datalog-theme 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 044a1ef441ccbf54db7acf3d354bb2c4c1285213894cb0271ec868fd1a1106ba
-  data.tar.gz: 76b0d5c472a965169b2dd773209c62d4b3628e93baec673175fdc0e301b43709
+  metadata.gz: 76c51ad2ebacf140c696deb3abdf2b8bff74bd31a9594533ddd65bd9c9a3aba4
+  data.tar.gz: 5b9d40c77ee4e740774d09ce6fd5c26a6f16c8c92da17d69a611e0a3d00cc930
 SHA512:
-  metadata.gz: 13394db55c58db0f89ddbe3ebf165823558b5a089a8036dde9c1a0056f73851631306db760e953b868263e4e74e81554601217960f6753be918b50834f010ebc
-  data.tar.gz: f972bb963121de7210fff3b1ea607a32bdbb128cfcf211510cfd02da296c79b4ea65e0e2201da2d966e2e8502e2b3662b015f90d2ae9a9d08ab7d7b8f5c2db3e
+  metadata.gz: 06a2ac68844fdc67bbed3abb7640d1ac13920964454dda355e5c08fb8d0627cbae16d1585677695b94d92bf6e9a568b427ed59871bf5ec2aa2ad02fcbd2f60b8
+  data.tar.gz: 8616c20c4894822cc7b047a83668b5f42d58b4e11799320273b697423e4af3e2aa498824e175f65c03fae05fc29793663ed859435a7f640c0e0ab85b7a6f71d1

