Bump versions of create-widget, update template dependencies and node24

.changeset/add-current-dir-scaffold.md

@@ -0,0 +1,9 @@
+---
+"@merkur/create-widget": minor
+---
+
+Add support for scaffolding into the current directory and `--skip-install` flag
+
+- **What** `create.mjs` now accepts `.` as the directory argument, using `process.cwd()` as the target instead of trying to create a new directory. `projName` is derived from the resolved path basename so it is never literally `"."`. A new `--skip-install` flag skips the automatic `npm install` step. Updated README and website getting-started docs with usage examples.
+- **Why** Users working in a pre-created or cloned directory (e.g. after `mkdir my-widget && cd my-widget` or after cloning an empty repo) previously got an "already exists" error because `.` always resolves to an existing path. `--skip-install` is useful in CI pipelines that manage their own dependency installation.
+- **How** Nothing — both behaviours are opt-in.

.changeset/every-cooks-enjoy.md

@@ -0,0 +1,9 @@
+---
+"@merkur/create-widget": patch
+---
+
+Add missing `.npmignore` rule so template `.gitignore` is included in the published package
+
+- **What** Added `!/template/.gitignore` to `.npmignore`. Without this entry npm was stripping the template `.gitignore` file from the published package, so newly scaffolded projects had no `.gitignore`.
+- **Why** The npm default ignore rules exclude dot-files; an explicit negation rule is required to keep them.
+- **How** Nothing — the fix is internal to the published package.

.changeset/quick-ads-argue.md

@@ -0,0 +1,10 @@
+---
+"@merkur/create-widget": major
+---
+
+Bump minimum Node.js requirement to 24 and update all dependencies to latest major versions
+
+- **What** Updated the minimum Node.js engine requirement from `>=12` to `>=24` in `create-widget` and from `>=20` to `>=24` in the generated widget template. Updated `execa` (7→9), `inquirer` (9→13, `list` prompt type renamed to `select`), `express` (4→5), `helmet` (5→8), `cross-env` (7→10), `config` (3→4), `express-static-gzip` (2→3). Replaced the deprecated `cluster.isMaster` with `cluster.isPrimary` in the generated server template. Bumped `.nvmrc` in the template to Node 24.
+- **Why** The previous dependencies were outdated and relied on Node.js APIs and package versions that are now deprecated or no longer maintained. Aligning with Node 24 LTS ensures users benefit from current security patches and modern APIs.
+- **How** Upgrade your Node.js runtime to at least version 24 before running `@merkur/create-widget`. If you have an existing generated project, upgrade the listed server dependencies (`express`, `helmet`, `cross-env`, `config`, `express-static-gzip`) to the versions listed above.
+

.changeset/shy-chicken-flow.md

@@ -0,0 +1,10 @@
+---
+"@merkur/create-widget": patch
+---
+
+Escape HTML output in vanilla template to prevent XSS
+
+- **What** Added `escHtml()` calls around all widget state and property values interpolated into template literals in `Counter.js`, `WidgetDescription.js`, `HeadlineSlot.js`, and `ErrorView.js`. Also fixed `className` to `class` in `ErrorView.js`.
+- **Why** Raw interpolation of widget state into HTML strings is vulnerable to XSS. Any user-controlled value (e.g. `widget.state.counter`, `widget.name`, `widget.error.message`) could inject arbitrary HTML.
+- **How** Nothing.
+

.github/workflows/ci.yml

@@ -45,6 +45,8 @@ jobs:
         run: npm run build
       - name: Script version check
         run: npm run test:es:version
+      - name: Utils tests
+        run: npm run test:utils
       - name: Build Docusaurus website
         run: |
           cd website
@@ -116,7 +118,7 @@ jobs:
     name: Deploy to GitHub Pages
     needs: release
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     permissions:
       contents: read
       pages: write

CHANGELOG.md

@@ -1,3 +1,10 @@
+## [1.0.3](https://github.com/crysadrak/merkur/compare/v1.0.2...v1.0.3) (2026-04-10)
+
+### Patch Changes
+
+- c49d82e: Re-release after process fixes
+
+
 ## [1.0.2](https://github.com/mjancarik/merkur/compare/v1.0.1...v1.0.2) (2026-04-08)
 
 ### Patch Changes