v0.1.1 — post-release hygiene + drop Node 18

Patch release covering post-v0.1.0 review follow-through and a Node 18 EOL decision.

Why v0.1.1?

A post-v0.1.0 review surfaced 2 critical and 5 high-priority issues. This release ships the fixes that don't change runtime behaviour but tighten security defaults, sync version metadata, and rebalance the supported Node versions.

What's in this release

Security hygiene

• USE_PROXY default flipped from true to false. The previous default would silently route all CareLink traffic through the proxies listed in https.txt if that file existed — a footgun for a medical-data bridge. New users get no proxying; power users opt in explicitly with USE_PROXY=true. README documents the new default.
• Removed undocumented dotenv.config({ path: 'my.env' }) lookups from src/main.ts and src/login.ts. These were upstream legacy, never documented, gitignored but confusing for anyone reading the entrypoint.
• SECURITY.md contact clarified. Removed the NovaLux12@users.noreply.github.com email line (GitHub's auto-generated no-reply addresses do not accept inbound mail). Security Advisories are now the sole contact channel.

Metadata sync

• package.json version is now 0.1.0 to match the v0.1.0 git tag. Was inherited from upstream at 2.0.0 — would have caused npm install carelink-bridge to report the wrong version.

Test coverage

• Regression test for the cherry-picked BLE device detection fix (upstream PR #2 by @terminalcommand). Extracted isBleDevice from a private method to a module-level export; added 7 cases including the exact bug condition (deviceFamily: 'BLE_MINIMED', medicalDeviceFamily: undefined).
• 27/27 tests pass (was 20/20 before v0.1.0).

Platform support

• Node 18 dropped from CI matrix and engines.node. Node 18 was EOL'd upstream on 2025-04-30. Vitest 4 (the supported line, which fixes 5 transitive dev CVEs) does not support Node 18. Now targeting Node 20+.
• vitest bumped to ^4.1.10. Kills 5 transitive dev CVEs (esbuild GHSA-67mh-4wv8-2f99, vite moderate/high, vitest critical, @vitest/mocker, vite-node). All dev-only — no runtime impact.

Repo hygiene

• Issues enabled on the repo (was disabled by default for forks). The shipped .github/ISSUE_TEMPLATE/ files are now reachable.
• Dependabot security updates enabled. Auto-PRs will fire for any future CVE.
• Branch protection on main — CI required, linear history, no force pushes, no branch deletion, conversation resolution required, admins included.

Credits

All new code in this release is by @NovaLux12. The BLE detection fix is by @terminalcommand, co-authored by Nicolas Raverdy (@nraverdy).

Upstream relationship

No behavioural divergence from upstream in this release. Every change is either (a) a hygiene fix for inherited upstream quirks (USE_PROXY default, my.env lookup, package.json version), (b) additive (tests, docs, repo config), or (c) a CVE fix on the supported dev toolchain. The fork continues to carry only changes that landed in or were submitted upstream — the BLE fix remains cherry-picked from upstream PR #2.