@reportforge/playwright-pdf 0.16.1 → 0.18.0

package/CHANGELOG.md

@@ -3,11 +3,30 @@
 All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.18.0] - 2026-07-11
+
+### Changed
+
+- **Node 20 is now the minimum supported version** (was Node 18). Node 18 reached end-of-life in April 2025 and no longer receives security patches, and dependencies have begun dropping support for it. If you are still on Node 18, upgrade to Node 20 or later before taking this release. CI now tests against Node 20, 22, and 24.
+- `puppeteer-core` is now supported up to v25 (peer range widened to `>=21 <26`). Existing v21 to v24 installs keep working, so no action is needed unless you want to upgrade.
+- Internal dependency updates: `sharp` 0.35 (which requires Node 20), and `@types/node` 26.
+
+---
+
+## [0.17.0] - 2026-07-09
+
+### Added
+
+- **The reporter now tells you when a newer version is available.** Each run ends with one info line naming the current and latest version and the update command, e.g. `Update available: 0.16.1 -> 0.17.0. Run: npm i -D @reportforge/playwright-pdf@latest`. The latest published version is piggybacked on the existing license activate/refresh call, so there are no extra network calls; the notice never blocks or fails a run and disappears once you update.
+- **Admins can send release announcement emails.** A new `/admin/announce` panel builds the email body from the changelog entry for a chosen version and sends it to a selected audience (active subscribers, all subscribers, or active plus recently churned within 90 days), with a preview step and idempotency protection against duplicate sends.
+
+---
+
 ## [0.16.1] - 2026-07-09
 
 ### Changed
 
-- **Relicensed from MIT to the Elastic License 2.0** (source-available). The source stays readable, copyable, and modifiable; the license does not allow offering the software as a hosted service, bypassing or removing the license-key check, or stripping license/copyright notices. Surfaces updated together: `LICENSE`, `package.json` license metadata, README badge + License section, docs badge, marketing footer, pricing FAQ, and legal terms (§2 License grant, §7 IP, `lastUpdated`). Versions 0.16.0 and earlier were published under MIT and remain MIT.
+- **Relicensed from MIT to the Elastic License 2.0** (source-available). The source stays readable, copyable, and modifiable; the license does not allow offering the software as a hosted service, bypassing or removing the license-key check, or stripping license/copyright notices. Surfaces updated together: `LICENSE`, `package.json` license metadata, README badge + License section, docs badge, marketing footer, pricing FAQ, and legal terms (§2 License grant, §7 IP, `lastUpdated`).
 
 ---
 

package/README.md

@@ -47,7 +47,7 @@ Three templates, one reporter. Every PDF is fully offline: fonts, charts, and sc
 
 - **3 templates**: `minimal` (developer), `detailed` (QA team), `executive` (stakeholders)
 - **Detailed reports**: KPI dashboard, suite breakdown with inline failure detail (error, screenshot, root-cause chip) under each failed test, CI/CD environment
-- **Embedded Chart.js**: pass-rate doughnut + per-suite bar chart, bundled inline (no CDN); every suite gets its own bar — large runs switch to full-width suite charts that continue across pages, so per-suite coverage and failures stay visible run-wide
+- **Embedded Chart.js**: pass-rate doughnut + per-suite bar chart, bundled inline (no CDN); every suite gets its own bar, and large runs switch to full-width suite charts that continue across pages, so per-suite coverage and failures stay visible run-wide
 - **Self-contained PDFs**: screenshots, fonts, logos all embedded; share or archive with confidence
 - **Custom branding**: logo, primary/accent colours, watermark, PDF password encryption
 - **Dynamic filenames**: `{date}`, `{branch}`, `{status}` tokens in the output path
@@ -63,6 +63,7 @@ Three templates, one reporter. Every PDF is fully offline: fonts, charts, and sc
 - **Configurable sections**: add or remove any report section per template via `sections`.
 - **Executive report brief band**: leads with a plain-language brief (trend + root causes) and one hero pass-rate number instead of a flat KPI grid
 - **Hybrid licensing**: one short key unlocks it; reports keep rendering offline via a cached JWT between refreshes
+- **Update notice**: when a newer reporter version is published, each run ends with one info line naming it and the update command; delivered over the existing license refresh, no extra network calls
 
 ---
 
@@ -97,7 +98,7 @@ npx playwright test
 
 > **See it first.** Run `npx @reportforge/playwright-pdf demo` to generate a realistic sample PDF in under 60 seconds, no license key required. Supports `--template=minimal|detailed|executive` and `--output=<path>`.
 
