 s budget; the dev-server test waits for an HTTP answer instead of grepping stdout and asserts that the config placeholders it replaces still exist - one real `npm install` for the option flags instead of four: the cursor-rules × pp-components combinations run with --no-install - `pretest` runs unbuild, so `npm test` always tests the current source - CI retries a failed test once and keeps a trace of a failure Refs: PP-4793
…oots keep their separator Three review findings on the previous commit: - Without a terminal, a missing --cursor-rules, --pp-components or --install flag was noticed only when its prompt came up, after the scaffold was on disk; a retry with the flag then met a non-empty directory. Every flag that would be asked for is now checked up front and the message names all of them. A non-empty target without a terminal says which directory and what to do about it. - --yes "kept" the files of a non-empty directory but still overwrote any that the template also has (package.json, .gitignore, src/...). With nobody to ask, a collision with a top-level template entry now stops the run before anything is written and lists the files. - formatTargetDir stripped the trailing separator from a filesystem root: "C:\" became the drive-relative "C:", which resolves to the current directory. Roots keep their separator; an empty target falls back to the default name. Refs: PP-4793
- package.json said "license": "ISC" while LICENSE is MIT (added in 1.1.4); npm showed ISC - `format:check` runs prettier --check; `.github/` (generated callers, Dependabot config) and `docs/` are ignored, and endOfLine is "auto" because the checkout is CRLF on Windows and LF in git - build.config.ts: the `prompts` alias pointed at a package that was replaced by @clack/prompts long ago, and inlineDependencies had no effect (runtime dependencies stay external); both removed - scripts/postbuild.js packs the tarball itself (`npm pack --json`), removes the tarballs of earlier builds first and names the copy from npm's answer instead of picking the newest .tgz by mtime; it runs clean-templates.js before packing with scripts off, because prepack output would land in the JSON - scripts/clean-templates.js explains why it exists: `files` whitelists template-*/** and a root .npmignore cannot exclude below it, so prepack is what keeps a template's node_modules out of the package Refs: PP-4794
README: Node.js 24 (as engines says, not 22); every flag with its default under --yes; the non-interactive behaviour (no prompt without a terminal, exit 1 before anything is written); what tells nextjs from nextjs-esm and the Vite templates' embedding mode from the others' standalone mode; where the token goes; the development commands. .cursorrules described semantic-release and claimed perf doesn't release; .cursor/rules/create-release.mdc prescribed a manual tag on origin/main, which the shared release workflow creates itself. Both are replaced by CONTRIBUTING.md (commit convention, release process, pull requests) and CLAUDE.md (project map and conventions), as in pp-dev. Refs: PP-4794
The rule copied into new projects' .cursor/rules carried a copy of the pp-dev README from around 1.0: --logLevel levels that don't exist, inspector.maxMemory at 1 GiB (it is 100 MB), no next-build, no users, server.allowedHosts, sync.maxBackups / buildTimeoutMs or devPanel, and a migration guide from the pre-pp-dev helper. Replaced by a summary of pp-dev 1.5 (scripts, commands, config sections with defaults, validation, environment, Next.js base paths, dev server) that points at the pp-dev README as the reference. The MI variables section stays. Refs: PP-4794
Refs: PP-4794
…ions Follows the --yes change in 2c01ce3 (PP-4793). Refs: PP-4794
Refs: PP-4794
yarn and pnpm set npm_execpath too, to their own CLI; running that with npm's `pack --json --ignore-scripts` fails (other options, another output shape). postbuild.js now takes npm_execpath only when it ends in npm-cli.js, otherwise the npm that ships with the running node, and npm from PATH as the last resort. The Playwright helpers that run npm had the same assumption and get the same guard. Test: postbuild packs with npm when npm_execpath points at a yarn.js. Refs: PP-4794
fix(deps): bump @metricinsights/pp-dev to ^1.5.0 in the templates
…assets fix(templates): .env and build output in .gitignore, Next asset prefix, tsconfig, READMEs (PP-4792)
…pdates Updates the requirements on [react](https://github.com/react/react/tree/HEAD/packages/react), [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin), [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react), [eslint](https://github.com/eslint/eslint), [globals](https://github.com/sindresorhus/globals), [prettier](https://github.com/prettier/prettier) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) to permit the latest version. Updates `react` to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@typescript-eslint/eslint-plugin` to 8.72.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` to 8.72.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/parser) Updates `@vitejs/plugin-react` from 6.3.0 to 6.2.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.2.1/packages/plugin-react) Updates `eslint` to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) Updates `globals` to 17.14.