chore(release): v1.2.0

CHANGELOG.md

@@ -7,35 +7,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Planned
+
+See [ROADMAP.md](./ROADMAP.md) (dependency currency, remaining scale items, v2.0).
+
+## [1.2.0] - 2026-07-16
+
+**Canvas power tools** + security hardening + scale/ops features that landed after 1.1.0.
+
 ### Added
 
-- GitHub Actions **Publish npm** workflow — auto-publish `papercut-cli` on GitHub Release via [npm trusted publishers](https://docs.npmjs.com/trusted-publishers) (OIDC; no long-lived token)
-- Light/dark theme toggle (VS Code–style palettes, `localStorage` persistence)
-- Roadmap: **dependency currency** policy (prefer latest packages + majors plan)
-- Opt-in process metrics (`PAPERCUT_METRICS=1`) — `GET /api/metrics` counters only (`pastes_created`, `unlocks_ok`, `rate_limited`); disabled by default; no content/IP logging
+#### Canvas (v1.2)
+
 - Log canvas **wrap / no-wrap** toggle (dense horizontal scroll), sticky line-number gutter, preference in `localStorage`
 - Log canvas **line pins / bookmarks** (per-paste `localStorage`, gutter star + sidebar jump list)
 - Log canvas **download filtered / visible lines** (`paste-<id>-filtered.log`)
 - Log canvas **custom highlight rules** (regex → color, per-browser `localStorage`)
 - Log canvas **timeline scrubber** for timestamped logs (ISO / date-time / syslog / epoch)
 - Log canvas **multi-paste compare** (side-by-side via `?compare=<id>` or sidebar)
+
+#### Scale & ops
+
+- GitHub Actions **Publish npm** workflow — auto-publish `papercut-cli` on GitHub Release via [npm trusted publishers](https://docs.npmjs.com/trusted-publishers) (OIDC; no long-lived token)
+- Light/dark theme toggle (VS Code–style palettes, `localStorage` persistence)
+- Roadmap: **dependency currency** policy (prefer latest packages + majors plan)
+- Opt-in process metrics (`PAPERCUT_METRICS=1`) — `GET /api/metrics` counters only (`pastes_created`, `unlocks_ok`, `rate_limited`); disabled by default; no content/IP logging
 - Proxy-aware runtime: `TRUSTED_PROXY_HOPS` for rate-limit client keys; Secure cookies from `PAPERCUT_PUBLIC_URL` / `COOKIE_SECURE`
 - Docker Compose **profiles**: `proxy` (Caddy + ACME), `sweeper` (periodic `/api/health` purge)
 - Optional **Redis** rate limiting via `REDIS_URL` (multi-node; memory fallback)
 - CLI **streaming upload** (`text/plain` body + headers); API accepts raw body with size limit
 
 ### Fixed
 
-- **Security:** production rejects empty/known-placeholder/`<16` char `PASTE_AUTH_SECRET`; Compose no longer ships a working default secret
-- **Security:** default `TRUSTED_PROXY_HOPS=0` (ignore spoofable XFF on direct deploys); in-memory rate limiters prune/evict keys; set hops `1` behind a reverse proxy
-- **Security:** bound JSON create and unlock request bodies; max password length 1024 (reject before scrypt)
 - Theme FOUC boot script is a static string (no `JSON.stringify` interpolation) to clear CodeQL `js/bad-code-sanitization`
 - CI workflow sets explicit `permissions: contents: read` (CodeQL `actions/missing-workflow-permissions`)
 - `stripAnsi` uses a linear scan instead of nested quantifier regexes (CodeQL `js/polynomial-redos`)
 
-### Planned
+### Security
+
+- Production rejects empty/known-placeholder/`<16` char `PASTE_AUTH_SECRET`; Compose no longer ships a working default secret
+- Default `TRUSTED_PROXY_HOPS=0` (ignore spoofable XFF on direct deploys); in-memory rate limiters prune/evict keys; set hops `1` behind a reverse proxy
+- Bound JSON create and unlock request bodies; max password length 1024 (reject before scrypt)
 
-See [ROADMAP.md](./ROADMAP.md) (dependency updates, canvas tools, scale features, etc.).
+### Package versions
+
+`1.2.0` — root, `papercut-cli`, `@papercut/server`
 
