Target Node 26

.dockerignore

@@ -1,5 +1,6 @@
 *
 !package.json
+!package-lock.json
 !build/
 !build/**
 !src/

.github/copilot-instructions.md

@@ -4,6 +4,8 @@
 
 - Treat `package.json` as the source of truth for the application version.
 - Keep `package.json`, `build/package.player.json`, and `build/package.web.json` on the same version number.
+- Keep dependency versions and package metadata in `package.json`, `package-lock.json`, `build/package.player.json`, and `build/package.web.json` aligned unless a dependency is intentionally omitted from a specific bundle.
+- When changing bundled library versions, update the About page source data from the same package metadata or vendored asset banner rather than hardcoding a fresh literal.
 - When the app version changes, update `CHANGELOG.md` in the same change.
 - Keep database migration versions aligned with the release they actually belong to.
 - If only part of a migration batch belongs to a newer release, split that batch into a separate migration entry instead of relabeling the earlier release.

.github/workflows/docker-publish.yml

@@ -7,17 +7,18 @@ on:
   workflow_dispatch:
 
 jobs:
-  build-and-push:
+  build-and-push-existing-registry:
     runs-on: ubuntu-latest
 
     strategy:
+      fail-fast: false
       matrix:
         include:
           - name: web
-            image: git.lzstealth.com/lzstealth/pulse-signage-web
+            repository: pulse-signage-web
             dockerfile: ./build/Dockerfile
           - name: player
-            image: git.lzstealth.com/lzstealth/pulse-signage-player
+            repository: pulse-signage-player
             dockerfile: ./build/Dockerfile.player
 
     steps:
@@ -27,7 +28,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to container registry
+      - name: Log in to existing package registry
         uses: docker/login-action@v3
         with:
           registry: git.lzstealth.com
@@ -38,7 +39,8 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ matrix.image }}
+          images: |
+            git.lzstealth.com/lzstealth/${{ matrix.repository }}
           tags: |
             type=raw,value=latest
             type=ref,event=tag

CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.7.5 - 2026-08-15
+
+### Changed
+
+- The About page now reads bundled library versions from package metadata and the vendored AdminLTE stylesheet.
+- AdminLTE is now reported as 4.3.1.
+- Animate.css is now reported as 4.1.1.
+- Bootstrap Icons is now reported as 1.13.1.
+- Cropper.js is now reported as 1.6.2.
+- Express is now reported as 5.2.1.
+- Handlebars is now reported as 4.7.8.
+- hls.js is now reported as 1.7.0.
+- Multer is now reported as 2.2.0.
+- MySQL2 is now reported as 3.23.3.
+- Sharp is now reported as 0.35.3.
+- TinyMCE is now reported from the vendored package metadata.
+- ws is now reported as 8.21.3.
+- The runtime and container images now target Node.js 26.
+
 ## 2.7.4 - 2026-08-15
 
 ### Added

build/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine
+FROM node:26-alpine
 
 WORKDIR /app
 
@@ -6,6 +6,7 @@ RUN apk add --no-cache chromium nss freetype harfbuzz ttf-freefont
 
 COPY build/package.web.json ./package.json
 RUN npm install --omit=dev --no-audit --no-fund
+COPY package-lock.json ./package-lock.json
 
 COPY src ./src
 COPY scripts ./scripts

build/Dockerfile.player

@@ -1,4 +1,4 @@
-FROM node:24-alpine
+FROM node:26-alpine
 
 WORKDIR /app
 
@@ -6,6 +6,7 @@ RUN apk add --no-cache ffmpeg
 
 COPY build/package.player.json ./package.json
 RUN npm install --omit=dev --no-audit --no-fund
+COPY package-lock.json ./package-lock.json
 
 COPY src ./src
 COPY scripts ./scripts

build/package.player.json

@@ -1,8 +1,11 @@
 {
   "name": "pulse-signage-player",
-  "version": "2.7.4",
+  "version": "2.7.5",
   "private": false,
   "description": "Pulse Signage player application bundle",
+  "engines": {
+    "node": ">=26.0.0"
+  },
   "main": "src/common.js",
   "scripts": {
     "start": "node -r dotenv/config src/player.js",
@@ -10,10 +13,10 @@
   },
   "dependencies": {
     "dotenv": "^17.4.2",
-    "express": "^4.21.2",
+    "express": "^5.2.1",
     "handlebars": "^4.7.8",
-    "hls.js": "^1.5.15",
-    "mysql2": "^3.14.3",
-    "ws": "^8.21.0"
+    "hls.js": "^1.7.0",
+    "mysql2": "^3.23.3",
+    "ws": "^8.21.3"
   }
 }

