The package page showed a sha256 hash instead of a usable tag. cosign
pushes a separate artifact per build, tagged sha256-<digest>.sig, and
because it goes up after the image it was the newest entry. Sixty-odd
nightly runs had filled the listing with them.
Dropping the signing step leaves :latest visible. The tradeoff is real:
published images are no longer signed against the sigstore log. There's no
way to keep cosign and hide its artifacts, since GHCR renders them as
ordinary versions, so it's signing against a readable package page.
Also makes the tagging explicit instead of relying on the action default.
latest=auto moves :latest onto any pushed vX.Y.Z tag.
Version goes to 2.0.0: storage moved to a new key format, migrated on
first open, and Backspace no longer deletes.
Removes the analytics tag from index.html.
Bundle goes from 337 kB to 52 kB, or 89 kB to 20 kB gzipped. Almost all of
it was lottie-web, imported at the top level to draw one decorative empty
state, so every visitor paid 305 kB whether they ever saw it or not. It's
an inline SVG now, and it respects prefers-reduced-motion.
The 500ms splash is gone. There was no async work behind it.
Dark mode is applied by a small script in the head before first paint, so
dark-mode users stop getting a white flash on load. The theme class moves
to <html>, and App.svelte reads its initial state from that class instead
of re-reading storage after mount.
publicDir moves from assets/ to public/, which stops shipping the 200 kB
README screenshot to everyone.
Svelte 4.2 to 5.56, Vite 5 to 8, vite-plugin-svelte 3 to 7. The old tree
wouldn't resolve incrementally, because a stale vite-plugin-svelte-inspector
pinned the v3 peer, so this is a clean reinstall.
Clears all 7 npm audit advisories, including a high-severity Rollup path
traversal.
Reactivity moves to runes: $state, $derived, $effect. Event directives
become properties, and main.js uses mount().
Also drops inputElement, a bind:this target nothing ever read.
Groundwork before pulling logic out of App.svelte.
Vitest runs in a node environment. Nothing under test needs a DOM, because
every module takes its dependencies as arguments.
package-lock.json is tracked now and the Dockerfile installs with npm ci,
so the nightly rebuild can't quietly land on different versions.
.gitignore: .DS_Store was anchored to the root and missed nested copies,
and dist/ wasn't ignored at all.
Aculix Technologies