design: redesign landing with 3D system visuals

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/deploy.yml

@@ -11,8 +11,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -21,9 +19,14 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    # configure-pages reads the Pages site through the API, which needs
+    # `pages: read`. Deployment/OIDC permissions live only on the deploy job.
+    permissions:
+      contents: read
+      pages: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: npm
@@ -32,17 +35,20 @@ jobs:
         env:
           NEXT_PUBLIC_BASE_PATH: /web
       - run: touch out/.nojekyll
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: out
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/security-audit.yml

@@ -0,0 +1,33 @@
+name: Security Audit
+
+on:
+  push:
+  pull_request:
+  schedule:
+    # Weekly, Mondays at 06:23 UTC (off the top of the hour to reduce runner contention).
+    - cron: '23 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: npm audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Audit dependencies
+        run: npm audit --audit-level=high

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2026-10-24 — Security update
+
+- Updated Next.js from 16.3.1 to 16.4.3 and aligned `eslint-config-next` to 16.4.3, closing the critical Next.js advisories (including the unauthenticated RCE and cache-poisoning/SSRF reports).
+- Updated the sharp override to 0.35.5 (libheif/librsvg fixes) and resolved the remaining transitive advisories: source-map-js 1.2.2, zod 4.6.7, js-yaml 4.3.2 and brace-expansion 1.1.21/5.0.12.
+- `npm audit` now reports 0 vulnerabilities, including with `--omit=dev`. The static export still builds successfully (142 pages) and no site content or layout changed.
+- Added `security-audit.yml` running `npm ci --ignore-scripts` and `npm audit --audit-level=high` on push, pull request and weekly schedules.
+- Added weekly Dependabot updates for npm and GitHub Actions, pinned all workflow actions by commit SHA, disabled persisted checkout credentials, and moved Pages write/OIDC permissions to the deploy job only.
+
 ## 2026-09-12 — WebAssembly docs and home demo fix
 
 - Added wiki pages for the WebAssembly runtime, the four wasm plugins and the three wasm extensions in English, Spanish and German; plugin index, presets and summary updated

docs/de/SUMMARY.md

@@ -2,7 +2,7 @@
 
 Ein plattformunabhangiges Systeminformations-Tool geschrieben in Rust.
 
-- **Version:** 1.0.0
+- **Version:** 1.0.1
 - **Lizenz:** MIT
 - **Autor:** xscriptor
 - **Repository:** github.com/xfetch-cli/xfetch

docs/de/changelog.md

@@ -1,6 +1,16 @@
 # Anderungsprotokoll
 # Anderungsprotokoll
 
+## v1.0.1 · Sicherheitsrelease: gepatchte Abhängigkeiten, signierte Releases und sicherere Installer · 2026-10-24
+
+- **Alle RustSec-Hinweise im Abhängigkeitsgraph von v1.0.0 sind geschlossen:** `wasmtime` und `wasmtime-wasi` 48.0.7, `rustls` 0.23.46, `rustls-webpki` 0.103.16, `webpki-roots` 1.0.11, `tokio` 1.54.1 und `yoke-derive` 0.8.4. `cargo audit --deny warnings` meldet 0 Schwachstellen und 0 Warnungen.
+- **Die Binaries von v1.0.0 sind weiterhin betroffen; auf v1.0.1 aktualisieren.**
+- **Wasm-Artefakte pinnen:** Manifeste akzeptieren ein optionales `sha256`, und Plugins, Effekte und Erweiterungen akzeptieren `--sha256`. Der Digest wird bei heruntergeladenen, eingecheckten, gebauten und lokalen Artefakten geprüft; eine Abweichung bricht ab, bevor etwas geschrieben wird. Remote-Installationen ohne Digest funktionieren weiter, warnen aber deutlich.
+- **Härtung von Remote-Installationen:** validierte Guest-Namen, private temporäre Verzeichnisse, `git clone --depth 1 -- <repo>` und explizite Warnungen, wenn Manifest-`build`-Befehle oder native Gäste ohne Sandbox laufen.
+- **Prebuilt-Installer:** portables SHA-256 über `sha256sum`, `shasum` oder `openssl`; `SHA256SUMS` ist Pflicht; ab v1.0.1 wird zusätzlich ein signiertes `SHA256SUMS.bundle` verlangt. `--require-signature` macht cosign Pflicht, `--allow-unsigned` ist ein explizites Opt-out, und Version sowie Asset stammen aus dem Tag und dem exakten erwarteten Dateinamen.
+- **Signierte Releases:** Keyless-cosign-Signatur für `SHA256SUMS`, GitHub-Build-Provenance-Attestations und ein Gate, das prüft, dass der Tag auf `main` liegt, zu `Cargo.toml` passt, Tests und `cargo audit` ausführt und Signatur sowie Checksums vor dem Veröffentlichen erneut verifiziert.
+- **Supply Chain:** CI mit `cargo audit`/`npm audit`, Dependabot, per SHA gepinnte GitHub Actions und Release-Builds mit Rust 1.98.1 und `--locked`.
+
 ## v1.0.0 · Native Windows-Probes, Daemons unter Windows und Abhängigkeits-Refresh · 2026-09-18
 
 - **Native Windows-Probes:** CPU, Datum, Akku und GPU werden über die Win32-API (`platform/windows/`) gelesen statt über sysinfos PDH-Zähler und PowerShell/`wmic`-Subprozesse — der Standard-Fetch ging auf einem 16-Thread-Rechner von ~575 ms auf ~33 ms (warm), mit identischen Werten

docs/en/SUMMARY.md

@@ -2,7 +2,7 @@
 
 A cross-platform system information fetching tool written in Rust.
 
