HomeAll Repositories

LumaSync-Site

releasev1.1.35

Marketing site, docs, and blog for LumaSync — the tray-first open-source ambilight + Philips Hue desktop app.

0stars
0forks
0watchers
1open issues
owner: voyvodkastatus: CORElanguage: MDXbranch: mainlicense: Otherupdated: 7/29/2026, 7:56:48 AMlast push: 8/3/2026, 3:08:03 AM
adalightambilightastrobias-lightingled-stripmarketing-siteopensourcephilips-huetauriws2812b
RepositoryLive

README Snapshot

LumaSync-Site

Marketing site, docs, and blog for LumaSync — the tray-first open-source ambilight + Philips Hue desktop app.

Stack

  • Astro 6 + MDX content collections (docs, compare, legal, blog)
  • Pagefind for offline in-browser search; Umami for cookie-free analytics
  • Cloudflare Pages (direct-upload via wrangler) + Cloudflare DNS
  • IBM Plex Sans / Mono (self-hosted WOFF2, preloaded)
  • No secrets bundled; the site never talks to the desktop app

Develop

Requires Node 22.12+ and pnpm (pinned via packageManager in package.json).

pnpm install
pnpm dev        # http://localhost:4321
pnpm lint       # prettier --check
pnpm check      # astro check (type-check + content schema)
pnpm build      # astro build + pagefind index

Deploy

Every push to main triggers .github/workflows/deploy.yml, which lint- and type-checks, builds, and ships dist/ to Cloudflare Pages.

Required repo secrets for CI: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID.

License

  • Code (Astro components, layouts, CI, styling) — MIT
  • Content (MDX under src/content/, docs, comparisons, blog) — CC BY 4.0

See /license for the public-facing summary and LICENSE for the full text.

Contributing

Issues and PRs welcome — see CONTRIBUTING.md for scope, local preview, and commit conventions. For app-level bugs (firmware, USB pipeline, Hue streaming), file against the LumaSync app repo instead.

Security

Report vulnerabilities through GitHub's Private Vulnerability Reporting — see SECURITY.md or /.well-known/security.txt.

Changelog

Changelog — lumasync-site

This is the changelog for the marketing/docs site at lumasync.app. The LumaSync app's own release notes live in the app repo and surface on /changelog — site versions track independently from app versions.

The site follows Semantic Versioning at its own cadence; bumping the LumaSync app submodule does not require bumping the site version.

[1.1.35] — 2026-07-29

Security

  • Four high-severity CVEs in the shipped dependency tree are closed. js-yaml (GHSA-52cp-r559-cp3m), svgo (GHSA-2p49-hgcm-8545), sharp (GHSA-f88m-g3jw-g9cj) and postcss (GHSA-r28c-9q8g-f849) all picked up advisories after v1.1.34. None is a direct dependency — they arrive transitively through astro, @astrojs/mdx and @tailwindcss/vite — so each is pinned to its patched range via pnpm.overrides, alongside the existing fast-uri / esbuild / yaml entries. The pnpm audit --prod --audit-level=high gate had been failing on main and passes again.

Fixed

  • TV sizes in the hardware checklist use a real prime mark. The measurements were authored with a straight ", an unpaired quote the Markdown typographer had to guess at. Astro 7's typographer reads it as an opening quote, so the sizes now carry U+2033 (double prime) — the correct character for inches, and unambiguous under any typographer. The same upgrade also corrects the opening quote on the USB controllers page heading, which had been rendering as a closing quote.

Dependencies

  • Astro 6.4.8 → 7.1.5 and @astrojs/mdx 6.0.3 → 7.0.5, which also moves vite from 7 to 8. The two majors travel together — @astrojs/mdx 6.x peers against Astro 6. Verified against a baseline build of the previous main: the output tree is identical (272 files, 54 HTML pages, 34 byte-identical OG images) and scoped-style hashes still resolve. The only deltas are the generator meta tag, regenerated data-astro-cid hashes, and tighter whitespace / CSS-declaration minification from the newer pipeline.
  • TypeScript deliberately held at 6.0.3. The 7.x native compiler does not ship the programmatic Language Service API that astro check is built on, and @astrojs/check declares a ^5 || ^6 peer range — so astro check fails outright on TypeScript 7. Tracked upstream in withastro/roadmap#1321.
  • Minor/patch group bump across 11 packages — satori 0.26 → 0.29, tailwindcss and @tailwindcss/vite 4.3.2 → 4.3.3, the three @fontsource families 5.2.x → 5.3.0, marked 18.0.6 → 18.0.7, isomorphic-dompurify 3.18 → 3.19, prettier 3.9.5 → 3.9.6, prettier-plugin-tailwindcss 0.8.0 → 0.8.1, @astrojs/check 0.9.9 → 0.9.10. Manifest + lockfile only.