data/CHANGELOG.md

@@ -2,6 +2,131 @@
 
 All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.0] - 2026-09-14
+
+### Added
+
+- `tests/test_csp_pages.rb` checks that every nonce in a page matches its policy, that MathJax and Disqus pages get what they load, and that Observable's classic embeds may be framed (#196).
+- `csp.script_src`, `csp.style_src`, `csp.font_src` and `csp.connect_src` in `_config.yml` add sources to the Content Security Policy, as `csp.frame_src` does for iframes (#196).
+- The policy sets `object-src 'none'`, `base-uri 'self'` and `form-action 'self'`. None of them falls back to `default-src`, so all three were open (#196).
+- `tests/test_csp.rb` checks which pages get the looser policy. `tests/integration/csp-charts.spec.js` loads the real Plotly and widget manager, checks that the chart and the widget render, and fails on any script or style violation. Unit tests in `tests/js/visualizations.test.js` cover the order in which chart libraries and require.js load (#195).
+- A `rouge_highlight` Liquid filter highlights code passed to an include as the site builds. The package API examples and the enhanced code block, which printed its code unescaped, use it, and the notebook converter highlights code cells the same way (#197).
+- The head preloads the visualization, notebook and academic bundles on the pages that use them, as it already did for search and math, so they download alongside the core bundle instead of after it (#197).
+- `tests/test_rouge_highlighting.rb` checks that code is highlighted as the site builds and that pages load no Prism. `tests/test_feature_loading.rb` checks the new preloads and which pages inline the academic data, and a Playwright test checks that the copy button labels the language and leaves out line numbers (#197).
+- Ruby Tests jobs on Ruby 3.3 and 3.4 in the Tests workflow run the Ruby suite on the newer releases, next to the existing job on 3.2. `tests/test_gem_package.rb` checks the Ruby requirement, that every runtime dependency has an upper bound, that the unused and optional gems stay out, and which script files the gem ships (#203).
+- `tests/test_site_output.rb` checks that every in-page link on the built site reaches an element on that page (#206).
+- A Docker Images workflow builds `Dockerfile` and `Dockerfile.dev`, without pushing, on pull requests that change what they are built from (#205).
+- `bundle exec rake test` builds the demo site and runs the Minitest suite, the same command as the Tests workflow, and is the default Rake task. `tests/test_site_output.rb` takes over what the `ci:verify` scripts checked and no other suite did: `CITATION.cff` matching the theme version, citation exports and scholar metadata on posts, the math status live region, `noopener` on every link that opens a new tab, and sandboxed app embeds. The browser suite checks that code blocks in a post get a labelled copy button, which the post layout adds when the page loads (#204).
+- A Lint job in the Tests workflow runs ESLint and RuboCop, and the test summary fails when it does. Both linters were configured in the repository but ran in no workflow. RuboCop is now a development dependency, pinned because the repository has no `Gemfile.lock`; the offenses that predate the job are listed in `.rubocop_todo.yml`, so new code has to pass (#204).
+- `tests/test_workflows.rb` checks the release and CI guards described below, and `tests/js/cdn-integrity.test.js` runs the Subresource Integrity check from `tests/test_sri.js`, a script no test command ran (#204).
+- `tests/test_gem_consumer.rb` builds a minimal site against the packaged theme and against a checkout of the repository, and fails if the build breaks or publishes anything that identifies the maintainer.
+- `tests/test_navigation_cache.rb` checks that each section still marks only its own navigation link now that the navigation is cached.
+- The performance tests fail if the stylesheet grows past 25 KB gzipped, as they already did for the core script bundle.
+- `tests/test_related_posts.rb` checks that a post lists the posts it shares a tag with.
+- `csp.frame_src` in `_config.yml` lists the hosts a site embeds iframes from, such as Shiny apps, slide decks or videos, and the Content Security Policy allows them next to Observable.
+- `tests/test_feature_loading.rb` checks which pages load MathJax and the search bundle.
+- `show_title: false` in a page's or a layout's front matter leaves out the title the default layout prints, for pages and layouts that render their own `<h1>`.
+- `tests/test_page_structure.rb` checks that no built page has more than one `<h1>`, the footer's headings and landmark name, the color scheme script at the top of `<body>` and the heights of the academic chart's bars. `tests/js/blocked-storage.test.js` covers dark mode and the core initializers with storage blocked, and the browser suite checks that the saved theme applies before any script bundle loads and that the core bundle still loads when storage is blocked.
+- `tests/test_head_metadata.rb` checks that each head tag appears once, that empty verification tags are left out, that the 404, search and admin pages carry `noindex` and stay out of the sitemap, and that every page's JSON-LD parses without empty values.
+- Tests for the fixes to the config validator, the warning filter, notebook images and languages, the analytics cache, plugin hook registration, `{% t %}` options, `datalog publish` and `datalog new post`, in the existing test files for each.
+
+### Changed
+
+- Each page's Content Security Policy allows only the jsDelivr packages that page loads: the math engine's directory, and Plotly, D3, BokehJS, Vega or Chart.js where the page uses them. The policy allowed all of jsDelivr, which serves any npm package, on every page. Widget pages still allow all of jsDelivr, and they are the only pages that allow require.js from cdnjs (#196).
+- Google's analytics hosts are in the policy only on a site that sets `google_analytics`. They are the hosts Google documents for GA4, including the regional `*.google-analytics.com` hosts GA4 reports to (#196).
+- The Content Security Policy is looser on pages with a Plotly or ipywidgets block and unchanged on every other page. Plotly pages allow inline styles in place of the style nonce. Widget pages also allow `'unsafe-eval'` and fonts from jsDelivr. A page that loads either library another way can set `csp.unsafe_inline_styles` or `csp.unsafe_eval` in its front matter (#195).
+- Code is highlighted by Rouge alone, when the site builds. Pages with code also loaded Prism from jsDelivr (seven scripts and two stylesheets on a post), which highlighted the blocks again in the browser and turned every language it had no grammar for, such as bash and yaml, into plain text. The theme now styles Rouge's tokens and line numbers in light and dark mode, in greys that meet 4.5:1 contrast (the comment grey Prism used measured 2.33:1 in light mode), and gives every code block tabindex="0", as Prism did, so a wide block can be scrolled from the keyboard. Search results show code snippets as plain text (#197).
+- The academic and publication data is inlined only on pages that render citation metrics, tables or charts, the only pages whose script reads it. On the home page it was nearly a quarter of the HTML (#197).
+- The image optimizer fetches one image per page early: the first image in the post or page content, and none on a page that preloads its hero. It gave the first image anywhere on the page both `loading="lazy"` and `fetchpriority="high"`, which was a post card below the hero on the home page and a related-post thumbnail at the bottom of tutorials (#197).
+- Google Fonts is asked for the eight weights the stylesheet uses instead of eleven, and the font stylesheet link no longer repeats its `media` and `data-async-style` attributes (#197).
+- The gem requires Ruby 3.2, the version the sass-embedded and nokogiri releases it resolves need; it claimed 3.0. Every runtime dependency is bounded below its next major version (`~> 1.15` rather than `>= 1.15`), so a breaking release arrives through a pull request instead of an untested `bundle update` (#203).
+- `googleauth` is no longer a dependency of the theme. Only the analytics dashboard with a GA4 property configured uses it, and every site installed it with its Google Cloud dependencies; a site that uses the dashboard adds `gem "googleauth"` to its Gemfile, and without it the dashboard says so (#203).
+- The Docker images build on `ruby:3.4-slim` and serve from `nginx:1.30-alpine`. `ruby:3.2-slim` is end of life, and 1.27 was an nginx mainline branch that no longer gets releases (#203).
+- The pre-commit hook runs lint-staged only: ESLint and the Vitest tests related to the staged JavaScript. It used to run `npm audit`, which needs the network, and the whole Vitest suite on every commit; both still run on every pull request (#205).
+- Dependabot pull requests are titled `chore(deps)`, `chore(deps-dev)` and `ci(deps)`. The prefixes repeated the scope Dependabot appends, which gave titles like `chore(deps-dev)(deps-dev)` (#205).
+- The accessibility, broken link, dependency review and Lighthouse workflows cancel a pull request's superseded runs, the accessibility workflow installs a pinned `pa11y-ci` and uses the `http-server` devDependency, and `package.json` is marked private so `npm publish` refuses to publish the repository's tooling (#205).
+- `gem-release.yml` publishes only from a `v*` tag, a manual run included, and stops when the tag does not match `lib/datalog/theme/version.rb`. The tag job in `release.yml` builds the script bundles and the gem and runs `scripts/verify_gem_package.rb` before it creates the tag, so a broken package no longer leaves a tag and a GitHub release for a gem that never published (#204).
+- The Python security audit runs `pip-audit` on `requirements.txt`. It used to collect `import` lines from `scripts/`, which name modules rather than packages, and ignore every result (#204).
+- `search.json` no longer stores a normalized copy of each document's title, summary, content, tags and languages. The search engine normalizes them in the browser, once per document, with the function it applies to queries; the copy was 41% of the file, and queries and documents had been normalized by different code. With the code blocks below added, the demo's index goes from 219 KB to 137 KB.
+- The Tests workflow runs the Playwright suite and enforces the coverage thresholds on pull requests. The coverage steps waited for a Node 20 leg the matrix no longer has, and the browser specs only ran in the deploy after a merge, so both kinds of failure surfaced on `develop` instead of on the pull request.
