Dependency hygiene, four small fixes, and a shorter path to a first render. Fully backward-compatible: every CLI flag, API signature, MCP tool name, worker contract, and checkpoint file format from 1.5.x works unchanged.
Fixed
npm auditis clean on install. The pinned MCP SDK (1.29.0) pulled in seven advisories (three high) through its HTTP transport dependencies, code this stdio server never runs but everynpm installreported.@modelcontextprotocol/sdkmoves to^1.30.0andzodto^3.25.76(the SDK's peer range); the tree now audits to zero.renderParallel({ quiet: true })is byte-clean on stdout with the dashboard on. The dashboard URL box bypassed quiet mode becausesilentwas never passed through tostartDashboard. The URL is now announced on stderr instead. The MCP server was unaffected (it remaps console output before loading anything); library callers were.- The post-render output check honors
FFMPEG_RENDER_PRO_FFPROBE. It spawned a literalffprobefrom PATH, so installs using the env-var override silently skipped the check. colorGradewith a VA-API codec keeps the grade. The encoder's requiredformat=nv12,hwuploadfilter is now merged into the grade chain as one-vf; previously ffmpeg kept only the encoder's filter and dropped the grade. Output for every other codec is unchanged.buildColorGradeArgsis exported from the module for tests.getConfig()uses the float-safecomputeTotalFrames()like the renderer does.
Added
ffmpeg-render-pro init [my-worker.js]writes a starter worker into the current folder and prints the next two commands. The starter (examples/starter-worker.js) is a short file where onlyrenderFrame(frameNum, buffer)needs editing; the ffmpeg pipe, backpressure, progress, and done/error plumbing are already there.--forceoverwrites. Works before ffmpeg is installed.get_worker_templatereturnsstarterPathandstarterSourcealongside the existingtemplatePathandtemplateSource, and its text now opens with the copy-and-edit-renderFrame recipe. Additive: existing fields are unchanged.- The CLI help text opens with a three-command "Start here" block.
- CI matrix adds Node 24.
- npm trusted publishing. A tag push now publishes to npm from GitHub Actions through OIDC (
.github/workflows/release.yml), with no publish token anywhere and a provenance attestation on every release. The workflow refuses to publish when the tag does not matchpackage.jsonandserver.json, runs the full test suite with real ffmpeg as the gate, and then publishesserver.jsonto the MCP Registry in a second job that waits for npm to confirm the version. This replacespublish-mcp.yml.
Changed
- README rewritten around getting to a first render: a three-command start, the worker contract as two tables instead of a 75-line inline script (
initgives you the file), one MCP install method per client, and no duplicated changelog or test-file listing. About 1,900 words, down from 4,000.llms.txtfollows the same shape.
Tests
- 241 checks grew to 255:
init(copy, refuse-overwrite,--force, nested dirs, end-to-end), quiet mode with the dashboard on, VA-API grade argv composition, an end-to-endinitthenrenderof the starter worker with an exact frame count, and the newget_worker_templatefields.
Published to npm from GitHub Actions through npm trusted publishing (OIDC) with a provenance attestation: https://www.npmjs.com/package/ffmpeg-render-pro/v/1.5.2