-> **License required.** Start a **[7-day free trial at reportforge.org/pricing](https://reportforge.org/pricing)**: card required, no charge until day 8. Paste the resulting `RFSU-…` key into `RF_LICENSE_KEY`. Without a valid license the reporter logs a warning and skips PDF generation; your Playwright tests still run normally.
+> **License required.** Start a **[7-day free trial at reportforge.org/pricing](https://reportforge.org/pricing)**: card required, no charge until day 8. Paste the resulting `RFSU-…` key into `RF_LICENSE_KEY`. Without a valid license the reporter logs a warning and skips PDF generation; your Playwright tests still run normally. When a newer reporter version exists, runs end with a one-line update notice.
 
 ---
 
@@ -157,7 +158,7 @@ reporter: [['@reportforge/playwright-pdf', {
 | Plan | INR | USD | Includes |
 |---|---|---|---|
 | **Monthly** | **₹999 / month** | **$12 / month** | All three templates · custom branding · PDF encryption · up to 25 active machines · priority email support |
-| **Yearly** | **₹8,499 / year** | **$99 / year** | Everything in Monthly · ~29–31% saving vs monthly |
+| **Yearly** | **₹8,499 / year** | **$99 / year** | Everything in Monthly · ~29-31% saving vs monthly |
 
 Currency is auto-detected by region; toggle on the pricing page.
 
@@ -198,7 +199,7 @@ All options are the second element of the reporter tuple.
 | `notify` | `object` | n/a | Notification channels: `slack`, `teams` (each `{ url, enabled, on }`), `discord` (`{ url, enabled, on, attachPdf }`), `email` (`{ to, enabled, on, attachPdf }`). See the Notifications docs. |
 | `failureAnalysis` | `object` | `{ enabled: true }` | Offline failure root-cause analysis (embedded Naive Bayes; no runtime network). Fields: `enabled` (default `true`), `maxClusters` (default `10`), `minStrength` (`weak`\|`moderate`\|`strong`, default `weak`), `maxFailuresToAnalyse` (default `500`), `collectUnclassified` (default `true`), `autoUpdateModel` (default `true`). See the Failure Analysis docs. |
 | `capture` | `object` | `{}` (off) | Opt-in rich execution capture for the defect log (reporter-side; no fixtures, no test-code changes). Fields: `steps` (a copy-pasteable "Steps to Reproduce" outline built from the Playwright step tree; each row is a Markdown list line indented under its parent `test.step`, default `false`), `apiSteps` (include every top-level `pw:api` action (click/fill/check/goto) in the outline for a full action trail; without it the outline shows only `test.step` intent + `expect` assertions, default `false`), `console` (Node stdout/stderr tail, default `false`), `evidence` (trace/video file links, default `false`), `maxSteps` (default `50`), `maxConsoleLines` (default `50`). Renders in the Defect Log section of the `detailed` template. |
-| `live` | `object` | `{}` (off) | Opt-in live test-execution streaming. When `enabled`, the reporter prints an unguessable watch link to the CI logs at run start and streams per-test progress to the hosted dashboard while tests run; all shards of one CI run converge on a single live view. Fields: `enabled` (default `false`), `runId` (override the auto-derived run id), `serverUrl` (override the streaming server), `steps` (`none`\|`failed`\|`intent`\|`all`, default `failed`; `intent` shows only your `test.step` names plus any failing step), `console` (stream stdout/stderr tails, default `false`), `flushMs` (batch debounce 500–10000, default `2000`). The PDF at the end of the run is unaffected. Requires an active subscription with the `live` entitlement. See the Live Runs docs. |
+| `live` | `object` | `{}` (off) | Opt-in live test-execution streaming. When `enabled`, the reporter prints an unguessable watch link to the CI logs at run start and streams per-test progress to the hosted dashboard while tests run; all shards of one CI run converge on a single live view. Fields: `enabled` (default `false`), `runId` (override the auto-derived run id), `serverUrl` (override the streaming server), `steps` (`none`\|`failed`\|`intent`\|`all`, default `failed`; `intent` shows only your `test.step` names plus any failing step), `console` (stream stdout/stderr tails, default `false`), `flushMs` (batch debounce 500-10000, default `2000`). The PDF at the end of the run is unaffected. Requires an active subscription with the `live` entitlement. See the Live Runs docs. |
 | `historyFile` | `string` | `~/.reportforge/{key}/history.json` | Path to the history JSON file. Relative paths resolve from `cwd`. Enables pass-rate trending charts in the `detailed` template. |
 | `historySize` | `number` | `10` | Maximum number of test runs to keep in the history file (integer ≥ 2). Older runs are pruned on append. |
 | `showTrend` | `boolean` | `true` | Show the pass-rate sparkline and delta badge in the `detailed` template. Set to `false` to disable history tracking entirely. |
@@ -225,7 +226,7 @@ reporter: [
       enabled: true,
       steps: 'failed',   // 'none' | 'failed' | 'intent' | 'all'
       // console: false,  // stream stdout/stderr tails (off by default; see note)
-      // flushMs: 2000,   // batch debounce (500–10000)
+      // flushMs: 2000,   // batch debounce (500-10000)
     },
   }],
 ],
@@ -676,8 +677,10 @@ Full documentation at [reportforge.org/docs](https://reportforge.org/docs):
 
