@particle-academy/react-fancy 5.35.1 → 5.36.1

package/CHANGELOG.md

@@ -11,6 +11,87 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.36.1] - 2026-10-11
+
+### Security
+
+- **`encodeQr` spent linear time on a value it was always going to refuse.**
+  `<QrCode>` renders a `value` the component did not author, and version
+  selection walked versions 1–40 re-encoding the payload at each one — so a
+  value too long to fit was encoded **forty times** before being rejected.
+  Measured on the built bundle: **342 ms for 100 kB, 2.0 s for 500 kB**,
+  linear, which is tens of seconds of blocked main thread for a few megabytes
+  through `<QrCode value={userInput} />`.
+
+  The refusal was always correct; the *cost* of the refusal was the defect. An
+  impossible value is now rejected from `value.length` alone — a character
+  count can never exceed a byte count, so a string longer than the largest
+  capacity any mode offers cannot fit in any of them. **500 kB now refuses in
+  0.0 ms**, and the legitimate path got faster too (the payload's bit length
+  depends on the version only through the character-count indicator, which has
+  three tiers, so it is computed at most three times rather than forty).
+
+  **Nothing to do** — the API, the thrown `RangeError` and every value that
+  previously encoded are unchanged, boundary cases included (2,953 bytes still
+  encodes; 2,954 still throws).
+
+  Worth stating why this was treated as a security fix rather than a
+  performance note: this encoder reaches consumers **as vendored source** via
+  `npx fancy-cli add qr-code`, not only as a package. Vendored source carries
+  no manifest, so no advisory, Dependabot alert or audit row would ever have
+  named it — the only time to fix it is before anyone copies it in.
+
+## [5.36.0] - 2026-10-11
+
+### Added
+
+- **`<QrCode>` — a QR code as an SVG, with no dependencies.** ISO/IEC 18004,
+  versions 1–40, error correction L/M/Q/H, and numeric / alphanumeric / byte
+  modes selected automatically. **Nothing to do** — it is a new component and
+  nothing else changed.
+
+  ```tsx
+  <QrCode value="https://host/pair#482913" size={192} label="Pair this device" />
+  ```
+
+  `label` is required. A QR code is unusable to anyone who cannot point a second
+  device at the screen, so it needs an accessible name describing the
+  *destination* — and the value should also appear as text or a link nearby,
+  which an `aria-label` cannot substitute for.
+
+  Also exported on the `./qr-code` subpath, and **the encoder is exported
+  separately** (`encodeQr`, `selectMode`) for a consumer that needs the modules
+  rather than an SVG — a canvas, a PDF, a thermal printer, a terminal. Without
+  that, getting at them would mean adding a dependency for something already in
+  the package.
+
+  Three notes that decide whether a code actually scans, none of which are
+  visible in a screenshot:
+
+  - **The quiet zone is not padding.** It is how a scanner finds the symbol's
+    edge, so it defaults to the standard's minimum of 4 modules. `quietZone={0}`
+    is allowed and is not a space saving.
+  - **`background` defaults to `"transparent"`**, which inherits whatever is
+    behind it — so on a dark surface the symbol renders dark-on-dark and most
+    scanners refuse it. Set `foreground` and `background` together there.
+  - **`"H"` is not a free upgrade over `"M"`.** It survives more damage and
+    holds a third less, so at the same pixel width the modules are smaller; on a
+    phone screen it can read *worse*. Raise it for print or a covered symbol.
+
+  Rendered as a single `<path>` on a module-unit `viewBox` rather than a `<rect>`
+  per module: a version 10 symbol has over three thousand modules, and the
+  module-unit viewBox is what lets `size` scale with no resampling — a raster
+  code at a non-integer multiple of its module size has blurred module edges,
+  and a scanner reading a blurred edge guesses.
+
+  `encodeQr` throws a `RangeError` rather than truncating a value that will not
+  fit, because a truncated symbol scans cleanly and yields the wrong string.
+  Kanji mode and structured append are not supported; an untested branch in an
+  encoder fails as a code a phone quietly refuses to read.
+
+  Built for `claude · tynn`'s device-pairing panel (Genie 2 §6.8), which
+  previously had only a typed URL.
+
 ## [5.35.1] - 2026-10-10
 
 ### Fixed