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.13.0...v17.14.0) Updates `prettier` to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `vite` from 8.3.7 to 8.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.72.1 dependency-type: direct:development dependency-group: templates-major - dependency-name: "@typescript-eslint/parser" dependency-version: 8.72.1 dependency-type: direct:development dependency-group: templates-major - dependency-name: "@vitejs/plugin-react" dependency-version: 6.2.1 dependency-type: direct:development dependency-group: templates-major - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development dependency-group: templates-major - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production dependency-group: templates-major - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production dependency-group: templates-major - dependency-name: vite dependency-version: 8.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: templates-major ... Signed-off-by: dependabot[bot] <support@github.com>
…ev-server test on a free port Second Copilot round on #359/#360: - The warning for an unreachable registry printed npm_config_registry verbatim, so a URL with basic-auth userinfo would land its password in the terminal or a CI log. The URL is shown without userinfo, and the same redaction is applied to the error text. - With --yes --cursor-rules, the collision check looked at the template entries only, so an existing .cursor/rules/*.mdc was overwritten despite the promise to keep the files. The requested rule destinations are part of the check now. - The dev-server test polled the fixed port 4173 and accepted any response, so an unrelated service on that port made it pass. It takes a free port, starts pp-dev with --strictPort and waits for the 302 to /pl/<package name>/ that only the scaffolded app answers with. Regression tests: "the registry warning does not repeat credentials from the registry URL" and "--yes --cursor-rules refuses a directory with a Cursor rule it would overwrite".
fix(cli): strict flags, --help/--version, --yes, errors that exit 1; test-suite hardening (PP-4793)
Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 8.71.1 to 8.72.1. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.71.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
chore: license, README, CONTRIBUTING/CLAUDE, pp-dev 1.5 Cursor rule, build scripts (PP-4794)
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.9 to 3.9.10. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…lop/typescript-eslint/eslint-plugin-8.71.2 chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.71.1 to 8.72.1
…lop/playwright/test-1.64.1 chore(deps-dev): bump @playwright/test from 1.63.0 to 1.64.1
Bumps [eslint](https://github.com/eslint/eslint) from 10.12.0 to 10.14.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.13.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…lop/eslint-10.13.0 chore(deps-dev): bump eslint from 10.12.0 to 10.14.0
…ir advisories npm audit at every severity, for the package and the five templates, found two advisories under the moderate count: minimatch < 11.0.1 (GHSA-g3hv-75wg-m249, denial of service through globparts amplification) in the eslint / typescript-eslint / glob chain, and glob <= 14.0.1 (GHSA-3g3m-2fjr-6pw4, AbortSignal cancellation bypass) behind pp-dev's svgtofont, through svgicons2svgfont and cacache. No dependency asks for the fixed versions yet, so `overrides` pin them: minimatch ^11.0.4 in the root, minimatch and glob ^14.0.2 in every template, as pp-dev does in its own package. A vanilla project scaffolded with the overrides installs, lints and builds, and npm audit reports nothing. The root's remaining findings are three low ones from deepmerge through unbuild, which has no fixed version. CLAUDE.md says what the overrides are for and when to remove them; Dependabot does not maintain them.
…l day The allowlist parser checked the shape of `until` only, so an entry with `until: "2026-99-99"` sorted after today and stayed active, suppressing the findings it names with an expiry nobody can reach. The parser lives in scripts/audit-allowlist.js now and takes an entry only when `until` is a calendar day that exists (2026-02-30 and 2026-99-99 are not), as the shared audit does. Tests (@offline): a valid entry applies; it applies through its until day and expires after it; an until that is not a real day is rejected; an entry without a GHSA id or reason is ignored; an empty list allowlists nothing.
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.64.1 to 1.65.0. - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.64.1...v1.65.0) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.65.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
The templates' `overrides` are read by npm only. The CLI installs with the package manager that runs it, and with pnpm 10 or yarn 1.22 a scaffolded project still resolved glob 10.5 / 11.1 and minimatch 10.2 (pnpm audit: 4 moderate, yarn audit: 6 moderate). Each template now repeats the pins in `resolutions`, which yarn and pnpm read and npm ignores; with it both resolve glob 14.0.4 and minimatch 11.0.5 and their audits report nothing, in all five templates. Tests (@offline): every template has the same entries in `resolutions` and `overrides`, and a scaffolded project carries both fields. CLAUDE.md says the two are changed together.
