bilbospocketses · bilbospocketses · Jun 11, 2026 · Jun 11, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -55,11 +55,11 @@ jobs:
       # Pin vpk to match the NuGet `Velopack` package version in
       # ControlMenu.csproj + ControlMenuLauncher.csproj — the CLI and the
       # runtime library share a release/serialization line and must stay in
-      # lockstep. 1.1.1 is the first stable line we ship on; `--msi` /
-      # `--instLocation` are standard post-1.0 (the earlier 0.0.1589 prerelease
-      # pin predated their stable availability). Mirrors ws-scrcpy-web's pin.
+      # lockstep. 1.2.0 matches the Dependabot bump of the Velopack NuGet
+      # package (#44); `--msi` / `--instLocation PerMachine` are solidly
+      # supported on the 1.2.0 line (bundled WiX 5). Mirrors ws-scrcpy-web's pin.
       - name: Install vpk CLI
-        run: dotnet tool install -g vpk --version 1.1.1
+        run: dotnet tool install -g vpk --version 1.2.0
 
       # No .sln in this repo — restore + build per project directly.
       # Mirrors the local-pack.ps1 approach (3x dotnet publish below).

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,10 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.1] - 2026-06-11
+
 ### Changed
 
 - **Module `SortOrder` values renumbered to eliminate a collision.** `JellyfinModule` and `AndroidPowerToolsModule` both declared `SortOrder = 2`, so the sidebar order held only by the `DisplayName` alphabetical tiebreak. Renumbered Jellyfin `2 → 3`, Utilities `3 → 4`, and Cameras `4 → 5` so every module has a distinct ordering key (Android Devices `1` and Android Power Tools `2` unchanged). The rendered sidebar / module-tile order is unchanged — this only removes the fragile tie. `CamerasModuleTests.SortOrder_Is4` renamed to `SortOrder_Is5`.
-- **Velopack `0.0.1589-ga2c5a97` (prerelease) → `1.1.1` (stable).** Bumped in both production csprojs (`ControlMenu`, `ControlMenuLauncher`) and the `vpk` CLI pin (`release.yml`, `scripts/local-pack.ps1`) — the CLI and runtime library share a release line and must stay in lockstep. The earlier prerelease pin predated stable `--msi` / `--instLocation`, now standard post-1.0. The consumed .NET surface (`UpdateManager` / `GithubSource` / `CheckForUpdatesAsync` / `DownloadUpdatesAsync` / `VelopackApp.Build().SetAutoApplyOnStartup(false).Run()`) is source-compatible — verified by a clean Release build, the full 445-test suite, and a local `vpk 1.1.1` `--msi --instLocation PerMachine` pack producing a working `ControlMenu-stable.msi`. Supersedes Dependabot #34.
+- **Velopack `0.0.1589-ga2c5a97` (prerelease) → `1.2.0` (stable).** Bumped in both production csprojs (`ControlMenu`, `ControlMenuLauncher`) and the `vpk` CLI pin (`release.yml`, `scripts/local-pack.ps1`) — the CLI and runtime library share a release line and must stay in lockstep. Landed in two steps: PR #41 moved the prerelease pin to `1.1.1` (superseding Dependabot #34), then Dependabot #44 auto-bumped the NuGet `Velopack` package `1.1.1 → 1.2.0`; this release brings the `vpk` CLI pin up to `1.2.0` to restore lockstep. `1.2.0` is the line where `--msi --instLocation PerMachine` is solidly supported (bundled WiX 5). The consumed .NET surface (`UpdateManager` / `GithubSource` / `CheckForUpdatesAsync` / `DownloadUpdatesAsync` / `VelopackApp.Build().SetAutoApplyOnStartup(false).Run()`) is source-compatible — verified by a clean Release build and the full 445-test suite. `1.2.0`'s `--msi --instLocation PerMachine` packaging is exercised by the release CI on tag and by `scripts/local-pack.ps1` locally.
+- **Bumped `xunit` `2.9.2 → 2.9.3`** (test dependency; Dependabot #45).
 
 ### Removed
 
@@ -21,6 +24,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **`release.yml` publish-job download-artifact path** — added explicit `name: windows-final` + `path: artifacts/windows-final/` to the `actions/download-artifact@v8.0.1` step. **Symptom:** v1.1.0's release.yml run completed with all 3 jobs green, but the published v1.1.0 GitHub Release contained only `SHA256SUMS` (195 bytes); the MSI + nupkg + releases.stable.json were missing despite being present in the workflow artifact. **Root cause:** `actions/download-artifact@v8` with no `name:` filter and `path: artifacts/` flattens a single artifact's files directly into `artifacts/` (no auto-subdirectory), but the `softprops/action-gh-release@v3.0.0` globs below targeted `artifacts/windows-final/*.msi` / `*.nupkg` / `releases.<channel>.json` — zero matches, silent skip per softprops's "Pattern '...' does not match any files" advisory. Drift introduced when Dependabot bumped download-artifact (PR #4, v4 → v8) on 2026-05-18 — v4 may have behaved differently for single-artifact downloads; either way, the explicit `name:` + nested `path:` is the deterministic fix that also future-proofs against any version-specific behavior. **Recovery:** v1.1.0 release patched 2026-05-19 via manual `gh run download` + `gh release upload` of the original artifact bytes (SHAs verified against existing SHA256SUMS); no rebuild required, original Sigstore attestation unchanged + still verifies against the patched MSI.
 - **`scripts/fresh-vm-smoke.md` MSI filename references** — step 1's expected release assets list listed `ControlMenu-<version>-win-Setup.msi` / `*-win.nupkg` / `*-win-delta.nupkg` — that's a notional naming convention that doesn't match vpk's actual output. vpk embeds the **channel** (not the version) in the MSI name and the **version + channel** in the nupkg names: `ControlMenu-<channel>.msi`, `ControlMenu-<version>-<channel>-full.nupkg`, `ControlMenu-<version>-<channel>-delta.nupkg`. Runbook updated with the correct convention + a note that channel separation (not version embedding) is the load-bearing axis for Velopack's update feed.
 