build/package.web.json

@@ -1,22 +1,25 @@
 {
   "name": "pulse-signage-web",
-  "version": "2.7.4",
+  "version": "2.7.5",
   "private": false,
   "description": "Pulse Signage web and bridge application bundle",
+  "engines": {
+    "node": ">=26.0.0"
+  },
   "main": "src/common.js",
   "scripts": {
     "start": "node -r dotenv/config src/web.js",
     "start:web": "node -r dotenv/config src/web.js"
   },
   "dependencies": {
-    "@sparticuz/chromium": "^137.0.0",
+    "@sparticuz/chromium": "^149.0.0",
     "dotenv": "^17.4.2",
-    "express": "^4.21.2",
+    "express": "^5.2.1",
     "handlebars": "^4.7.8",
     "multer": "^2.2.0",
-    "mysql2": "^3.14.3",
-    "puppeteer-core": "^24.16.0",
+    "mysql2": "^3.23.3",
+    "puppeteer-core": "^25.7.0",
     "sharp": "^0.35.3",
-    "ws": "^8.21.0"
+    "ws": "^8.21.3"
   }
 }

package.json

@@ -1,8 +1,11 @@
 {
   "name": "pulse-signage",
-  "version": "2.7.4",
+  "version": "2.7.5",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
+  "engines": {
+    "node": ">=26.0.0"
+  },
   "repository": {
     "type": "git",
     "url": "https://git.lzstealth.com/LZStealth/pulse-signage.git"
@@ -17,19 +20,19 @@
     "test": "node --test"
   },
   "dependencies": {
-    "@sparticuz/chromium": "^137.0.0",
+    "@sparticuz/chromium": "^149.0.0",
     "animate.css": "^4.1.1",
-    "bootstrap-icons": "1.11.3",
+    "bootstrap-icons": "1.13.1",
     "cropperjs": "^1.6.2",
     "dotenv": "^17.4.2",
-    "express": "^4.21.2",
+    "express": "^5.2.1",
     "handlebars": "^4.7.8",
-    "hls.js": "^1.5.15",
+    "hls.js": "^1.7.0",
     "multer": "^2.2.0",
-    "mysql2": "^3.14.3",
-    "puppeteer-core": "^24.16.0",
+    "mysql2": "^3.23.3",
+    "puppeteer-core": "^25.7.0",
     "sharp": "^0.35.3",
-    "ws": "^8.21.0"
+    "ws": "^8.21.3"
   },
   "devDependencies": {
     "nodemon": "^3.1.10"

src/web/routes/settings/about/index.js

@@ -1,21 +1,70 @@
 // Settings page renderer for the About page.
 
+const fs = require('fs');
+const path = require('path');
 const { renderView } = require('../../../view');
+const packageLock = require('#root/package-lock.json');
+const tinyMcePackage = require('#root/src/web/public/vendor/tinymce/package.json');
+
+function readVersionFromLockfile(packageName) {
+  const entry = packageLock && packageLock.packages ? packageLock.packages[`node_modules/${packageName}`] : null;
+  return entry && entry.version ? String(entry.version) : '';
+}
+
+function readPackageVersion(packageName) {
+  const lockedVersion = readVersionFromLockfile(packageName);
+  if (lockedVersion) {
+    return lockedVersion;
+  }
+
+  try {
+    const packageJsonPath = require.resolve(`${packageName}/package.json`);
+    return String(JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')).version || '');
+  } catch (_error) {
+    try {
+      let currentDir = path.dirname(require.resolve(packageName));
+      for (;;) {
+        const packageJsonPath = path.join(currentDir, 'package.json');
+        if (fs.existsSync(packageJsonPath)) {
+          const parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+          if (String(parsed && parsed.name || '') === packageName) {
+            return String(parsed.version || '');
+          }
+        }
+
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir) {
+          return '';
+        }
+        currentDir = parentDir;
+      }
+    } catch (_error2) {
+      return '';
+    }
+  }
+}
+
+function readAdminLteVersion() {
+  const cssPath = path.join(__dirname, '../../../public/adminlte/css/adminlte.min.css');
+  const cssText = fs.readFileSync(cssPath, 'utf8');
+  const match = cssText.match(/AdminLTE v([0-9]+\.[0-9]+\.[0-9]+)/i);
+  return match ? match[1] : '';
+}
 
