@networkpro/web 1.26.12 → 1.26.14

package/CHANGELOG.md

@@ -24,6 +24,34 @@ version increments reflecting both user-visible and operational impact.
 
 ---
 
+## [1.26.14] - 2026-03-07
+
+### Changed
+
+- Bumped project version to `v1.26.14`.
+- Added deferred script to `src/app.html` to display the Keep Android Open banner.
+- Allowed `https://keepandroidopen.org` in `Content-Security-Policy` `script-src` across production, audit, and dev/test modes to support the Keep Android Open banner script.
+
+---
+
+## [1.26.13] - 2026-03-07
+
+### Changed
+
+- Bumped project version to `v1.26.13`.
+- Updated dependencies:
+  - `@eslint/compat` `^2.0.2` → `^2.0.3`
+  - `dompurify` `^3.3.1` → `^3.3.2`
+  - `svelte-check` `^4.4.4` → `^4.4.5`
+  - `posthog-js` `^1.358.1` → `^1.359.1`
+  - `svelte-eslint-parser` `^1.5.1` → `^1.6.0`
+
+### Security
+
+- Updated `dompurify` to `^3.3.2` to mitigate CVE-2026-0540.
+
+---
+
 ## [1.26.12] - 2026-03-04
 
 ### Changed
@@ -2487,7 +2515,9 @@ This enables analytics filtering and CSP hardening for the audit environment.
 
 <!-- Link references -->
 
-[Unreleased]: https://github.com/netwk-pro/netwk-pro.github.io/compare/v1.26.12...HEAD
+[Unreleased]: https://github.com/netwk-pro/netwk-pro.github.io/compare/v1.26.14...HEAD
+[1.26.14]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.14
+[1.26.13]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.13
 [1.26.12]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.12
 [1.26.11]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.11
 [1.26.10]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.10

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@networkpro/web",
   "private": false,
-  "version": "1.26.12",
+  "version": "1.26.14",
   "description": "Locking Down Networks, Unlocking Confidence™ | Security, Networking, Privacy — Network Pro Strategies",
   "keywords": [
     "advocacy",
@@ -89,13 +89,13 @@
     "pre-push": "bash scripts/hooks/pre-push.sh"
   },
   "dependencies": {
-    "dompurify": "^3.3.1",
-    "posthog-js": "^1.358.1",
+    "dompurify": "^3.3.2",
+    "posthog-js": "^1.359.1",
     "semver": "^7.7.4",
     "svelte": "5.53.7"
   },
   "devDependencies": {
-    "@eslint/compat": "^2.0.2",
+    "@eslint/compat": "^2.0.3",
     "@eslint/js": "9.39.2",
     "@lhci/cli": "^0.15.1",
     "@playwright/test": "^1.58.2",
@@ -128,8 +128,8 @@
     "stylelint-config-html": "^1.1.0",
     "stylelint-config-recommended": "^18.0.0",
     "stylelint-order": "^7.0.1",
-    "svelte-check": "^4.4.4",
-    "svelte-eslint-parser": "^1.5.1",
+    "svelte-check": "^4.4.5",
+    "svelte-eslint-parser": "^1.6.0",
     "svelte-preprocess": "^6.0.3",
     "typescript": "^5.9.3",
     "vite": "^7.3.1",

package/src/app.html

@@ -55,6 +55,9 @@
 
     <meta name="generator" content="SvelteKit 2.53.4" />
 
+    <!-- Temporary banner -->
+    <script src="https://keepandroidopen.org/banner.js" defer></script>
+
     <script src="/disableSw.js"></script>
 
     %sveltekit.head%

package/src/hooks.server.js

@@ -51,7 +51,7 @@ export async function handle({ event, resolve }) {
 
   const cspDirectives = [
     "default-src 'self';",
-    "script-src 'self' 'unsafe-inline' https://us.i.posthog.com https://us-assets.i.posthog.com;",
+    "script-src 'self' 'unsafe-inline' https://us.i.posthog.com https://us-assets.i.posthog.com https://keepandroidopen.org;",
     "style-src 'self' 'unsafe-inline';",
     "img-src 'self' data:;",
     "connect-src 'self' https://us.i.posthog.com https://us-assets.i.posthog.com;",
@@ -66,7 +66,7 @@ export async function handle({ event, resolve }) {
   // 🧪 Looser CSP for local/CI test environments
   if (isDebug) {
     cspDirectives[1] =
-      "script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:* ws://localhost:*;";
+      "script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:* ws://localhost:* https://keepandroidopen.org;";
     cspDirectives[2] = "style-src 'self' 'unsafe-inline' http://localhost:*;";
     cspDirectives[3] = "img-src 'self' data: http://localhost:*;";
     cspDirectives[4] =
@@ -75,7 +75,8 @@ export async function handle({ event, resolve }) {
 
   // 🧩 Hardened CSP for audit environment — no analytics, no CSP reporting
   if (isAudit) {
-    cspDirectives[1] = "script-src 'self' 'unsafe-inline';";
+    cspDirectives[1] =
+      "script-src 'self' 'unsafe-inline' https://keepandroidopen.org;";
     cspDirectives[2] = "style-src 'self' 'unsafe-inline';";
     cspDirectives[3] = "img-src 'self' data:;";
     cspDirectives[4] = "connect-src 'self';";