From c91aa052b74c10fea6aea3749f6feb1b20ea2524 Mon Sep 17 00:00:00 2001
From: "mi-examples-workflows-bot[bot]"
 <333657910+mi-examples-workflows-bot[bot]@users.noreply.github.com>
Date: Tue, 10 Nov 2026 13:52:46 +0000
Subject: [PATCH 1/2] chore(release): v1.1.8

---
 CHANGELOG.md      | 31 +++++++++++++++++++++++++++++++
 package-lock.json |  4 ++--
 package.json      |  2 +-
 3 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9b06d0..b6156fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,36 @@
 # Changelog
 
+## [1.1.8](https://github.com/mi-examples/create-pp-dev/compare/v1.1.7...v1.1.8) (2026-11-10)
+
+### Features
+
+- Added `--help` to print usage with every flag, the template list and examples, and `--version` to print the package version.
+- `--yes` now works and asks nothing: it uses the default project name, derives the package name from the directory, installs packages and skips Cursor rules and `@metricinsights/pp-components`. It requires `--template`.
+- The CLI can run without a terminal. It never prompts, and if any required flag is missing it exits with code 1 before writing anything, listing all of the missing flags.
+
+### Bug fixes
+
+- Unknown flags and flags missing a value now exit with code 1 and point to `--help`. Previously they were silently accepted.
+- An unknown template or an invalid `--package-name` is now reported before the target directory is touched, so existing files are no longer deleted.
+- A failed package install now exits with code 1 instead of reporting "Project created successfully!", and the scaffolded files are kept.
+- With `--yes`, a non-empty target directory is only accepted when nothing in it would be overwritten, including template files and existing `.cursor/rules/*.mdc` files; otherwise the run stops and lists the conflicting files.
+- Adding `@metricinsights/pp-components` no longer crashes when the registry is unreachable: the lookup times out, writes `^1.0.0` and prints a warning.
+- The registry warning and error text no longer print credentials embedded in the registry URL.
+- A filesystem root such as `C:\` as the target is no longer turned into the current directory.
+- The generated `.gitignore` now ignores `.env` and `.env.*` (keeping `.env.example`), so `MI_ACCESS_TOKEN` is no longer committed by accident; the Next.js templates also ignore `dist`, `dist-zip` and `backups`.
+- The Next.js templates now import their logos and favicon as static assets, so they load under both `pp-dev next` and the exported build instead of returning 404 in development.
+- The Next.js templates ship the `tsconfig.json` values Next 16 writes on first run, so a new project's `tsconfig.json` is no longer modified by `pp-dev next`.
+- The `vanilla-ts` template's `tsconfig.node.json` no longer references a `vite.config.ts` that doesn't exist.
+
+### Other changes
+
+- The Next.js templates now use `next` and `eslint-config-next` 16.4.5, which fixes two critical remote code execution advisories and a high-severity denial-of-service advisory present in 16.3.8.
+- The templates now require `@metricinsights/pp-dev` `^1.5.1`. With this version, `pp-dev generate-icon-font` needs `svgtofont` installed in the project (`npm install --save-dev svgtofont`).
+- The templates pin `minimatch` in both `overrides` and `resolutions` to clear a denial-of-service advisory with npm, yarn and pnpm alike.
+- Updated the template dependencies, including `react` and `react-dom` 19.3.1, `vite`, `@vitejs/plugin-react`, `eslint`, `prettier`, `globals` and `typescript-eslint`.
+- The MI Cursor rule copied into new projects now describes `pp-dev` 1.5 (commands, config sections with defaults, Next.js base paths and dev server) instead of an outdated copy of its README.
+- The package's `license` field now correctly says MIT.
+
 ## [1.1.7](https://github.com/mi-examples/create-pp-dev/compare/v1.1.6...v1.1.7) (2026-10-22)
 
 ### Bug fixes
diff --git a/package-lock.json b/package-lock.json
index 51f2c7a..1fb2913 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@metricinsights/create-pp-dev",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@metricinsights/create-pp-dev",
-      "version": "1.1.7",
+      "version": "1.1.8",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^1.8.1",
diff --git a/package.json b/package.json
index 46bbecd..52500b5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@metricinsights/create-pp-dev",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "type": "module",
   "description": "Scaffolds a Metric Insights Portal Page project from a template",
   "bin": {

From 314f252f6a6cf189bd739bda63c6a1cbf977f78c Mon Sep 17 00:00:00 2001
From: Serhii Shpak <sergak.shpak@gmail.com>
Date: Tue, 10 Nov 2026 15:56:30 +0200
Subject: [PATCH 2/2] chore(release): v1.2.0 instead of v1.1.8

The release adds --help, --version, a working --yes and the run without a terminal, so it is a minor release. The commits were typed fix, which made the workflow plan a patch.
---
 CHANGELOG.md      | 2 +-
 README.md         | 2 +-
 package-lock.json | 4 ++--
 package.json      | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6156fc..86fafae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## [1.1.8](https://github.com/mi-examples/create-pp-dev/compare/v1.1.7...v1.1.8) (2026-11-10)
+## [1.2.0](https://github.com/mi-examples/create-pp-dev/compare/v1.1.7...v1.2.0) (2026-11-10)
 
 ### Features
 
diff --git a/README.md b/README.md
index 1c840be..cfaf87a 100644
--- a/README.md
+++ b/README.md
@@ -130,7 +130,7 @@ Releases use the shared workflows from [mi-examples-workflows](https://github.co
 - every push to `develop` with releasable commits publishes `X.Y.Z-beta.N` under the `beta` dist-tag (`npm create @metricinsights/pp-dev@beta`);
 - **Actions → Release → Run workflow** opens a release pull request into `main`; merging it publishes `latest` and opens the back-merge into `develop`;
 - versions come from [Conventional Commits](https://www.conventionalcommits.org/) (`feat` → minor; `fix`, `perf`, `revert` → patch; `!` or `BREAKING CHANGE:` → major);
-- `CHANGELOG.md` and the tags are written by the release workflow (from 1.1.8 on; older entries were written by semantic-release or by hand);
+- `CHANGELOG.md` and the tags are written by the release workflow (from 1.2.0 on; older entries were written by semantic-release or by hand);
 - publishing uses npm Trusted Publishing (OIDC) from `.github/workflows/release.yml`, so don't rename that file.
 
 ## License
diff --git a/package-lock.json b/package-lock.json
index 1fb2913..68f99d0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@metricinsights/create-pp-dev",
-  "version": "1.1.8",
+  "version": "1.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@metricinsights/create-pp-dev",
-      "version": "1.1.8",
+      "version": "1.2.0",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^1.8.1",
diff --git a/package.json b/package.json
index 52500b5..edfb562 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@metricinsights/create-pp-dev",
-  "version": "1.1.8",
+  "version": "1.2.0",
   "type": "module",
   "description": "Scaffolds a Metric Insights Portal Page project from a template",
   "bin": {