+- MathJax loads only on pages with math, and the search bundle only on the search page. With `render_on_load: auto`, MathJax loaded wherever a dollar sign or an escaped parenthesis appeared in the rendered page, including shell variables, prices and inline scripts, and the demo also turned it on for every post; it now follows the expressions the math preprocessor finds, and on the demo loads on 6 pages instead of 28. The search bundle was preloaded and run on every page because the header's search form matched the loader's check; it now loads on the one page that renders the search app.
+- The release workflow promotes a `release/vX.Y.Z` branch to `main` instead of promoting `develop` itself, so the pull request and the merge commit on `main` name the release rather than reading "from develop". `develop` still receives the version bump.
+- The stylesheet carries the styles of an optional feature only when the site uses it: search (`features.search`), visualizations (`features.visualizations`), notebook pages, the `packages` collection, the academic dashboard (`features.academic_dashboard`) and open science badges (badges in `_data/academic.yml`). `assets/css/main.scss` configures the new `_sass/_features.scss` from the site's settings, and each partial loads those styles at the position they always had, so a site with every feature on gets the same stylesheet byte for byte. With all six off it shrinks from 169 KB to 122 KB, or from 27.6 KB to 20.5 KB gzipped. A site that replaced `main.scss` with a plain `@use "theme"` keeps the complete stylesheet. `_sass/_phase1-enhancements.scss` is now `_sass/_post-components.scss`.
+- The layouts use `jekyll-include-cache`, a dependency the theme already declared but never used. The footer and skip link are rendered once per build (the skip link once per page language) and the header navigation once per distinct current section, where each was rendered on every page before: on the demo site the navigation renders 10 times instead of 53. The CSP meta tag, the script loader and the analytics snippet stay per page because each carries that page's CSP nonce. Requiring the theme now also loads `jekyll-include-cache`.
+- The documentation is organised by task. `docs/README.md` indexes the guides by what a reader wants to do; the phase summaries, the configuration refactoring plan and the 2025 security audit moved to `docs/history/` under a note that they are not maintained; and the Phase 1 features guide became `docs/components.md`, without the `phase1_features` settings the theme never read and with instructions that work for a site using the gem. The installation guide lost its leftover citation markers, and the README and the starter template pin the current `~> 0.7` series.
+- The installation guide covers what a site supplies itself (pages, navigation, social links), installing from a Git checkout, and publishing to GitHub Pages with GitHub Actions. It replaces instructions for the built-in Pages build, which cannot run the theme.
+
+### Deprecated
+
+- `theme_options.syntax_highlighting` no longer has an effect, and a build that sets it prints a warning (#197).
+
+### Removed
+
+- The CSP generator's inline script hashes. It computed them after a page had rendered, too late to reach the policy written into its head, and every inline script already carries the nonce (#196).
+- Prism: its scripts and stylesheets, their SRI entries, the `meta/syntax-config.html` include, the `syntax_highlighting` page setting and the `theme_options.syntax_highlighting` block in the demo configuration (#197).
+- `window.DatalogTheme` and `window.DatalogContent`, which every page inlined and no script read (#197).
+- `jekyll-archives` and `jekyll-remote-theme` from the gem's dependencies, which nothing in the theme used, and the 22 unbundled script sources from the gem. Pages load the bundles in `assets/js/dist` and `assets/js/loader.js`; every site copied the sources into its published output as well. A site that installs the theme from a checkout still has them (#203).
+- Settings in the demo `_config.yml` that nothing reads: `features.math_toolkit`, `math_search`, `accessibility_skip_link`, `academic_calendar` and `notebook_support`, `theme_options.math.equation_numbering`, and `integrations.binder` and `integrations.colab`, whose buttons are configured under `notebooks:` (#206).
+- `rake ci:verify` and its twelve scripts in `scripts/`. Most checked that source files contained particular strings, repeated what Minitest, Vitest and Playwright already cover, and passed whether or not the built site worked. The Tests workflow no longer sets up Python, which only one of them needed (#204).
+- `project-sync.yml`, which only printed what it would have done, and `tests/test_critical_css.js`, `tests/test_search_accessibility.js` and `tests/test_viz_accessibility.js`, which no test command ran and which failed against the current sources (#204).
+- `lib/datalog/theme/theme.rb`, a theme registration hook that nothing required.
+- Includes and layouts that no layout, page or plugin used, with the styles written for them: the `archive` and `post-sidebar` layouts, and the user preferences panel, popular posts, back-to-top button and keyboard shortcuts panel (`navigation-enhancements`), social proof, enhanced metadata, reading progress, reading time, content recommendations, comments, language switcher, bookmark, email preferences, advanced search, newsletter signup and series navigation includes. Several read `phase2_features` to `phase5_features` settings that nothing defined. Comments still render through the `datalog-comments` plugin. The rules in those stylesheets that did style rendered pages (the `kbd` element, fieldsets, `.button` and the search result cards) moved to the partials for what they style, and `_sass/_phase3-enhancements.scss`, `_phase4-enhancements.scss` and `_phase5-enhancements.scss` are gone. Together with the feature gating above, the demo's stylesheet goes from 169 KB to 134 KB (27.6 KB to 23 KB gzipped), and a site with every optional feature off gets 85 KB (15.7 KB gzipped).
+
+### Fixed
+
+- MathJax typesets math again. Its configuration loaded the `\require` extension, which stopped MathJax 3.2 while starting up (`Illegal characters used in \require prefix`), so no page rendered an equation. Every extension the pages use is loaded directly, so authors don't need `\require`.
+- Posts with math no longer throw `Cannot read properties of undefined (reading 'then')`. The post layout read `MathJax.startup.promise` before MathJax had loaded; MathJax now announces typeset math with a `datalog:math-ready` event.
+- Equations are no longer taken out of the tab order. MathJax's explorer gave each one `tabindex="1"`, which axe reports; it is turned off, and the assistive MathML screen readers use stays on.
+- The math preprocessor's wrapper has `role="math"`. It carried an `aria-label` with no role, which ARIA forbids, and axe failed the page once MathJax rendered the expression inside it.
+- Notebook pages run their inline scripts. The pages are created after the CSP generator assigns nonces, and their templates printed an empty `page.csp_nonce`, so the browser refused every inline script in the head. MathJax's inserted stylesheet is allowed on math pages.
+- Bokeh blocks render. The theme loaded BokehJS's core bundle, which has no `Bokeh.Plotting`; it now loads the API bundle too, and logs a failed load instead of ignoring it.
+- Disqus comments load. The policy refused Disqus's script, stylesheet, iframe and the inline style that sizes the iframe.
+- Observable embeds display. An `observablehq.com` embed redirects to `old.observablehq.com`, which the policy refused. The demo's two embeds pointed at notebooks that return 404 and now embed D3's zoomable sunburst and bar chart.
+- The demo post's slide deck loads. It pointed at a host that does not exist; it now embeds the reveal.js demo deck, and `revealjs.com` is in the demo's `csp.frame_src`.
+- KaTeX's fonts load. The policy refused the fonts its stylesheet requests from jsDelivr (#196).
+- Plotly charts render. Plotly inserts its rules into a `<style>` element it creates, which the policy refused, so every Plotly block reported that Plotly failed to load (#195).
+- Jupyter widgets render. The policy refused the widget manager's `<style>` elements, the `new Function` it compiles widget schemas with, and its icon fonts. The theme also called a `WidgetManager` that `@jupyter-widgets/html-manager` does not export, and the error was swallowed; it now uses `HTMLManager` (#195).
+- A page with a widget no longer loses its Plotly, D3 or BokehJS chart depending on which script loads first. require.js, which the widget manager loads, made a bundle that ran after it register as an anonymous module, and require.js threw `Mismatched anonymous define()`. Bundles requested after require.js now load through it (#195).
+- The package API include's "See Also" list treated its comma-separated `see_also` string as a single item, so every list became one link to an anchor that did not exist; on the StatFlow page six of them led nowhere. It now splits the list, and StatFlow only lists functions it documents. The Plotly showcase post's contents linked to a heading written as raw HTML without an id, which now has one (#206).
+- Documentation that contradicted the code: the testing guide and the coverage review process quoted coverage thresholds of 20% and 80% where `vitest.config.js` enforces 88/78/83/88; the testing guide still listed Percy; the configuration guide described a comments configuration the plugin does not read, Binder and Colab settings nothing reads, and the MathJax detection #194 replaced; the user guide sent notebook metadata to an unread `_data/notebooks.yml` and Binder links to an unread `integrations.notebooks`; `_config.yml` pointed at `_data/config` files that do not exist; `_data/config/author.yml` linked to a missing page; and the Minimal Mistakes post linked to a docs page the site does not build (#206).
+- Neither Docker image built. `Dockerfile` copied a `Gemfile.lock` the repository does not have, then built the script bundles without esbuild, a dev dependency it had skipped; `Dockerfile.dev` ran `bundle install` without the gemspec the Gemfile loads. Both copy what the gemspec requires, install the OpenSSL and YAML headers that gems such as `openssl` compile against, drop the Python they installed for a notebook check that is gone, and use Node.js 22 like CI (#205).
+- The config validator stopped a build with "Invalid type for 'author'" for `author: Jane Doe`, and with "Invalid value for 'url'" for `url: ""`, which `jekyll new` writes. Both are accepted (#202).