CI

  • actions/setup-node pinned forward from v6 to v7 in both the CI and deploy workflows.

[1.1.34] — 2026-07-14

Fixed

  • Press-state feedback on inline links now actually renders. The 404 page's .home-cta and the /download/ version pill both declared a prefers-reduced-motion-gated transform: scale(0.96) on :active and listed transform in their transition — but both are anchors laid out as non-replaced inline boxes, and CSS transform does not apply to those. The press animation was silently dead CSS. Both now set display: inline-block, so the tactile :active treatment shipped for the version pill in v1.1.31 finally takes effect.

Accessibility

  • The landing page's .inline-cta links press like the site's other CTAs. They gained display: inline-block, a transform entry in their transition list, and a prefers-reduced-motion-gated scale(0.96) on :active — matching the interaction treatment already carried by the primary/secondary CTAs and the compare cards.

Dependencies

  • Minor/patch group bumps across two batches — tailwindcss and @tailwindcss/vite 4.3.0 → 4.3.2, marked 18.0.5 → 18.0.6, dompurify 3.4.11 → 3.4.12, prettier 3.9.1 → 3.9.5. Manifest + lockfile only, no source change; the prettier-check, type-check, build, and Lighthouse-CI gates pass unchanged.

[1.1.33] — 2026-06-29

Added

  • Content-Usage AI-preference signal in robots.txt. Alongside the existing Cloudflare Content-Signal, the site now also emits the IETF AIPREF standards-track directive (Content-Usage: search=y, train-ai=n) — the successor mechanism that updates the Robots Exclusion Protocol (RFC 9309). The AIPREF vocabulary currently defines only search and train-ai, so the RAG/answer-engine axis stays on Content-Signal for now; the policy is unchanged (indexing yes, model training no).
  • Web Bot Auth directory placeholder. /.well-known/http-message-signatures-directory now serves an empty JWKS ({ "keys": [] }) as application/json. The site makes no signed outbound requests, so it publishes no keys, but the directory's presence satisfies agent-readiness probes (RFC 9421 HTTP Message Signatures).

CI

  • Lighthouse CI pinned to @lhci/[email protected] instead of @latest, so the runner (and its bundled Lighthouse 12.6.1) no longer re-resolves per run and CI stays deterministic. A note flags adding a categories:agentic-browsing assertion once lhci ships a build bundling Lighthouse ≥ 13.3.0 (the release that made the Agentic Browsing category default).

[1.1.32] — 2026-06-29

Security

  • Pagefind stamp script no longer has a check-then-act file race. The build-time stamper probed each core file with existsSync() and then appended to it by path — a time-of-check/time-of-use window (CWE-367) where the file referenced by the name could change between the two operations. It now opens each file once with an r+ descriptor (which fails closed with ENOENT when the file is absent, preserving the "stamp only if present" behaviour) and appends through that descriptor, so the check and the write target the same handle. CodeQL js/file-system-race alert resolved.

[1.1.31] — 2026-06-29

Security

  • Pagefind search results now scheme-validate their link URLs. Each result's URL was injected into the result anchor's href after HTML-escaping, which neutralizes markup but not a javascript: or data: scheme — so a poisoned index entry could have executed on click. A sanitizeUrl() guard now parses every result URL with the native URL constructor (a dummy base preserves relative paths) and allow-lists only http:/https:, falling back to # for anything else, before the existing escape. Defense-in-depth: the index is built from our own content, but search URLs are no longer trusted blindly.

Accessibility

  • The /download/ version pill reads and behaves as the link it is. The pill links to the GitHub release but rendered as a static-looking badge with no interactive affordance. It now inverts colors on :hover, draws the standard 2px --focus-ring outline on :focus-visible, presses with a prefers-reduced-motion-gated scale(0.96) on :active, and carries a descriptive title — matching the interaction treatment used elsewhere on the site.

Dependencies

  • Dev-only prettier bump 3.8.4 → 3.9.1 (minor/patch group) — manifest + lockfile only, no source change. The prettier-check, type-check, build, and Lighthouse-CI gates pass unchanged.