-- **Version:** 1.0.0
+- **Version:** 1.0.1
 - **License:** MIT
 - **Author:** xscriptor
 - **Repository:** github.com/xfetch-cli/xfetch

docs/en/changelog.md

@@ -1,6 +1,16 @@
 # Changelog
 # Changelog
 
+## v1.0.1 · Security release: patched dependencies, signed releases & safer installers · 2026-10-24
+
+- **Every RustSec advisory in the v1.0.0 dependency graph is closed:** `wasmtime` and `wasmtime-wasi` 48.0.7, `rustls` 0.23.46, `rustls-webpki` 0.103.16, `webpki-roots` 1.0.11, `tokio` 1.54.1 and `yoke-derive` 0.8.4. `cargo audit --deny warnings` reports 0 vulnerabilities and 0 warnings.
+- **v1.0.0 binaries remain affected by these advisories; upgrade to v1.0.1.**
+- **Wasm artifact pinning:** manifests accept an optional `sha256` and plugins, effects and extensions accept `--sha256`. The digest is enforced on downloaded, checked-in, built and direct-file artifacts; a mismatch aborts before anything is written. Remote installs without a digest still work but print a prominent warning.
+- **Remote install hardening:** validated guest names, private temporary directories, `git clone --depth 1 -- <repo>`, and explicit warnings when manifest build commands or native guests run unsandboxed.
+- **Prebuilt installer:** portable SHA-256 via `sha256sum`, `shasum` or `openssl`; `SHA256SUMS` is mandatory; v1.0.1+ also requires a signed `SHA256SUMS.bundle`. `--require-signature` makes cosign mandatory, `--allow-unsigned` is an explicit opt-out, and the version/assets come from the release tag and exact expected filename.
+- **Signed releases:** keyless cosign signature for `SHA256SUMS`, GitHub build provenance attestations, and a release gate that checks the tag is on `main`, matches `Cargo.toml`, runs the tests and `cargo audit`, and re-verifies the signature and checksums before publishing.
+- **Supply chain:** added `cargo audit`/`npm audit` CI, Dependabot, SHA-pinned GitHub Actions, and Rust 1.98.1 with `--locked` release builds.
+
 ## v1.0.0 · Windows Native Probes, Daemons on Windows & Dependency Refresh · 2026-09-18
 
 - **Windows native probes:** CPU, datetime, battery and GPU are read through the Win32 API (`platform/windows/`) instead of sysinfo's PDH counters and PowerShell/`wmic` subprocesses — the default fetch went from ~575 ms to ~33 ms warm on a 16-thread machine, with identical rendered values

docs/es/SUMMARY.md

@@ -2,7 +2,7 @@
 
 Una herramienta de obtención de información del sistema multiplataforma escrita en Rust.
 
-- **Versión:** 1.0.0
+- **Versión:** 1.0.1
 - **Licencia:** MIT
 - **Autor:** xscriptor
 - **Repositorio:** github.com/xfetch-cli/xfetch

docs/es/changelog.md

@@ -1,6 +1,16 @@
 # Registro de Cambios
 # Registro de Cambios
 
+## v1.0.1 · Release de seguridad: dependencias parchadas, releases firmadas e instaladores más seguros · 2026-10-24
+
+- **Cerrados todos los avisos de RustSec del grafo de v1.0.0:** `wasmtime` y `wasmtime-wasi` 48.0.7, `rustls` 0.23.46, `rustls-webpki` 0.103.16, `webpki-roots` 1.0.11, `tokio` 1.54.1 y `yoke-derive` 0.8.4. `cargo audit --deny warnings` reporta 0 vulnerabilidades y 0 warnings.
+- **Los binarios de v1.0.0 siguen afectados por estos avisos; actualiza a v1.0.1.**
+- **Fijado de artefactos wasm:** los manifiestos aceptan un `sha256` opcional y los comandos de plugins, efectos y extensiones aceptan `--sha256`. El digest se verifica en artefactos descargados, versionados, generados por build y archivos locales; una discrepancia aborta antes de escribir nada. Las instalaciones remotas sin digest siguen funcionando, pero muestran un aviso claro.
+- **Endurecimiento de instalaciones remotas:** nombres de invitado validados, directorios temporales privados, `git clone --depth 1 -- <repo>` y avisos explícitos cuando un comando `build` del manifiesto o un plugin nativo se ejecuta sin sandbox.
+- **Instalador prebuilt:** SHA-256 portable con `sha256sum`, `shasum` u `openssl`; `SHA256SUMS` es obligatorio; desde v1.0.1 también se exige `SHA256SUMS.bundle` firmado. `--require-signature` hace obligatorio cosign, `--allow-unsigned` es una excepción explícita, y la versión y el asset se derivan del tag y del nombre exacto esperado.
+- **Releases firmadas:** firma keyless de cosign para `SHA256SUMS`, attestations de procedencia de GitHub y un gate que comprueba que el tag está en `main`, coincide con `Cargo.toml`, ejecuta tests y `cargo audit`, y re-verifica firma y checksums antes de publicar.
+- **Cadena de suministro:** CI con `cargo audit`/`npm audit`, Dependabot, GitHub Actions pineadas por SHA y builds de release con Rust 1.98.1 y `--locked`.
+
 ## v1.0.0 · Sondas nativas en Windows, daemons en Windows y actualización de dependencias · 2026-09-18
 
 - **Sondas nativas en Windows:** CPU, fecha, batería y GPU se leen por la API Win32 (`platform/windows/`) en vez de los contadores PDH de sysinfo y los subprocesos de PowerShell/`wmic` — el fetch por defecto pasó de ~575 ms a ~33 ms en caliente en una máquina de 16 hilos, con valores idénticos