+- Loading the theme broke `warn` keyword arguments for the whole build: a `Kernel#warn` override printed `uplevel:` and `category:` as a hash after the message. The override is gone; the `Warning` filter beside it still silences the same two messages (#202).
+- Notebook images whose base64 data Jupyter had split over lines or ended with a newline failed the data URI check and lost their `src`. The data is joined without whitespace first (#202).
+- A notebook's language went into a code cell's `class` attribute unescaped; it is now cut down to the characters a class name can hold (#202).
+- The analytics dashboard cached a missing-configuration or error report for a day, so after `GA4_PROPERTY_ID` was set it went on saying analytics wasn't configured. Only successful reports are cached (#202).
+- Every DataLog plugin hook ran twice for each post: the loader registered its hooks for posts as well as documents, and Jekyll fires both for a post (#202).
+- `{% t %}` split its options on every comma, so a quoted value such as `name: "Doe, Jane"` reached the translation as a fragment (#202).
+- `datalog publish` built without `JEKYLL_ENV=production`, so the published site left out the analytics tag and included the development CSP logger, and it ignored the exit status of `git commit` and `git push`, so a rejected push still ended as a publish. It builds for production and exits with an error when either step fails (#202).
+- `datalog new post` wrote the title, summary, author and tags between plain quotes, so a title with a double quote or a tag with a colon produced front matter that didn't parse (#202).
+- The `datalog_slides`, `datalog_comments` and `datalog_bibliography` fallback tags, which stand in when their plugin is disabled, printed "feature coming soon", the slides one with the page's raw configuration, on a page that set the key by hand. They render nothing and log a warning naming the plugin to enable (#202).
+- Search never matched code: every document's code list in `search.json` was empty, because the index template split the content on backticks after Jekyll had already rendered posts to HTML. `_plugins/search_code_blocks.rb` collects fenced code blocks from the source before rendering, and the demo's index now carries 34 of them (#198).
+- The 404, search and admin pages asked search engines to index them, the search and admin pages were listed in `sitemap.xml`, and all three appeared in site search. The robots tag now comes from `robots:` in front matter, and those pages set `noindex`, `sitemap: false` and `exclude_from_search: true` (#198, #199).
+- Every page carried the `keywords`, `format-detection` and jsDelivr `preconnect` tags twice, written by both `head.html` and the default layout, and empty Google, Bing, Yandex and Baidu verification tags when the site set no codes (#199).
+- The JSON-LD had `"dateModified": ""` on 26 pages, `"description": ""` where a page had no description, and `"headline": null` on the home page. Values a page doesn't have are left out, and the headline falls back to the site title (#199).
+- A blocked `localStorage` stopped every script feature on the page. Where storage access throws (Safari with all cookies blocked, sandboxed iframes, some privacy extensions), the dark mode toggle threw while the core bundle loaded, the loader gave up, and search, math, visualizations and the academic features never started. Dark mode now treats blocked storage as no saved choice, and each core initializer runs on its own, so a failure is logged without stopping the others (#201).
+- Readers who chose the dark theme saw each page in the light theme first, because the core bundle applied the theme after the page had been drawn. A small nonced script at the top of `<body>` now applies the saved or system choice before anything paints (#201).
+- GitHub repository cards kept their "—" placeholders when the API request failed, with no sign the numbers weren't coming, and asked again on every page view against the unauthenticated limit of 60 requests an hour. A card whose request failed now shows the translated "N/A" and is marked `data-github-state="error"`, and the failure is remembered for ten minutes (#201).
+- Fourteen demo pages had more than one `<h1>`: the default layout printed the title, and so did the dataset, project, portfolio, notebook and package layouts, the 404 page, the archive, category and tag pages and the CV page. Those layouts and pages now set `show_title: false`. Headings in notebook markdown cells move down a level, since a notebook usually opens with its title, and package API examples render as code rather than Markdown, which had turned every Python comment into a heading (15 `<h1>`s on the StatFlow page) (#200).
+- The footer's column titles were `<h3>` regardless of the page above them, and its navigation was an unnamed landmark next to "Primary navigation". The titles are `<h2>` with the same look, and the navigation takes its name from the "Explore" heading (#200).
+- Screen readers announced "Reading progress: N%" on every scroll event, because the percentage sat in a live region. The live region is gone; the progress bar stays hidden from assistive technology (#200).
+- On narrow screens, Escape moved focus to the menu button even with the menu closed, for example while clearing the search field. It now acts only when the menu is open (#200).
+- The bars of the citations-by-year chart on `/academic/` had no height: each set it in a `style` attribute, which the Content Security Policy drops. The heights now come from a nonced style block (#195).
+- Related posts never appeared: the list of posts was split into single characters before it was filtered, so every post said "No related posts yet".
+- Search dropped every letter outside ASCII from its index, so accented, Greek, Cyrillic and CJK words could not be found, and every build printed "[search_normalizer] unicode_normalize gem not available": `String#unicode_normalize` is part of Ruby, not a gem. The browser also cut queries down to the letters a to z; both now keep letters of any script.
+- The search page trapped keyboard focus: Tab from the input or any filter cycled through the filters, so the results could not be reached.
+- Search results inserted text from the index as HTML, and highlighting several words could put one `<mark>` inside the tags of another ("remark" became `re<<mark>ma</mark>rk>`). Results and suggestions are now escaped and highlighted in one pass, and index content is stripped of markup in an inert document.
+- A `_data/publications.yml` written as a list of entries stopped the build with a `TypeError`. A list is now read as the manual entries.
+- The math preprocessor wrapped dollar signs inside code as math, inserting markup into shell, R and SQL snippets, and read prices such as "$5 a month, or $50 a year" as an expression. Fenced code, highlight tags and inline code are left alone, and inline math follows Pandoc's rule: the opening `$` is followed by a non-space, and the closing `$` follows one and is not followed by a digit.
+- The analytics dashboard never rendered: its script uses `export` but was loaded as a classic script from the unbundled source, which failed to parse. It now loads as a module from the built bundle.
+- The Copy buttons of the citation tools on posts, datasets and projects did nothing: their handler lived in the academic bundle, which those pages never load. The core bundle now handles them.
+- Visualizations were refused by the theme's own Content Security Policy. D3 and scripted Bokeh blocks ran their code with `new Function`, which the policy refuses; the code now runs as a script carrying the page's nonce. Plotly and Bokeh loaded from hosts the policy does not list, and Bokeh also requested a stylesheet BokehJS 3 does not publish; both load from jsDelivr now. Observable blocks ignored `data-viz-src`, the attribute the user guide documents; they now accept it, and take embed addresses only from observablehq.com, so a `javascript:` or `data:` URL in the markup never becomes the frame's source. Iframes from any host but Observable were refused. On the demo, the D3 chart, the Observable embed and the Shiny app now render in Chromium. Plotly and ipywidgets charts still fail, because those libraries insert inline styles or evaluate strings, which the policy forbids, and Bokeh has not been confirmed to render.
+- Sites installing the gem published part of the demo site. The maintainer's CV templates and publication exports were copied into every site, and the demo's social profiles, contact addresses and academic profiles reached the footer and the script data on every page through `_data`. The gem now contains only the `_data` files the layouts need (translations, the script manifest and CDN integrity hashes) and none of the demo's downloads, and `scripts/verify_gem_package.rb` refuses a gem that does.
+- A site installing the theme from a Git checkout or a local path inherited the whole demo site. Jekyll merged the demo's `_config.yml` into the site's configuration, so the build stopped on a `datasets` feed for a collection the site did not have, and a site that declared the collection to get past it carried the maintainer's author details, contact addresses and social profiles. The build now stops with an explanation until the site sets `ignore_theme_config: true`, and with that set the theme also leaves out the demo's `_data` files and downloads.
+- The repository and the gem carried `_data/js_meta.json`, the esbuild metafile, whose committed copy had fallen behind the sources: its byte counts described an older build than the bundles it shipped with, and running `npm run build:js` left it modified. The metafile now stays with the bundles in `assets/js/dist/` and out of the gem. The build also no longer rewrites an unchanged `_data/js_manifest.json`, which Windows checkouts reported as modified because of line endings, and the test and gem release workflows fail if the committed manifest does not match the sources.
+- The README said notebooks publish under `/blog/` and that GitHub Pages builds a site with the `github-pages` gem. Notebooks publish under `/notebooks/`, and the build GitHub Pages runs by itself cannot load the theme's plugins, so the README now points to the GitHub Actions workflow in the installation guide.
+- Without `_data/navigation.yml` the header and footer linked to the demo's sections (Research, Projects, Datasets, Academic Ops), which a site using the theme does not have, and the header and footer showed "DataLog" rather than the site's title. The navigation and the footer's "Explore" and "Connect" columns are now left out when there is nothing to list, and the name falls back to `title`.
+
 ## [0.7.0] - 2026-09-12
 
