v2 PascalCase schema, Release Timeline, Signed Versions, dark mode fix

[headmin]

Summary

• Vue components migrated to v2 PascalCase schema (2026.04.11.2) — SecurityInfo, ReleaseInstallerTable, FeedInfo
• Release Timeline — new git-branch SVG visualization of release chains showing device-specific branches and BSI entries, with Mermaid/Markdown export
• Signed Versions — admin-friendly view of currently signed OS versions with grouped device tables (Model, Identifier, Board ID), Markdown export
• Dark mode fix — Tailwind 4 @custom-variant for VitePress .dark class strategy, removed blanket !important overrides from bento-system.css
• Static data — device_lookup.json expanded with 13 Intel Mac board IDs, mac_models_mapping.json corrected per AppleDB cross-validation
• Pipeline — bumped to sofa-core-cli v0.3.0
• Security — bumped preact 10.26.5 → 10.28.4 (fixes GHSA-36hm-qxxp-pg3m), resolves dependabot PR Bump preact from 10.26.5 to 10.28.4 in /web #300

Details

Schema migration

The v2 feeds now use PascalCase fields (UpdateSummary.Summary, MacOSIPSWVersion, ActivelyExploitedCVEs). Vue components updated to match — old snake_case/camelCase fallback paths removed.

Release Timeline (/release-timeline)

SVG graph showing the release chain per platform. Device-specific releases (like macOS 26.3.2 for MacBook Neo) branch off and merge back — like git branches. BSI entries appear as purple diamonds with their own dates. Includes Copy Markdown / Download .md with Mermaid gitGraph diagrams.

Signed Versions (/signed-versions)

Simple card view for admins: what's currently signed, CVE counts, device support grouped by product type (MacBook Pro, Air, iMac, Mac mini, etc.) with identifiers and board IDs. Handles unsigned versions gracefully ("No longer signed" badge).

Dark mode

Root cause: Tailwind 4 defaults to prefers-color-scheme media query, ignoring VitePress's .dark class toggle. Fixed with @custom-variant dark in both tailwind.css and bento-system.css.

Device data

• device_lookup.json: +13 Intel Mac board IDs (2018-2020 models) validated against AppleDB + Mactracker
• mac_models_mapping.json: 3 name corrections per AppleDB, added MacBookPro16,1 with Tahoe 26 support (confirmed via InstallAssistant manifest)

Security audit

pnpm audit shows 3 remaining vulnerabilities (1 high, 2 moderate) in transitive dependencies of VitePress (rollup, esbuild, vite). These are all build/dev-time vulnerabilities, not runtime — they don't affect the deployed static site. Fixes depend on upstream VitePress releases. The preact JSON VNode Injection vulnerability (high) has been resolved by bumping to 10.28.4.

Test plan

• /release-timeline — SVG renders for macOS and iOS
• iOS 18 — 3 device-specific branches merge into 18.7.7
• Click version labels — navigates to security page with ?version= deep link
• /signed-versions — device tables grouped by product type
• Toggle dark/light mode on dark-mode device — cards follow VitePress toggle
• /macos/tahoe SecurityInfo — UpdateSummary renders with Summary/Recommendation
• /macos-installer-info — IPSW/UMA data displays correctly
• Copy Markdown / Download .md — Mermaid diagram renders in GitHub