 Questions and bug reports: email [support@reportforge.org](mailto:support@reportforge.org).
 
-## License
+## Security
+
+Found a vulnerability? Email [support@reportforge.org](mailto:support@reportforge.org) with a subject starting with `[SECURITY]` — please don't open a public issue. Details, scope, and response timelines are in [SECURITY.md](./SECURITY.md); machine-readable contact data is at [reportforge.org/.well-known/security.txt](https://reportforge.org/.well-known/security.txt).
 
-[Elastic License 2.0](./LICENSE), source-available. Read, copy, and modify the source freely. Three things the license does not allow: offering the software as a hosted service, bypassing or removing the license-key check, and stripping license or copyright notices. Generating PDF reports requires an active subscription.
+## License
 
-Versions 0.16.0 and earlier shipped under MIT and stay MIT.
+[Elastic License 2.0](./LICENSE). The license does not allow offering the software as a hosted service, bypassing or removing the license-key check, or stripping license or copyright notices. Generating PDF reports requires an active subscription.

package/SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policy
+
+ReportForge handles license keys, payment webhooks, and customer data. We take
+vulnerability reports seriously and appreciate coordinated disclosure.
+
+## Reporting a vulnerability
+
+Email **[support@reportforge.org](mailto:support@reportforge.org)** with the
+subject line starting with `[SECURITY]`.
+
+Please include:
+
+- A description of the issue and where it lives (npm package
+  `@reportforge/playwright-pdf`, the `reportforge.org` service, or both).
+- Steps to reproduce, or a proof of concept.
+- The version(s) affected, if known.
+
+Please do **not** open a public GitHub issue for security reports, and do not
+test against production customer data — a trial subscription gives you a full
+legitimate environment to test the license flow.
+
+## What to expect
+
+- **Acknowledgement within 48 hours** of your report.
+- A triage verdict (accepted / not a vulnerability / duplicate) within 7 days.
+- If accepted: a fix or mitigation timeline, and credit in the release notes
+  if you want it. We ask for up to **90 days** of coordinated disclosure
+  before you publish details.
+- We do not currently run a paid bounty program.
+
+## Scope
+
+In scope:
+
+- The npm package `@reportforge/playwright-pdf` (report generation, license
+  client, bundled assets).
+- The `reportforge.org` service: license API, dashboard, checkout, webhooks.
+
+Out of scope:
+
+- Denial of service / volumetric attacks.
+- Reports about the 25-machine licensing cap working as documented.
+- Vulnerabilities exclusively in third-party services we integrate
+  (Razorpay, Clerk, Vercel, Resend) — report those upstream.
+
+## Supported versions
+
+Only the latest published version of `@reportforge/playwright-pdf` receives
+security fixes. Machine-readable contact data is published at
+[`https://reportforge.org/.well-known/security.txt`](https://reportforge.org/.well-known/security.txt).

