@matfsw/docusaurus-plantuml-plugin 1.0.2 → 1.0.3

package/CHANGELOG.md

@@ -7,6 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.3]
+
+### Security
+
+- `copy-webpack-plugin` `12` → `14`, which moves the transitive `serialize-javascript`
+  dependency to `7.0.7`. That closes a high-severity advisory (RCE via `RegExp.flags`) and a
+  denial-of-service advisory in the version the plugin previously pulled in. The dependency is
+  used at build time and never reaches a site visitor's browser.
+
+### Changed
+
+- `engines.node` is now `>= 20.9.0`, following `copy-webpack-plugin@14`. In practice this is
+  not a restriction: the Node 20 LTS line begins at `20.9.0`, so any supported Node 20 already
+  satisfies it.
+- Development dependencies updated: `globals` `16` → `17`, `@types/node` `22` → `26`, and
+  React `18` → `19` for the unit-test environment. The plugin still supports React 18 and 19;
+  the example site continues to exercise React 18 end to end, so both are covered.
+- GitHub Actions updated: `actions/checkout` `5` → `7`, `actions/setup-node` `5` → `7`,
+  `actions/upload-artifact` `4` → `7`.
+
+### Fixed
+
+- Resets of the zoom view now have exactly one owner. The listener effect also reset on every
+  re-attach, duplicating the effect keyed on the rendered picture; any re-attach for an
+  unrelated reason would have silently discarded a zoom the reader had chosen.
+- A unit test built a fake React element from its internal `$$typeof` symbol, which React 19
+  renamed. It now uses a real element, so it no longer depends on React internals.
+- The maximize round-trip test no longer assumes effect flush order, which made it flaky on
+  CI. It asserts the same value, so a genuinely wrong transform still fails.
+
 ## [1.0.2]
 
 ### Fixed
@@ -96,7 +126,8 @@ Initial release.
   opt-out.
 - Plugin option validation that rejects unknown keys and out-of-range values at build time.
 
-[Unreleased]: https://github.com/matf/docusaurus-plantuml-plugin/compare/v1.0.2...HEAD
+[Unreleased]: https://github.com/matf/docusaurus-plantuml-plugin/compare/v1.0.3...HEAD
+[1.0.3]: https://github.com/matf/docusaurus-plantuml-plugin/compare/v1.0.2...v1.0.3
 [1.0.2]: https://github.com/matf/docusaurus-plantuml-plugin/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/matf/docusaurus-plantuml-plugin/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/matf/docusaurus-plantuml-plugin/compare/v0.1.0...v1.0.0

package/README.md

@@ -42,7 +42,7 @@ them are exported.
 | Requirement     | Supported                                                                              |
 | --------------- | -------------------------------------------------------------------------------------- |
 | Docusaurus      | `3.5.0` and later `3.x`                                                                |
-| Node.js (build) | `>= 20`                                                                                |
+| Node.js (build) | `>= 20.9.0` (the Node 20 LTS line)                                                     |
 | React           | `18.x` or `19.x` (matching your Docusaurus install)                                    |
 | Bundler         | webpack (default) and Rspack (`future.v4` / `@docusaurus/faster`)                      |
 | PlantUML engine | `@plantuml/core` `1.2026.6`                                                            |

package/dist/theme/PlantUmlDiagram/useZoomPan.js

@@ -121,8 +121,6 @@ export function useZoomPan({ enabled, resetKey }) {
         const viewport = viewportRef.current;
         if (!viewport)
             return undefined;
-        // The layer node is replaced whenever the rendered SVG changes; start from a clean view.
-        write(IDENTITY);
         let dragging = false;
         let pointerId = null;
         let startX = 0;
@@ -255,9 +253,16 @@ export function useZoomPan({ enabled, resetKey }) {
         // the listeners against a clean view.
     }, [apply, enabled, measure, resetKey, write]);
     /**
-     * A cache hit resolves before any phase is reported, so a colour-mode toggle can go
-     * `ready -> ready` without ever unmounting the layer. The effect above would not re-run in
-     * that case, which is why the reset is also driven directly by `resetKey`.
+     * The single owner of "reset the view".
+     *
+     * `resetKey` identifies the rendered picture, so this covers both a new diagram and a
+     * colour-mode change — including the case where a cache hit resolves before any phase is
+     * reported and the component goes `ready -> ready` without the layer ever unmounting.
+     *
+     * The listener effect deliberately does *not* also reset. Its dependencies are a superset of
+     * this one's, so any re-attach for an unrelated reason — a remount, or a callback identity
+     * change from a future refactor — would silently throw away a zoom the reader had chosen.
+     * One owner means a reset happens when the picture changes, and at no other time.
      */
     useEffect(() => {
         if (!enabled)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@matfsw/docusaurus-plantuml-plugin",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Render PlantUML diagrams in Docusaurus 3 entirely in the browser - no Java, no PlantUML server, no CDN.",
   "keywords": [
     "docusaurus",
@@ -41,7 +41,7 @@
     "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.9.0"
   },
   "scripts": {
     "clean": "node scripts/clean.mjs",
@@ -70,7 +70,7 @@
   },
   "dependencies": {
     "@plantuml/core": "^1.2026.6",
-    "copy-webpack-plugin": "^12.0.2",
+    "copy-webpack-plugin": "^14.0.0",
     "dompurify": "^3.2.7"
   },
   "peerDependencies": {
@@ -91,19 +91,19 @@
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.0",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "^22.18.13",
-    "@types/react": "^18.3.27",
-    "@types/react-dom": "^18.3.7",
+    "@types/node": "^26.1.2",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "@vitest/coverage-v8": "^3.2.4",
     "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^5.2.0",
-    "globals": "^16.5.0",
+    "globals": "^17.9.0",
     "jsdom": "^26.1.0",
     "prettier": "^3.6.2",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "tsup": "^8.5.0",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.46.4",