release: 1.6.8 (3-card sign-in, curated deps, AGPL on Zapstore)

- 3-card sign-in chooser + desktop welcome modal (from 2164dd6's LoginDialog
  restyle) ships.
- Curated dependency fixes (vite 6.4.5 / vitest 3.2.7 / unhead 2.1.17 /
  yaml 2.9.1, TS pinned 5.8.3) — OSV 107 -> 59.
- zapstore.yaml license: custom -> AGPL-3.0-only (the listing now shows the real
  licence; verified on the 32267 tag).
Bump 1.6.7 -> 1.6.8, APK built + published + verified.

AGENTS.md

@@ -2207,7 +2207,7 @@ Rules:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH`.
     Complete non-interactive publish:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH; zsp publish --quiet zapstore.yaml`
-    ✅ **Published 1.6.1–1.6.7 on 2026-10-12/14** — the app's usual path is an **inline
+    ✅ **Published 1.6.1–1.6.8 on 2026-10-12/26** — the app's usual path is an **inline
     `SIGN_WITH=<nsec1…>`** (the value lives only in the shell/history, never in
     the repo); verify the signer is the app identity first (`nak key public` →
     `npub1yrnuj…` / hex `20e7c953…`). Use **`~/go/bin/zsp`** (v0.4.11) — the
@@ -2304,6 +2304,14 @@ Rules:
   replacing). Lesson: do NOT rely on a blanket `npm update`; update in curated
   batches (pin `typescript`, add `overrides`/`npm dedupe` for the duplicated
   packages, keep majors as their own migrations) and let the timer gate each.
+  ✅ **Curated batch landed (2026-10-26):** pinned `typescript` **5.8.3 exact**,
+  updated `vite` **6.4.5**, `vitest` **3.2.7**, `@unhead/react`/`unhead`
+  **2.1.17**, `yaml` **2.9.1**, then `npm dedupe` — `npm test` green and OSV
+  **107 → 59** findings. Remaining are transitive/major (vitest 4, valibot 1,
+  uuid 11, zod 4) or **xlsx** (no fix — and it's **write-only**: only
+  `book_new`/`aoa_to_sheet`/`writeFile`, no `read`, so the parse CVEs don't
+  apply). `zapstore.yaml` license was `custom` (the listing showed "custom");
+  now **`AGPL-3.0-only`** (re-published in 1.6.8, verified on the 32267 tag).
 
 ### Community relay — self-hosted Newlay (2026-10-12)
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.6.7",
+      "version": "1.6.8",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.6.7",
+  "version": "1.6.8",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",

release-notes.txt

@@ -1,3 +1,20 @@
+🔑 A clearer way in
+- Sign-in now leads with three clear choices — browser extension, signer app
+  (bunker/Amber), or scan a code to sign in with your phone — plus a quiet
+  "Secret Key" option.
+- On desktop, a welcome sign-in card appears once for logged-out visitors (you
+  can dismiss it).
+
+🛡 Dependency security
+- Updated Vite, Vitest, unhead and yaml and pinned TypeScript; the OSV scan now
+  reports far fewer known issues (remaining ones are upstream major versions or
+  have no fix).
+
+📄 License
+- The Zapstore listing now shows the real licence: AGPL-3.0-only (was "custom").
+
+---
+
 🔧 Amber signing fix
 - Fixed messages (and other long encrypted data) occasionally failing to open
   when signed with Amber — the signer can compress large results and the app now

zapstore.yaml

@@ -60,7 +60,7 @@ description: |
   - Works offline (PWA)
 
 website: https://skate-spots.org
-license: custom
+license: AGPL-3.0-only
 
 # App icon (local path or URL). YAML config ALWAYS wins over the icon
 # extracted from the APK or pulled from external metadata sources.