[1.1.30] — 2026-06-26

Fixed

  • Cmd+K search now actually loads its WebAssembly — Pagefind core JS is cache-busted per deploy. The v1.1.28 CSP fix (wasm-unsafe-eval) was correct at the origin, but Cloudflare had edge-cached /pagefind/pagefind-worker.js with the old CSP header; because that file's bytes never change between deploys, conditional revalidation kept returning 304 and serving the stale header — a "Purge Everything" was re-revalidated straight back to it, so search stayed broken. The build now appends a build-unique stamp to Pagefind's non-fingerprinted core JS (pagefind.js, pagefind-worker.js, pagefind-ui.js) so their ETag changes each deploy, forcing a full 200 that ships the current CSP. The search worker can compile its WASM module again.

[1.1.29] — 2026-06-25

Changed

  • Landing roadmap "Shipped" column scoped to the current release. It had been accumulating the full v1.5.0–v1.5.3 feature list (13 bullets), dwarfing the "Next" and "Never" columns and stretching the section well past a screen. It now lists only the latest release's highlights (v1.5.3) — matching the column's version header — so the three columns read at comparable length, with the full history one click away under "Full changelog →".

[1.1.28] — 2026-06-25

Fixed

  • Cmd+K search restored. The Content-Security-Policy script-src was missing 'wasm-unsafe-eval', so Pagefind could not compile its WebAssembly module and search silently failed with a CSP console error on every page. Added the narrow 'wasm-unsafe-eval' source — it permits WASM compilation only, not general eval — so the search index loads again.

Build

  • Pinned the vendor/lumasync submodule to the v1.5.3 release commit so the deployed build resolves the v1.5.3 version surfaces (roadmap header, JSON-LD softwareVersion, compare cells) and renders the v1.5.3 release notes on /changelog/ — completing the v1.1.27 app sync.

[1.1.27] — 2026-06-25

Documentation

  • Synced docs to LumaSync app v1.5.3. Added a macOS launch-crash note — the 1.5.2 build crashed on launch on Macs without Xcode, and v1.5.3 fixes it — to the install guide, the error-handling reference, the download page, and USB troubleshooting. Expanded Hue troubleshooting with the self-clearing active-streamer banner, the fixed "Reconnecting" stall, and the HUE_STOP_TIMEOUT_PARTIAL "Retry Stop" hint. Documented the v1.5.3 shutdown-hardening continuation, the transient-notice timer-leak fix, the visibility-aware Hue polling and output hot-path optimizations, the room-map template-selector design-token + aria-label work, and single-HTTP-client gamut fetching. Bumped updated: frontmatter on every touched doc.

Content

  • Landing page refreshed for v1.5.3. The roadmap "Shipped" column now leads with the v1.5.3 headline items (macOS launch-crash fix, self-clearing Hue active-streamer banner, shutdown hardening), and the macOS platform card notes the 1.5.2 → 1.5.3 launch-crash fix.

Accessibility

  • Focus-visible rings on landing-page text links — the custom inline CTA links (.inline-cta), the feature-grid "→" links, and the trust-section links now draw the standard 2px --focus-ring outline on keyboard focus, matching the treatment already used on CTAs and cards. Incorporates community PR #103.

SEO

  • Bumped the site-wide Last-Modified freshness signal so answer engines and AI crawlers see a current date on HTML and markdown responses.

[1.1.26] — 2026-06-22

Security

  • External-link noopener rollout finished on render-time links: the 1.1.25 pass hardened the static-href outbound links, but missed a handful whose href resolves conditionally and so never matched a literal-href audit — the 404 page's recovery links (the GitHub "Report a bug" entry), the /community/ FAQ answers built as inline HTML strings (the /issues and /discussions/ideas GitHub links) and the "where to go" forum cards, and the /download/ per-OS asset cards. Each now sets rel="noopener noreferrer", with the attribute guarded the same way as the href so internal and disabled links stay untouched. Defense-in-depth plus Referer-header suppression; no target="_blank" exists site-wide.