 ### Added

data/CITATION.cff

@@ -16,8 +16,8 @@ abstract: >-
   It offers integrated notebook publishing, advanced math rendering, interactive
   visualization workflows, and reproducibility tooling optimised for open science communities.
 license: MIT
-version: 0.7.0
-date-released: 2026-09-12
+version: 0.8.0
+date-released: 2026-09-14
 keywords:
   - data-science
   - jekyll

data/README.md

@@ -74,13 +74,15 @@ site; the rest is reference content you can copy from.
 
 ## Documentation
 
+- [Documentation Index](docs/README.md) — every guide, grouped by what you want to do.
 - [Documentation Site](docs/site/README.md) — source for the live `datalog-theme.github.io` documentation hub with feature walk-throughs, interactive demos, and migration guides.
 - [User Guide](docs/user-guide.md) — comprehensive documentation covering installation, notebooks, math, visualizations, research workflows, accessibility, performance, and collaboration best practices for DataLog users.
 - [Environment Setup Guide](docs/environment-setup.md) — configure environment variables, secrets, and integrations for analytics, testing, and deployment.
 - [Scripts Reference](docs/scripts-reference.md) — complete reference for all build, test, import/export, and utility scripts.
 - [Changelog](CHANGELOG.md) — release highlights and upgrade guidance for each published version of the DataLog theme.
 - [Template Repository Guide](docs/template-repository.md) — instructions for publishing a GitHub template with starter content, configuration, and automated deployments.
-- [Installation Guide](docs/install.md) — prerequisites, GitHub Pages, local, and Docker setup paths.
+- [Installation Guide](docs/install.md) — adding the theme to a site, installing from a Git checkout, publishing with GitHub Actions, and local and Docker setup.
+- [Post Components](docs/components.md) — sharing buttons, breadcrumbs, author cards, the table of contents and difficulty badges.
 - [Migrating from Minimal Mistakes](docs/migrating-from-minimal-mistakes.md) — the front-matter fields DataLog reads natively (hero and teaser images, SEO title and description, `classes: wide`, `redirect_from`) and the settings that keep existing URLs.
 - [Plugin Development Guide](docs/plugin-development.md) — understand the hook system and learn how to package extensions for reuse.
 - [Security Policy](SECURITY.md) — report security vulnerabilities and learn about security best practices.
@@ -150,7 +152,7 @@ Once configured, Chart.js visualizations will highlight top-performing posts, se
 
 DataLog ships with an opinionated notebook-to-post pipeline tailored for technical storytelling:
 
-1. **Drop `.ipynb` files into `_notebooks/`** — the custom generator transforms each notebook into a permalink under `/blog/` while keeping a downloadable copy at `/notebooks/<slug>.ipynb`.
+1. **Drop `.ipynb` files into `_notebooks/`** — the custom generator transforms each notebook into a page under `/notebooks/<slug>/` while keeping a downloadable copy at `/notebooks/<slug>.ipynb`.
 2. **Leverage notebook metadata** — optional fields like `title`, `tags`, `keywords`, `difficulty`, and execution metadata will surface in the rendered article header and sidebar.
 3. **Preserve interactivity** — HTML outputs, Plotly figures, and widget placeholders are embedded automatically with responsive styling and dark-mode aware formatting.
 4. **Launch live sessions** — configure `notebooks.repository` and `notebooks.branch` in `_config.yml` to enable Binder and Google Colab links for each notebook, alongside GitHub source references and clone instructions.
@@ -159,9 +161,8 @@ DataLog ships with an opinionated notebook-to-post pipeline tailored for technic
 Matplotlib/Seaborn plots, LaTeX, and code syntax highlighting are optimized for both desktop and mobile viewing, while cell numbering and input/output differentiation mirror the native Jupyter experience.
 
 4. **Deploy to GitHub Pages**
-   - Push the repository to GitHub
-   - Enable GitHub Pages on the repository settings (use the `develop` branch)
-   - GitHub Pages will automatically build the site using the `github-pages` gem
+   - The build GitHub Pages runs by itself cannot load the theme's plugins, so build and publish with GitHub Actions: see [Publish with GitHub Pages](docs/install.md#23-publish-with-github-pages)
+   - `.github/workflows/deploy.yml` publishes this repository's demo site that way
 
 ## Data Science Workflow Integration
 
@@ -187,7 +188,7 @@ Matplotlib/Seaborn plots, LaTeX, and code syntax highlighting are optimized for
 The `_config.yml` file exposes an opinionated set of options crafted for research teams:
 
 - `theme_options.math` toggles between **MathJax** and **KaTeX** engines, equation numbering, and accessibility defaults.
-- `theme_options.syntax_highlighting` defines the Prism CDN, theme pairings for light/dark modes, and the language components to preload.
+- Code blocks are highlighted by Rouge when the site builds, and the theme styles Rouge's output for light and dark mode, so code needs no settings.
 - `theme_options.visualizations` controls default behaviour for Plotly, D3, Bokeh, Observable, Shiny, and widget embeds.
 - `theme_options.taxonomy`, `content.research_areas`, and `content.methodologies` organize content by research area and methodology for archive navigation.
 - `integrations.github` enables live repository metrics with caching support for portfolio cards, while Binder/Colab/Kaggle toggles control interactive notebook links.
@@ -207,35 +208,40 @@ Data-driven configuration allows you to publish or reorder projects, datasets, s
 Add the theme gem to your Jekyll site:
 
 ```ruby
-gem "datalog-theme", "~> 0.1"
+gem "datalog-theme", "~> 0.7"
 ```
 
-Then enable it in `_config.yml`:
+Then enable it in `_config.yml`. Naming the theme under `plugins:` registers its Liquid tags, and the build needs an author name:
 
 ```yml
 theme: datalog-theme
+plugins:
+  - datalog-theme
+author:
+  name: Your Name
 ```
 
-For GitHub Pages, pin the `github-pages` gem and allow the included workflow to build and deploy the site automatically.
+The [installation guide](docs/install.md) covers the files a site supplies itself, installing from a Git checkout, and publishing to GitHub Pages. GitHub Pages cannot build a site that uses this theme by itself, so the guide publishes it with GitHub Actions.
 
