create-volt 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `create-volt` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.14.0] - 2026-06-28
+
+### Changed
+- **Adopted the most-secure admin model: ephemeral, shell-only.** Removed the
+  persistent role-gated `admin` add-on (from 0.13.0). There is now **no web
+  admin** anywhere — the data browser is the ephemeral, localhost-only
+  `--studio`, and config is `--edit`; both are shell/SSH-gated. SECURITY.md
+  updated to state this as a core property.
+
+### Added
+- Dependency auto-update: `scripts/update-deps.mjs` + a weekly GitHub Action
+  bump create-volt's pinned dependency floors to the latest **within the current
+  major** (never a breaking major). Repo-only — scaffolded apps are untouched.
+- Refreshed floors: express ^4.22.2, socket.io ^4.8.3, mongodb ^6.21.0,
+  mysql2 ^3.22.5, pg ^8.22.0, nodemailer ^6.10.1.
+
+## [0.13.0] - 2026-06-28
+
+### Added
+- Opt-in **`admin`** add-on: a persistent, role-gated web admin (data browser)
+  for browser-only admins. Gated by auth **and** an `ADMIN_EMAILS` allowlist;
+  the panel is hidden for non-admins and `/admin/api/*` returns 403. Internal
+  collections (auth tokens/sessions) hidden. Wired into the default + starter
+  templates and the setup wizard (ADMIN_EMAILS field).
+- `SECURITY.md` documenting the ephemeral-admin model and secure defaults.
+
+### Note
+- Prefer the ephemeral `--studio` (shell-gated) for admins with server access;
+  the `admin` add-on is the explicit standing-surface opt-in for non-shell admins.
+
 ## [0.12.0] - 2026-06-28
 
 ### Added
@@ -173,6 +203,8 @@ All notable changes to `create-volt` are documented here. The format follows
   watching and full-page hot reload. Supports `--skip-install` and `--force`,
   and auto-detects npm / pnpm / yarn / bun for the install step.
 
+[0.14.0]: https://github.com/MIR-2025/volt/releases/tag/v0.14.0
+[0.13.0]: https://github.com/MIR-2025/volt/releases/tag/v0.13.0
 [0.12.0]: https://github.com/MIR-2025/volt/releases/tag/v0.12.0
 [0.11.0]: https://github.com/MIR-2025/volt/releases/tag/v0.11.0
 [0.10.0]: https://github.com/MIR-2025/volt/releases/tag/v0.10.0

package/README.md

@@ -80,6 +80,16 @@ driver, and is **never** a route in the running app (no standing `/admin` to
 attack — shell/SSH access is the gate). Needs a persistent driver (MongoDB /
 MySQL / Postgres) to show data; the memory driver is per-process.
 
+## Security & admin model
+
+Volt is secure by default, and deliberately has **no web admin** — nothing like
+`/wp-admin` anywhere. The config wizard (`--edit`) and data browser (`--studio`)
+are ephemeral, localhost-only processes; **shell/SSH access is the auth**.
+Several admins? Give each an SSH key — stronger than a shared web panel, with
+nothing public to attack. Plus: escaping by default (no XSS), server-side
+validation + caps, security headers, and `HttpOnly`+`SameSite` cookies. See
+[SECURITY.md](https://github.com/MIR-2025/volt/blob/main/SECURITY.md).
+
 ## Updating Volt
 
 Volt is vendored as a single file (`public/volt.js`), not an npm dependency.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-volt",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Scaffold a new Volt app — no-build, signals-based UI with Socket.io hot reload.",
   "type": "module",
   "bin": {

package/templates/default/package.json

@@ -10,7 +10,7 @@
     "dev": "node server.js"
   },
   "dependencies": {
-    "express": "^4.19.2",
-    "socket.io": "^4.7.5"
+    "express": "^4.22.2",
+    "socket.io": "^4.8.3"
   }
 }

package/templates/default/server.js

@@ -21,7 +21,7 @@ const ENV_PATH = path.join(__dirname, ".env");
 const PKG_PATH = path.join(__dirname, "package.json");
 const ADDONS_DIR = path.join(__dirname, ".volt", "addons"); // bundled add-on sources
 const DEFAULT_PORT = 26628; // create-volt stamps this with the project's date-port
-const PKG_VERSIONS = { mongodb: "^6.8.0", mysql2: "^3.11.0", pg: "^8.12.0", nodemailer: "^6.9.0" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1" };
 const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---

package/templates/guestbook/package.json

@@ -10,12 +10,12 @@
     "dev": "node server.js"
   },
   "dependencies": {
-    "express": "^4.19.2",
-    "socket.io": "^4.7.5"
+    "express": "^4.22.2",
+    "socket.io": "^4.8.3"
   },
   "optionalDependencies": {
-    "mongodb": "^6.8.0",
-    "mysql2": "^3.11.0",
-    "pg": "^8.12.0"
+    "mongodb": "^6.21.0",
+    "mysql2": "^3.22.5",
+    "pg": "^8.22.0"
   }
 }

package/templates/starter/package.json

@@ -10,7 +10,7 @@
     "dev": "node server.js"
   },
   "dependencies": {
-    "express": "^4.19.2",
-    "socket.io": "^4.7.5"
+    "express": "^4.22.2",
+    "socket.io": "^4.8.3"
   }
 }

package/templates/starter/public/app.js

@@ -137,7 +137,6 @@ if (hasChat) {
     /* chat UI unavailable */
   }
 }
-
 const TABS = [
   ["home", "Home"],
   ...(hasAuth ? [["notes", "Notes"]] : []),

package/templates/starter/server.js

@@ -22,7 +22,7 @@ const ENV_PATH = path.join(__dirname, ".env");
 const PKG_PATH = path.join(__dirname, "package.json");
 const ADDONS_DIR = path.join(__dirname, ".volt", "addons"); // bundled add-on sources
 const DEFAULT_PORT = 26628; // create-volt stamps this with the project's date-port
-const PKG_VERSIONS = { mongodb: "^6.8.0", mysql2: "^3.11.0", pg: "^8.12.0", nodemailer: "^6.9.0" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1" };
 const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---