package/dist/index.d.mts

@@ -379,6 +379,13 @@ interface LicenseInfo {
      * field was persisted — treat absence as "no extra features".
      */
     features?: string[];
+    /**
+     * Latest published npm version of the reporter, as last reported by the
+     * license server (activate/refresh piggyback). Absent when the server
+     * could not reach the registry or the cache predates this field. Used
+     * only for the non-blocking run-end update notice.
+     */
+    latestVersion?: string;
 }
 
 /**
@@ -417,6 +424,7 @@ interface LicenseInfo {
 declare class PdfReporter implements Reporter {
     private readonly options;
     private readonly cwd;
+    private readonly version;
     private readonly licenseClient;
     private readonly dataCollector;
     private readonly pdfGenerator;

package/dist/index.d.ts

@@ -379,6 +379,13 @@ interface LicenseInfo {
      * field was persisted — treat absence as "no extra features".
      */
     features?: string[];
+    /**
+     * Latest published npm version of the reporter, as last reported by the
+     * license server (activate/refresh piggyback). Absent when the server
+     * could not reach the registry or the cache predates this field. Used
+     * only for the non-blocking run-end update notice.
+     */
+    latestVersion?: string;
 }
 
 /**
@@ -417,6 +424,7 @@ interface LicenseInfo {
 declare class PdfReporter implements Reporter {
     private readonly options;
     private readonly cwd;
+    private readonly version;
     private readonly licenseClient;
     private readonly dataCollector;
     private readonly pdfGenerator;

package/dist/index.js

@@ -10995,7 +10995,8 @@ var LicenseClient = class {
         fingerprintHash: this.fingerprint.hash,
         machinesUsed: result.machinesUsed,
         machineLimit: result.machineLimit,
-        features: payload.features
+        features: payload.features,
+        latestVersion: result.latestVersion
       };
       writeCache(entry);
       logger.debug(`license path=${cached ? "refresh" : "activate"} response`, {
@@ -11014,7 +11015,8 @@ var LicenseClient = class {
         expiry: new Date(payload.exp * 1e3),
         machinesUsed: result.machinesUsed,
         machineLimit: result.machineLimit,
-        features: payload.features
+        features: payload.features,
+        latestVersion: result.latestVersion
       };
     } catch (err) {
       const msg = err.message;
@@ -11111,13 +11113,47 @@ function toLicenseInfo(payload, cached, normalizedKey, source) {
     // Prefer the signed `features` claim (authenticated) over the unauthenticated
     // sidecar — falls back to the sidecar only for caches written before the
     // payload was threaded through here.
-    features: payload.features ?? cached.features
+    features: payload.features ?? cached.features,
+    latestVersion: cached.latestVersion
   };
 }
 function normalizeUrl(url) {
   return url.endsWith("/") ? url.slice(0, -1) : url;
 }
 
