Repository navigation
chore(deps-dev): bump marked from 15.0.12 to 18.1.1 - #10
Closed
dependabot[bot] wants to merge 41 commits into
Closed
dependabot[bot] wants to merge 41 commits into
dependabot[bot] wants to merge 41 commits into
Conversation
Updated logo and added screenshots section to README.
Added a badge for DeepWiki to the README.
Speed and progress were wrong on both sides and concurrent sends could corrupt files. The engine is rewritten around receiver acknowledgements. - Send files one at a time per peer so chunks never interleave - Report sender progress and speed from receiver acks, not local buffer - Use a 2 s rolling window for speed; update the UI at 4 Hz - Prefetch disk reads in 8 MB blocks; batch receiver writes to 4 MB - Add an ack window so slow disks cannot exhaust receiver memory - Give every transfer a unique ID so same-name files do not collide - Buffer ICE candidates until the remote description is set - Retry transient disconnects with ICE restart instead of tearing down - Add receiver-side cancel, size verification and OPFS cleanup - Show the connection route (local network, direct, TURN relay) - Accept 6-character room codes in the join field
- Point-cloud scene with bloom and haze, drawn behind the app - The scene changes with the session: landing, waiting room, and a stream between the two devices whose flow follows live speed - Show live throughput on the connected screen - Respect reduced motion, cap particles on mobile, fall back without WebGL - Fix the waiting-room card alignment and the VITE_BACKEND_URL docs
Security (full review in SECURITY.md): - Require approval before a new device can send anything, and an explicit accept for every incoming file - Show a safety number derived from both DTLS fingerprints so users can rule out a man-in-the-middle signaling server - Limit wrong room-code guesses per IP; add optional room passwords (scrypt) - Scope signaling messages to members of the same room and cap their size - Make rate limits proxy-aware and stop rate limiting static assets - Issue short-lived TURN credentials from /api/turn; enable Helmet/CSP - Enforce the announced file size on the receiver - Remove inaccurate encryption claims from the docs Features: - Resume an interrupted transfer from the exact byte - Save straight to disk or into a folder (File System Access API) - Send folders with their structure; save as a streaming ZIP (ZIP64) - Keep a stable client ID so reconnects never duplicate peers or sends - Readable room codes, nearby-device discovery and invites - Paste to send, clipboard sync (beta), speed graph, local history - Installable PWA with share target - Move session logic into a useRelay hook and split the UI into components; add React type definitions
- Keep every guide and page as Markdown in content/, one source for the app, search engines and AI assistants - Prerender each route to static HTML with title, description, canonical URL, Open Graph and JSON-LD - Publish a .md copy of every page (with Accept: text/markdown negotiation), llms.txt, llms-full.txt and a sitemap - Serve 301s for merged URLs and real 404s - 33 guides: correct 18, merge 4 duplicates, add 15 - Fail the build on broken internal links, duplicate titles and over-long descriptions - Add a Dockerfile and a Render blueprint; rewrite the README
- Explain where a file goes, how to verify the other device, and what the server can see, next to the actions they relate to - Clearer waiting room, approval and incoming-file copy; persistent Verified state after comparing safety numbers - Accessible dialog with focus trap, Escape and focus return; fix dialogs stealing focus on re-render - Skip link, visible focus, labelled controls, correct heading order and contrast - Announce incoming files, approvals and completions to screen readers - Add a footer switch to stop the background animation
- Rebuild the favicon, app icons and an SVG mark from the original scan-line R; use them in the header, footer and Open Graph image - Draw the R from particles in the background; split it into two marks joined by a stream while devices are connected - Add links that open ChatGPT, Claude, Google AI and Perplexity with a question about Relay (logos from @lobehub/icons, MIT) - Refresh the README screenshots
- Keep only the four packages the server needs at runtime in dependencies; move the client and build tooling to devDependencies so the production image installs less - Remove unused packages (dotenv, jszip, autoprefixer) - Add package metadata (license, repository, homepage, engines) and a typecheck script in place of lint - Remove the Google AI Studio metadata file and its HMR settings - Add .editorconfig and .nvmrc
The home page now opens on the product itself: a Send and Receive window that works straight away, instead of a marketing hero. - New dark interface (Geist, night palette, one indigo accent) applied to the home page, waiting room, connected view, guides, articles, Verify page, dialogs and 404 - Pick or drop files before anyone joins; they are staged and sent as soon as the other device is approved - Branded QR codes: dots in the Relay gradient, rounded finder patterns and the R in the centre, at error-correction level H so they still scan - Logo: the original line-drawn R in the brand gradient, no tile - Connected view: live speed between the two devices' marks, with transfers, sending and messages in one window - Home page sections: how files travel, a comparison with WeTransfer, Google Drive and AirDrop, and a short FAQ - Split vendor code into cacheable chunks - Accessibility: axe reports no violations on any screen; keyboard flow unchanged
- favicon.svg: the line-drawn R in the brand gradient, with deeper colours on light browser tabs - PNG and ICO fallbacks and app icons: the R on a night background so it stays legible at 16 px - New Open Graph image to match the dark site
- README uses the new logo and the current screenshots (WebP, about a tenth of the previous size) - Guides refer to the renamed Start sending button - Add CONTRIBUTING.md with setup, checks and commit conventions
Also enable Dependabot for npm (weekly, minor and patch grouped) and GitHub Actions (monthly).
Relay 2.0: dark redesign, send-first flow and branded QR codes
dependabot
Bot
added
dependencies
Light design - A second, Apple-style light design: white and light-grey surfaces, system fonts, blue pill buttons, a laptop-and-phone hero, stat tiles, a black privacy section and the working app under "Try it right here" - Every screen (waiting room, connected view, guides, articles, Verify, dialogs) follows the active design through shared colour tokens - The particle band in the connected view renders on light or dark Design switch - Dark/Light switch in the header; the choice is remembered and can be linked with ?design=light or ?design=dark - Applied before first paint by a small same-origin script, so there is no flash and the CSP stays strict Phones - Home page split into components shared by both designs - Touch-sized controls (44 px), 16 px inputs so iOS doesn't zoom, phone-first copy where dragging isn't possible - Waiting room shows the code and share buttons first, QR code below - Connected view: device rows instead of wrapping chips, two-column offer buttons, and the marks centred on the speed readout - Comparison becomes cards on phones; the "how it works" diagram switches to a vertical layout - Scrollable markdown tables are keyboard-focusable axe reports no violations in either design on desktop or phone.
Light design, design switch and phone layout
Room codes now pair a quality or idea with something from nature, both Sanskrit words found across the Vedas, Upanishads and the Gita, plus a number (satya-ganga-108). About 11 million combinations; wrong guesses are still rate limited per IP. Device names follow the same idea (Shanti Hamsa, Karuna Megha).
The mark is an R on a 5x7 pixel grid with one pale pixel leaving its shoulder: the file on its way. Icons are the white R on ultramarine; the favicon follows the browser's light or dark tab colour.
The working app is now the home page's hero: one ultramarine sheet with Send and Receive side by side, under a headline that says what Relay does. The waiting room and the connected screen are the same sheet, so the app looks like one object from start to finish. - Palette: cool paper and a single ultramarine, no other accent. - Type: Aujournuit (display, on a variable width axis that reacts to the pointer), Apfel Grotezk (text) and Departure Mono only for room codes and safety numbers. All SIL OFL and self-hosted. - The link between devices is a stream whose speed follows the real transfer speed. - QR codes redrawn in the same pixel language as the mark; error correction stays at level H. - Guides and content pages share the grid, with a metadata column. - A viewfinder cursor on mouse and trackpad, one transition between pages and smooth scrolling (Lenis), all off for reduced motion and on touch screens. Removes the Dark and Light designs, the design switch, the WebGL background and the unused Inter and Geist packages.
Plays "Relay — Straight" and then "Relay — Across" by Thepla Theorist and Rishi Shah, on a loop. Off by default; nothing downloads until the key is pressed, and the volume fades in and out. The files stream from jsDelivr (served from this repository), so music never counts against the host's bandwidth, with this server as the fallback. The recordings are not MIT licensed; see public/audio/LICENSE.txt.
Ultramarine redesign, Sanskrit room codes and a soundtrack
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/marked-18.1.1
branch
from
October 28, 2026 16:58
274a6f9 to
b4df4a8
Compare
…fer" New guides for what people search when a file won't send: the best free file transfer sites with their real limits, file size limits for email, chat and cloud apps, emailing a large file, large WhatsApp videos, SHAREit and Xender alternatives (both still blocked in India), Quick Share alternatives, Mac and Windows, two computers, sending without an account, whether WeTransfer is safe, and a glossary. Each opens with a direct answer, compares options in a table, ends with an FAQ and cites its sources with dates, so search and AI answers can quote it. Existing guides link to the new ones.
- Entry screen on the home page: the mark assembles pixel by pixel and the packet pixel leaves; visitors enter with sound on (default) or off. Pressing Enter is the gesture browsers need before music can play. Skipped for room links (?code=), guides, crawlers and repeat visits in the same session. - One shared soundtrack player behind every sound control, with a fade, lock-screen metadata and a one-time invitation on guide pages. - Cursor: a dot plus a spring-driven ring that wraps buttons and links in their own corner radius, turns white on the blue sheet, steps aside over text fields, squeezes on press and sleeps when the pointer is still. - Motion: headline lines rise after the entry closes, section headings reveal word by word, lists stagger in, FAQ answers open smoothly, the footer wordmark rises with the scroll, new room codes resolve out of noise and the live speed eases between values. - Kinetic type only animates while on screen and while something moves. - Phones: compact header with a visible Sound key, no empty drop area on touch screens. - Fonts move to public/fonts so they can be preloaded.
…rand kit - A 1200x630 link preview for every page (public/og), set per page in og:image and twitter:image. - Favicon set (ICO 16/32/48, 96 px PNG, SVG) drawn so the mark survives the round crop search results apply. - Structured data: a Person for the author with sameAs links, logo as an ImageObject, per-article images, language and word count. - Home page targets "free file transfer" in its title, description and H1; the animated headline is decorative and hidden from assistive tech and snippets. - Long guides get an "On this page" list; tables get unique labels. - IndexNow: key file, scripts/indexnow.mjs and a workflow that submits the sitemap after each deploy to main. - Optional GOOGLE_SITE_VERIFICATION and BING_SITE_VERIFICATION tags. - Brand kit at /brand (also as /brand.md and in llms.txt) with logo, mark and app icon downloads, colours, type, usage and an approved description. - scripts/brand-assets.mjs regenerates all icons, previews and brand files; fonts, previews and brand files are cached for a week.
SEO, AEO and experience: new guides, link previews, entry screen and brand kit
It was a link to the home page, so on the home page it did nothing. It now opens the file picker on any screen: on the landing page the chosen files are staged and a room opens, in a room they are sent, and from a guide it brings you home first.
Fix: header Send key opens the file picker
The prerendered home page painted for a moment while the app loaded, then the entry screen covered it. A tiny blocking script in <head> now applies the same rules as the entry screen and, when it will show, paints the page ultramarine before anything else. The entry screen removes the cover once it is on screen; if the app never starts, the cover fades by itself after six seconds.
A "Scan QR code" key under Receive on touch screens opens Relay's own scanner: the camera fills the screen, the ultramarine sheet frames a square viewfinder with a sweeping line, and a light key appears where the camera has a torch. A Relay link or bare room code joins the room straight away; any other QR says so instead of opening it. Uses the browser's BarcodeDetector where available and jsQR elsewhere (including iPhone Safari). Both load only when the scanner opens, so the page itself does not get heavier. Tested end to end with a fake camera feed of the branded QR code.
Branded QR scanner for phones and tablets
Bumps [marked](https://github.com/markedjs/marked) from 15.0.12 to 18.1.1. - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v15.0.12...v18.1.1) --- updated-dependencies: - dependency-name: marked dependency-version: 18.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/marked-18.1.1
branch
from
October 28, 2026 18:01
b4df4a8 to
86e484d
Compare
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps marked from 15.0.12 to 18.1.1.
Release notes
Sourced from marked's releases.
... (truncated)
Commits
cdbdc01chore(release): 18.1.1 [skip ci]2134976docs: add AGENTS.md (#4125)699a969chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)6a57018fix: keep a backslash in a code span from hiding emphasis (#4117)eaa1ffffix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)7e8754dperf: avoid repeated raw string copies in nested lists (#4082)cc07bb9fix: preserve enclosing link state after parsing images (#4123)627d9aefix: make walkTokens linear by appending values in place (#4121)4bd2528fix: respect tab stops in list continuation indentation (#4119)9e64a6afix: end blockquote before a lazy line after a heading, hr or html block (#4115)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for marked since your current version.