fix: audit every template in CI and weekly, overrides for glob and minimatch, one Dependabot group (PP-4795)
Bumps [globals](https://github.com/sindresorhus/globals) from 17.13.0 to 17.14.0. - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.13.0...v17.14.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the templates group with 2 updates in the /template-nextjs directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Bumps the templates group with 2 updates in the /template-nextjs-esm directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `eslint-config-next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `eslint-config-next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `eslint-config-next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `eslint-config-next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.4.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: templates - dependency-name: eslint-config-next dependency-version: 16.4.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: templates - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: templates - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: templates ... Signed-off-by: dependabot[bot] <support@github.com>
…op the glob pin pp-dev 1.5.1 made svgtofont an optional peer dependency, and svgtofont was the only way glob 10 and 11 (GHSA-3g3m-2fjr-6pw4) reached a scaffolded project. On ^1.5.1 neither glob nor svgtofont is in the resolved tree under npm, pnpm or yarn, so the glob entry leaves `overrides` and `resolutions`. The minimatch pin stays: it comes through eslint and typescript-eslint. The shipped Cursor rule says that `pp-dev generate-icon-font` needs svgtofont in the project; CLAUDE.md describes the pins that are left.
fix(deps): templates on @metricinsights/pp-dev ^1.5.1, glob pin removed (PP-4795)
…late-nextjs/develop/templates-23c105f1a1 fix(deps): bump the templates group across 2 directories with 2 updates
…lop/globals-17.14.0 chore(deps-dev): bump globals from 17.13.0 to 17.14.0
…lop/playwright/test-1.65.0 chore(deps-dev): bump @playwright/test from 1.64.1 to 1.65.0
… updates Updates the requirements on [react](https://github.com/react/react/tree/HEAD/packages/react), [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [eslint](https://github.com/eslint/eslint), [prettier](https://github.com/prettier/prettier), [globals](https://github.com/sindresorhus/globals), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) to permit the latest version. Updates `react` to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@types/node` to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) Updates `prettier` to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `react` to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@types/node` to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) Updates `prettier` to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `eslint` to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) Updates `prettier` to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `globals` to 17.14.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.13.0...v17.14.0) Updates `eslint` to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) Updates `prettier` to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `globals` to 17.14.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.13.0...v17.14.0) Updates `@typescript-eslint/eslint-plugin` from 8.72.2 to 8.72.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.72.2 to 8.72.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/parser) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development dependency-group: templates-major - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development dependency-group: templates-major - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.72.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: templates-major - dependency-name: "@typescript-eslint/parser" dependency-version: 8.72.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: templates-major - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development dependency-group: templates-major - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development dependency-group: templates-major - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development dependency-group: templates-major - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development dependency-group: templates-major - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development dependency-group: templates-major - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production dependency-group: templates-major - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production dependency-group: templates-major - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production dependency-group: templates-major - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production dependency-group: templates-major ... Signed-off-by: dependabot[bot] <support@github.com>
…late-nextjs/develop/templates-major-17404a3005 fix(deps): bump the templates-major group across 4 directories with 8 updates
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
The release adds --help, --version, a working --yes and the run without a terminal, so it is a minor release. The commits were typed fix, which made the workflow plan a patch.
There was a problem hiding this comment.
🟡 Changes recommended
The preflight guard allows installation to rewrite existing lockfiles, violating the no-overwrite guarantee.
3 open issues
What changed in this PR
Prepares v1.2.0 of the Metric Insights Portal Page scaffolder, improving unattended setup, template safety and release tooling.
Changes:
- Adds help/version flags, working
--yesdefaults, early validation and clearer installation failures. - Refreshes template dependencies, protects environment files and fixes Next.js static asset loading.
- Adds template-wide dependency audits and updates packaging, CI and documentation.