 ## [1.1.0] - 2026-07-15
 
@@ -80,67 +96,3 @@ First stable release. HTTP API paths and CLI flags in this version are covered b
 
 - Bump `drizzle-orm` to ≥0.45.2 (SQL identifier injection advisory)
 - Bump `postcss` to ≥8.5.10 (stringify XSS advisory)
-
-### Includes (from 0.x)
-
-- Zero-dependency CLI upload client
-- Next.js server with SQLite pastes, password protection, expiry
-- Interactive log canvas (ANSI, virtual scroll, filters, search, JSON, line links)
-- Docker multi-stage image and compose stack
-
-## [0.2.1] - 2026-07-15
-
-### Added
-
-- [CHANGELOG.md](./CHANGELOG.md) (Keep a Changelog)
-- Release checklist in [CONTRIBUTING.md](./CONTRIBUTING.md) (versions, changelog, SECURITY, tag)
-
-### Changed
-
-- Package versions aligned to the release line on every tag (root, CLI, server)
-- [SECURITY.md](./SECURITY.md) supported-versions table tracks the current minor line
-- README documents current version and links to the changelog
-
-## [0.2.0] - 2026-07-15
-
-### Added
-
-- Interactive log canvas: virtualized list, ANSI color rendering, log-level sidebar filters
-- Substring and `/regex/flags` search over plain (ANSI-stripped) lines
-- Expandable JSON inspector for structured log lines
-- GitHub-style line deep links (`#L12`, `#L12-L20`) with scroll and highlight
-- Raw copy and `.log` download from the canvas toolbar
-- Multi-stage `Dockerfile` and `docker-compose.yml` with SQLite volume
-- Unit coverage for log-line helpers and ANSI HTML escaping
-
-### Changed
-
-- Paste page uses `LogCanvas` instead of a plain `<pre>` view
-- README Docker self-host instructions expanded
-
-### Removed
-
-- Unused `BasicPasteView` component
-
-## [0.1.0] - 2026-07-15
-
-### Added
-
-- Project foundation: README, CONTRIBUTING, SECURITY, monorepo layout (GPL-3.0)
-- Next.js App Router server with Tailwind (VS Code Dark theme)
-- SQLite persistence via Drizzle + better-sqlite3
-- Paste API: create, get, password unlock with HMAC cookies
-- Metadata extraction (line counts, log levels, JSON-ish detection)
-- Expiry parsing (`30m`, `1h`, `1d`, `7d`, …) and purge-on-read
-- Zero-dependency CLI: stdin upload, `--private`, `--expire`, `--url`, share card, clipboard
-- Landing page and password gate UI
-- Initial unit tests for server libs and CLI
-
-## Links
-
-- [Unreleased]: https://github.com/ArianAr/PaperCut/compare/v1.1.0...HEAD
-- [1.1.0]: https://github.com/ArianAr/PaperCut/compare/v1.0.0...v1.1.0
-- [1.0.0]: https://github.com/ArianAr/PaperCut/compare/v0.2.1...v1.0.0
-- [0.2.1]: https://github.com/ArianAr/PaperCut/compare/v0.2.0...v0.2.1
-- [0.2.0]: https://github.com/ArianAr/PaperCut/compare/v0.1.0...v0.2.0
-- [0.1.0]: https://github.com/ArianAr/PaperCut/releases/tag/v0.1.0