 ## Continuous Integration & Testing
 
-The repository ships with a multi-language CI pipeline located in `.github/workflows/ci.yml`. It performs the following checks:
+The Tests workflow (`.github/workflows/test.yml`) runs on every pull request:
 
-- Ruby matrix builds (3.1 & 3.2) to compile the theme, run lint-style verifications, and execute the `ci:verify` Rake task.
-- Python notebook validation to ensure `.ipynb` files retain kernel metadata and can be published.
-- Node.js checks that interactive visualizations (Plotly, Observable, Bokeh, R Shiny, ipywidgets) remain wired up.
-- Accessibility, math rendering, syntax highlighting, and performance budgets enforced through scripts in the `scripts/` directory.
+- Vitest unit tests for the JavaScript, with coverage thresholds.
+- A Jekyll build of the demo site, then the Minitest suite against the output: plugins, templates, the Content Security Policy, packaging and performance budgets.
+- Playwright browser tests, including axe accessibility checks in both themes.
+- ESLint and RuboCop.
 
-Run the suite locally with:
+Separate workflows audit dependencies and run CodeQL, Pa11y and Lighthouse. Run the unit and Ruby suites locally with:
 
 ```bash
-bundle exec rake ci:verify
+npm test
+bundle exec rake test
 ```
 
 ## Demo Site
 
-The repository doubles as a demo site and content laboratory. Explore the curated examples locally via `bundle exec jekyll serve` or review the walkthrough in [`demo/README.md`](demo/README.md) for deployment and navigation tips.
+The repository doubles as a demo site and content laboratory, published at <https://diogoribeiro7.github.io/analytics-blog-jekyll/>. Explore the curated examples locally with `bundle exec jekyll serve`.
 
 ## Citation & Academic Metadata
 

data/_data/cdn-integrity.yml

@@ -13,36 +13,6 @@ https://cdn.jsdelivr.net/npm/katex@0.16.9/dist/katex.min.js:
 https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js:
   crossorigin: anonymous
   integrity: sha384-AHAnt9ZhGeHIrydA1Kp1L7FN+2UosbF7RQg6C+9Is/a7kDpQ1684C2iH2VWil6r4
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/components/prism-javascript.min.js:
-  crossorigin: anonymous
-  integrity: sha384-D44bgYYKvaiDh4cOGlj1dbSDpSctn2FSUj118HZGmZEShZcO2v//Q5vvhNy206pp
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/components/prism-julia.min.js:
-  crossorigin: anonymous
-  integrity: sha384-joWnGJCIIBw7UmQ231RAVzCNiATJS38xk7yfiIDHRBJeYiBPvacMLMvx9d49VnrH
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/components/prism-python.min.js:
-  crossorigin: anonymous
-  integrity: sha384-WJdEkJKrbsqw0evQ4GB6mlsKe5cGTxBOw4KAEIa52ZLB7DDpliGkwdme/HMa5n1m
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/components/prism-r.min.js:
-  crossorigin: anonymous
-  integrity: sha384-a0dW6ZXBBtsBzzpPHKLx+AdpKmRJXfTGeCGNpzDA83/BoZoTUknyIAwMDuOTBfkS
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/components/prism-sql.min.js:
-  crossorigin: anonymous
-  integrity: sha384-/MKWdycCDliku23mP5sYXbZNuXrzgmQO/jsVxwPFn99dVOaXRyKsqDjarqpueGAp
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/plugins/line-numbers/prism-line-numbers.min.css:
-  crossorigin: anonymous
-  integrity: sha384-nUkTNLI8COlMCRJ0FHIdX76If83145OTCLUx4gQyfnO0gGeO/sD9czGEUBxtkcUv
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/plugins/normalize-whitespace/prism-normalize-whitespace.min.js:
-  crossorigin: anonymous
-  integrity: sha384-1Q1Kn1ruXt6wc5JfXB25OWRaEVBJ5OQ0gfL/pneNkXoVmWmhkBacvG9Rls1+yB2h
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/prism.min.js:
-  crossorigin: anonymous
-  integrity: sha384-BGaNxfftg+9+TtC098wxawPFVEUpKYvaiCgbB0iqAMjK/4jDdmUY+oGxrPNvnXEf
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/themes/prism-coy.css:
-  crossorigin: anonymous
-  integrity: sha384-/HnXSmP1Tv+9YA13kJX5sL1eVi3XeI57BUEGl+PiVlv6pPcxsbVrHaiw+OepvnSd
-https://cdn.jsdelivr.net/npm/prismjs@1.29.0/themes/prism-tomorrow.css:
-  crossorigin: anonymous
-  integrity: sha384-RCpAEDK2BSI4uVvV9kefzLdwlNUNZkCZJdOE2LkEa3jtLRcv2YrEVSbM4vwbCCW2
 https://giscus.app/client.js:
   crossorigin: anonymous
   integrity: sha384-UwLZGbJGvkTzz0719+xEzUm/idqwzs0yZN8aB9Se5vUXHbyRyDWw9yqZTIsOsJ7x

data/_includes/analytics/dashboard.html

@@ -145,5 +145,7 @@
       window.__DATALOG_ANALYTICS__ = {};
     {% endif %}
   </script>
-  <script src="{{ '/assets/js/analytics-dashboard.js' | relative_url }}" defer></script>
+  {%- comment -%} The built bundle, as a module: the script uses `export`, which a classic script cannot parse. {%- endcomment %}
+  {%- assign dashboard_bundle = site.data.js_manifest.entrypoints['analytics-dashboard'] | default: '/assets/js/dist/analytics-dashboard.js' %}
+  <script type="module" src="{{ dashboard_bundle | relative_url }}"></script>
 </div>

data/_includes/components/api-function.html

@@ -74,19 +74,38 @@ Parameters:
     <div class="api-function__section">
       <h4 class="api-function__section-title">Examples</h4>
       <div class="api-function__examples">
+        {%- comment -%}
+        Examples are code. Through markdownify, a Python comment such as
+        "# Two-sample t-test" became a page heading. Examples written as
+        Markdown with fenced code blocks still render as Markdown.
+        {%- endcomment -%}
+        {% if include.examples contains '```' %}
         {{ include.examples | markdownify }}
+        {% else %}
+        {% assign example_language = include.language | default: page.language | default: 'text' | downcase %}
+        <pre class="highlight" tabindex="0"><code class="language-{{ example_language }}">{{ include.examples | strip | rouge_highlight: example_language }}</code></pre>
+        {% endif %}
       </div>
     </div>
   {% endif %}
 
   {% if include.see_also %}
+    {%- comment -%}
+    `see_also` is a comma-separated list of functions documented on the same page, such as
+    `see_also="mannwhitneyu, anova"`. The loop used to take the whole string as one item, so two
+    names made a single link to an anchor that did not exist.
+    {%- endcomment -%}
+    {% assign see_also_items = include.see_also | split: "," %}
     <div class="api-function__section">
       <h4 class="api-function__section-title">See Also</h4>
       <ul class="api-function__see-also">
-        {% for item in include.see_also %}
+        {% for raw_item in see_also_items %}
+          {% assign item = raw_item | strip %}
+          {% if item != "" %}
           <li>
             <a href="#{{ item | slugify }}"><code>{{ item }}</code></a>
           </li>
+          {% endif %}
         {% endfor %}
       </ul>
     </div>

data/_includes/components/enhanced-code-block.html

@@ -104,7 +104,7 @@ Parameters:
     </div>
   </div>
 
-  <pre class="enhanced-code-block__pre{% if show_line_numbers %} enhanced-code-block__pre--numbered{% endif %}"><code id="{{ code_id }}" class="language-{{ language }}" data-code-content>{{ code_content }}</code></pre>
+  <pre class="highlight enhanced-code-block__pre{% if show_line_numbers %} enhanced-code-block__pre--numbered{% endif %}" tabindex="0"><code id="{{ code_id }}" class="language-{{ language }}" data-code-content>{{ code_content | rouge_highlight: language }}</code></pre>
 
