chore(release): v1.5.1

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [1.5.1](https://github.com/mi-examples/pp-dev/compare/v1.5.0...v1.5.1) (2026-11-10)
+
+### Bug fixes
+
+- Installing `pp-dev` no longer pulls in the `glob` and `minimatch` versions that `npm audit` reports as moderate vulnerabilities. They only came in through `svgtofont`, which is now an optional dependency.
+
+### Other changes
+
+- `svgtofont` is no longer installed with `pp-dev`. If you use `pp-dev generate-icon-font`, add it to the project with `npm install --save-dev svgtofont`; without it the command exits with a message saying what to install.
+
 ## [1.5.0](https://github.com/mi-examples/pp-dev/compare/v1.4.7...v1.5.0) (2026-11-06)
 
 ### Features

CLAUDE.md

@@ -95,6 +95,7 @@ Test fixtures (real apps installed with the local .tgz):
 - **Dual ESM/CJS output** — Rollup builds `dist/esm/` from 4 entry points (`index`, `plugin`, `helpers`, `cli`), `dist/cjs/` from the first three (the CLI runs as ESM from `bin/pp-dev.js`), and `dist/types/`.
 - **Config caching** — `src/config.ts` caches loaded config (30 s) and `package.json` (60 s).
 - **Lazy heavy imports** — `esbuild`, `jsdom`, `file-type`, `svgtofont` and the Vite plugins are imported lazily to keep startup fast (`sharp` and `svgo` only through `vite-plugin-image-optimizer`).
+- **`svgtofont` is an optional peer dependency** — only `generate-icon-font` uses it (`loadSvgToFont()` in `src/lib/icon-font-generator.ts` says what to install when it is missing). Keep it in `peerDependencies` (optional) + `devDependencies`, never in `dependencies`: root `overrides` do not reach the projects that install pp-dev, so as a dependency it gave each of them `glob`/`minimatch` versions that `npm audit` reports. For any new dependency, check `npm audit` in a project that installs pp-dev, not only `audit:all`.
 - **Axios instance cache** — one Axios instance per base URL; `keepAlive: false` avoids max-listeners warnings.
 - **No bare `npm audit`** — always `npm run audit:all` so test fixtures are included.
 

README.md

@@ -36,6 +36,8 @@ npm install next@^16
 
 **Note**: pp-dev accepts Next.js 13 to 16 (`peerDependencies`: `>= 13 < 17`); the test apps run on Next.js 16. It is a peer dependency, so it isn't installed with pp-dev.
 
+`svgtofont` is an optional peer dependency too. Only `pp-dev generate-icon-font` uses it — see [Icon Font Generation](#icon-font-generation).
+
 ### Bundled build tools
 
 pp-dev installs `sass` (SCSS in a portal page), and `sharp` and `svgo` (image optimization, `build.imageOptimisations`): a page uses them without listing them itself. A page that pins its own version of one lists it in its `package.json`.
@@ -511,6 +513,23 @@ pp-dev generate-icon-font [source] [destination] [options]
 | `--destination <path>` | -           | Output directory                |
 | `--fontName <name>`    | `icon-font` | Font name                       |
 
+The command needs [`svgtofont`](https://www.npmjs.com/package/svgtofont), which is not installed with pp-dev. Add it to the project that generates icon fonts:
+
+```bash
+npm install --save-dev svgtofont
+```
+
+`svgtofont` 6.5.3 depends on `glob` and `minimatch` versions that `npm audit` reports ([GHSA-3g3m-2fjr-6pw4](https://github.com/advisories/GHSA-3g3m-2fjr-6pw4), [GHSA-g3hv-75wg-m249](https://github.com/advisories/GHSA-g3hv-75wg-m249), both moderate), and no `svgtofont` release fixes that yet. Until one does, a project that installs it can add these `overrides` to its `package.json` and run `npm install` again:
+
+```json
+{
+  "overrides": {
+    "glob": "^14.0.3",
+    "minimatch": "^11.0.4"
+  }
+}
+```
+
 ## Next.js Integration
 
 1. Add a `pp-dev.config.ts` to your project root