Accessibility

  • Skip-to-content link gains a visible focus ring and press feedback: the .skip-link already slid into view on focus, but rendered no :focus-visible outline once visible. It now draws the standard 2px --focus-ring outline with a 2px offset and a prefers-reduced-motion-gated scale(0.96) :active

Releases

  • v1.1.35 — transitive CVE overrides, Astro 7, dependency refresh

    Security

    • Four high-severity CVEs closed in the shipped dependency tree — js-yaml (GHSA-52cp-r559-cp3m), svgo (GHSA-2p49-hgcm-8545), sharp (GHSA-f88m-g3jw-g9cj), postcss (GHSA-r28c-9q8g-f849).
    • All four arrive transitively through astro, @astrojs/mdx and @tailwindcss/vite; each is pinned to its patched range via pnpm.overrides.
    • The pnpm audit --prod --audit-level=high gate had been failing on main and passes again.

    Fixed

    • TV sizes in the hardware checklist now use U+2033 (double prime) instead of an ambiguous straight quote — the correct character for inches.
    • The USB controllers page heading's opening quote no longer renders as a closing quote.

    Dependencies

    • Astro 6.4.8 → 7.1.5 and @astrojs/mdx 6.0.3 → 7.0.5, which also moves vite 7 → 8.
    • Verified against a baseline build: identical output tree (272 files, 54 HTML pages, 34 byte-identical OG images), scoped-style hashes resolve.
    • Remaining deltas are the generator meta tag, regenerated data-astro-cid hashes, and tighter minification.
    • TypeScript held at 6.0.3 — the 7.x native compiler drops the programmatic Language Service API astro check needs (withastro/roadmap#1321).
    • Minor/patch group bump across 11 packages: satori, tailwindcss, @tailwindcss/vite, three @fontsource families, marked, isomorphic-dompurify, prettier, prettier-plugin-tailwindcss, @astrojs/check.

    CI

    • actions/setup-node v6 → v7 in the CI and deploy workflows.
    Open on GitHub
  • v1.1.34 — inline-link press states, dependency bumps

    Fixed

    • Press-state feedback on inline links now actually renders. The 404 page's .home-cta and the /download/ version pill both declared a prefers-reduced-motion-gated transform: scale(0.96) on :active, but both are anchors laid out as non-replaced inline boxes — where CSS transform does not apply. The press animation was silently dead CSS. Both now set display: inline-block, so the tactile :active treatment shipped for the version pill in v1.1.31 finally takes effect.

    Accessibility

    • The landing page's .inline-cta links press like the site's other CTAs — display: inline-block, a transform transition, and a prefers-reduced-motion-gated scale(0.96) on :active, matching the primary/secondary CTAs and compare cards.

    Dependencies

    • Minor/patch group bumps across two batches — tailwindcss and @tailwindcss/vite 4.3.0 → 4.3.2, marked 18.0.5 → 18.0.6, dompurify 3.4.11 → 3.4.12, prettier 3.9.1 → 3.9.5. Manifest + lockfile only; all CI gates pass unchanged.

    Full changelog: https://github.com/voyvodka/LumaSync-Site/compare/v1.1.33...v1.1.34

    Open on GitHub
  • v1.1.33

    Added

    • Content-Usage AI-preference signal in robots.txt. Emitted alongside the existing Cloudflare Content-Signal — the IETF AIPREF standards-track successor (Content-Usage: search=y, train-ai=n) that updates RFC 9309. Policy unchanged: indexing yes, model training no. The AIPREF vocabulary defines only search/train-ai so far, so the RAG axis stays on Content-Signal.
    • Web Bot Auth directory placeholder. /.well-known/http-message-signatures-directory now serves an empty JWKS ({ "keys": [] }) as application/json, satisfying agent-readiness probes (RFC 9421). The site signs no outbound requests, so it publishes no keys.

    CI

    • Lighthouse CI pinned to @lhci/[email protected] (was @latest) for deterministic runs. Adding a categories:agentic-browsing assertion is deferred until lhci bundles Lighthouse ≥ 13.3.0.
    Open on GitHub
  • v1.1.32

    Security

    • Pagefind stamp script no longer has a check-then-act file race. The build-time stamper probed each core file with existsSync() and then appended to it by path — a time-of-check/time-of-use window (CWE-367) where the file referenced by the name could change between the two operations. It now opens each file once with an r+ descriptor (fails closed with ENOENT when absent, preserving the stamp-only-if-present behaviour) and appends through that descriptor, so the check and the write target the same handle. CodeQL js/file-system-race alert resolved.
    Open on GitHub
  • v1.1.31

    Security

    • Pagefind search results now scheme-validate their link href — a sanitizeUrl() guard parses each result URL with the native URL constructor and allow-lists only http:/https: (falling back to #) before HTML-escaping, blocking javascript:/data: URIs from a poisoned index. Defense-in-depth.

