From cb63267a499dcc8ca05487c33cbd6c16c94f72a8 Mon Sep 17 00:00:00 2001
From: ***** <721466+soodoku@users.noreply.github.com>
Date: Sun, 20 Sep 2026 16:51:00 -0700
Subject: [PATCH 1/2] Prepare Reader 0.3.0

---
 CHANGELOG.md      | 24 ++++++++++++++++++++++++
 package-lock.json |  4 ++--
 package.json      |  2 +-
 3 files changed, 27 insertions(+), 3 deletions(-)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..aea8edb
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,24 @@
+# Changelog
+
+## 0.3.0 - 2026-09-20
+
+Reader 0.3.0 removes the unsafe server-generated audio path, updates the Gemini integration, and makes build checks enforceable.
+
+### Changed
+
+- Renamed the product and package to Reader.
+- Updated the Gemini integration to the current Google GenAI plugin and `gemini-flash-latest` model alias.
+- Replaced the invalid static web manifest with a typed Next.js manifest.
+- Aligned ESLint with Next.js 15 and restored lint and type validation during production builds.
+- Documented the supported input as text-based PDF files.
+
+### Removed
+
+- Removed persistent MP3 generation, its public audio uploads, and the unmaintained `node-gtts` dependency. Browser speech synthesis remains available.
+- Removed generated-audio state, storage rules, and the duplicate Firebase Admin setup used by that endpoint.
+
+### Security
+
+- Updated Next.js to 15.5.25 to include its available security fixes.
+- Added Firebase ID-token verification and an input-size limit to the word-repair endpoint.
+- Reduced the production audit on 2026-09-20 to 0 critical, 14 high, 55 moderate, and 2 low findings. The remaining findings are in transitive dependencies without compatible direct-package fixes.
diff --git a/package-lock.json b/package-lock.json
index 7e26644..aa529d5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "reader",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "reader",
-      "version": "0.2.0",
+      "version": "0.3.0",
       "dependencies": {
         "@genkit-ai/google-genai": "1.42.0",
         "@hookform/resolvers": "^4.1.3",
diff --git a/package.json b/package.json
index 36189b9..6c45f0b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "reader",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": true,
   "type": "module",
   "engines": {

From 162e2f46c283c5a56336d072e7f935e4ca48cc7d Mon Sep 17 00:00:00 2001
From: ***** <721466+soodoku@users.noreply.github.com>
Date: Sun, 20 Sep 2026 16:55:42 -0700
Subject: [PATCH 2/2] Correct Reader speech controls documentation

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 5d97ab1..5a9786e 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Reader turns uploaded PDFs into a private reading and listening workspace. It ex
 - Email/password authentication with Firebase Authentication
 - Per-user PDF storage and library metadata with Firebase Storage and Firestore
 - PDF text extraction with PDF.js
-- Browser text-to-speech with pause, resume, stop, and speed controls
+- Browser text-to-speech with pause, resume, and stop controls
 - Gemini summaries, quizzes, and sentence explanations
 - Responsive reader and library views