+// src/license/update-notice.ts
+init_cjs_shims();
+
+// src/license/version.ts
+init_cjs_shims();
+function parseTriple(v) {
+  if (!v) return null;
+  const m = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(v.trim());
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function isNewer(latest, current) {
+  const l = parseTriple(latest);
+  const c = parseTriple(current);
+  if (!l || !c) return false;
+  if (l[0] !== c[0]) return l[0] > c[0];
+  if (l[1] !== c[1]) return l[1] > c[1];
+  return l[2] > c[2];
+}
+
+// src/license/update-notice.ts
+function maybePrintUpdateNotice(licenseInfo, currentVersion) {
+  try {
+    const latest = licenseInfo?.latestVersion;
+    if (!latest || !isNewer(latest, currentVersion)) return;
+    const shown = latest.replace(/[^\w.+-]/g, "");
+    logger.info(
+      `Update available: ${currentVersion} -> ${shown}. Run: npm i -D @reportforge/playwright-pdf@latest`
+    );
+  } catch {
+  }
+}
+
 // src/analysis/index.ts
 init_cjs_shims();
 
@@ -14119,8 +14155,8 @@ var PdfReporter = class {
     this.liveConsole = false;
     this.options = parseOptions(rawOptions);
     this.dataCollector = new DataCollector(this.options.capture);
-    const version = true ? "0.16.1" : "0.x";
-    logger.info(`@reportforge/playwright-pdf v${version} initialised`);
+    this.version = true ? "0.18.0" : "0.x";
+    logger.info(`@reportforge/playwright-pdf v${this.version} initialised`);
     this.licenseClient = new LicenseClient({
       licenseKey: this.options.licenseKey,
       serverUrl: this.options.serverUrl,
@@ -14193,7 +14229,10 @@ var PdfReporter = class {
     const licenseInfo = await this.license();
     if (!licenseInfo) return;
     const collected = this._collectData(result);
-    if (!collected) return;
+    if (!collected) {
+      maybePrintUpdateNotice(licenseInfo, this.version);
+      return;
+    }
     if (this.options.showTrend && collected.stats.total > 0) {
       try {
         this._appendTrend(collected);
@@ -14218,6 +14257,7 @@ var PdfReporter = class {
       const sender = new NotificationSender();
       await sender.sendAll(reportData, this.options.notify, pdfPaths);
     }
+    maybePrintUpdateNotice(licenseInfo, this.version);
   }
   _collectData(result) {
     if (this.options.shardResults && this.options.shardResults.length > 0) {

package/dist/index.mjs

@@ -10996,7 +10996,8 @@ var LicenseClient = class {
         fingerprintHash: this.fingerprint.hash,
         machinesUsed: result.machinesUsed,
         machineLimit: result.machineLimit,
-        features: payload.features
+        features: payload.features,
+        latestVersion: result.latestVersion
       };
       writeCache(entry);
       logger.debug(`license path=${cached ? "refresh" : "activate"} response`, {
@@ -11015,7 +11016,8 @@ var LicenseClient = class {
         expiry: new Date(payload.exp * 1e3),
         machinesUsed: result.machinesUsed,
         machineLimit: result.machineLimit,
-        features: payload.features
+        features: payload.features,
+        latestVersion: result.latestVersion
       };
     } catch (err) {
       const msg = err.message;
@@ -11112,13 +11114,47 @@ function toLicenseInfo(payload, cached, normalizedKey, source) {
     // Prefer the signed `features` claim (authenticated) over the unauthenticated
     // sidecar — falls back to the sidecar only for caches written before the
     // payload was threaded through here.
-    features: payload.features ?? cached.features
+    features: payload.features ?? cached.features,
+    latestVersion: cached.latestVersion
   };
 }
 function normalizeUrl(url) {
   return url.endsWith("/") ? url.slice(0, -1) : url;
 }
 
+// src/license/update-notice.ts
+init_esm_shims();
+
+// src/license/version.ts
+init_esm_shims();
+function parseTriple(v) {
+  if (!v) return null;
+  const m = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(v.trim());
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function isNewer(latest, current) {
+  const l = parseTriple(latest);
+  const c = parseTriple(current);
+  if (!l || !c) return false;
+  if (l[0] !== c[0]) return l[0] > c[0];
+  if (l[1] !== c[1]) return l[1] > c[1];
+  return l[2] > c[2];
+}
+
+// src/license/update-notice.ts
+function maybePrintUpdateNotice(licenseInfo, currentVersion) {
+  try {
+    const latest = licenseInfo?.latestVersion;
+    if (!latest || !isNewer(latest, currentVersion)) return;
+    const shown = latest.replace(/[^\w.+-]/g, "");
+    logger.info(
+      `Update available: ${currentVersion} -> ${shown}. Run: npm i -D @reportforge/playwright-pdf@latest`
+    );
+  } catch {
+  }
+}
+
 // src/analysis/index.ts
 init_esm_shims();
 