    Accessibility

    • The /download/ version pill now reads as the link it is: color-inverting :hover, a 2px --focus-ring :focus-visible outline, a prefers-reduced-motion-gated scale(0.96) :active press, and a descriptive title.

    Dependencies

    • Dev-only prettier bump 3.8.4 → 3.9.1 (minor/patch group) — manifest + lockfile only, all gates pass unchanged.
    Open on GitHub
  • v1.1.30

    Fixed

    • Cmd+K search now actually loads its WebAssembly — Pagefind core JS is cache-busted per deploy. The v1.1.28 CSP fix (wasm-unsafe-eval) was correct at the origin, but Cloudflare had edge-cached /pagefind/pagefind-worker.js with the old CSP header. Because that file's bytes never change between deploys, conditional revalidation kept returning 304 and serving the stale header — a "Purge Everything" was re-revalidated straight back to it, so search stayed broken. The build now appends a build-unique stamp to Pagefind's non-fingerprinted core JS (pagefind.js, pagefind-worker.js, pagefind-ui.js) so their ETag changes each deploy, forcing a full 200 that ships the current CSP. The search worker can compile its WASM module again.
    Open on GitHub
  • v1.1.29

    Changed

    • Landing roadmap "Shipped" column scoped to the current release. It had been accumulating the full v1.5.0–v1.5.3 feature list (13 bullets), dwarfing the "Next" and "Never" columns and stretching the section well past a screen. It now lists only the latest release's highlights (v1.5.3) — matching the column's version header — so the three columns read at comparable length, with the full history one click away under "Full changelog →".
    Open on GitHub
  • v1.1.28

    Fixed

    • Cmd+K search restored — the Content-Security-Policy script-src was missing 'wasm-unsafe-eval', so Pagefind could not compile its WebAssembly module and search silently failed with a CSP console error on every page. Added the narrow 'wasm-unsafe-eval' source (WASM compilation only, not general eval).

    Build

    • Pinned the vendor/lumasync submodule to the v1.5.3 release commit so the deployed build resolves the v1.5.3 version surfaces (roadmap header, JSON-LD softwareVersion, compare cells) and renders the v1.5.3 release notes on /changelog/ — completing the v1.1.27 app sync.
    Open on GitHub
  • v1.1.27

    Marketing/docs site sync to the LumaSync app v1.5.3 release.

    Documentation

    • macOS launch-crash fix (1.5.2 builds crashed on Macs without Xcode) documented across the install guide, error-handling reference, download page, and USB troubleshooting.
    • Hue troubleshooting expanded: self-clearing active-streamer banner, fixed "Reconnecting" stall, and the HUE_STOP_TIMEOUT_PARTIAL "Retry Stop" hint.
    • Added v1.5.3 shutdown-hardening continuation, transient-notice timer-leak fix, visibility-aware Hue polling, output hot-path optimizations, room-map template-selector a11y, and single-HTTP-client gamut fetching. Bumped updated: frontmatter on every touched doc.

    Content

    • Landing roadmap "Shipped" column now leads with the v1.5.3 highlights; the macOS platform card notes the 1.5.2 → 1.5.3 crash fix.

    Accessibility

    • Focus-visible rings on the landing page's inline CTA, feature-grid, and trust-section links (incorporates PR #103).

    SEO

    • Bumped the site-wide Last-Modified freshness signal.
    Open on GitHub
  • v1.1.26

    Security

    • Finished the external-link noopener rollout on the render-time href links the 1.1.25 pass missed: 404 recovery links, /community/ FAQ inline links and forum cards, and /download/ per-OS asset cards. rel="noopener noreferrer" is guarded the same way as each href, so internal and disabled links stay untouched.

    Accessibility

    • Skip-to-content link now draws a visible :focus-visible ring (2px --focus-ring) plus a reduced-motion-gated scale(0.96) press state once it slides into view.
    • 404 page recovery cards and the ← Home link gained the standard :focus-visible outline so keyboard users can see which target holds focus.

    Dependencies

    • Minor/patch group: astro 6.4.7 → 6.4.8, dompurify 3.4.8 → 3.4.11, isomorphic-dompurify 3.16.0 → 3.18.0 (manifest + lockfile only).

