[callinmullaney]

Summary

Patch release candidate for @emulsify/core 4.5.2, cut from the published v4.5.1 tag on main. Consumer npm run build now prints the same Emulsify banner and build summary that npm run develop already prints, and 31 dependency minimums are raised with a regenerated lockfile.

• Proposed version: 4.5.2 (patch). The only release-producing commit is fix(reporter): show build summaries and refresh dependencies (b2c10ca).
• Publishing: merging into main triggers publish.yml. It re-runs release:verify on the merged SHA, then semantic-release publishes 4.5.2 to npm latest with provenance, tags v4.5.2, and creates the GitHub release.
• Merge strategy: Create a merge commit (the established strategy). A squash merge also produces 4.5.2 because the title is a conventional fix.
• Node.js policy: unchanged. Consumers need Node.js >=24.13.0 (package.json#engines). Repository development and most CI jobs use 24.18.0 (.nvmrc), and release-readiness runs on both.

User-facing changes

• npm run build (any one-shot vite build using Core's Vite config) prints the Emulsify wordmark, the installed Core version, project facts, input roots, output file counts and sizes, and a completion line (✓ built in …). Vite's normal per-file production table is kept.
• Detailed mode (EMULSIFY_VERBOSE=2 or npm run build --verbose) also applies to production builds and lists compiled files with sizes.
• A failed production build prints one failed summary (✗ build failed after …) and still exits non-zero. This includes strict asset failures under EMULSIFY_STRICT_ASSETS=1.
• Static storybook build keeps its compact diagnostics (asset repairs and collected Sass deprecations) with no second banner, so a combined Vite and Storybook build prints one banner.
• npm run develop output is unchanged.
• Raised dependency minimums include the Storybook family at exactly 10.6.5, Vite ^8.3.5, Sass ^1.107.1, Jest ^30.5.2, axe-core ^4.14.0 and glob ^14.0.3, plus Puppeteer ^25.16.0 in dev. The full table is in docs/dependency-review-4.5.2.md.

Compatibility and migration impact

• No migration. Consumers update Core and their lockfile (npm install @emulsify/core@^4.5.2, or npm install --save-dev @emulsify/core@^4.5.2 where Core is a dev dependency).
• Built output is unchanged. The author's baseline-to-candidate comparison found all 17 production output files byte-identical, and every release fixture passes.
• The visible change is console output from npm run build. Anything that parses that output will now see the banner and summary.
• glob moves from 13 to 14 (a major) in dependencies. Core uses only globSync and escape, and their signatures are unchanged. Glob 14 removes the unused debug option and adds an opt-in normalize option. Its engine range (18 || 20 || >=22) admits Node 24.13.0.
• These majors are deliberately held back: Babel 8 (blocked by babel-preset-minify), ESLint 10 (plugin peer ranges) and Stylelint 18 (its Node 24 floor is above Core's 24.13.0, and plugin peers aren't ready). Standalone @babel/parser stays on 7.x by maintainer choice.

Internal architecture and performance changes

• developReporterPlugin now decides on the full report by "not a static Storybook build" (fullReport) instead of "watch mode". Watch mode still controls quiet logging, unminified output and source maps.
• One-shot builds report from closeBundle, so the summary prints after Vite's asset table. Watch builds still report from writeBundle.
• renderSummary accepts watching and failed. One-shot builds drop the watching src/ suffix, and strict asset failures mark the summary as failed.
• vite.config.js passes the existing isStorybookBuild signal, which Core's Storybook viteFinal sets, through the plugin environment.
• The lockfile was regenerated through npm with no overrides or patches. allowScripts approvals now match the locked versions: esbuild@0.28.2 and puppeteer@25.16.0. The obsolete unrs-resolver@1.12.2 approval is removed because 1.13.0 has no install script.
• Performance: default one-shot builds render one summary per build, and gzip sizing runs only in detailed mode. No benchmarks were run.

Public API and package-export changes

• There are no changes to the export map, the bin entries or the published files list. docs/ isn't published.
• makePlugins(env), exported from @emulsify/core/vite/plugins, accepts an optional env.isStorybookBuild. The change is additive, and callers that omit the flag get theme-build reporting.

Known limitations

• A Storybook setup that loads Core's Vite config without Core's viteFinal won't pass isStorybookBuild. Its storybook build would print the full theme banner and summary. The effect is cosmetic.
• npm audit drops from 89 to 77 affected package records (1 low, 72 moderate, 2 high and 2 critical). The critical path is @emulsify/cli@2.4.1 → simple-git@3.x, and npm reports no fix within the CLI's range. The other remaining findings are bundled inside npm 11 (via @semantic-release/npm) or held back by the ranges in Jest, Storybook and ESLint. See docs/dependency-review-4.5.2.md.
• Installs still print upstream deprecation warnings for nested glob@10.5.0, whatwg-encoding@3.1.1 and eslint@9.39.5.
• A theme that imports glob without declaring it, relying on npm hoisting Core's copy, will get glob 14. glob isn't part of the documented consumer contract.

Release evidence

CI (observed): CI run 41851120119 on head b2c10ca passed all 19 required contexts.

