v2.60.3

Random AI prompt + image generator for the Stable Diffusion WebUI -- a CLI and a local web UI.

Pre-release software. Provided as-is under Apache-2.0.

What's new in this release

Changelog — August 2026

Newest entry on top.

2026-08-02 — security (2.60.3) — remediate the OpenSSF Scorecard (6.7 → projected ~7.4)

Closed the compliance audit's headline finding (ship-contract Scorecard below the 7.0 floor) by
clearing the dominant lever — the Vulnerabilities check (was 0). Fixed everything fixable:
root + targets/web npm audit fix (→ 0 vulns each), and targets/mobile pinned postcss ^8.5.25

• brace-expansion ^2.0.2 via overrides. Documented + filtered the genuine-no-fix advisories
  via osv-scanner.toml next to each manifest (the mechanism Scorecard's Vulnerabilities check honors):
  17 unmaintained Tauri-v2-Linux gtk3-rs/glib/proc-macro/unic Rust crates (confirmed no-fix by
  cargo audit) in targets/web-shell/, and 1 build-time-only Expo uuid advisory in targets/mobile/.
  Verified with the real tool — osv-scanner v2.4.0 reports "No issues found" — so the check moves
  0 → 10, lifting the score to ~7.4. npm test green (375 + 430 + 122). PATCH 2.60.2 → 2.60.3. The public
  api.securityscorecards.dev number refreshes on OSSF's weekly rescan. Report:
  ../fairyfox-reports/2026-08-02-scorecard-remediation.md.

2026-08-02 — docs/notes — fairyfox: first full standards compliance audit

Ran the first full compliance audit (the gap seeded in the 2026-08-02 adoption). Walked every
adopted standard's ## Verify and recorded a dated per-standard result in
../reference/adoption-manifest.md: 25/30 applicable standards
implemented (34 rows − 4 N-A; 5 non-implemented), the rest honest dated gaps. Headline finding: the ship-contract's OpenSSF Scorecard
is 6.7, below the 7.0 floor — verified against the live api.securityscorecards.dev (not the badge).
The dominant lever is Vulnerabilities = 0 (27 known, mostly RUSTSEC advisories in the Tauri/Rust
desktop deps); several other checks (Code-Review, Contributors, Branch-Protection) are structurally low
for a solo 0-approval repo. Also partial: supply-chain (releases signed but no provenance), docs-site
(chrome 2.2.1 → 2.3.0, browser-gated), docker (no Dockerfile yet), mandate-ledger (no ledger triggered).
Fixed in-pass: pruned 5 stale Dependabot branches → the remote carries only main/dev
(repo-hygiene clean). Also flags a date-accuracy correction: earlier artifacts in this effort were
mis-dated 2026-07-25 (hub-commit date); the real date is 2026-08-02. Report:
../fairyfox-reports/2026-08-02-compliance-audit.md.
No VERSION bump (notes/docs only).

How to get it

Prefer not to build? Download a pre-built edition:

• Desktop app -- Windows .msi / .exe (or a portable .zip), macOS .dmg, Linux .AppImage / .deb (attached below). Self-contained; nothing to install first.
• random-ai-prompt-2.60.3-online.zip -- the online edition as static files; host it anywhere, or just use https://prompt.fairyfox.io.
• random-ai-prompt-2.60.3.tar.gz -- source tarball (run with Node 24: npm install then npm start).
• random-ai-prompt-2.60.3-docs.zip -- the generated documentation site.

What's Changed

• docs: first full standards compliance audit by @1fairyfox in #65
• Release v2.60.3 — Scorecard security remediation by @1fairyfox in #66

Full Changelog: v2.60.2...v2.60.3