    Build

    • GitHub Actions: actions/checkout 6 → 7 across CI/CodeQL/deploy, and pnpm/action-setup 6.0.8 → 6.0.9 (SHA-pinned). CI-only.
    Open on GitHub
  • v1.1.25

    Security

    • esbuild advisory cleared (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr): pnpm override pins esbuild to >=0.28.1; the pnpm audit --prod --audit-level=high CI gate is green again.
    • yaml advisory cleared (GHSA-48c2-rrv3-qjmp): pnpm override forces yaml to >=2.8.3 (was 2.7.1 via @astrojs/check). pnpm audit now reports no known vulnerabilities at any severity, prod or dev.
    • External-link hardening completed site-wide: rel="noopener noreferrer" extended to the remaining outbound links on the home, download, and community pages, finishing the rollout begun in 1.1.24.

    Accessibility

    • Disabled community forum links now show their native title tooltip on hover (.forums a.disabled: pointer-events: none → cursor: default), with no interactivity regression.

    Dependencies

    • astro 6.4.4 → 6.4.7 (manifest + lockfile), plus a full lockfile refresh for the latest in-range patches across the tree.
    Open on GitHub
  • v1.1.24

    Security

    • CSP img-src tightened to 'self' data: — removed the https: scheme wildcard; the site loads no external images (verified by repo-wide scan), so arbitrary-origin image loads are no longer permitted.
    • rel="noopener noreferrer" on external outbound links — GitHub links in CompareCTA, Footer outbound links, and repo/license links on /changelog/ and /license/ now carry both hints; defense-in-depth (no target="_blank" exists site-wide) plus Referer-leak prevention.

    Full details in CHANGELOG.md.

    Open on GitHub
  • v1.1.23

    Build

    • Declared Node engine floor aligned to the real requirement: package.json engines.node tightened >=22.0.0 → >=22.12.0, and the README "Develop" note now reads "Node 22.12+", matching the floor imposed by Astro 6 and @astrojs/mdx 6 (both declare node >=22.12.0).
    • No runtime or build-output change — .nvmrc already resolves a compliant Node 22.x, so CI was unaffected; this only makes the declared range honest. No redeploy needed.
    Open on GitHub
  • v1.1.22

    Accessibility

    • Keyboard focus rings (:focus-visible, 2px --focus-ring) on the primary/secondary CTAs in CompareCTA.astro and on the homepage.
    • Compare-listing (/compare/) grid cards gain the same focus ring plus a prefers-reduced-motion-gated scale(0.96) active-press transform.

    Dependencies

    • Minor/patch group: astro 6.4.2 → 6.4.4, marked 18.0.4 → 18.0.5, dompurify 3.4.7 → 3.4.8, isomorphic-dompurify 3.15.0 → 3.16.0.
    • @astrojs/mdx 5.0.6 → 6.0.2 (major) — Astro 6.4 satisfies the new astro: ^6.4.0 peer range; build, type-check, and Lighthouse-CI gates green.
    Open on GitHub
  • v1.1.21

    Accessibility

    • Disabled Discord card explains itself on hover — the "Coming soon" Discord card on /community/ now carries a native title tooltip ("Pending community growth"), mirroring the disabled download-card treatment so hovering users see why the card is inert. Already kept out of the keyboard/click path via aria-disabled and an undefined href.

    Dependencies

    • Minor/patch group bump (4 updates) — astro 6.3.7 → 6.4.2, @astrojs/sitemap 3.7.2 → 3.7.3, dompurify 3.4.5 → 3.4.7, isomorphic-dompurify 3.14.0 → 3.15.0. Astro is a minor release; the rest are routine upstream patches — lockfile + manifest only, no source change.
    Open on GitHub
  • v1.1.20

    Security

    • Response-header hardening — removed the deprecated block-all-mixed-content directive from the CSP (upgrade-insecure-requests supersedes it) and added a Permissions-Policy denying camera, microphone, geolocation, payment, USB, the motion sensors, and the Topics API. No functional change — the static site calls no powerful browser APIs.