README.md

@@ -7,12 +7,14 @@
 
 <p align="center">
   <a href="https://github.com/ArianAr/PaperCut/actions/workflows/ci.yml"><img src="https://github.com/ArianAr/PaperCut/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <a href="https://github.com/ArianAr/PaperCut/releases/tag/v1.2.0"><img src="https://img.shields.io/badge/version-v1.2.0-blue.svg" alt="Version v1.2.0" /></a>
   <a href="https://github.com/ArianAr/PaperCut/releases/latest"><img src="https://img.shields.io/github/v/release/ArianAr/PaperCut?label=release" alt="Release" /></a>
+  <a href="https://www.npmjs.com/package/papercut-cli"><img src="https://img.shields.io/npm/v/papercut-cli.svg?logo=npm&label=papercut-cli" alt="npm papercut-cli" /></a>
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-GPL--3.0-blue.svg" alt="License" /></a>
   <a href="https://nodejs.org/"><img src="https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg" alt="Node.js" /></a>
   <a href="./Dockerfile"><img src="https://img.shields.io/badge/docker-ready-2496ED?logo=docker&logoColor=white" alt="Docker" /></a>
   <a href="./SECURITY.md"><img src="https://img.shields.io/badge/security-policy-red.svg" alt="Security" /></a>
-  <a href="./ROADMAP.md"><img src="https://img.shields.io/badge/roadmap-v1.1+-informational.svg" alt="Roadmap" /></a>
+  <a href="./ROADMAP.md"><img src="https://img.shields.io/badge/roadmap-v1.2+-informational.svg" alt="Roadmap" /></a>
 </p>
 
 ```bash
@@ -196,7 +198,7 @@ UI: `/paste/:id` · deep links `#L12`, `#L12-L20`.
 
 ## Status
 
-**Current version: [1.1.0](https://github.com/ArianAr/PaperCut/releases/tag/v1.1.0)** · [1.x API compatibility](./CHANGELOG.md) · roadmap: [ROADMAP.md](./ROADMAP.md)
+**Current version: [1.2.0](https://github.com/ArianAr/PaperCut/releases/tag/v1.2.0)** · CLI on [npm](https://www.npmjs.com/package/papercut-cli) · [1.x API compatibility](./CHANGELOG.md) · roadmap: [ROADMAP.md](./ROADMAP.md)
 
 ## Disclaimer
 

ROADMAP.md

@@ -1,6 +1,6 @@
 # PaperCut Roadmap
 
-Living plan for post-**1.0** work. Status: **1.1.0 shipped** (stable self-hosted pastebin + log canvas).
+Living plan for post-**1.0** work. Status: **1.2.0 shipped** (canvas power tools + security hardening; scale features from the v1.3 track also on `main`).
 
 Priorities may shift based on users and security needs. Items become GitHub issues when work starts; this file is the high-level map.
 
@@ -70,7 +70,7 @@ Focus: production operators and contributors.
 
 ---
 
-## Later — v1.2 “Canvas power tools”
+## Shipped — v1.2 “Canvas power tools” (in **1.2.0**)
 
 Focus: log analysis depth.
 

SECURITY.md

@@ -6,19 +6,20 @@ Security fixes are provided for the versions below. Always run the latest patch
 
 | Version | Supported          | Notes |
 | ------- | ------------------ | ----- |
-| 1.1.x   | :white_check_mark: | Current stable line (latest: **1.1.0**) — [CHANGELOG](./CHANGELOG.md) |
-| 1.0.x   | :x:                | Superseded by 1.1.x |
+| 1.2.x   | :white_check_mark: | Current stable line (latest: **1.2.0**) — [CHANGELOG](./CHANGELOG.md) |
+| 1.1.x   | :x:                | Superseded by 1.2.x |
+| 1.0.x   | :x:                | Superseded |
 | 0.2.x   | :x:                | Superseded |
 | 0.1.x   | :x:                | Superseded |
 | < 0.1  | :x:                | Pre-release / untagged |
 
 Policy:
 
 - Fixes land on `main` first, then ship in the next **semver** tag on the supported line.
-- Only the latest **stable minor** is supported (currently **1.1.x**).
+- Only the latest **stable minor** is supported (currently **1.2.x**).
 - Upgrade by pulling the latest release tag or `main` and redeploying (Docker or Node).
 
-When reporting an issue, include the version from `package.json` / the Git tag (e.g. `v1.1.0`).
+When reporting an issue, include the version from `package.json` / the Git tag (e.g. `v1.2.0`).
 
 ## Reporting a vulnerability
 

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "papercut-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "CLI client for PaperCut — pipe terminal output to an interactive log canvas",
   "license": "GPL-3.0-only",
   "type": "commonjs",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "papercut",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "private": true,
   "description": "Interactive terminal pastebin and log analysis canvas",
   "license": "GPL-3.0-only",

server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papercut/server",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "private": true,
   "description": "PaperCut Next.js server — API and interactive log canvas",
   "license": "GPL-3.0-only",