proj4 2.20.6 → 2.20.7

package/PUBLISHING.md

@@ -1,22 +1,34 @@
 Publishing
 ===
 
-Make sure you have the latest from the main branch:
+## Releasing a new version
 
-    git pull origin master
+1. Make sure you have the latest from the main branch:
 
-Use `tin` to update the version number in the `package.json`, `component.json` & `bower.json`.
+       git pull origin master
 
-    tin -v x.y.z
+2. Update `changelog.md` with the changes since the last release, then commit:
 
-Then run the publish script
+       git add changelog.md
+       git commit -m 'update changelog for x.y.z'
 
-   ./publish.sh
+4. Set the release version (updates `package.json` and `package-lock.json`, creates a commit and a git tag):
 
-afterwards don't forget to update the versions to be a prerelease of the next version, so if you just published 1.1.1 then:
+       npm version x.y.z
 
-    tin -v 1.1.2-alpha
-    npm install
-    git add package.json package-lock.json component.json bower.json
-    git commit -m 'update version to 1.1.2-alpha'
-    git push origin master
+5. Push the commit and tag:
+
+       git push --follow-tags
+
+6. The tag push triggers two GitHub Actions workflows:
+   - **publish.yml** — publishes to npm using [trusted publishing with OIDC](https://docs.npmjs.com/trusted-publishers) (no token required, provenance is automatic)
+   - **release.yml** — drafts a GitHub release with `dist.zip` attached (contains the full `dist/` directory)
+
+7. Go to the [GitHub releases page](https://github.com/proj4js/proj4js/releases), review the draft release, edit the notes if needed, and publish it.
+
+8. Update the version to the next pre-release:
+
+       npm version x.y.(z+1)-alpha --no-git-tag-version
+       git add package.json package-lock.json
+       git commit -m 'update version to x.y.(z+1)-alpha'
+       git push origin master

package/README.md

@@ -10,11 +10,9 @@ Depending on your preferences
 
 ```bash
 npm install proj4
-bower install proj4
-component install proj4js/proj4js
 ```
 
-or just manually grab the file `proj4.js` from the [latest release](https://github.com/proj4js/proj4js/releases)'s `dist/` folder.
+or download `dist.zip` from the [latest release](https://github.com/proj4js/proj4js/releases) and grab `proj4.js` from it.
 
 If you do not want to download anything, Proj4js is also hosted on [cdnjs](https://www.cdnjs.com/libraries/proj4js) for direct use in your browser applications.
 
@@ -179,12 +177,12 @@ await proj4.nadgrid('ca_nrc_NA83SCRS.tif', tiff).ready;
 Then use the given key in your definition, e.g. `proj4.defs("EPSG:32188","+proj=tmerc +lat_0=0 +lon_0=-73.5 +k=0.9999 +x_0=304800 +y_0=0 +ellps=GRS80 +nadgrids=ca_nrc_NA83SCRS.tif +units=m +no_defs +type=crs");` noting the `+nadgrids=ca_nrc_NA83SCRS.tif` parameter.
 
 ## Developing
-To set up build tools make sure you have node and grunt-cli installed and then run `npm install`.
+To set up build tools make sure you have node installed and then run `npm install`.
 
-To do the complete build and browser tests run
+To do the complete build run
 
 ```bash
-node_modules/.bin/grunt
+npm run build
 ```
 
 To run node and browser tests run
@@ -203,16 +201,16 @@ npm run test:coverage
 To create a build with only default projections (latlon and Mercator) run
 
 ```bash
-node_modules/.bin/grunt build
+node scripts/build.mjs default
 ```
 
-To create a build with only custom projections include a comma separated list of projections codes (the file name in 'lib/projections' without the '.js') after a colon, e.g.
+To create a build with only custom projections include a comma separated list of projections codes (the file name in 'lib/projections' without the '.js'), e.g.
 
 ```bash
-node_modules/.bin/grunt build:tmerc
+node scripts/build.mjs tmerc
 #includes transverse Mercator
-node_modules/.bin/grunt build:lcc
+node scripts/build.mjs lcc
 #includes lambert conformal conic
-node_modules/.bin/grunt build:omerc,moll
+node scripts/build.mjs omerc,moll
 #includes oblique Mercator and Mollweide
 ```

package/SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release of proj4js receives security fixes.
+
+| Version | Supported |
+|---------|-----------|
+| latest  | ✅        |
+| older   | ❌        |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues.
+
+Instead, use [GitHub private vulnerability reporting](https://github.com/proj4js/proj4js/security/advisories/new) to submit a report confidentially. This allows us to assess and address the issue before any public disclosure.
+
+Please include:
+- A description of the vulnerability and its potential impact
+- Steps to reproduce or a minimal proof-of-concept
+- Any suggested mitigations, if known
+
+We will acknowledge the report within 7 days and aim to release a fix within 90 days, following responsible disclosure practices.

package/changelog.md

@@ -1,5 +1,7 @@
-Change log
-===
+## Change log
+
+- 2.20.7: GitHub releases now contain a separate dist.zip file, so users don't have to find the dist folder in the downloaded source code any more; removed bower.json and component.json; trusted OIDC publishing for the npm package; added security policy; vitest instead of mocha for the tests; removed grunt; renamed main branch to main
+
 - 2.20.0: Include WGS84 UTM zones 1-60 North/South and WGS84 UPS North/South; add support for `+over`; add general oblique transformation; make projjson work with `proj4.defs(code, projjson)`
 
 - 2.19.0: TypeScript type definitions are now included. When upgrading, please uninstall the `@types/proj4` package.

package/dist/proj4-src.js

@@ -10660,7 +10660,7 @@
     nadgrid,
     transform,
     mgrs,
-    version: '2.20.6'
+    version: '2.20.7'
   });
   includedProjections(proj4);