   {%- comment -%} Feedback message {%- endcomment -%}
   <div class="enhanced-code-block__feedback" data-feedback role="status" aria-live="polite"></div>

data/_includes/csp-meta.html

@@ -1,17 +1,121 @@
 {% assign csp_registry = site.data.csp | default: {} %}
 {% assign nonce_source = page.csp_nonce | default: csp_registry.nonces[page.path] | default: csp_registry.nonces[page.url] | default: '' %}
-{% assign script_hashes = page.csp_hashes | default: [] %}
-{% capture script_hash_directives -%}
-  {%- for hash in script_hashes -%}
-    'sha256-{{ hash }}'{% unless forloop.last %} {% endunless %}
-  {%- endfor -%}
-{%- endcapture -%}
+{%- comment -%}
+  Sources a site adds for its own embeds, listed under `csp` in _config.yml:
+  frame_src for iframes (Shiny apps, slide decks, videos), and script_src,
+  style_src, font_src and connect_src for anything else.
+{%- endcomment -%}
+{% assign frame_hosts = site.csp.frame_src | join: ' ' %}
+{% assign extra_script_src = site.csp.script_src | join: ' ' %}
+{% assign extra_style_src = site.csp.style_src | join: ' ' %}
+{% assign extra_font_src = site.csp.font_src | join: ' ' %}
+{% assign extra_connect_src = site.csp.connect_src | join: ' ' %}
+{%- comment -%}
+  Plotly, the Jupyter widget manager and MathJax can't run under the strict
+  policy. Plotly inserts its rules into a <style> element it creates; the widget
+  manager adds <style> elements too, and compiles widget schemas with
+  new Function; MathJax's CHTML output adds the stylesheet its layout depends
+  on. Only the pages that run them get inline styles, and widget pages eval. A
+  page that loads such a library another way sets csp.unsafe_inline_styles or
+  csp.unsafe_eval in its front matter. A browser ignores 'unsafe-inline' in a
+  directive that also lists a nonce, so those pages drop the style nonce.
+{%- endcomment -%}
+{% assign csp_inline_styles = page.csp.unsafe_inline_styles %}
+{% assign csp_eval = page.csp.unsafe_eval %}
+{%- comment -%}
+  jsDelivr serves any npm package, so the policy names the packages this page
+  loads rather than the whole host: the math engine, from the URLs the head's
+  script tags use (math-config.html and head.html set them), and the chart
+  libraries the visualization and notebook scripts load for the blocks on the
+  page. Keep these in step with the URLs in assets/js/visualizations.js,
+  assets/js/notebook.js and _includes/analytics/dashboard.html;
+  tests/test_csp.rb checks that they are.
+{%- endcomment -%}
+{% assign cdn_scripts = '' %}
+{% assign cdn_styles = '' %}
+{% assign cdn_fonts = '' %}
+{% assign cdn_connect = '' %}
+{% assign cdn_frames = '' %}
+{% if math_enabled %}
+  {% if math_engine == 'katex' %}
+    {% assign cdn_scripts = cdn_scripts | append: ' ' | append: katex_cdn %}
+    {% assign cdn_styles = cdn_styles | append: ' ' | append: katex_cdn %}
+    {% assign cdn_fonts = cdn_fonts | append: ' ' | append: katex_cdn %}
+  {% else %}
+    {%- comment -%} MathJax loads its components, fonts and speech data from the directory of its main script. {%- endcomment -%}
+    {% assign mathjax_file = mathjax_url | split: '/' | last %}
+    {% assign mathjax_dir_length = mathjax_url.size | minus: mathjax_file.size %}
+    {% assign mathjax_dir = mathjax_url | slice: 0, mathjax_dir_length %}
+    {% assign cdn_scripts = cdn_scripts | append: ' ' | append: mathjax_dir %}
+    {% assign cdn_fonts = cdn_fonts | append: ' ' | append: mathjax_dir %}
+    {% assign cdn_connect = cdn_connect | append: ' ' | append: mathjax_dir %}
+    {% assign csp_inline_styles = true %}
+  {% endif %}
+{% endif %}
+{% if content contains 'data-viz-type="plotly"' or content contains "data-viz-type='plotly'" or content contains 'notebook-output-plotly' %}
+  {% assign csp_inline_styles = true %}
+  {% assign cdn_scripts = cdn_scripts | append: ' https://cdn.jsdelivr.net/npm/plotly.js-dist-min@2.27.0/' %}
+{% endif %}
+{% if content contains 'data-viz-type="d3"' or content contains "data-viz-type='d3'" %}
+  {% assign cdn_scripts = cdn_scripts | append: ' https://cdn.jsdelivr.net/npm/d3@7/' %}
+{% endif %}
+{% if content contains 'data-viz-type="bokeh"' or content contains "data-viz-type='bokeh'" %}
+  {% assign cdn_scripts = cdn_scripts | append: ' https://cdn.jsdelivr.net/npm/@bokeh/bokehjs@3.3.3/' %}
+{% endif %}
+{% if content contains 'notebook-output-vega' %}
+  {% assign cdn_scripts = cdn_scripts | append: ' https://cdn.jsdelivr.net/npm/vega@5 https://cdn.jsdelivr.net/npm/vega-lite@5 https://cdn.jsdelivr.net/npm/vega-embed@6' %}
+{% endif %}
+{% if content contains 'npm/chart.js@4.4.0/' %}
+  {% assign cdn_scripts = cdn_scripts | append: ' https://cdn.jsdelivr.net/npm/chart.js@4.4.0/' %}
+{% endif %}
+{%- comment -%}
+  Widget pages load require.js from cdnjs, and allow all of jsDelivr: the widget
+  manager loads any widget package a notebook names from it, and its icon fonts.
+{%- endcomment -%}
+{% if content contains 'data-viz-type="ipywidgets"' or content contains "data-viz-type='ipywidgets'" or content contains 'application/vnd.jupyter.widget-state+json' %}
+  {% assign csp_inline_styles = true %}
+  {% assign csp_eval = true %}
+  {% assign cdn_scripts = cdn_scripts | append: ' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com/ajax/libs/require.js/2.3.6/' %}
+  {% assign cdn_fonts = cdn_fonts | append: ' https://cdn.jsdelivr.net' %}
+{% endif %}
+{%- comment -%}
+  The Disqus embed loads its script from the site's shortname subdomain of
+  disqus.com and its assets from disquscdn.com, shows the thread in an iframe
+  from disqus.com, and sizes that iframe with an inline style. The policy
+  allowed none of them.
+{%- endcomment -%}
+{% if content contains 'id="disqus_thread"' %}
+  {% assign csp_inline_styles = true %}
+  {% assign cdn_scripts = cdn_scripts | append: ' https://*.disqus.com https://*.disquscdn.com' %}
+  {% assign cdn_styles = cdn_styles | append: ' https://*.disquscdn.com' %}
+  {% assign cdn_connect = cdn_connect | append: ' https://*.disqus.com' %}
+  {% assign cdn_frames = cdn_frames | append: ' https://disqus.com' %}
+{% endif %}
+{%- comment -%}
+  Google's tag loads only on a site that sets google_analytics, and the policy
+  allowed its hosts on every site. These are the hosts Google documents for GA4,
+  which reports to regional subdomains such as region1.google-analytics.com.
+{%- endcomment -%}
+{% assign csp_analytics = false %}
+{% if site.google_analytics and site.google_analytics != "" %}
+  {% assign csp_analytics = true %}
+{% endif %}
+{%- comment -%}
+  object-src, base-uri and form-action do not fall back to default-src. An
+  injected <base> tag could repoint the page's relative script URLs, which the
+  nonce would then authorise; every theme form submits to the site itself.
+  Observable serves classic notebook embeds from old.observablehq.com, and an
+  observablehq.com embed URL redirects there.
+{%- endcomment -%}
 <meta http-equiv="Content-Security-Policy" content="
   default-src 'self';
-  script-src 'self' 'nonce-{{ nonce_source }}'{% if script_hash_directives != '' %} {{ script_hash_directives | strip }}{% endif %} https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://www.googletagmanager.com https://www.google-analytics.com;
-  style-src 'self' 'nonce-{{ nonce_source }}' https://fonts.googleapis.com https://cdn.jsdelivr.net;
+  script-src 'self' 'nonce-{{ nonce_source }}'{% if csp_eval %} 'unsafe-eval'{% endif %}{{ cdn_scripts }}{% if csp_analytics %} https://*.googletagmanager.com{% endif %}{% if extra_script_src != '' %} {{ extra_script_src }}{% endif %};
+  style-src 'self' {% if csp_inline_styles %}'unsafe-inline'{% else %}'nonce-{{ nonce_source }}'{% endif %} https://fonts.googleapis.com{{ cdn_styles }}{% if extra_style_src != '' %} {{ extra_style_src }}{% endif %};
   img-src 'self' data: https:;
-  font-src 'self' https://fonts.gstatic.com data:;
-  connect-src 'self' https://api.github.com https://www.google-analytics.com https://cdn.jsdelivr.net;
-  frame-src 'self' https://observablehq.com;
+  font-src 'self' https://fonts.gstatic.com data:{{ cdn_fonts }}{% if extra_font_src != '' %} {{ extra_font_src }}{% endif %};
+  connect-src 'self' https://api.github.com{{ cdn_connect }}{% if csp_analytics %} https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com{% endif %}{% if extra_connect_src != '' %} {{ extra_connect_src }}{% endif %};
+  frame-src 'self' https://observablehq.com https://old.observablehq.com{{ cdn_frames }}{% if frame_hosts != '' %} {{ frame_hosts }}{% endif %};
+  object-src 'none';
+  base-uri 'self';
+  form-action 'self';
 " />