@@ -14120,8 +14156,8 @@ var PdfReporter = class {
     this.liveConsole = false;
     this.options = parseOptions(rawOptions);
     this.dataCollector = new DataCollector(this.options.capture);
-    const version = true ? "0.16.1" : "0.x";
-    logger.info(`@reportforge/playwright-pdf v${version} initialised`);
+    this.version = true ? "0.18.0" : "0.x";
+    logger.info(`@reportforge/playwright-pdf v${this.version} initialised`);
     this.licenseClient = new LicenseClient({
       licenseKey: this.options.licenseKey,
       serverUrl: this.options.serverUrl,
@@ -14194,7 +14230,10 @@ var PdfReporter = class {
     const licenseInfo = await this.license();
     if (!licenseInfo) return;
     const collected = this._collectData(result);
-    if (!collected) return;
+    if (!collected) {
+      maybePrintUpdateNotice(licenseInfo, this.version);
+      return;
+    }
     if (this.options.showTrend && collected.stats.total > 0) {
       try {
         this._appendTrend(collected);
@@ -14219,6 +14258,7 @@ var PdfReporter = class {
       const sender = new NotificationSender();
       await sender.sendAll(reportData, this.options.notify, pdfPaths);
     }
+    maybePrintUpdateNotice(licenseInfo, this.version);
   }
   _collectData(result) {
     if (this.options.shardResults && this.options.shardResults.length > 0) {

package/package.json

@@ -1,16 +1,11 @@
 {
   "name": "@reportforge/playwright-pdf",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "description": "Playwright Test reporter that generates designed PDF reports: minimal, detailed, and executive templates with CI/CD integrations",
   "license": "Elastic-2.0",
   "author": "ReportForge",
   "homepage": "https://reportforge.org",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/muralidharan92/reportforge"
-  },
   "bugs": {
-    "url": "https://github.com/muralidharan92/reportforge/issues",
     "email": "support@reportforge.org"
   },
   "keywords": [
@@ -30,7 +25,11 @@
     "pdf-generator",
     "ci",
     "puppeteer",
-    "html-to-pdf"
+    "html-to-pdf",
+    "reportforge",
+    "reportforge-playwright-pdf",
+    "report",
+    "forge"
   ],
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -53,7 +52,8 @@
     "ci-templates",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "prebuild": "npm run bundle-chartjs && npm run bundle-fonts && npm run bundle-pubkey && npm run bundle-model && npm run precompile-templates",
@@ -82,14 +82,14 @@
   },
   "peerDependencies": {
     "@playwright/test": ">=1.40.0",
-    "puppeteer-core": ">=21.0.0 <25.0.0"
+    "puppeteer-core": ">=21.0.0 <26.0.0"
   },
   "dependencies": {
     "chrome-finder": "^1.0.7",
     "framer-motion": "^12.40.0",
     "glob": "^13.0.6",
     "handlebars": "^4.7.8",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.3",
     "zod": "^3.23.8"
   },
   "devDependencies": {
@@ -98,20 +98,20 @@
     "@fontsource/source-serif-pro": "^5.2.5",
     "@playwright/test": "^1.49.0",
     "@types/handlebars": "^4.1.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.1.1",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
-    "@vitest/coverage-v8": "^2.1.0",
+    "@vitest/coverage-v8": "^4.1.10",
     "chart.js": "^4.4.0",
     "eslint": "^9.0.0",
     "prettier": "^3.3.0",
-    "puppeteer-core": "^23.0.0",
+    "puppeteer-core": "^25.3.0",
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.6.0",
-    "vitest": "^2.1.0"
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }