chore(release): promote v1.1.5 to main

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file. The format
 
 ## [Unreleased]
 
+## [1.1.5] - 2026-09-11
+
+### Changed
+
+- [#447](https://github.com/mohanagy/miftah/issues/447) Prepared the compatible v1.1.5 patch release. The only change that reaches installers is the `@hono/node-server` runtime dependency, refreshed from 2.0.10 to 2.1.1; neither version carries a security advisory, so this is a dependency refresh rather than a security release. No runtime behavior and no public API changed. Publication remains gated on exact `development`-to-`main` promotion and protected OIDC trusted publishing, registry provenance, a fresh install, and package-signature verification; this release does not authorize removal of any legacy behavior.
+- [#446](https://github.com/mohanagy/miftah/issues/446) Landed the Dependabot backlog and modernized the development toolchain, superseding five pull requests that could not pass on their own: the Vitest pair was split across separate PRs so each broke the other's peer requirement, two bumped packages pinned by the security-override contract tests, and one needed source work. Vitest moved 3.2.7 to 5.0.0 with `@vitest/coverage-v8` and an explicit `vite` peer, alongside `@types/node` 22 to 26, `esbuild` 0.28.1 to 0.28.2, `eslint` 10.8.0 to 10.10.0, and `typescript-eslint` 8.65.0 to 8.70.0. `@types/node` 26 added a `throwIfNoEntry` overload to `stat()`, so `Awaited<ReturnType<typeof stat>>` resolves to a union including `undefined` whose `keyof` is `never`; the affected type derivations were replaced with the concrete `Stats` type, which is erased at compile time and changes no runtime behavior. Vitest 4 removed `test.poolOptions` in favour of top-level options, and Vitest 5 applies AST-aware remapping unconditionally, so function and branch coverage figures are not comparable across the migration and were recalibrated to measured actuals with line thresholds unchanged. This toolchain work is not published. It does clear the two development-only advisories that v1.1.4 explicitly did not claim, so both the production-only and full npm audits now report zero for this repository. `zod` was deliberately held at 4.2.0 in the lockfile only, leaving the declared `^4.2.0` range untouched, because the evidence-pinned bundled test fixture embeds `zod` and bumping it would invalidate the recorded fixture hash that the named-host compatibility evidence depends on.
+
 ## [1.1.4] - 2026-09-11
 
 ### Fixed

README.md

@@ -53,7 +53,7 @@ Install Miftah, then choose the terminal wizard or the browser Console. Both use
 ### 1. Install the current release
 
 ```bash
-npm install -g @lubab/miftah@1.1.4
+npm install -g @lubab/miftah@1.1.5
 miftah version
 ```
 

docs/mcp-compatibility.md

@@ -2,7 +2,7 @@
 
 This page is the compatibility source of truth for Miftah's downstream MCP server. It records protocol-era behavior separately from generated client-configuration support and from upstream MCP transport support. A generated snippet proves only that Miftah emitted the documented JSON shape; it does not prove that an untested host completed a protocol exchange.
 
-- Miftah baseline: `1.1.4`
+- Miftah baseline: `1.1.5`
 - Locked MCP TypeScript packages: `@modelcontextprotocol/client`, `core`, `server`, `node`, and `server-legacy` `2.0.0`
 - Evidence date: 2026-08-23
 - Modern protocol era: `2026-07-28`

docs/presets-and-clients.md

@@ -5,7 +5,7 @@ This is the compatibility source of truth for generated `miftah init` configurat
 For downstream protocol eras and real packaged-host evidence, see [MCP protocol and client compatibility](mcp-compatibility.md). The tables below validate generated configuration shapes; they do not by themselves establish a runtime exchange with Claude Desktop, Claude Code, Cursor, or VS Code.
 
 - Catalog version: `3`
-- Miftah package version: `1.1.4`
+- Miftah package version: `1.1.5`
 - Last tested / validation boundary: the catalog builds strict Miftah configuration that `validateConfig` accepts. The docs contract test checks generated configuration only; it does **not** construct a runtime, start, authenticate to, or smoke-test external providers.
 
 Miftah itself requires Node.js `>=20`. That does not establish an upstream server's Node requirement.

docs/whats-new-in-0.5.md

@@ -1,9 +1,9 @@
 # What is in Miftah 0.5
 
-Install `@lubab/miftah@1.1.4`, the current stable release, to use the guided setup and account-management capabilities introduced in 0.5 instead of assembling a multi-account configuration by hand:
+Install `@lubab/miftah@1.1.5`, the current stable release, to use the guided setup and account-management capabilities introduced in 0.5 instead of assembling a multi-account configuration by hand:
 
 ```bash
-npm install -g @lubab/miftah@1.1.4
+npm install -g @lubab/miftah@1.1.5
 miftah version
 ```