    Structured Data

    • Organization logo dimensions corrected — the logo ImageObject now declares 320x80 to match the SVG's intrinsic viewBox (was 512x128), so strict validators don't flag a dimension mismatch.
    Open on GitHub
  • v1.1.19

    Bug Fixes

    • Dead links + slashless structured-data URLs — llms.txt linked llms-full.txt/ and .well-known/security.txt/ (both 404 with a trailing slash) and the docs leaf/group schema URLs (breadcrumb, TechArticle/HowTo, CollectionPage) 308-redirected; all now resolve directly and the Telemetry link points at /docs/reference/telemetry/.
    • /docs/ and /compare/ hub OG images 404'd — added the missing OG route keys so social/crawler unfurls render a card.
    • SoftwareApplication shared one @id with two downloadUrls — homepage and /download/ now both resolve to the stable /download/ canonical.
    • humans.txt — corrected the deploy host to Cloudflare Pages.

    Content

    • Hue Sync comparison repositioned — corrected the inaccurate "discontinued" claim (the Hue Sync desktop app is still maintained; only the mobile app was retired) and reframed LumaSync as a free, open-source alternative, keeping the migration guidance.

    Accessibility

    • Muted text now meets WCAG AA contrast — --text-muted lightened from #6b7280 to #8b919c.
    • Disabled download cards carry a native title tooltip explaining why they're inert.

    Performance

    • 30-day caching for /media/ — the LCP hero and screenshots no longer pay the 4h must-revalidate round-trip.

    Discoverability

    • Link header advertising llms.txt / llms-full.txt now uses rel="alternate"; type="text/markdown".

    Build

    • CI gates on production CVEs via pnpm audit --prod --audit-level=high.
    Open on GitHub
  • v1.1.18

    Security

    • Sanitized GitHub API fetch errors on /download/ — raw error messages are no longer surfaced to the UI; failures are logged server-side and degrade with a generic upstream API unavailable string, avoiding leakage of upstream API structure or network details.

    Accessibility

    • Search-hint <kbd> glyphs hidden from the accessible name — the modal hint's arrow/enter symbols now carry aria-hidden="true" paired with sr-only text equivalents ("Up and down arrows", "Enter"), applied to both the static markup and the empty-query repaint; the Close button's Esc kbd is also aria-hidden (covered by aria-keyshortcuts).

    Interaction

    • Press-state feedback on search results — added a :active scale(0.98) to search results, gated behind prefers-reduced-motion: no-preference.
    Open on GitHub
  • v1.1.17

    Security

    • CSP hardening — https: wildcard removed from script-src and connect-src in public/_headers. Both directives are now pinned to 'self'. The site serves no third-party scripts at runtime, so this is a no-op for legitimate traffic and narrows the XSS / data-exfiltration attack surface.

    Accessibility

    • aria-keyshortcuts + dialog-popup semantics on search triggers: header search button and 404-page .search-cta now expose aria-keyshortcuts="Control+K Meta+K", aria-haspopup="dialog", and aria-controls="search-dialog", with their visual <kbd>⌘</kbd><kbd>K</kbd> wrappers hidden from AT via aria-hidden="true". The search modal's Close button also gains aria-keyshortcuts="Escape". 404 CTA additionally gets an explicit aria-label="Search".
    • Focus-visible outline on landing-page compare cards — closes the last landing-page interactive surface that lacked a keyboard outline, matching the focus pattern used across the rest of the site.

    Dependencies

    • Minor/patch group bump (4 updates): astro 6.3.3 → 6.3.7, marked 18.0.3 → 18.0.4, dompurify 3.4.4 → 3.4.5, isomorphic-dompurify 3.13.0 → 3.14.0.
    Open on GitHub
  • v1.1.16

    Bug Fixes

    • Stale search queries no longer overwrite fresher results in Search.astro: a monotonic queryId is now captured per input event and re-checked after every await (loadPagefind, pf.search, data()), so a superseded query bails before touching the DOM. Clearing the input also invalidates any in-flight query.

    Accessibility

    • Disabled download cards on /download/ now drop their href entirely, removing unavailable-platform cards from the keyboard tab order and disabling Enter-key activation. Mirrors the community-forum-card fix from v1.1.15.

    Dependencies

    • Minor/patch group: astro 6.3.1 → 6.3.3, @astrojs/mdx 5.0.4 → 5.0.6, dompurify 3.4.2 → 3.4.4, isomorphic-dompurify 3.12.0 → 3.13.0.
    • pnpm/action-setup 6.0.6 → 6.0.8 (CI + deploy).
    • cloudflare/wrangler-action 3.15.0 → 4.0.0 (deploy) — non-breaking, wranglerVersion: '4' already pinned; stale pin comment corrected to # v4.0.0.
    Open on GitHub