[chore] align primary website with deployed security and release inputs

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

tools/web/package-lock.json

@@ -29,15 +29,15 @@
   "dependencies": {
     "@material/web": "2.2.0",
     "esp-web-tools": "10.4.0",
-    "next": "16.2.12",
+    "next": "16.3.4",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-server-dom-webpack": "19.2.8",
     "vinext": "1.0.0-beta.8"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
-    "@next/eslint-plugin-next": "16.2.12",
+    "@next/eslint-plugin-next": "16.3.4",
     "@testing-library/jest-dom": "7.0.0",
     "@testing-library/react": "16.3.2",
     "@types/node": "26.1.2",
@@ -53,12 +53,12 @@
     "typescript": "5.9.3",
     "typescript-eslint": "8.65.0",
     "vite": "8.1.5",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "overrides": {
     "next": {
       "postcss": "8.5.26",
-      "sharp": "0.35.3"
+      "sharp": "0.35.4"
     }
   }
 }

tools/web/package.json

@@ -563,11 +563,11 @@ License file: LICENSE
    limitations under the License.
 
 ================================================================================
-@next/env 16.2.12
+@next/env 16.3.4
 Installed path: node_modules/@next/env
 SPDX license: MIT
-Source: https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz
-License file: reviewed fallback for node_modules/@next/env@16.2.12
+Source: https://registry.npmjs.org/@next/env/-/env-16.3.4.tgz
+License file: reviewed fallback for node_modules/@next/env@16.3.4
 
 The MIT License (MIT)
 
@@ -1088,10 +1088,10 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
-@swc/helpers 0.5.15
+@swc/helpers 0.5.23
 Installed path: node_modules/@swc/helpers
 SPDX license: Apache-2.0
-Source: https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz
+Source: https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz
 License file: LICENSE
 
                               Apache License
@@ -3995,10 +3995,10 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 ================================================================================
-next 16.2.12
+next 16.3.4
 Installed path: node_modules/next
 SPDX license: MIT
-Source: https://registry.npmjs.org/next/-/next-16.2.12.tgz
+Source: https://registry.npmjs.org/next/-/next-16.3.4.tgz
 License file: license.md
 
 The MIT License (MIT)

tools/web/public/WEBSITE_THIRD_PARTY_LICENSES.txt

@@ -60,7 +60,7 @@ SOFTWARE.`;
 
 const reviewedLicenseFallbacks = {
   "node_modules/@next/env": {
-    version: "16.2.12",
+    version: "16.3.4",
     text: mitLicense(
       "Copyright (c) 2025 Vercel, Inc.",
       "The MIT License (MIT)",

tools/web/scripts/generate-website-third-party-licenses.js

@@ -7,6 +7,7 @@ import { PageIntro } from "@/components/page-intro";
 import { WaveshareBoardPhoto } from "@/components/waveshare-board-photo";
 import {
   firmwareVersionUsesFiveProfiles,
+  isOwnerConfirmedFirmwareRelease,
   releaseIncludesWaveshareLcd147b,
 } from "@/lib/firmware-release";
 import {
@@ -33,6 +34,7 @@ export default function FlashPage() {
   const release = preview ? null : firmwareReleaseSelectedAtBuild();
   const publicBeta = release?.deployment === "public-beta";
   const candidate = release?.deployment === "candidate";
+  const ownerConfirmed = isOwnerConfirmedFirmwareRelease(release);
   const waveshareLcd147b = releaseIncludesWaveshareLcd147b(release);
   const fiveProfileRelease =
     release !== null && firmwareVersionUsesFiveProfiles(release.version);
@@ -59,7 +61,9 @@ export default function FlashPage() {
         <p>
           One-time wired provisioning installs PyBLE-enabled MicroPython. Then
           develop over Bluetooth Low Energy from the tablet-first PyBLE app.
-          {preview
+          {ownerConfirmed
+            ? " Firmware v0.6.1 is available for all five board profiles following qualification confirmed by the project owner."
+            : preview
             ? ` LOCAL ENGINEERING PREVIEW v${preview.version} — UNQUALIFIED. This is not a public release.`
             : publicBeta
               ? " The current v0.4.2 installer is a hardware-tested firmware beta. Production Chrome erase/install and deliberately interrupted-flash recovery passed on both exact profiles. Complete release qualification is still pending; this is not a qualified release."

