release: v0.5.5

Housekeeping roll-up, no runtime behaviour change:
- Dependabot: Alpine runtime base 3.23→3.24 (CVE-clean, verified locally
  with trivy: 0 HIGH/CRITICAL), node/golang build-stage digests, web dev-deps
  (playwright/eslint/prettier/vitest/vite), CI actions (checkout v6→v7,
  setup-go, golangci-lint). Prettier 3.9 reformatted 4 files (whitespace).
- ponytail-audit dead-code removal (ProgressBar label prop, supportsWebSocket
  placeholder, FirmwareUpdateResult type).

Bundles PRs #78, #77, #75 + the ponytail cleanup. Full changelog in
CHANGELOG.md.

Author: buliwyf42

CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.5.5] - 2026-07-01 — Dependency roll-up + dead-code cleanup
+
+Housekeeping release: no runtime behaviour change. Bundles the Dependabot
+dependency bumps with the ponytail-audit dead-code removal.
+
+### Changed
+
+- **Runtime base image Alpine 3.23 → 3.24** (`docker/Dockerfile`), plus the
+  `node:26-alpine` and `golang:1.26-alpine` build-stage digests refreshed.
+  Alpine 3.24.1 ships the same CVE-clean OpenSSL (`libcrypto3`/`libssl3`
+  3.5.7-r0) that v0.5.4 pinned by digest.
+- **Dev-dependency bumps** (`web/`): playwright 1.60→1.61, typescript-eslint
+  8.60→8.62, vitest coverage 4.1.8→4.1.9, eslint 10.4→10.6, prettier 3.8→3.9
+  (+ eslint-plugin-svelte, vite). The prettier bump reformatted four
+  pre-existing files (whitespace only, no logic change).
+- **CI action bumps**: `actions/checkout` 6→7, `actions/setup-go` 6.4→6.5,
+  `golangci/golangci-lint-action` digest.
+
+### Removed
+
+- **Dead frontend code** flagged by ponytail-audit (grep-verified zero
+  references, no behaviour change): the unused `ProgressBar` `label` prop and
+  its branches/CSS, the `supportsWebSocket()` placeholder, and the orphaned
+  `FirmwareUpdateResult` type.
+
 ## [0.5.4] - 2026-07-01 — Shelly 2.0.0-beta3: alt-firmware + provisioning visibility
 
 ### Added

CLAUDE.md

@@ -12,7 +12,7 @@ details, see [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md).
 - **Backend**: Go 1.25 (single binary, `cmd/shellyctl/main.go`). The Go floor moved from 1.24 → 1.25 in v0.1.16 — gin v1.12.0 pulls `quic-go/quic-go` for HTTP/3, which requires Go 1.25.0 in its `go.mod`. CI's `setup-go` and the Dockerfile backend stage use the **Go 1.26 toolchain** (bumped in v0.3.4); the `go.mod` directive stays `go 1.25.0` — the floor — and the newer toolchain builds it backward-compatibly. **The binary links quic-go but does NOT open any UDP/QUIC listener** — the HTTP server in main.go is plain `net/http` over TCP. Phase 2 (v0.2.11) verified this; the QUIC code paths in the binary are dead weight at runtime, not an attack surface.
 - **Frontend**: Svelte + TypeScript SPA (`web/src/`)
 - **Database**: SQLite via `modernc.org/sqlite` (no CGO required)
-- **Deployment**: Multi-stage Docker image — Node 26 builds frontend, Go 1.26 builds backend, Alpine 3.23 is the runtime
+- **Deployment**: Multi-stage Docker image — Node 26 builds frontend, Go 1.26 builds backend, Alpine 3.24 is the runtime (bumped from 3.23 in v0.5.5)
 - **Entry point**: `cmd/shellyctl/main.go` → `internal/services/app.go`
 
 The SPA is embedded into the Go binary at build time via `//go:embed`.

