aura-glass 3.4.5 → 3.4.7

package/README.md

@@ -152,9 +152,24 @@ npx aura-glass doctor --json
 - npm package: [npmjs.com/package/aura-glass](https://www.npmjs.com/package/aura-glass)
 - Changelog: [CHANGELOG.md](./CHANGELOG.md)
 - Installation guide: [INSTALLATION.md](./INSTALLATION.md)
+- Documentation: [docs](./docs)
+- Examples: [examples](./examples)
 - Contributing guide: [CONTRIBUTING.md](./CONTRIBUTING.md)
+- Security policy: [SECURITY.md](./SECURITY.md)
 - Agent context: [llms.txt](./llms.txt)
 
+## Contributing
+
+Contributions should improve package reliability, developer adoption, visual quality, accessibility, SSR behavior, documentation, or release evidence without weakening the public package boundary. Read [CONTRIBUTING.md](./CONTRIBUTING.md) before opening a pull request.
+
+## Security
+
+Report vulnerabilities using the guidance in [SECURITY.md](./SECURITY.md). Security-sensitive changes should preserve package-only installs, avoid credential leakage, and keep provider-backed hosted runtime behavior opt-in.
+
+## License
+
+AuraGlass is released under the [MIT License](./LICENSE).
+
 ## Package-Only And Optional Hosted Runtime
 
 The public npm package is the primary supported AuraGlass surface. Package-only apps install `aura-glass`, import components and CSS, and do not need AuraGlass API, WebSocket, Redis, OpenAI, Pinecone, Google Vision, Remove.bg, or Sentry infrastructure.
@@ -537,7 +552,7 @@ Useful scripts:
 
 ## Release Evidence
 
-The 3.4 surface redesign is verified by the release gate commands below — typecheck, token and style lints, the 31-check glass pipeline, 90 WCAG AA contrast checks, and 432 Jest suites with 2,373 tests — while 3.3-era package launch claims remain backed by checked-in evidence under `reports/3.3-release`. The final publish path uses `npm publish --access public --tag latest --provenance=false --ignore-scripts` after the dry-run, pack, and integration gates pass.
+The 3.4 surface redesign is verified by the release gate commands below — typecheck, token and style lints, the 31-check glass pipeline, 90 WCAG AA contrast checks, and 432 Jest suites with 2,373 tests — while 3.3-era package launch claims remain backed by checked-in evidence under `reports/3.3-release`. The normal publish path uses `npm publish --access public --tag latest` from a clean release commit after the dry-run, pack, and integration gates pass; `package.json` enables npm provenance for trusted publishing environments.
 
 Package gates:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aura-glass",
-  "version": "3.4.5",
+  "version": "3.4.7",
   "description": "Liquid Glass React and Next.js component library for polished dashboards, AI apps, media tools, and SaaS interfaces.",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -504,12 +504,19 @@
     "zod": "^3.22.0"
   },
   "overrides": {
+    "@grpc/grpc-js": "^1.14.4",
+    "@opentelemetry/core": "^2.9.0",
+    "@opentelemetry/resources": "^2.9.0",
+    "@opentelemetry/sdk-trace-base": "^2.9.0",
     "@tootallnate/once": "^3.0.1",
     "github-build": {
       "axios": "^1.16.0"
     },
+    "protobufjs": "^7.6.5",
     "scheduler": "^0.23.0",
-    "serialize-javascript": "^7.0.5"
+    "serialize-javascript": "^7.0.5",
+    "socket.io-adapter": "^2.5.8",
+    "ws": "^8.21.0"
   },
   "bundlesize": [
     {