tools/web/src/app/flash/page.tsx

@@ -10,6 +10,7 @@ import { verifyFirmwareProfile } from "@/lib/firmware-integrity";
 import {
   hasExactFirmwareProfileDescriptors,
   isExactPublicBetaFirmwareRelease,
+  isOwnerConfirmedFirmwareRelease,
   releaseIncludesWaveshareLcd147b,
   firmwareVersionUsesFiveProfiles,
   type FirmwareProfileDescriptor,
@@ -159,7 +160,8 @@ function policyFailure(release: FirmwareReleaseDescriptor | null | undefined) {
       body: "Hardware validation is still required on every profile included in a v0.6.0-derived candidate before the public installer can be enabled.",
     };
   }
-  if (release.deployment !== "public" && release.deployment !== "candidate") {
+  if (release.deployment !== "public" && release.deployment !== "candidate" &&
+      !isOwnerConfirmedFirmwareRelease(release)) {
     if (
       release.deployment !== "public-beta" ||
       !isExactPublicBetaFirmwareRelease(release)
@@ -379,6 +381,7 @@ function FlashStatusForRelease({
       : profileConsentItems;
   const everyConsent = requiredConsentItems.every(({ id }) => consents[id]);
   const candidate = activeRelease.deployment === "candidate";
+  const ownerConfirmed = isOwnerConfirmedFirmwareRelease(activeRelease);
   const publicBeta = activeRelease.deployment === "public-beta";
 
   function chooseProfile(profileId: FirmwareProfileId) {
@@ -485,7 +488,9 @@ function FlashStatusForRelease({
         <div>
           <p className="flash-status__eyebrow">Installer status</p>
           <h2 id="installer-status-title">
-            {candidate
+            {ownerConfirmed
+              ? "Owner-qualified release"
+              : candidate
               ? "Protected release candidate"
               : publicBeta
                 ? "Hardware-tested firmware beta"
@@ -498,7 +503,11 @@ function FlashStatusForRelease({
         role={candidate || publicBeta ? "status" : undefined}
         className="flash-status__message"
       >
-        {candidate
+        {ownerConfirmed ? (
+          <>Firmware v0.6.1 qualification was confirmed by the project owner.
+            {" "}<a href="/firmware-v0.6.1-owner-confirmation.md">Publication record</a>.
+            {" "}Select and verify your exact board profile before installation.</>
+        ) : candidate
           ? "Protected release candidate: hardware validation is pending."
           : publicBeta
             ? "Hardware-tested firmware beta: exact PyBLE v0.4.2 browser installation and interrupted-flash recovery passed on real esp32-4mb and esp32-s3-n16r8 hardware. Complete release qualification is still pending; this is not a qualified release."

tools/web/src/components/flash-status.tsx

@@ -8,6 +8,7 @@ import {
   historicalFirmwareProfileTable,
   firmwareVersionUsesFiveProfiles,
   isExactPublicBetaFirmwareRelease,
+  isOwnerConfirmedFirmwareRelease,
   publicBetaFirmwareVersion,
   type FirmwareProfileDescriptor,
   type FirmwareProfileId,
@@ -378,7 +379,8 @@ function validateDescriptor(
   if (
     descriptor.deployment !== "public" &&
     descriptor.deployment !== "candidate" &&
-    descriptor.deployment !== "public-beta"
+    descriptor.deployment !== "public-beta" &&
+    !isOwnerConfirmedFirmwareRelease(descriptor)
   ) {
     fail("Selected firmware deployment mode is invalid");
   }

