From 3e55d645358f351106f1a40bac68250a7bf42196 Mon Sep 17 00:00:00 2001 From: ArianAr Date: Thu, 16 Jul 2026 02:56:41 +0300 Subject: [PATCH] chore(release): 1.2.0 Canvas power tools milestone, security hardening, and scale/ops features already on main. Bump root / papercut-cli / @papercut/server to 1.2.0. README: version badge v1.2.0 and npm registry badge for papercut-cli. Closes #71 --- CHANGELOG.md | 98 ++++++++++++--------------------------------- README.md | 6 ++- ROADMAP.md | 4 +- SECURITY.md | 9 +++-- cli/package.json | 2 +- package.json | 2 +- server/package.json | 2 +- 7 files changed, 39 insertions(+), 84 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fd6e01d..ffebee1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,18 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Planned + +See [ROADMAP.md](./ROADMAP.md) (dependency currency, remaining scale items, v2.0). + +## [1.2.0] - 2026-07-16 + +**Canvas power tools** + security hardening + scale/ops features that landed after 1.1.0. + ### Added -- GitHub Actions **Publish npm** workflow — auto-publish `papercut-cli` on GitHub Release via [npm trusted publishers](https://docs.npmjs.com/trusted-publishers) (OIDC; no long-lived token) -- Light/dark theme toggle (VS Code–style palettes, `localStorage` persistence) -- Roadmap: **dependency currency** policy (prefer latest packages + majors plan) -- Opt-in process metrics (`PAPERCUT_METRICS=1`) — `GET /api/metrics` counters only (`pastes_created`, `unlocks_ok`, `rate_limited`); disabled by default; no content/IP logging +#### Canvas (v1.2) + - Log canvas **wrap / no-wrap** toggle (dense horizontal scroll), sticky line-number gutter, preference in `localStorage` - Log canvas **line pins / bookmarks** (per-paste `localStorage`, gutter star + sidebar jump list) - Log canvas **download filtered / visible lines** (`paste--filtered.log`) - Log canvas **custom highlight rules** (regex → color, per-browser `localStorage`) - Log canvas **timeline scrubber** for timestamped logs (ISO / date-time / syslog / epoch) - Log canvas **multi-paste compare** (side-by-side via `?compare=` or sidebar) + +#### Scale & ops + +- GitHub Actions **Publish npm** workflow — auto-publish `papercut-cli` on GitHub Release via [npm trusted publishers](https://docs.npmjs.com/trusted-publishers) (OIDC; no long-lived token) +- Light/dark theme toggle (VS Code–style palettes, `localStorage` persistence) +- Roadmap: **dependency currency** policy (prefer latest packages + majors plan) +- Opt-in process metrics (`PAPERCUT_METRICS=1`) — `GET /api/metrics` counters only (`pastes_created`, `unlocks_ok`, `rate_limited`); disabled by default; no content/IP logging - Proxy-aware runtime: `TRUSTED_PROXY_HOPS` for rate-limit client keys; Secure cookies from `PAPERCUT_PUBLIC_URL` / `COOKIE_SECURE` - Docker Compose **profiles**: `proxy` (Caddy + ACME), `sweeper` (periodic `/api/health` purge) - Optional **Redis** rate limiting via `REDIS_URL` (multi-node; memory fallback) @@ -26,16 +39,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed -- **Security:** production rejects empty/known-placeholder/`<16` char `PASTE_AUTH_SECRET`; Compose no longer ships a working default secret -- **Security:** default `TRUSTED_PROXY_HOPS=0` (ignore spoofable XFF on direct deploys); in-memory rate limiters prune/evict keys; set hops `1` behind a reverse proxy -- **Security:** bound JSON create and unlock request bodies; max password length 1024 (reject before scrypt) - Theme FOUC boot script is a static string (no `JSON.stringify` interpolation) to clear CodeQL `js/bad-code-sanitization` - CI workflow sets explicit `permissions: contents: read` (CodeQL `actions/missing-workflow-permissions`) - `stripAnsi` uses