| File | Description |
|---|---|
template-vanilla/README.md |
Corrects documentation wording and example URL. |
template-vanilla/package.json |
Updates dependencies and adds security overrides. |
template-vanilla/_gitignore |
Excludes environment files containing credentials. |
template-vanilla-ts/tsconfig.node.json |
Removes the nonexistent Vite config reference. |
template-vanilla-ts/README.md |
Removes incorrect Next.js wording. |
template-vanilla-ts/package.json |
Updates dependencies and adds security overrides. |
template-vanilla-ts/_gitignore |
Excludes environment files containing credentials. |
template-react/src/app.tsx |
Corrects the displayed source filename. |
template-react/README.md |
Updates flat-config linting guidance. |
template-react/package.json |
Refreshes dependencies and security overrides. |
template-react/_gitignore |
Excludes environment files containing credentials. |
template-nextjs/tsconfig.json |
Aligns settings with Next.js-generated defaults. |
template-nextjs/src/pages/index.tsx |
Uses imported logo assets. |
template-nextjs/src/constants.ts |
Removes the hard-coded asset prefix. |
template-nextjs/src/components/root-layout.tsx |
Uses an imported favicon and correct MIME type. |
template-nextjs/src/components/docs/docs.tsx |
Uses imported documentation logos. |
template-nextjs/src/assets/img/react.svg |
Adds an importable React logo. |
template-nextjs/src/assets/img/pp-dev.svg |
Adds an importable PP Dev logo. |
template-nextjs/src/assets/img/next.svg |
Adds an importable Next.js logo. |
template-nextjs/src/assets/img/metricinsights.svg |
Adds an importable Metric Insights logo. |
template-nextjs/src/assets/img/.gitkeep |
Removes the asset-directory placeholder. |
template-nextjs/README.md |
Updates the scaffolder repository link. |
template-nextjs/package.json |
Updates Next.js and other dependencies. |
template-nextjs/_gitignore |
Excludes credentials and generated build artifacts. |
template-nextjs-esm/tsconfig.json |
Aligns settings with Next.js-generated defaults. |
template-nextjs-esm/src/pages/index.tsx |
Uses imported logo assets. |
template-nextjs-esm/src/constants.ts |
Removes the hard-coded asset prefix. |
template-nextjs-esm/src/components/root-layout.tsx |
Uses an imported favicon and correct MIME type. |
template-nextjs-esm/src/components/docs/docs.tsx |
Uses imported documentation logos. |
template-nextjs-esm/src/assets/img/react.svg |
Adds an importable React logo. |
template-nextjs-esm/src/assets/img/pp-dev.svg |
Adds an importable PP Dev logo. |
template-nextjs-esm/src/assets/img/next.svg |
Adds an importable Next.js logo. |
template-nextjs-esm/src/assets/img/metricinsights.svg |
Adds an importable Metric Insights logo. |
template-nextjs-esm/src/assets/img/.gitkeep |
Removes the asset-directory placeholder. |
template-nextjs-esm/README.md |
Updates the scaffolder repository link. |
template-nextjs-esm/package.json |
Updates Next.js and other dependencies. |
template-nextjs-esm/_gitignore |
Excludes credentials and generated build artifacts. |
src/types/clack-prompts.d.ts |
Removes the untyped prompts module declaration. |
src/index.ts |
Adds CLI flags, unattended setup and failure safeguards. |
scripts/postbuild.js |
Packs fresh tarballs and maintains the latest alias. |
scripts/npm-cli.js |
Adds cross-platform npm command resolution. |
scripts/clean-templates.js |
Documents why prepack cleanup is required. |
scripts/audit-allowlist.js |
Parses and validates expiring audit exceptions. |
scripts/audit-all.mjs |
Audits the root package and every template. |
README.md |
Documents CLI behavior, requirements and development commands. |
playwright.config.mjs |
Adds CI retries and failure-trace retention. |
package.json |
Sets v1.2.0, corrects licensing and updates scripts. |
package-lock.json |
Synchronizes release metadata and dependency resolutions. |
mi-cursor-rules/mi-custom-apps-dev.mdc |
Refreshes generated-project guidance for pp-dev. |
CONTRIBUTING.md |
Documents contribution and automated release processes. |
CLAUDE.md |
Adds repository development guidance. |
CHANGELOG.md |
Adds v1.2.0 release notes. |
build.config.ts |
Removes dependency inlining and obsolete configuration. |
.prettierrc.cjs |
Supports platform-specific line endings. |
.prettierignore |
Excludes prose notes and generated GitHub files. |
.github/workflows/dependency-audit.yml |
Runs the template-wide audit command. |
.github/workflows/ci.yml |
Uses the template-wide audit in CI. |
.github/mi-examples-workflows.json |
Configures audit commands for generated workflows. |
.github/dependabot.yml |
Consolidates template dependency update groups. |
.cursorrules |
Removes obsolete repository guidance. |
.cursor/rules/create-release.mdc |
Removes obsolete manual-tagging instructions. |
Review effort: Balanced
| // "Keep the files" has to mean it: with nobody to ask, a template file or a Cursor rule that | ||
| // would land on an existing one stops the run before anything is written. | ||
| const templateDir = path.join(packageRoot, `template-${argTemplate}`); | ||
| const wouldWrite = fs.readdirSync(templateDir).map((file) => renameFiles[file] ?? file); |
Contributor
There was a problem hiding this comment.
