@devopsplaybook.io/common-web 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project are documented here.
 This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0] - 2026-11-01
+
+### Added
+
+- Type-check gate: `npm run typecheck` runs `nuxi typecheck` (`vue-tsc --noEmit`)
+  over the layer, playground and tests. TypeScript 6.0.3, vue-tsc 3.3.14 and
+  Node 22 types are pinned in `devDependencies`; both CI workflows run the gate.
+- Node-environment SSR smoke test (`tests/ssr.spec.ts`) rendering the shipped
+  components with `createSSRApp` and `renderToString` as part of `npm test`.
+
+### Changed
+
+- Production dependency audit is clean again: `follow-redirects` is pinned to
+  1.16.2 through the lockfile (GHSA-mrwp-f3q8-3g9p). The full dev-only audit
+  and its accepted advisories are documented in `CONTRIBUTING.md`.
+- Packaging metadata: `vue` is now an explicit peer dependency and `pinia` is
+  optional through `peerDependenciesMeta` (still a devDependency for tests).
+- `pretest` and `prebuild` run `nuxi prepare` so the generated Nuxt tsconfig
+  that the root `tsconfig.json` extends exists before the test and playground
+  build steps, which also runs in CI after a clean install.
+- The type-check gate required mechanical type annotations in
+  `tests/contrast.spec.ts`; no runtime behaviour or public API changed.
+
+### Fixed
+
+- `npm audit --omit=dev --audit-level=high` no longer fails on `main`.
+
 ## [0.8.1] - 2026-10-29
 