a linear scan instead of nested quantifier regexes (CodeQL `js/polynomial-redos`) -### Planned +### Security + +- Production rejects empty/known-placeholder/`<16` char `PASTE_AUTH_SECRET`; Compose no longer ships a working default secret +- Default `TRUSTED_PROXY_HOPS=0` (ignore spoofable XFF on direct deploys); in-memory rate limiters prune/evict keys; set hops `1` behind a reverse proxy +- Bound JSON create and unlock request bodies; max password length 1024 (reject before scrypt) -See [ROADMAP.md](./ROADMAP.md) (dependency updates, canvas tools, scale features, etc.). +### Package versions + +`1.2.0` — root, `papercut-cli`, `@papercut/server` ## [1.1.0] - 2026-07-15 @@ -80,67 +96,3 @@ First stable release. HTTP API paths and CLI flags in this version are covered b - Bump `drizzle-orm` to ≥0.45.2 (SQL identifier injection advisory) - Bump `postcss` to ≥8.5.10 (stringify XSS advisory) - -### Includes (from 0.x) - -- Zero-dependency CLI upload client -- Next.js server with SQLite pastes, password protection, expiry -- Interactive log canvas (ANSI, virtual scroll, filters, search, JSON, line links) -- Docker multi-stage image and compose stack - -## [0.2.1] - 2026-07-15 - -### Added - -- [CHANGELOG.md](./CHANGELOG.md) (Keep a Changelog) -- Release checklist in [CONTRIBUTING.md](./CONTRIBUTING.md) (versions, changelog, SECURITY, tag) - -### Changed - -- Package versions aligned to the release line on every tag (root, CLI, server) -- [SECURITY.md](./SECURITY.md) supported-versions table tracks the current minor line -- README documents current version and links to the changelog - -## [0.2.0] - 2026-07-15 - -### Added - -- Interactive log canvas: virtualized list, ANSI color rendering, log-level sidebar filters -- Substring and `/regex/flags` search over plain (ANSI-stripped) lines -- Expandable JSON inspector for structured log lines -- GitHub-style line deep links (`#L12`, `#L12-L20`) with scroll and highlight -- Raw copy and `.log` download from the canvas toolbar -- Multi-stage `Dockerfile` and `docker-compose.yml` with SQLite volume -- Unit coverage for log-line helpers and ANSI HTML escaping - -### Changed - -- Paste page uses `LogCanvas` instead of a plain `
` view
-- README Docker self-host instructions expanded
-
-### Removed
-
-- Unused `BasicPasteView` component
-
-## [0.1.0] - 2026-07-15
-
-### Added
-
-- Project foundation: README, CONTRIBUTING, SECURITY, monorepo layout (GPL-3.0)
-- Next.js App Router server with Tailwind (VS Code Dark theme)
-- SQLite persistence via Drizzle + better-sqlite3
-- Paste API: create, get, password unlock with HMAC cookies
-- Metadata extraction (line counts, log levels, JSON-ish detection)
-- Expiry parsing (`30m`, `1h`, `1d`, `7d`, …) and purge-on-read
-- Zero-dependency CLI: stdin upload, `--private`, `--expire`, `--url`, share card, clipboard
-- Landing page and password gate UI
-- Initial unit tests for server libs and CLI
-
-## Links
-
-- [Unreleased]: https://github.com/ArianAr/PaperCut/compare/v1.1.0...HEAD
-- [1.1.0]: https://github.com/ArianAr/PaperCut/compare/v1.0.0...v1.1.0
-- [1.0.0]: https://github.com/ArianAr/PaperCut/compare/v0.2.1...v1.0.0
-- [0.2.1]: https://github.com/ArianAr/PaperCut/compare/v0.2.0...v0.2.1
-- [0.2.0]: https://github.com/ArianAr/PaperCut/compare/v0.1.0...v0.2.0
-- [0.1.0]: https://github.com/ArianAr/PaperCut/releases/tag/v0.1.0
diff --git a/README.md b/README.md
index aac2ba9..7b892c1 100644
--- a/README.md
+++ b/README.md
@@ -7,12 +7,14 @@
 
 

   CI
+  Version v1.2.0
   Release
+  npm papercut-cli
   License
   Node.js
   Docker
   Security
-  Roadmap
+  Roadmap
 

 
 ```bash
@@ -196,7 +198,7 @@ UI: `/paste/:id` · deep links `#L12`, `#L12-L20`.
 
 ## Status
 
-**Current version: [1.1.0](https://github.com/ArianAr/PaperCut/releases/tag/v1.1.0)** · [1.x API compatibility](./CHANGELOG.md) · roadmap: [ROADMAP.md](./ROADMAP.md)
+**Current version: [1.2.0](https://github.com/ArianAr/PaperCut/releases/tag/v1.2.0)** · CLI on [npm](https://www.npmjs.com/package/papercut-cli) · [1.x API compatibility](./CHANGELOG.md) · roadmap: [ROADMAP.md](./ROADMAP.md)
 
 ## Disclaimer
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 8ab790a..a725c23 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,6 +1,6 @@
 # PaperCut Roadmap
 
-Living plan for post-**1.0** work. Status: **1.1.0 shipped** (stable self-hosted pastebin + log canvas).
+Living plan for post-**1.0** work. Status: **1.2.0 shipped** (canvas power tools + security hardening; scale features from the v1.3 track also on `main`).
 
 Priorities may shift based on users and security needs. Items become GitHub issues when work starts; this file is the high-level map.
 
@@ -70,7 +70,7 @@ Focus: production operators and contributors.
 
 ---
 
-## Later — v1.2 “Canvas power tools”
+## Shipped — v1.2 “Canvas power tools” (in **1.2.0**)
 
 Focus: log analysis depth.
 
diff --git a/SECURITY.md b/SECURITY.md
index 7396a07..0eee732 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,8 +6,9 @@ Security fixes are provided for the versions below. Always run the latest patch
 
 | Version | Supported          | Notes |
 | ------- | ------------------ | ----- |
-| 1.1.x   | :white_check_mark: | Current stable line (latest: **1.1.0**) — [CHANGELOG](./CHANGELOG.md) |
-| 1.0.x   | :x:                | Superseded by 1.1.x |
+| 1.2.x   | :white_check_mark: | Current stable line (latest: **1.2.0**) — [CHANGELOG](./CHANGELOG.md) |
+| 1.1.x   | :x:                | Superseded by 1.2.x |
+| 1.0.x   | :x:                | Superseded |
 | 0.2.x   | :x:                | Superseded |
 | 0.1.x   | :x:                | Superseded |
 | < 0.1  | :x:                | Pre-release / untagged |
@@ -15,10 +16,10 @@ Security fixes are provided for the versions below. Always run the latest patch
 Policy:
 
 - Fixes land on `main` first, then ship in the next **semver** tag on the supported line.
-- Only the latest **stable minor** is supported (currently **1.1.x**).
+- Only the latest **stable minor** is supported (currently **1.2.x**).
 - Upgrade by pulling the latest release tag or `main` and redeploying (Docker or Node).
 
-When reporting an issue, include the version from `package.json` / the Git tag (e.g. `v1.1.0`).
+When reporting an issue, include the version from `package.json` / the Git tag (e.g. `v1.2.0`).
 
 ## Reporting a vulnerability
 
diff --git a/cli/package.json b/cli/package.json
index 1a98d68..73520e6 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "papercut-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "CLI client for PaperCut — pipe terminal output to an interactive log canvas",
   "license": "GPL-3.0-only",
   "type": "commonjs",
diff --git a/package.json b/package.json
index 4a892a7..144c486 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "papercut",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "private": true,
   "description": "Interactive terminal pastebin and log analysis canvas",
   "license": "GPL-3.0-only",
diff --git a/server/package.json b/server/package.json
index 1bb2f62..6e48de5 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@papercut/server",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "private": true,
   "description": "PaperCut Next.js server — API and interactive log canvas",
   "license": "GPL-3.0-only",