Public-ready: MIT license, security and contributing docs; upgrade web dependencies

Adds LICENSE (MIT), SECURITY.md (private reporting through GitHub, scope) and
CONTRIBUTING.md (setup, the checks CI runs, branch and PR conventions).

Upgrades the web app to clear the open Dependabot alerts on main:
- astro 5.18 -> 7.4.2 (with @astrojs/react 7), which clears the critical
  AVIF remote-code-execution and the high XSS and SSRF advisories;
- vitest 2.1 -> 4.1.12, which clears the critical file-read advisory and the
  @vitest/mocker advisories (tinypool, vite and esbuild come in with these);
- @playwright/test 1.48 -> 1.64.1, which clears the SSL advisory;
- vite is now 8.3.5 and sharp 0.35.5, which clear their advisories.

Astro 7 needs Node 22.23 or newer, so the web CI job moves to Node 22. Astro 7's
preview runs as a daemon, which Playwright reads as an early exit, so the smoke
test serves the built dist/ with a plain static server instead.

Checks run locally after the upgrade: typecheck, lint, 4 unit tests, the build,
and all 9 Playwright tests.

Author: deaneeth

.github/workflows/web.yml

@@ -26,7 +26,7 @@ jobs:
           version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: pnpm
           cache-dependency-path: web/pnpm-lock.yaml
       - run: pnpm install --frozen-lockfile

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing
+
+Thanks for looking at TinyCompiler. It is a small compiler for a small tensor language, and the
+bar for changes is that every result stays checked against a numpy oracle on the real chips.
+
+## Set up
+
+```bash
+git submodule update --init
+python3 -m venv .venv && .venv/bin/pip install -e ".[dev]" && .venv/bin/pip install -e targets/tiny-gpu --no-deps
+source scripts/env.sh
+```
+
+For the Compiler Explorer:
+
+```bash
+cd web && pnpm install && pnpm dev
+```
+
+`pnpm dev` regenerates the Python bundle and the example list first (`scripts/build_web.py`).
+
+## Before you open a pull request
+
+Run the same checks CI runs:
+
+```bash
+ruff check . && black --check .
+pytest -q
+cd web && pnpm lint && pnpm typecheck && pnpm test && pnpm e2e
+```
+
+- **Golden files** (`tests/golden/`) pin the emitted IR and assembly. If you change emitted
+  output on purpose, review the diff and run `pytest --update-golden`.
+- **Measured numbers** in `docs/ARCHITECTURE.md` come from `scripts/opt_table.py --write`. A test
+  fails if they drift.
+- Do not format `targets/` (the hardware submodules); the formatter config excludes it.
+
+## Branches and pull requests
+
+- Work on a `feat/*`, `fix/*` or `docs/*` branch. `main` is the default branch and is not pushed to
+  directly.
+- Keep a pull request to one change. Describe what changed and how you checked it.
+- Add a regression test for each bug you fix. A minimized failing program can go in
+  `tests/regressions/`.
+
+## Reporting bugs
+
+Open an issue with the `.tiny` program that fails, the command you ran, and what you expected. A
+minimal program makes the fix much faster. For security problems, see [SECURITY.md](SECURITY.md).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dineth Hettiarachchi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,30 @@
+# Security policy
+
+## Supported versions
+
+Only the latest code on `main` is supported. TinyCompiler is an educational compiler and
+simulator project; it has no releases yet.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a security problem.
+
+Report it privately through GitHub: open the repository's **Security** tab and choose
+**Report a vulnerability**. The report stays private until a fix is ready.
+
+Include, if you can:
+
+- what you ran (a `.tiny` program, a command, or a page of the Compiler Explorer),
+- what you expected and what happened,
+- the commit you tested.
+
+You should get an acknowledgement within a few days. A fix will land on `main`, and the report
+will be credited there unless you ask otherwise.
+
+## Scope
+
+In scope: the compiler (`tinyc/`), the runners (`runtime/`), the Compiler Explorer (`web/`), and
+the build and CI scripts.
+
+Out of scope: the tiny-gpu and tiny-tpu hardware designs, which are separate projects with their
+own security contacts, and problems that need a compromised machine to exploit.

web/package.json

@@ -15,9 +15,9 @@
     "e2e": "pnpm build && playwright test"
   },
   "dependencies": {
-    "@astrojs/react": "^4.0.0",
+    "@astrojs/react": "^7.1.1",
     "@codemirror/state": "^6.7.6",
-    "astro": "^5.0.0",
+    "astro": "^7.4.2",
     "codemirror": "^6.0.2",
     "framer-motion": "^12.43.0",
     "react": "^18.3.1",
@@ -26,14 +26,14 @@
   "devDependencies": {
     "@astrojs/check": "^0.9.12",
     "@eslint/js": "^9.39.5",
-    "@playwright/test": "1.48.2",
+    "@playwright/test": "1.64.1",
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "eslint": "^9.39.5",
     "globals": "^15.15.0",
     "typescript": "^5.6.3",
     "typescript-eslint": "^8.72.0",
-    "vitest": "^2.1.9"
+    "vitest": "^4.1.12"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

web/playwright.config.ts

@@ -1,12 +1,13 @@
 import { defineConfig, devices } from "@playwright/test";
 
-// The smoke test runs against `astro preview` of a fresh build (see the `e2e` script).
+// The smoke test runs against the static build in dist/ (the `e2e` script builds it first).
 export default defineConfig({
   testDir: "e2e",
   timeout: 180_000,
   use: { baseURL: "http://127.0.0.1:4321" },
   webServer: {
-    command: "pnpm preview --port 4321 --host 127.0.0.1",
+    // A plain static server: Astro 7's `preview` daemonises, which Playwright reads as an early exit.
+    command: "python3 -m http.server 4321 --bind 127.0.0.1 --directory dist",
     url: "http://127.0.0.1:4321/app",
     reuseExistingServer: true,
     timeout: 60_000,