data/_includes/footer.html

@@ -2,10 +2,11 @@
 {% assign footer_year = site.time | date: '%Y' %}
 {% assign navigation_data = site.data.navigation %}
 {% assign social_data = site.data.social %}
+{%- comment -%} The column titles are <h2>: the footer follows the page's own outline, which starts at its <h1>. {%- endcomment %}
 <footer class="site-footer" role="contentinfo">
   <div class="container footer-container">
     <section class="footer-about">
-      <h3>{{ site.name | default: 'DataLog' }}</h3>
+      <h2>{{ site.name | default: site.title }}</h2>
       <p class="footer-description">{{ site.description | strip_html | truncate: 160 }}</p>
       <p class="footer-author">
         <strong>{{ site.author.name }}</strong>
@@ -20,30 +21,24 @@
       {% endif %}
     </section>
 
-    <nav class="footer-navigation">
-      <h3>Explore</h3>
-      {%- comment -%} `footer:` in _data/navigation.yml drives this column; the demo's sections are the fallback. {%- endcomment -%}
-      {% assign footer_links = navigation_data.footer %}
+    {%- comment -%} `footer:` in _data/navigation.yml drives this column, which is left out without it. {%- endcomment -%}
+    {% assign footer_links = navigation_data.footer %}
+    {% if footer_links.size > 0 %}
+    <nav class="footer-navigation" aria-labelledby="footer-explore-heading">
+      <h2 id="footer-explore-heading">Explore</h2>
       <ul class="footer-link-list">
-        {% if footer_links and footer_links.size > 0 %}
         {% for item in footer_links %}
         <li><a href="{{ item.url | relative_url }}">{{ item.title }}</a></li>
         {% endfor %}
-        {% else %}
-        <li><a href="{{ '/blog/' | relative_url }}">Blog</a></li>
-        <li><a href="{{ '/research/' | relative_url }}">Research</a></li>
-        <li><a href="{{ '/portfolio/' | relative_url }}">Projects</a></li>
-        <li><a href="{{ '/datasets/' | relative_url }}">Datasets</a></li>
-        <li><a href="{{ '/visualizations/' | relative_url }}">Visualizations</a></li>
-        <li><a href="{{ '/about/' | relative_url }}">About</a></li>
-        {% endif %}
       </ul>
     </nav>
+    {% endif %}
 
+    {% assign primary_social = social_data.primary %}
+    {% if primary_social.size > 0 or site.author.email %}
     <section class="footer-connect">
-      <h3>Connect</h3>
-      {% assign primary_social = social_data.primary %}
-      {% if primary_social %}
+      <h2>Connect</h2>
+      {% if primary_social.size > 0 %}
       <ul class="footer-link-list">
         {% for profile in primary_social %}
         <li><a href="{{ profile.url }}" target="_blank" rel="{{ profile.rel | default: 'noopener' }}">{{ profile.label }}</a></li>
@@ -56,18 +51,22 @@
       </p>
       {% endif %}
     </section>
+    {% endif %}
 
     <section class="footer-subscribe">
-      <h3>Stay updated</h3>
+      <h2>Stay updated</h2>
       <p>Follow via RSS or check back for new research and tutorials.</p>
+      {%- comment -%} jekyll-feed is a dependency of the theme, so /feed.xml exists even when _data/social.yml lists no feeds. {%- endcomment -%}
       {% assign rss_links = social_data.rss %}
-      {% if rss_links %}
       <ul class="footer-link-list">
+        {% if rss_links.size > 0 %}
         {% for feed in rss_links %}
         <li><a href="{{ feed.url | relative_url }}">{{ feed.label }}</a></li>
         {% endfor %}
+        {% else %}
+        <li><a href="{{ '/feed.xml' | relative_url }}">RSS feed</a></li>
+        {% endif %}
       </ul>
-      {% endif %}
     </section>
   </div>
   <div class="container footer-bottom">