+### Security
+
+- **Hardened the Dependabot auto-merge workflow** (`.github/workflows/dependabot-auto-merge.yml`, #42). The top-level token is narrowed to `contents: read`, with the job stepping up to only the writes it needs (`contents` + `pull-requests: write`) — a top-level write token is flagged high-severity by OpenSSF Scorecard's `TokenPermissions` check. Auto-merge now covers patch/minor bumps **and security updates of any size** (gated on `dependabot/fetch-metadata`'s `ghsa-id`), while non-security **major** bumps are held with a `needs-manual-review` label + comment instead of merging.
+- **Bumped `github/codeql-action` `4.36.1 → 4.36.2`** (`scorecard.yml`, #43) — SHA-pinned with a precise version comment, per the repo's pin discipline.
+
 ## [1.1.0] - 2026-05-19
 
 ### Changed
@@ -262,7 +270,8 @@ First official release.
 - **`fix(theme)` TopBar theme toggle** stays in sync when theme changes via the iframe bridge.
 - **`fix(theme)` Blazor subscriber pattern** — switched from returning a JS unsubscribe closure (broke the Blazor circuit) to a numeric-token handle pattern.
 
-[Unreleased]: https://github.com/bilbospocketses/control-menu/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/bilbospocketses/control-menu/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/bilbospocketses/control-menu/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/bilbospocketses/control-menu/compare/v1.0.1...v1.1.0
 [1.1.0-beta.3]: https://github.com/bilbospocketses/control-menu/compare/v1.1.0-beta.2...v1.1.0-beta.3
 [1.1.0-beta.2]: https://github.com/bilbospocketses/control-menu/compare/v1.1.0-beta.1...v1.1.0-beta.2

diff --git a/scripts/local-pack.ps1 b/scripts/local-pack.ps1
@@ -59,7 +59,7 @@ function Resolve-VendoredDotnet {
 # Resolve vpk (global tool, mirrors ws-scrcpy-web release.yml)
 # ---------------------------------------------------------------------------
 function Resolve-Vpk {
-    $vpkVersion = '1.1.1'
+    $vpkVersion = '1.2.0'
     $listed = dotnet tool list -g | Select-String -Pattern "^vpk\s+$([regex]::Escape($vpkVersion))\s"
     if (-not $listed) {
         Write-Host "Installing vpk $vpkVersion globally (matches the Velopack NuGet pin)..."

diff --git a/src/ControlMenu.Common/ControlMenu.Common.csproj b/src/ControlMenu.Common/ControlMenu.Common.csproj
@@ -4,9 +4,9 @@
     <TargetFramework>net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <Version>1.1.0</Version>
-    <AssemblyVersion>1.1.0.0</AssemblyVersion>
-    <FileVersion>1.1.0.0</FileVersion>
+    <Version>1.1.1</Version>
+    <AssemblyVersion>1.1.1.0</AssemblyVersion>
+    <FileVersion>1.1.1.0</FileVersion>
     <RootNamespace>ControlMenu.Common</RootNamespace>
   </PropertyGroup>
 

diff --git a/src/ControlMenu/ControlMenu.csproj b/src/ControlMenu/ControlMenu.csproj
@@ -4,9 +4,9 @@
     <TargetFramework>net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <Version>1.1.0</Version>
-    <AssemblyVersion>1.1.0.0</AssemblyVersion>
-    <FileVersion>1.1.0.0</FileVersion>
+    <Version>1.1.1</Version>
+    <AssemblyVersion>1.1.1.0</AssemblyVersion>
+    <FileVersion>1.1.1.0</FileVersion>
   </PropertyGroup>
 
   <ItemGroup>

diff --git a/src/ControlMenuLauncher/ControlMenuLauncher.csproj b/src/ControlMenuLauncher/ControlMenuLauncher.csproj
@@ -5,9 +5,9 @@
     <TargetFramework>net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <Version>1.1.0</Version>
-    <AssemblyVersion>1.1.0.0</AssemblyVersion>
-    <FileVersion>1.1.0.0</FileVersion>
+    <Version>1.1.1</Version>
+    <AssemblyVersion>1.1.1.0</AssemblyVersion>
+    <FileVersion>1.1.1.0</FileVersion>
     <RootNamespace>ControlMenu.Launcher</RootNamespace>
     <AssemblyName>ControlMenuLauncher</AssemblyName>
   </PropertyGroup>

diff --git a/src/ControlMenuTray/ControlMenuTray.csproj b/src/ControlMenuTray/ControlMenuTray.csproj
@@ -5,9 +5,9 @@
     <TargetFramework>net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <Version>1.1.0</Version>
-    <AssemblyVersion>1.1.0.0</AssemblyVersion>
-    <FileVersion>1.1.0.0</FileVersion>
+    <Version>1.1.1</Version>
+    <AssemblyVersion>1.1.1.0</AssemblyVersion>
+    <FileVersion>1.1.1.0</FileVersion>
     <RootNamespace>ControlMenu.Tray</RootNamespace>
     <AssemblyName>ControlMenuTray</AssemblyName>
   </PropertyGroup>