tools/web/src/lib/firmware-integrity.ts

@@ -8,6 +8,7 @@ import {
   hasExactFirmwareProfileDescriptors,
   hasExactHistoricalFirmwareProfileDescriptors,
   isExactPublicBetaFirmwareRelease,
+  isOwnerConfirmedFirmwareRelease,
   releaseIncludesWaveshareLcd147b,
   type FirmwareReleaseDescriptor,
 } from "@/lib/firmware-release";
@@ -89,7 +90,8 @@ export function firmwareReleaseSelectedAtBuild(): FirmwareReleaseDescriptor | nu
   if (
     descriptor.deployment !== "public" &&
     descriptor.deployment !== "candidate" &&
-    descriptor.deployment !== "public-beta"
+    descriptor.deployment !== "public-beta" &&
+    !isOwnerConfirmedFirmwareRelease(descriptor)
   ) {
     throw new Error(
       "Build-selected firmware descriptor has an invalid deployment mode",

tools/web/src/lib/firmware-release-selection.ts

@@ -74,7 +74,7 @@ export type HistoricalFirmwareProfileId =
   (typeof historicalFirmwareProfileTable)[number]["id"];
 export type PlannedFirmwareProfileId =
   (typeof plannedFirmwareProfileTable)[number]["id"];
-export type FirmwareDeployment = "public" | "candidate" | "public-beta";
+export type FirmwareDeployment = "public" | "candidate" | "public-beta" | "owner-confirmed";
 export type FirmwareHilStatus = "pending" | "passed";
 export type FirmwareProvisioningKind =
   "esp-web-serial" | "verified-uf2-bootsel";
@@ -150,6 +150,23 @@ export interface FirmwareReleaseDescriptor {
   readonly profiles: readonly FirmwareProfileDescriptor[];
 }
 
+// Explicit owner authorization for these immutable bytes only; automated HIL
+// records stay pending. This does not relax the qualified-public release gate.
+export function isOwnerConfirmedFirmwareRelease(
+  descriptor: FirmwareReleaseDescriptor | null | undefined,
+): boolean {
+  return Boolean(
+    descriptor?.deployment === "owner-confirmed" &&
+    descriptor.accessControlled === false &&
+    descriptor.version === "0.6.1" &&
+    descriptor.hilStatus === "pending" &&
+    descriptor.releaseJson.path === "/firmware/v0.6.1/release.json" &&
+    descriptor.releaseJson.sha256 ===
+      "71f6aca6df07e31a1f54c7f70a48d82c7fe26b1c8ca0626a8ffc57c804fbb1bd" &&
+    hasExactFirmwareProfileDescriptors(descriptor.version, descriptor.profiles),
+  );
+}
+
 export interface VerifiedFirmwareProfile {
   readonly profileId: FirmwareProfileId;
   readonly provisioningKind?: FirmwareProvisioningKind;

tools/web/src/lib/firmware-release.ts

@@ -99,6 +99,33 @@ describe("production build contract", () => {
     });
   });
 
+  it("pins the patched Next, Sharp, and Vitest security closure", async () => {
+    const [packageJson, packageLock] = await Promise.all(
+      ["package.json", "package-lock.json"].map(async (file) =>
+        JSON.parse(await readFile(join(process.cwd(), file), "utf8")),
+      ),
+    );
+
+    expect(packageJson.dependencies?.next).toBe("16.3.4");
+    expect(packageJson.devDependencies?.["@next/eslint-plugin-next"]).toBe(
+      "16.3.4",
+    );
+    expect(packageJson.devDependencies?.vitest).toBe("4.1.11");
+    expect(packageJson.overrides?.next?.sharp).toBe("0.35.4");
+    for (const [name, version] of [
+      ["next", "16.3.4"],
+      ["@next/env", "16.3.4"],
+      ["@next/eslint-plugin-next", "16.3.4"],
+      ["sharp", "0.35.4"],
+      ["vitest", "4.1.11"],
+      ["@vitest/mocker", "4.1.11"],
+    ]) {
+      expect(packageLock.packages?.[`node_modules/${name}`]?.version).toBe(
+        version,
+      );
+    }
+  });
+
   it("pins the audited build closure and excludes the vulnerable image parser package", async () => {
     const [packageJson, packageLock, appFiles, sourceFiles] = await Promise.all(
       [