• release-readiness (24.13.0) and release-readiness (24.18.0): lint, 118 suites with 1,554 tests and 12 snapshots, and the repository Storybook build. The Storybook build log shows no theme banner.
• Packed package: npm pack dry run and the packed-package smoke test, including the installed emulsify-audit JSON mode.
• All 11 Fixture / … jobs, all 3 Packed consumer / … jobs, React peer / 18 and React peer / 19.
• CodeQL Analyze (javascript-typescript) passed.
• That run targeted develop, so Verify release calculation was skipped because it runs only for pull requests into main. The CI-tested merge tree (e98f374) is identical to the tree that merging into main produces.

Local review check (Linux x64, Node 24.18.0, npm 11.21.1, npm ci --ignore-scripts), run on a --no-ff merge of b2c10ca into main at 7365cc8:

• RELEASE_FROM=7365cc8 RELEASE_TO=HEAD RELEASE_SQUASH_MESSAGE="fix(reporter): show build summaries and refresh dependencies" npm run release:analyze printed semantic-release predicts patch: v4.5.1 -> v4.5.2 from 2 commits. Squash title preserves the patch release.
• The same command without a squash title (the merge-commit strategy) printed patch: v4.5.1 -> v4.5.2.
• npx jest --config ./config/jest.config.js --coverage=false config/vite/plugins/__tests__/reporter: 11 suites, 358 tests passed.

Local author verification (recorded in docs/releases/4.5.2.md):

• macOS ARM64 with Node 24.22.1 and npm 11.19.1: lifecycle-enabled npm ci, lint, 118 suites with 1,556 tests and 12 snapshots, Storybook, all release and packed-consumer fixtures, and the pack and smoke checks. A 4.5.1 consumer upgraded to the packed candidate with a valid npm ls --all. Production output was byte-identical, and the Pa11y and Puppeteer checks passed.
• Linux ARM64 with Node 24.16.0: npm ci, lint, 118 suites with 1,554 tests and 12 snapshots, and a production build from the installed tarball.

Not run: the authenticated semantic-release --dry-run, which runs only in publish.yml after merge, and the optional Twig PHP parity workflow, since there are no Twig runtime changes.

Outstanding checks and decisions

• Re-run CI against main by closing and reopening this PR or pushing a commit, so Packed package records the release calculation with this title.
• Get one approving maintainer review, which main requires.
• Confirm the patch classification. This is treated as a patch because it changes console output only, with no API, configuration or built-file changes, and it responds to a reported gap in production-build output. Note that config/release-analysis.cjs says further reporter additions should take a minor.
• After merge, confirm that publish.yml succeeds, npm shows 4.5.2 on latest with provenance, and the v4.5.2 tag and GitHub release exist.
• After publish, sync main back into develop. develop is still at 4.5.0 and is an ancestor of main.
• Accept the remaining audit findings for this patch, or track them as follow-ups.

Related issue(s)

There's no linked issue. During release preparation, a user reported that production builds leave out the Emulsify banner and the compiled-file summary shown during development. The dependency refresh was bundled into the same patch as routine maintenance. This follows #322 (4.5.1).

Review record

Review Track	Evidence Or Review Link	Status Or Outstanding Work
Storybook API and custom elements	No changes to src/storybook or the custom-element APIs. Fixture / mixed-storybook, React peer / 18 and React peer / 19 pass.	Not applicable — no Storybook API changes. The static-build reporting path is confirmed in the CI Storybook build log
Twig and Vite runtime	Reporter changes in config/vite/plugins/reporter/* and config/vite/vite.config.js. One-shot, failure, strict-mode and Storybook unit tests. 11 release fixtures	Reviewed
Audit CLI and JSON contract	No audit source changes. Glob 14 backs audit file discovery, and the globSync and escape signatures are unchanged. The packed emulsify-audit JSON smoke test passes	Reviewed — dependency-only impact
Package exports and tarball	The export map, bin and files are unchanged. Packed package dry run and smoke test	Reviewed
Generated-consumer dependency contract	Packed consumer / whisk-drupal, / none and / wordpress-twig. React peer / 18 and / 19	Reviewed
Node.js and dependency compatibility	Engines unchanged at >=24.13.0. npm ci with engine-strict=true passes on 24.13.0 and 24.18.0. docs/dependency-review-4.5.2.md	Reviewed
Accessibility	Core resolves axe-core 4.14.0 and Pa11y resolves 4.13.0. The WCAG 2.2 preset still adds only target-size, and tests check both runtimes. docs/accessibility.md updated	Reviewed — no changes to accessible output
Documentation and migration guidance	docs/develop-reporter.md, docs/README.md, docs/releases/4.5.2.md and docs/dependency-review-4.5.2.md	Reviewed
Release automation and semantic versioning	The local release:analyze predicts v4.5.1 → v4.5.2 for both merge strategies	Outstanding — record the CI release calculation on main, confirm the patch classification and check the publish after merge

Checklist

• Tests run and results noted
• Documentation impact considered
• Migration or backward compatibility impact considered
• Accessibility impact considered
• Release fixture impact considered
• Release pull request only: required description sections and all tracks
  in the release-review checklist
  completed

Notes

Keep the title conventional. CI rejects main pull requests whose title produces no release, and a squash merge under such a title would publish nothing.

[github-actions]

🎉 This PR is included in version 4.5.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