 function buildLibraryList() {
   return [
-    { name: 'AdminLTE', version: '4.3.1', usage: 'Admin dashboard layout and components', license: 'MIT', url: 'https://adminlte.io/' },
-    { name: 'Animate.css', version: '4.1.1', usage: 'Reusable animation classes', license: 'MIT', url: 'https://animate.style/' },
-    { name: 'Bootstrap Icons', version: '1.11.3', usage: 'Icon set used throughout the UI', license: 'MIT', url: 'https://icons.getbootstrap.com/' },
-    { name: 'Cropper.js', version: '1.6.2', usage: 'Image cropping in the slide editor', license: 'MIT', url: 'https://github.com/fengyuanchen/cropperjs' },
-    { name: 'Express', version: '4.21.2', usage: 'Web server and routing', license: 'MIT', url: 'https://expressjs.com/' },
-    { name: 'Handlebars', version: '4.7.8', usage: 'Server-side view rendering', license: 'MIT', url: 'https://handlebarsjs.com/' },
-    { name: 'hls.js', version: '1.5.15', usage: 'HTTP Live Streaming playback', license: 'Apache-2.0', url: 'https://github.com/video-dev/hls.js' },
-    { name: 'Multer', version: '2.2.0', usage: 'Multipart file uploads', license: 'MIT', url: 'https://github.com/expressjs/multer' },
-    { name: 'MySQL2', version: '3.14.3', usage: 'Database access layer', license: 'MIT', url: 'https://github.com/sidorares/node-mysql2' },
-    { name: 'Sharp', version: '0.35.3', usage: 'Image processing and transforms', license: 'Apache-2.0', url: 'https://sharp.pixelplumbing.com/' },
-    { name: 'TinyMCE', version: '7.7.0', usage: 'Rich text editing for content fields', license: 'GPL-2.0-or-later', url: 'https://www.tiny.cloud/' },
-    { name: 'ws', version: '8.21.0', usage: 'WebSocket transport', license: 'MIT', url: 'https://github.com/websockets/ws' }
+    { name: 'AdminLTE', version: readAdminLteVersion(), usage: 'Admin dashboard layout and components', license: 'MIT', url: 'https://adminlte.io/' },
+    { name: 'Animate.css', version: readPackageVersion('animate.css'), usage: 'Reusable animation classes', license: 'MIT', url: 'https://animate.style/' },
+    { name: 'Bootstrap Icons', version: readPackageVersion('bootstrap-icons'), usage: 'Icon set used throughout the UI', license: 'MIT', url: 'https://icons.getbootstrap.com/' },
+    { name: 'Cropper.js', version: readPackageVersion('cropperjs'), usage: 'Image cropping in the slide editor', license: 'MIT', url: 'https://github.com/fengyuanchen/cropperjs' },
+    { name: 'Express', version: readPackageVersion('express'), usage: 'Web server and routing', license: 'MIT', url: 'https://expressjs.com/' },
+    { name: 'Handlebars', version: readPackageVersion('handlebars'), usage: 'Server-side view rendering', license: 'MIT', url: 'https://handlebarsjs.com/' },
+    { name: 'hls.js', version: readPackageVersion('hls.js'), usage: 'HTTP Live Streaming playback', license: 'Apache-2.0', url: 'https://github.com/video-dev/hls.js' },
+    { name: 'Multer', version: readPackageVersion('multer'), usage: 'Multipart file uploads', license: 'MIT', url: 'https://github.com/expressjs/multer' },
+    { name: 'MySQL2', version: readPackageVersion('mysql2'), usage: 'Database access layer', license: 'MIT', url: 'https://github.com/sidorares/node-mysql2' },
+    { name: 'Sharp', version: readPackageVersion('sharp'), usage: 'Image processing and transforms', license: 'Apache-2.0', url: 'https://sharp.pixelplumbing.com/' },
+    { name: 'TinyMCE', version: tinyMcePackage.version, usage: 'Rich text editing for content fields', license: 'GPL-2.0-or-later', url: 'https://www.tiny.cloud/' },
+    { name: 'ws', version: readPackageVersion('ws'), usage: 'WebSocket transport', license: 'MIT', url: 'https://github.com/websockets/ws' }
   ];
 }
 
@@ -28,4 +77,6 @@ module.exports = function renderAboutPage(currentUser) {
     libraries: buildLibraryList(),
     scripts: []
   });
-};
+};
+
+module.exports.buildLibraryList = buildLibraryList;

test/about-page.test.js

@@ -3,13 +3,18 @@ const assert = require('node:assert/strict');
 
 require('../src/common');
 
+const packageJson = require('../package.json');
 const pages = require('../src/web/pages');
 const registerAboutRoutes = require('../src/web/routes/settings/about/routes');
+const renderAboutPage = require('../src/web/routes/settings/about');
 
 test('about page renders the footer link beside the version and lists bundled libraries', () => {
   const html = pages.renderAboutPage({ id: 1 });
+  const libraries = renderAboutPage.buildLibraryList();
 
-  const orderedNames = ['AdminLTE', 'Animate.css', 'Bootstrap Icons', 'Cropper.js', 'Express', 'Handlebars', 'hls.js', 'Multer', 'MySQL2', 'Sharp', 'TinyMCE', 'ws'];
+  const orderedNames = libraries.map(function (library) {
+    return library.name;
+  });
   let previousIndex = -1;
 
   orderedNames.forEach(function (name) {
@@ -19,12 +24,13 @@ test('about page renders the footer link beside the version and lists bundled li
     previousIndex = currentIndex;
   });
 
-  assert.match(html, /v2\.7\.4/);
+  assert.match(html, new RegExp('v' + packageJson.version.split('.').join('\\.')));
   assert.match(html, /About Pulse/);
   assert.match(html, /href="\/settings\/about"/);
-  assert.match(html, /Cropper\.js/);
-  assert.match(html, /TinyMCE/);
-  assert.match(html, /7\.7\.0/);
+  libraries.forEach(function (library) {
+    assert.ok(library.version, `${library.name} version is missing`);
+    assert.match(html, new RegExp(`>${library.version}<`));
+  });
   assert.match(html, /card card-outline card-primary h-100 overflow-hidden/);
   assert.doesNotMatch(html, /rounded-3 overflow-hidden border/);
 });