scenri 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.2.3](https://github.com/tonygorb/scenri/compare/v0.2.2...v0.2.3) (2026-08-20)
+
+
+### Bug Fixes
+
+* **deps:** clear the esbuild advisory and a flaky e2e teardown ([97c6985](https://github.com/tonygorb/scenri/commit/97c6985dc7f6e92e3cac1eebd9e039201b12fc16))
+* **deps:** clear the esbuild advisory, and stop the update fixture racing its own teardown ([5cb7bff](https://github.com/tonygorb/scenri/commit/5cb7bff083a92c929bc570b1d88b50747c3a3605))
+
+## [0.2.2](https://github.com/tonygorb/scenri/compare/v0.2.1...v0.2.2) (2026-08-20)
+
+
+### Bug Fixes
+
+* **deps:** patched fastify-static and sharp ([50669e5](https://github.com/tonygorb/scenri/commit/50669e596eb25252de3f2d154dd725ef4d6f2daf))
+* **deps:** patched fastify-static and sharp ([18fddd8](https://github.com/tonygorb/scenri/commit/18fddd8b5c25c7ce643798432f37cd7941af08c1))
+* **deps:** take the patched fastify-static and sharp ([d6e6c38](https://github.com/tonygorb/scenri/commit/d6e6c385f670d398006ac7f4efbaee7946711b5c))
+
 ## [0.2.1](https://github.com/tonygorb/scenri/compare/v0.2.0...v0.2.1) (2026-08-20)
 
 

package/README.md

@@ -4,7 +4,7 @@
   <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/tonygorb/scenri/main/docs/media/logo-on-dark.svg">
   <img src="https://raw.githubusercontent.com/tonygorb/scenri/main/docs/media/logo-on-light.svg" alt="scenri" width="200">
 </picture>
-<br>
+<br><br>
 
 **The open studio for brand-consistent AI visuals.**<br>
 Define a client's brand once. Then generate, branch, and art-direct on-brand images through a version tree, running entirely on your own machine and your own AI accounts.

package/dist/serve.js

@@ -6514,6 +6514,26 @@ function registerImageRoutes(app, deps) {
 
 // src/release/notes.data.ts
 var RELEASES = [
+  {
+    version: "0.2.3",
+    date: "2026-08-20",
+    sections: [
+      {
+        heading: "Security",
+        body: "The last advisory against a build dependency is closed. Nothing about how scenri runs changes, and nothing in the published package moves."
+      }
+    ]
+  },
+  {
+    version: "0.2.2",
+    date: "2026-08-20",
+    sections: [
+      {
+        heading: "Security",
+        body: "Two dependencies are on their patched releases. The file server that serves the studio is updated for a path traversal advisory, and the image library scenri re-encodes every upload through is updated for the libvips advisories. Nothing about how scenri works changes."
+      }
+    ]
+  },
   {
     version: "0.2.1",
     date: "2026-08-20",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenri",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "author": "Tony Gorb <hello@scenri.co>",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "@fastify/multipart": "^9.0.0",
-    "@fastify/static": "^8.0.0",
+    "@fastify/static": "^10.1.3",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "better-sqlite3": "^12.0.0",
@@ -28,7 +28,7 @@
     "open": "^10.1.0",
     "pixelmatch": "^7.1.0",
     "pngjs": "^7.0.0",
-    "sharp": "^0.34.0"
+    "sharp": "^0.35.3"
   },
   "devDependencies": {
     "@scenri/brand": "workspace:*",