README.de.md

@@ -49,7 +49,7 @@ Die Anwendung ist als Einzel-Container-Deployment ausgelegt mit:
 
 ## Status
 
-In aktiver Entwicklung. Aktuelles Release ist `v0.5.4` (Shelly-Firmware-2.0.0-beta3-Unterstützung: read-only Sichtbarkeit alternativer Firmware-Varianten und des Secure-Provisioning-Status, additiv zu `/api/devices` und der MCP-Fläche); die UI/API-Baseline ist ansonsten seit `v0.4.0` unverändert. Das Projekt folgt vor v1.0 dem SemVer-Schema mit Vorbehalt: Minor-Versionen können Breaking Changes enthalten. SemVer-Garantien gelten ab `v1.0.0`.
+In aktiver Entwicklung. Aktuelles Release ist `v0.5.5` (Wartung: Dependency-Sammel-Update inkl. Alpine-3.24-Runtime-Base + Dead-Code-Cleanup, ohne Verhaltensänderung). Das letzte Feature-Release war `v0.5.4` (Shelly-Firmware-2.0.0-beta3-Unterstützung: read-only Sichtbarkeit alternativer Firmware-Varianten und des Secure-Provisioning-Status); die UI/API-Baseline ist ansonsten seit `v0.4.0` unverändert. Das Projekt folgt vor v1.0 dem SemVer-Schema mit Vorbehalt: Minor-Versionen können Breaking Changes enthalten. SemVer-Garantien gelten ab `v1.0.0`.
 
 Eingeplantes Einsatzprofil:
 

README.md

@@ -49,7 +49,7 @@ It is designed as a single-container deployment with:
 
 ## Status
 
-Under active development. Current release is `v0.5.4` (Shelly firmware 2.0.0-beta3 support: read-only visibility of alternative firmware variants and secure-provisioning status, additive to `/api/devices` and the MCP surface); the UI/API baseline is otherwise unchanged since `v0.4.0`. The project follows pre-1.0 semver: minor versions may carry breaking changes. Semver guarantees apply from `v1.0.0`.
+Under active development. Current release is `v0.5.5` (housekeeping: dependency roll-up incl. Alpine 3.24 runtime base + dead-code cleanup, no behaviour change). The last feature release was `v0.5.4` (Shelly firmware 2.0.0-beta3 support: read-only visibility of alternative firmware variants and secure-provisioning status); the UI/API baseline is otherwise unchanged since `v0.4.0`. The project follows pre-1.0 semver: minor versions may carry breaking changes. Semver guarantees apply from `v1.0.0`.
 
 Intended posture:
 

VERSION

@@ -1 +1 @@
-0.5.4
+0.5.5

web/package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "shellyadmin-web",
   "private": true,
-  "version": "0.5.4",
+  "version": "0.5.5",
   "type": "module",
   "scripts": {
     "dev": "vite",

web/package.json

@@ -218,8 +218,7 @@
             (settings.subnets = (e.currentTarget as HTMLTextAreaElement).value
               .split('\n')
               .map((v) => v.trim())
-              .filter(Boolean))}
-        ></textarea>
+              .filter(Boolean))}></textarea>
         <div class="row g-3">
           <div class="col-md-4">
             <label class="form-label" for="settings-scan-timeout">Scan timeout (s)</label><input
@@ -541,8 +540,7 @@
           class="form-control font-monospace mb-2"
           rows="10"
           bind:value={importText}
-          placeholder="Paste exported backup JSON here"
-        ></textarea>
+          placeholder="Paste exported backup JSON here"></textarea>
         <div class="d-flex gap-2 flex-wrap">
           <button
             class="btn btn-outline-light"

web/src/pages/Settings.svelte

@@ -137,8 +137,7 @@
     class="form-control font-monospace"
     rows="6"
     placeholder="-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----"
-    bind:value={pem}
-  ></textarea>
+    bind:value={pem}></textarea>
   {#if !pemLooksValid}
     <div class="text-warning mt-1 text-hint-md">
       Warning: content does not contain a PEM header.

web/src/pages/provision/UserCAForm.svelte

@@ -103,8 +103,7 @@
             class="form-control form-control-sm font-monospace"
             rows="3"
             bind:value={entry.urls}
-            placeholder="https://example.com/hook"
-          ></textarea>
+            placeholder="https://example.com/hook"></textarea>
         </div>
       </div>
     {/each}