 ### Changed

package/CONTRIBUTING.md

@@ -7,6 +7,7 @@ Use Node.js 22 and run the repository checks before opening a pull request:
 ```sh
 npm ci
 npm run lint
+npm run typecheck
 npm test
 npm run build
 npm audit --omit=dev --audit-level=high
@@ -15,7 +16,13 @@ npm audit --omit=dev --audit-level=high
 The tests consume the generated npm tarball, not only the working tree.
 `npm run build` checks the publish file list and builds the Nuxt playground.
 
-Two quality gates run with `npm test`:
+`npm run typecheck` runs `nuxi typecheck` (`vue-tsc --noEmit`) over the shipped
+sources, the playground and the tests, and fails on any type error. `PR Check`
+and `Main Build` run it right after linting. The package ships raw TypeScript
+and Vue sources, so this gate catches type regressions that would otherwise
+surface only in a consuming application's build.
+
+Three quality gates run with `npm test`:
 
 - **Coverage thresholds** are enforced in `vitest.config.ts` (statements 95%,
   branches 88%, functions 99%, lines 97%) over the composables, services and
@@ -26,6 +33,9 @@ Two quality gates run with `npm test`:
   `color-contrast` rule is disabled there because jsdom cannot compute rendered
   contrast; WCAG AA color pairs are already gated by `tests/contrast.spec.ts`
   against the packed tokens.
+- **SSR**: `tests/ssr.spec.ts` renders the shipped components in a Node
+  environment with `createSSRApp` and `renderToString`, so the SSR
+  compatibility promised by the README is exercised on every test run.
 
 ## Scope and compatibility
 
@@ -66,20 +76,28 @@ shipped or executed inside a consuming application. A vulnerability that exists
 only in that toolchain is a build-environment risk, not a runtime risk for
 consumers.
 
-Accepted development-only advisories (2026-10-24, after the Nuxt 4.6.2 /
-Vitest 5.0.5 refresh):
+Accepted development-only advisories (2026-11-01, after the
+`follow-redirects` lockfile fix and the type-check toolchain):
 
 | Advisory | Package | Severity | Path | Status |
 | --- | --- | --- | --- | --- |
-| GHSA-86w9-cpqp-85rv | node-forge 1.4.0 | high | nuxt → @nuxt/nitro-server → nitropack → listhen → node-forge | No fixed release (1.4.0 is latest); npm's only suggested fix is downgrading Nuxt to 4.1.3, rejected |
-
-`npm audit` lists this single advisory as seven high entries because it is also
-aggregated through `@nuxt/nitro-server`, `@nuxt/vite-builder`,
-`@nuxt/vite-server`, `nitropack`, `listhen`, and `nuxt`.
+| GHSA-gcqx-w48m-w2h4 | `deepmerge` 4.3.1 (affected 4.2.0–4.3.1) | low | nuxt → @nuxt/nitro-server → nitropack → @rollup/plugin-node-resolve → deepmerge | No compatible release; npm's only suggested fix is downgrading Nuxt to 4.1.3, rejected |
+| GHSA-3g3m-2fjr-6pw4 | `glob` (affected 9.0.0–14.0.1) | moderate | Nuxt toolchain (@nuxt/nitro-server, nitropack, @vercel/nft, archiver, archiver-utils, zip-stream) and @vue/test-utils → js-beautify | npm's fix is downgrading @vue/test-utils to 2.4.11 or Nuxt to 4.1.3, rejected |
+| GHSA-g3hv-75wg-m249 | `minimatch` (affected <11.0.1) | moderate | @vue/test-utils → js-beautify → editorconfig → minimatch; also readdir-glob and archiver-utils | Same downgrade suggested, rejected |
+
+`npm audit` reports these three advisories as 17 entries (2 low, 15 moderate)
+because they are also aggregated through `@nuxt/nitro-server`,
+`@nuxt/vite-builder`, `@nuxt/vite-server`, `nitropack`, `nuxt`,
+`@vue/test-utils`, `archiver`, `archiver-utils`, `zip-stream`, `readdir-glob`,
+`@vercel/nft`, `@rollup/plugin-node-resolve`, `glob`, `minimatch`,
+`editorconfig`, `js-beautify` and `deepmerge`. Every entry is reachable only
+through `devDependencies`.
 
 Do not silence advisories with `npm audit fix --force`, npm `overrides`, or a
-Nuxt downgrade. Re-run both audits after every dependency update and update this
-table when the tree changes (remove the exception once `node-forge` ships a fix).
+Nuxt or `@vue/test-utils` downgrade. Re-run both audits after every dependency
+update and refresh this table when the tree changes; remove an entry once its
+toolchain ships a compatible fix. The production audit (0 vulnerabilities at
+this revision) is re-checked by `PR Check` and `Main Build` on every change.
 
 `PR Check` and `Main Build` run repository-local copies of the shared
 `common-utils` npm workflows because the shared versions still gate on a full

package/README.md

@@ -196,6 +196,10 @@ authentication state to become meaningful only after hydration.
 unguarded and must only be called in the browser (a client plugin or a
 composable hook, never during SSR).
 
+`tests/ssr.spec.ts` renders the shipped components with `createSSRApp` and
+`renderToString` in a Node environment, so this server-rendering contract is
+exercised by `npm test` and by both CI workflows.
+
 ## Tokens and app-shell styles
 
 The layer loads `assets/css/tokens.css` and `assets/css/app-shell.css`.
@@ -235,8 +239,11 @@ import Loading from "@devopsplaybook.io/common-web/components/Loading.vue";
 
 ## Compatibility and release policy
 
-This release supports Nuxt `^4.0.0` and Pinia
-`^2.0.0 || ^3.0.0 || ^4.0.0`. Pinia 4 is ESM-only and requires the consuming
+This release supports Nuxt `^4.0.0` and Vue `^3.5.0`; Nuxt provides Vue, so a
+Nuxt 4 application already satisfies that peer. Pinia
+`^2.0.0 || ^3.0.0 || ^4.0.0` is an optional peer: only
+`stores/AuthenticationStore` needs it, so applications that do not use the
+store do not have to install it. Pinia 4 is ESM-only and requires the consuming
 application to install its `@vue/devtools-api` peer dependency. Nuxt 3
 applications (including Telepathy) are not supported.
 
@@ -271,11 +278,14 @@ archive is what `npm test` runs against.
 ```sh
 npm ci
 npm run lint
+npm run typecheck
 npm test
 npm run build
 npm run dev
 ```
 
-`npm test` packs the library and runs component and service tests against that
-archive. `npm run build` validates its contents and builds the playground.
+`npm run typecheck` runs `nuxi typecheck` (`vue-tsc --noEmit`) over the layer,
+the playground and the tests and fails on type errors. `npm test` packs the
+library and runs component, service and SSR tests against that archive.
+`npm run build` validates its contents and builds the playground.
 See [CONTRIBUTING.md](CONTRIBUTING.md) for contribution and release details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devopsplaybook.io/common-web",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Shared Nuxt layer for DevOpsPlaybook web applications",
   "license": "ISC",
   "repository": {
@@ -40,19 +40,29 @@
   "scripts": {
     "dev": "nuxi dev playground",
     "lint": "oxlint components composables services stores tests scripts playground vitest.config.ts nuxt.config.ts",
+    "typecheck": "nuxi typecheck",
+    "pretest": "nuxi prepare",
     "test": "node scripts/test-packed.mjs",
+    "prebuild": "nuxi prepare",
     "build": "node scripts/build-package.mjs"
   },
   "peerDependencies": {
     "nuxt": "^4.0.0",
+    "vue": "^3.5.0",
     "pinia": "^2.0.0 || ^3.0.0 || ^4.0.0"
   },
+  "peerDependenciesMeta": {
+    "pinia": {
+      "optional": true
+    }
+  },
   "dependencies": {
     "axios": "^1.21.0",
     "jwt-decode": "^4.0.0",
     "mitt": "^3.0.1"
   },
   "devDependencies": {
+    "@types/node": "^22.20.5",
     "@vitejs/plugin-vue": "^6.0.10",
     "@vitest/coverage-v8": "^5.0.5",
     "@vue/test-utils": "^2.5.1",
@@ -61,7 +71,9 @@
     "nuxt": "^4.6.3",
     "oxlint": "^1.90.0",
     "pinia": "^4.1.0",
-    "vitest": "^5.0.5"
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.5",
+    "vue-tsc": "^3.3.14"
   },
   "publishConfig": {
     "access": "public"