Leaving this as it is for 1.2.0. The case needs a lockfile with no package.json next to it: when package.json exists, the run already stops on it before anything is written. A lockfile on its own describes no project, so the install that follows replaces nothing the user could still use, and the files --yes promises to keep are the ones the scaffold itself writes (template files and Cursor rules). If an orphan lockfile turns out to matter in practice, the check can list the lockfile names when installation is on.
Comment on lines
+103
to
+104
| } else { | ||
| ids.push(ghsaIdFromUrl(via.url) ?? `UNKNOWN:${via.title ?? name}`); |
Contributor
There was a problem hiding this comment.
Not changing this: the script deliberately mirrors the shared audit in mi-examples-workflows. Its evaluate() (scripts/audit/allowlist.mjs) also takes a package whose severity reaches the level and then requires every advisory behind it to be allowlisted, without filtering the advisories by their own severity, and npm run audit:all should fail in the same cases as the audit the other repositories run. The difference is on the safe side (an extra failure, never a missed finding). If the rule should change, it changes in the shared audit first and this script follows.
Comment on lines
+401
to
+407
| const wouldWrite = fs.readdirSync(templateDir).map((file) => renameFiles[file] ?? file); | ||
|
|
||
| if (shouldAddCursorRules) { | ||
| wouldWrite.push(...fs.readdirSync(cursorRulesDir).map((file) => `.cursor/rules/${file}`)); | ||
| } | ||
|
|
||
| const collisions = wouldWrite.filter((name) => fs.existsSync(path.join(targetDir, name))); |
Contributor
There was a problem hiding this comment.
This is intended. Under --yes nobody is there to confirm a merge, so the check is deliberately conservative: a top-level entry the template also writes stops the run, which is cheap to reason about and never wrong in the unsafe direction. Merging into an existing directory is what the interactive run offers ("Ignore files and continue"). A recursive check that tells overlapping files from mergeable directories, symbolic links and file/directory conflicts is more machinery than a scaffolder's unattended mode needs right now; it can come later if someone needs to scaffold over an existing src/.
sergak01
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases v1.2.0 (a minor release after v1.1.7: new flags
--help,--version, a working--yes), cut fromdevelop.Before merging
CHANGELOG.md. It becomes the GitHub release notes.package.json,package-lock.jsonand theCHANGELOG.mdheading.Merging publishes
v1.2.0to npm underlatest, creates the tag and the GitHub release, and opens the back-merge intodevelop.Release notes source:
ai (OpenRouter, anthropic/claude-opus-5.5).Release notes
Features
--helpto print usage with every flag, the template list and examples, and--versionto print the package version.--yesnow works and asks nothing: it uses the default project name, derives the package name from the directory, installs packages and skips Cursor rules and@metricinsights/pp-components. It requires--template.Bug fixes
--help. Previously they were silently accepted.--package-nameis now reported before the target directory is touched, so existing files are no longer deleted.--yes, a non-empty target directory is only accepted when nothing in it would be overwritten, including template files and existing.cursor/rules/*.mdcfiles; otherwise the run stops and lists the conflicting files.@metricinsights/pp-componentsno longer crashes when the registry is unreachable: the lookup times out, writes^1.0.0and prints a warning.C:\as the target is no longer turned into the current directory..gitignorenow ignores.envand.env.*(keeping.env.example), soMI_ACCESS_TOKENis no longer committed by accident; the Next.js templates also ignoredist,dist-zipandbackups.pp-dev nextand the exported build instead of returning 404 in development.tsconfig.jsonvalues Next 16 writes on first run, so a new project'stsconfig.jsonis no longer modified bypp-dev next.vanilla-tstemplate'stsconfig.node.jsonno longer references avite.config.tsthat doesn't exist.Other changes
nextandeslint-config-next16.4.5, which fixes two critical remote code execution advisories and a high-severity denial-of-service advisory present in 16.3.8.@metricinsights/pp-dev^1.5.1. With this version,pp-dev generate-icon-fontneedssvgtofontinstalled in the project (npm install --save-dev svgtofont).minimatchin bothoverridesandresolutionsto clear a denial-of-service advisory with npm, yarn and pnpm alike.reactandreact-dom19.3.1,vite,@vitejs/plugin-react,eslint,prettier,globalsandtypescript-eslint.pp-dev1.5 (commands, config sections with defaults, Next.js base paths and dev server) instead of an outdated copy of its README.licensefield now correctly says MIT.