第1章を全面的に書き直しました。まだ修整が必要そうですが、大筋はこの方向でいければと考えています。ご確認ください。

• Meeting Log

Agenda

前月の振り返りと進捗の報告（プロダクトごとに前回合意事項のその後を報告、あわせて現時点の課題を共有／検討）

Core（@shinyu）

• Issueの中から優先度の高いものを選んで提示する

CLI（@spring-raining）

• Issueを優先度順に整理する

VFM（@akabekobeko）

• メタデータに関する新規Issueをたててそこで議論

Themes （@yamasy1549）

• 逢賀サクさんさんに、同人小説用themeでどんな機能が欲しいか問い合わせる
• 「Vivliostyleで本を作ろう！」用のthemeを汎用的なthemeとして公開できないか、検討する（@spring-raining）

CreateBook（@akabekobeko）

• 以下のIssueに意見をだす（→everybody）
  • create-book を akabeko がリリースしてみる #23
  • npm publish doesn't change npm create templates #27

Pub（@takanakahiko）

• 1.0ベータは、7月には動くものを内部レビューでき、9月末にはベータ公開できることを目指す
• あわせて複数人で開発可能な体制を構築する
• 終わらなさそうな場合はなるべく早く報告する

その他の検討課題

公式サイト・ドキュメントの見直し（@yamasy1549 @MurakamiShinyu ）

「Vivliostyle で本を作ろう Vol. 5」の制作I（@spring-raining）

その他報告

2020年度活動報告書（@ogwata）

• 「年度中のできごとのまとめ」の形で執筆をすすめたが、村上の指摘で「年度末時点の成果のまとめ」に変更することに
• 現在Create vivliostyle report 2020 #5で執筆中
• 6/18までには公開したい

6/15 JEPAセミナーで村上と小形が講演予定（@ogwata）

• {あしたのVivliostyle：オープンソースCSS組版システムがつくる未来](https://kokucheese.com/event/index/611843/)
• 村上がVivliostyleの技術要件の解説を、小形が使用事例を話す予定
• 講演後、Zoom交流会を15～30分ほど開催。そこで提携先を模索したい

合意事項

進捗報告と今後の開発方針

• Core
  • 実装、対応を希望する Issue について Reaction で 👍 を付ける →everybody
  • 公式サイトの今後の開発予定に、P1 - P2ラベルのIssue、別項として good first issueラベルのIssueに手動でリンクを張る →@yamasy1549
  • 他のリポジトリもcoreを参考にしてラベル付けをする →@spring-raining @akabekobeko @yamasy1549 @takanakahiko
• Themes
  • 逢賀サクさんと協力しつつ新しいThemeを作成する →@yamasy1549
  • Themesの命名法についてIssueを作ったので、ここで議論をする →everybody
  • 「Vivliostyle で本を作ろう」を元にした新Themeは、機能を絞りシンプルなものとして再編する →@yamasy1549
• Pub
  • 先月の合意事項（以下）のその後について回答する → @takanakahiko
    • 1.0ベータは、7月には動くものを内部レビューでき、9月末にはベータ公開できることを目指す
    • あわせて複数人で開発可能な体制を構築する
    • 終わらなさそうな場合はなるべく早く報告する

公式サイト・ドキュメントの見直し

• 以下のIssueで議論を継続する @MurakamiShinyu @yamasy1549
  • 注目のissueを一覧にする #78
  • ユーザーガイドにVFMのドキュメントを追加 #79
  • 使ってみるページのCLIの説明を更新 #80
  • サンプルの更新 #81
  • ダウンロードページの更新 #82
  • FAQページの更新 #83
• ドキュメントページの更新について、GitHub Issue のパラメーターを拾って自動生成する方法を検討する（@yamasy1549）

Vivliostyleで本を作ろう vol.5の編集について

• 逢賀サクさん @AyumuTakai 執筆を検討、可能ならエントリーする

Members

• @MurakamiShinyu
• @ogwata
• @spring-raining
• @yamasy1549
• @AyumuTakai
• 逢賀サク
• @akabekobeko (Scribe)

合意事項を掲載したので本件は close します。

• Meeting Log

Agenda

• Description
• Description

Members

• @MurakamiShinyu
• @ogwata
• @spring-raining
• @yamasy1549
• @takanakahiko
• @AyumuTakai
• @akabekobeko (Scribe)

Bumps ws from 7.4.4 to 7.4.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>7.4.6</h2> <h1>Bug fixes</h1> <ul> <li>Fixed a ReDoS vulnerability (00c425ec).</li> </ul> <p>A specially crafted value of the <code>Sec-Websocket-Protocol</code> header could be used to significantly slow down a ws server.</p> <pre lang="js"><code>for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) { const value = 'b' + ' '.repeat(length) + 'x'; const start = process.hrtime.bigint(); <p>value.trim().split(/ *, */);</p> <p>const end = process.hrtime.bigint();</p> <p>console.log('length = %d, time = %f ns', length, end - start); } </code></pre></p> <p>The vulnerability was responsibly disclosed along with a fix in private by <a href="https://github.com/robmcl4">Robert McLaughlin</a> from University of California, Santa Barbara.</p> <p>In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the <a href="https://nodejs.org/api/cli.html#cli_max_http_header_size_size"><code>--max-http-header-size=size</code></a> and/or the <a href="https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener"><code>maxHeaderSize</code></a> options.</p> <h2>7.4.5</h2> <h1>Bug fixes</h1> <ul> <li>UTF-8 validation is now done even if <code>utf-8-validate</code> is not installed (23ba6b29).</li> <li>Fixed an edge case where <code>websocket.close()</code> and <code>websocket.terminate()</code> did not close the connection (67e25ff5).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/f5297f7090f6a628832a730187c5b3a06a247f00"><code>f5297f7</code></a> [dist] 7.4.6</li> <li><a href="https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff"><code>00c425e</code></a> [security] Fix ReDoS vulnerability</li> <li><a href="https://github.com/websockets/ws/commit/990306d1446faf346c76452409a4c11455690514"><code>990306d</code></a> [lint] Fix prettier error</li> <li><a href="https://github.com/websockets/ws/commit/32e3a8439b7c8273b44fe1adb5682f529e34d0ba"><code>32e3a84</code></a> [security] Remove reference to Node Security Project</li> <li><a href="https://github.com/websockets/ws/commit/8c914d18b86a7d1408884d18eeadae0fa41b0bb5"><code>8c914d1</code></a> [minor] Fix nits</li> <li><a href="https://github.com/websockets/ws/commit/fc7e27d12ad0af90ce05302afc85c292024000b4"><code>fc7e27d</code></a> [ci] Test on node 16</li> <li><a href="https://github.com/websockets/ws/commit/587c201bfc22c460658ca304d23477fc7ebd2a60"><code>587c201</code></a> [ci] Do not test on node 15</li> <li><a href="https://github.com/websockets/ws/commit/f67271079755e79a1ac2b40f3f4efb94ca024539"><code>f672710</code></a> [dist] 7.4.5</li> <li><a href="https://github.com/websockets/ws/commit/67e25ff50230d131d76b1061ca0be5c991df161f"><code>67e25ff</code></a> [fix] Fix case where <code>abortHandshake()</code> does not close the connection</li> <li><a href="https://github.com/websockets/ws/commit/23ba6b2922f521f2b656891a997ab562b7139dd4"><code>23ba6b2</code></a> [fix] Make UTF-8 validation work even if utf-8-validate is not installed</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/7.4.4...7.4.6">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps hosted-git-info from 2.8.8 to 2.8.9. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/npm/hosted-git-info/blob/v2.8.9/CHANGELOG.md">hosted-git-info's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/npm/hosted-git-info/compare/v2.8.8...v2.8.9">2.8.9</a> (2021-04-07)</h2> <h3>Bug Fixes</h3> <ul> <li>backport regex fix from <a href="https://github-redirect.dependabot.com/npm/hosted-git-info/issues/76">#76</a> (<a href="https://github.com/npm/hosted-git-info/commit/29adfe5">29adfe5</a>), closes <a href="https://github-redirect.dependabot.com/npm/hosted-git-info/issues/84">#84</a></li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01"><code>8d4b369</code></a> chore(release): 2.8.9</li> <li><a href="https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7"><code>29adfe5</code></a> fix: backport regex fix from <a href="https://github-redirect.dependabot.com/npm/hosted-git-info/issues/76">#76</a></li> <li>See full diff in <a href="https://github.com/npm/hosted-git-info/compare/v2.8.8...v2.8.9">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~nlf">nlf</a>, a new releaser for hosted-git-info since your current version.</p> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps ssri from 6.0.1 to 6.0.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/npm/ssri/blob/v6.0.2/CHANGELOG.md">ssri's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/zkat/ssri/compare/v6.0.1...v6.0.2">6.0.2</a> (2021-04-07)</h2> <h3>Bug Fixes</h3> <ul> <li>backport regex change from 8.0.1 (<a href="https://github.com/zkat/ssri/commit/b30dfdb">b30dfdb</a>), closes <a href="https://github-redirect.dependabot.com/zkat/ssri/issues/19">#19</a></li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/npm/ssri/commit/b7c8c7c61db89aeb9fbf7596c0ef17071bc216ef"><code>b7c8c7c</code></a> chore(release): 6.0.2</li> <li><a href="https://github.com/npm/ssri/commit/b30dfdb00bb94ddc49a25a85a18fb27afafdfbb1"><code>b30dfdb</code></a> fix: backport regex change from 8.0.1</li> <li>See full diff in <a href="https://github.com/npm/ssri/compare/v6.0.1...v6.0.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~nlf">nlf</a>, a new releaser for ssri since your current version.</p> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps ssri from 6.0.1 to 6.0.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/npm/ssri/blob/v6.0.2/CHANGELOG.md">ssri's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/zkat/ssri/compare/v6.0.1...v6.0.2">6.0.2</a> (2021-04-07)</h2> <h3>Bug Fixes</h3> <ul> <li>backport regex change from 8.0.1 (<a href="https://github.com/zkat/ssri/commit/b30dfdb">b30dfdb</a>), closes <a href="https://github-redirect.dependabot.com/zkat/ssri/issues/19">#19</a></li> </ul> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/npm/ssri/commit/b7c8c7c61db89aeb9fbf7596c0ef17071bc216ef"><code>b7c8c7c</code></a> chore(release): 6.0.2</li> <li><a href="https://github.com/npm/ssri/commit/b30dfdb00bb94ddc49a25a85a18fb27afafdfbb1"><code>b30dfdb</code></a> fix: backport regex change from 8.0.1</li> <li>See full diff in <a href="https://github.com/npm/ssri/compare/v6.0.1...v6.0.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~nlf">nlf</a>, a new releaser for ssri since your current version.</p> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

遅くなってすみません！　合意事項をまとめてみました。 なにか漏れがあればご指摘を。

合意事項

進捗報告と今後の開発方針

• Core
  • 実装、対応を希望する Issue について Reaction で 👍 を付ける →everybody
  • 公式サイトの今後の開発予定に、P1 - P2ラベルのIssue、別項として good first issueラベルのIssueに手動でリンクを張る →@yamasy1549
  • 他のリポジトリもcoreを参考にしてラベル付けをする →@spring-raining @akabekobeko @yamasy1549 @takanakahiko
• Themes
  • 逢賀サクさんと協力しつつ新しいThemeを作成する →@yamasy1549
  • Themesの命名法についてIssueを作ったので、ここで議論をする →everybody
  • 「Vivliostyle で本を作ろう」を元にした新Themeは、機能を絞りシンプルなものとして再編する →@yamasy1549
• Pub
  • 先月の合意事項（以下）のその後について回答する → @takanakahiko
    • 1.0ベータは、7月には動くものを内部レビューでき、9月末にはベータ公開できることを目指す
    • あわせて複数人で開発可能な体制を構築する
    • 終わらなさそうな場合はなるべく早く報告する

公式サイト・ドキュメントの見直し

• 以下のIssueで議論を継続する @MurakamiShinyu @yamasy1549
  • 注目のissueを一覧にする #78
  • ユーザーガイドにVFMのドキュメントを追加 #79
  • 使ってみるページのCLIの説明を更新 #80
  • サンプルの更新 #81
  • ダウンロードページの更新 #82
  • FAQページの更新 #83
• ドキュメントページの更新について、GitHub Issue のパラメーターを拾って自動生成する方法を検討する（@yamasy1549）

Vivliostyleで本を作ろう vol.5の編集について

• 逢賀サクさん @AyumuTakai 執筆を検討、可能ならエントリーする