@reportforge/playwright-pdf 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.18.0] - 2026-07-11
+
+### Changed
+
+- **Node 20 is now the minimum supported version** (was Node 18). Node 18 reached end-of-life in April 2025 and no longer receives security patches, and dependencies have begun dropping support for it. If you are still on Node 18, upgrade to Node 20 or later before taking this release. CI now tests against Node 20, 22, and 24.
+- `puppeteer-core` is now supported up to v25 (peer range widened to `>=21 <26`). Existing v21 to v24 installs keep working, so no action is needed unless you want to upgrade.
+- Internal dependency updates: `sharp` 0.35 (which requires Node 20), and `@types/node` 26.
+
+---
+
 ## [0.17.0] - 2026-07-09
 
 ### Added

package/README.md

@@ -677,6 +677,10 @@ Full documentation at [reportforge.org/docs](https://reportforge.org/docs):
 
 Questions and bug reports: email [support@reportforge.org](mailto:support@reportforge.org).
 
+## Security
+
+Found a vulnerability? Email [support@reportforge.org](mailto:support@reportforge.org) with a subject starting with `[SECURITY]` — please don't open a public issue. Details, scope, and response timelines are in [SECURITY.md](./SECURITY.md); machine-readable contact data is at [reportforge.org/.well-known/security.txt](https://reportforge.org/.well-known/security.txt).
+
 ## License
 
-[Elastic License 2.0](./LICENSE), source-available. Read, copy, and modify the source freely. Three things the license does not allow: offering the software as a hosted service, bypassing or removing the license-key check, and stripping license or copyright notices. Generating PDF reports requires an active subscription.
+[Elastic License 2.0](./LICENSE). The license does not allow offering the software as a hosted service, bypassing or removing the license-key check, or stripping license or copyright notices. Generating PDF reports requires an active subscription.

package/SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policy
+
+ReportForge handles license keys, payment webhooks, and customer data. We take
+vulnerability reports seriously and appreciate coordinated disclosure.
+
+## Reporting a vulnerability
+
+Email **[support@reportforge.org](mailto:support@reportforge.org)** with the
+subject line starting with `[SECURITY]`.
+
+Please include:
+
+- A description of the issue and where it lives (npm package
+  `@reportforge/playwright-pdf`, the `reportforge.org` service, or both).
+- Steps to reproduce, or a proof of concept.
+- The version(s) affected, if known.
+
+Please do **not** open a public GitHub issue for security reports, and do not
+test against production customer data — a trial subscription gives you a full
+legitimate environment to test the license flow.
+
+## What to expect
+
+- **Acknowledgement within 48 hours** of your report.
+- A triage verdict (accepted / not a vulnerability / duplicate) within 7 days.
+- If accepted: a fix or mitigation timeline, and credit in the release notes
+  if you want it. We ask for up to **90 days** of coordinated disclosure
+  before you publish details.
+- We do not currently run a paid bounty program.
+
+## Scope
+
+In scope:
+
+- The npm package `@reportforge/playwright-pdf` (report generation, license
+  client, bundled assets).
+- The `reportforge.org` service: license API, dashboard, checkout, webhooks.
+
+Out of scope:
+
+- Denial of service / volumetric attacks.
+- Reports about the 25-machine licensing cap working as documented.
+- Vulnerabilities exclusively in third-party services we integrate
+  (Razorpay, Clerk, Vercel, Resend) — report those upstream.
+
+## Supported versions
+
+Only the latest published version of `@reportforge/playwright-pdf` receives
+security fixes. Machine-readable contact data is published at
+[`https://reportforge.org/.well-known/security.txt`](https://reportforge.org/.well-known/security.txt).

package/dist/index.js

@@ -14155,7 +14155,7 @@ var PdfReporter = class {
     this.liveConsole = false;
     this.options = parseOptions(rawOptions);
     this.dataCollector = new DataCollector(this.options.capture);
-    this.version = true ? "0.17.0" : "0.x";
+    this.version = true ? "0.18.0" : "0.x";
     logger.info(`@reportforge/playwright-pdf v${this.version} initialised`);
     this.licenseClient = new LicenseClient({
       licenseKey: this.options.licenseKey,

package/dist/index.mjs

@@ -14156,7 +14156,7 @@ var PdfReporter = class {
     this.liveConsole = false;
     this.options = parseOptions(rawOptions);
     this.dataCollector = new DataCollector(this.options.capture);
-    this.version = true ? "0.17.0" : "0.x";
+    this.version = true ? "0.18.0" : "0.x";
     logger.info(`@reportforge/playwright-pdf v${this.version} initialised`);
     this.licenseClient = new LicenseClient({
       licenseKey: this.options.licenseKey,

package/package.json

@@ -1,16 +1,11 @@
 {
   "name": "@reportforge/playwright-pdf",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Playwright Test reporter that generates designed PDF reports: minimal, detailed, and executive templates with CI/CD integrations",
   "license": "Elastic-2.0",
   "author": "ReportForge",
   "homepage": "https://reportforge.org",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/muralidharan92/reportforge"
-  },
   "bugs": {
-    "url": "https://github.com/muralidharan92/reportforge/issues",
     "email": "support@reportforge.org"
   },
   "keywords": [
@@ -30,7 +25,11 @@
     "pdf-generator",
     "ci",
     "puppeteer",
-    "html-to-pdf"
+    "html-to-pdf",
+    "reportforge",
+    "reportforge-playwright-pdf",
+    "report",
+    "forge"
   ],
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -53,7 +52,8 @@
     "ci-templates",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "prebuild": "npm run bundle-chartjs && npm run bundle-fonts && npm run bundle-pubkey && npm run bundle-model && npm run precompile-templates",
@@ -82,14 +82,14 @@
   },
   "peerDependencies": {
     "@playwright/test": ">=1.40.0",
-    "puppeteer-core": ">=21.0.0 <25.0.0"
+    "puppeteer-core": ">=21.0.0 <26.0.0"
   },
   "dependencies": {
     "chrome-finder": "^1.0.7",
     "framer-motion": "^12.40.0",
     "glob": "^13.0.6",
     "handlebars": "^4.7.8",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.3",
     "zod": "^3.23.8"
   },
   "devDependencies": {
@@ -98,20 +98,20 @@
     "@fontsource/source-serif-pro": "^5.2.5",
     "@playwright/test": "^1.49.0",
     "@types/handlebars": "^4.1.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.1.1",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
-    "@vitest/coverage-v8": "^2.1.0",
+    "@vitest/coverage-v8": "^4.1.10",
     "chart.js": "^4.4.0",
     "eslint": "^9.0.0",
     "prettier": "^3.3.0",
-    "puppeteer-core": "^23.0.0",
+    "puppeteer-core": "^25.3.0",
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.6.0",
-    "vitest": "^2.1.0"
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }