Feature/10 timing 2.2.3 dependency refresh

.github/workflows/host-tests.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - main
-      - feature/observable-callback-coverage
+      - feature/10-timing-2.2.3-dependency-refresh
   pull_request:
     branches:
       - main
@@ -53,13 +53,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-Timing
-          ref: 2.2.2
+          ref: 2.2.3
           path: deps/ESPressio-Timing
 
       - uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-Units
-          ref: 0.2.1
+          ref: 0.2.2
           path: deps/ESPressio-Units
 
       - uses: actions/checkout@v4

.github/workflows/security-integration-tests.yml

@@ -2,7 +2,7 @@ name: Security Integration
 
 on:
   push:
-    branches: [feature/security-integration, feature/observable-callback-coverage, main]
+    branches: [feature/security-integration, feature/10-timing-2.2.3-dependency-refresh, main]
   pull_request:
     branches: [main]
 
@@ -43,12 +43,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-Timing
-          ref: 2.2.2
+          ref: 2.2.3
           path: deps/ESPressio-Timing
       - uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-Units
-          ref: 0.2.1
+          ref: 0.2.2
           path: deps/ESPressio-Units
       - uses: actions/checkout@v4
         with:

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.5.1 — 2026-08-20
+
+### Changed
+- Raised the required ESPressio Timing baseline from 2.2.2 to 2.2.3, carrying the Units 0.2.2 / Serializable 0.10.1 dependency refresh downstream.
+- Preserved the required ESPressio Observable baseline at `>=3.0.1 <4.0.0`.
+- Preserved Command >= 0.3.0 < 1.0.0 and Security >= 0.2.0 < 1.0.0 as opt-in integration baselines.
+- Updated package and compile-time version metadata to 0.5.1.
+- Documented the existing reciprocal optional Event/ESP-Now integration as an architectural dependency-cycle exception pending downstream relocation of the ESP-Now-specific Observer-to-Event bridge.
+
+### Compatibility
+- ESP-NOW transport, clock synchronization, Event Transport, Command Transport, Security integration, and Observable APIs remain source-compatible with 0.5.0.
+- Event remains opt-in; no new mandatory Event dependency is introduced.
+
 ## 0.5.0 — 2026-08-20
 
 ### Added
@@ -102,7 +115,7 @@ Versioning](https://semver.org/).
 - Existing ESP-NOW System Clock synchronization remains unchanged.
 - Event Transport remains opt-in; applications using only ESP-NOW/Timing functionality do not acquire ESPressio Event or Serializable dependencies.
 
-## \[0.2.0\] - 2026-08-19
+## [0.2.0] - 2026-08-19
 
 ### Added
 
@@ -126,7 +139,7 @@ Versioning](https://semver.org/).
 -   Preserved receive-callback isolation and existing Timing/System
     Clock synchronization.
 
-## \[0.1.0\] - 2026-08-18
+## [0.1.0] - 2026-08-18
 
 ### Added
 

ESPRESSIO_DEPENDENCY_CHART.md

@@ -1,23 +1,46 @@
-# ESPressio Dependency Chart — ESP-Now 0.4.0
+# ESPressio Dependency Chart — ESP-Now 0.5.1
 
-ESPressio ESP-Now keeps core dependencies small and exposes higher-level integrations only when selected by the application.
+ESPressio ESP-Now keeps its core dependencies small and exposes higher-level
+integrations only when explicitly selected.
 
 ```text
-ESPressio ESP-Now 0.4.x
+ESPressio ESP-Now 0.5.1
 |
-+-- required --> ESPressio Timing >= 2.2.2 < 3.0.0
++-- required --> ESPressio Timing >= 2.2.3 < 3.0.0
 |
-+-- optional --> ESPressio Event >= 5.7.1 < 6.0.0
-|                  +-- used by ESPNowEventTransport
++-- required --> ESPressio Observable >= 3.0.1 < 4.0.0
 |
-+-- optional --> ESPressio Command >= 0.2.0 < 1.0.0
-|                  +-- used by ESPNowCommandTransport
++-- optional --> ESPressio Event >= 5.8.0 < 6.0.0
+|                  +-- ESPNowEventTransport
 |
-+-- optional --> ESPressio Security >= 0.1.0 < 1.0.0
-                   +-- used by ESPNowSecureTransport
++-- optional --> ESPressio Command >= 0.3.0 < 1.0.0
+|                  +-- ESPNowCommandTransport
+|
++-- optional --> ESPressio Security >= 0.2.0 < 1.0.0
+                   +-- ESPNowSecureTransport
+```
+
+The Event baseline intentionally remains a compatible 5.x range here rather
+than creating a hard ESP-Now 0.5.1 -> Event 5.8.1 release dependency. Event is
+optional and, importantly, Event 5.8 currently also contains an ESP-Now-specific
+Observer bridge. Strengthening both edges would make the reciprocal dependency
+more difficult to remove.
+
+## Transitive Timing chain
+
+```text
+ESP-Now 0.5.1
+    -> Timing 2.2.3
+        -> Units 0.2.2
+            - - -> Serializable >= 0.10.1 < 1.0.0
+                   only for Serializable Unit representations
+        -> Observable 3.0.1
 ```
 
-## Security Placement
+ESP-Now does not acquire a direct Units or Serializable dependency through this
+chain.
+
+## Security placement
 
 ```text
 Event / Command / Clock Sync / application protocol
@@ -35,9 +58,11 @@ Event / Command / Clock Sync / application protocol
                        ESP-NOW
 ```
 
-Security is deliberately below application protocol semantics and above the concrete ESP-NOW radio transport. Event, Command, and Timing therefore do not gain direct Security dependencies merely because their payloads may be protected.
+Security remains below application protocol semantics and above the concrete
+ESP-NOW radio transport. Event, Command, and Timing therefore do not gain direct
+Security dependencies merely because their payloads may be protected.
 
-## Optional Dependency Rule
+## Optional dependency rule
 
 The normal:
 
@@ -46,38 +71,55 @@ The normal:
 ```
 
 does not include headers that introduce Event, Command, or Security dependencies.
+Applications explicitly select the relevant integration headers.
 
-Applications explicitly select:
+## Circular-dependency audit
 
-```cpp
-#include <ESPressio_ESPNowEventTransport.hpp>
-#include <ESPressio_ESPNowCommandTransport.hpp>
-#include <ESPressio_ESPNowSecureTransport.hpp>
+The current ecosystem contains one reciprocal optional relationship:
+
+```text
+ESP-Now - - -> Event
+    ESPNowEventTransport
+
+Event - - -> ESP-Now
+    ESPNowTransportEventBridge
+```
+
+This is not the desired long-term dependency direction. The preferred hierarchy
+is:
+
+```text
+Event
+  ^
+  |
+  | optional downstream integration
+  |
+ESP-Now
+  +-- ESPNowEventTransport
+  +-- ESPNowTransportEventBridge   (preferred future location)
 ```
 
-and must then provide the corresponding library dependency.
+`ESPNowTransportEventBridge` is transport-specific integration and should move
+downstream into ESP-Now's Event integration, or into a dedicated integration
+package, so Event remains transport-neutral and no Event -> ESP-Now edge exists.
+
+No new reciprocal dependency should be introduced before that relocation.
 
 ## PlatformIO
 
 Core:
 
 ```ini
 lib_deps =
-    https://github.com/Flowduino/ESPressio-ESP-Now@^0.4.0
-    https://github.com/Flowduino/ESPressio-Timing@^2.2.2
+    https://github.com/Flowduino/ESPressio-ESP-Now@^0.5.1
+    https://github.com/Flowduino/ESPressio-Timing@^2.2.3
+    https://github.com/Flowduino/ESPressio-Observable@^3.0.1
 ```
 
-Security integration:
+Security integration additionally requires:
 
 ```ini
-lib_deps =
-    https://github.com/Flowduino/ESPressio-ESP-Now@^0.4.0
-    https://github.com/Flowduino/ESPressio-Security@^0.1.0
-    https://github.com/Flowduino/ESPressio-Timing@^2.2.2
+    https://github.com/Flowduino/ESPressio-Security@^0.2.0
 ```
 
-Command/Event dependencies are added only when those adapters are compiled.
-
-## Version Policy
-
-Dependency ranges stay within the currently supported major line so a future breaking major release is not selected automatically.
+Command/Event dependencies are added only when their adapters are compiled.