@networkpro/web 1.26.13 → 1.26.15

package/.github/workflows/build-and-publish.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci
@@ -130,7 +130,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci
@@ -186,7 +186,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci

package/.github/workflows/lighthouse.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Clean previous Lighthouse reports
         run: |

package/.github/workflows/playwright.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci

package/.github/workflows/publish-test.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci
@@ -134,7 +134,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci
@@ -195,7 +195,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci

package/.github/workflows/templates/publish.template.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci
@@ -134,7 +134,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci
@@ -190,7 +190,7 @@ jobs:
       - name: Upgrade npm
         run: |
           corepack enable
-          npm install -g npm@11.11.0
+          npm install -g npm@11.11.1
 
       - name: Install Node.js dependencies
         run: npm ci

package/.ncurc.cjs

@@ -31,7 +31,7 @@ This file is part of Network Pro.
 /** @type {import('npm-check-updates').RunOptions} */
 module.exports = {
   // Ignore specific dependencies (prevent upgrades)
-  reject: ['eslint', '@eslint/js'],
+  reject: [],
 
   // Always upgrade devDependencies as well
   dep: 'prod,dev',

package/CHANGELOG.md

@@ -24,6 +24,55 @@ version increments reflecting both user-visible and operational impact.
 
 ---
 
+## [1.26.15] - 2026-03-12
+
+### Changed
+
+- Updated `vite.config.js` to resolve tsconfig paths.
+- Updated generator metadata in `src/app.html` to reflect **SvelteKit 2.54.0**.
+- Updated all GitHub Actions workflows to utilize **npm** `11.11.1`.
+- Removed `@eslint/js` and `eslint` from `.ncurc.cjs` "reject" list.
+- Modified `vite.config.js` to comment out `vite-plugin-devtools-json` related entries until package is updated.
+- Updated `scripts/checkEnv.js` to satisfy newer ESLint rules by removing an unnecessary placeholder assignment and preserving existing validation behavior.
+- Updated `src/service-worker.js` to satisfy newer ESLint rules by preserving caught error context during precache failures and removing an unnecessary reassignment in the install handler.
+- Bumped project version to `v1.26.15`.
+- Updated dependencies:
+  - `dompurify` `^3.3.2` → `^3.3.3`
+  - `eslint-plugin-svelte` `^3.15.0` → `^3.15.2`
+  - `svelte` `5.53.7` → `5.53.11`
+  - `@sveltejs/kit` `2.53.4` → `2.54.0`
+  - `@vitest/coverage-v8` `4.0.18` → `4.1.0`
+  - `eslint-plugin-jsdoc` `^62.7.1` → `^62.8.0`
+  - `lightningcss` `^1.31.1` → `^1.32.0`
+  - `posthog-js` `^1.359.1` → `^1.360.1`
+  - `vitest` `4.0.18` → `4.1.0`
+  - `@sveltejs/vite-plugin-svelte` `^6.2.4` → `^7.0.0`
+  - `stylelint-order` `^7.0.1` → `^8.0.0`
+  - `vite` `^7.3.1` → `^8.0.0`
+  - `@eslint/js` `9.32.2` → `10.0.1`
+  - `eslint` `9.39.2` → `10.0.3`
+
+### Removed
+
+- Removed `vite-plugin-devtools-json`, as it is not compatible with Vite 8.
+- Removed `vite-tsconfig-paths`, as it is now included natively in Vite.
+
+### Security
+
+- Pinned transitive dependency `tar` to `^7.5.11` to mitigate CVE-2026-31802.
+
+---
+
+## [1.26.14] - 2026-03-07
+
+### Changed
+
+- Bumped project version to `v1.26.14`.
+- Added deferred script to `src/app.html` to display the Keep Android Open banner.
+- Allowed `https://keepandroidopen.org` in `Content-Security-Policy` `script-src` across production, audit, and dev/test modes to support the Keep Android Open banner script.
+
+---
+
 ## [1.26.13] - 2026-03-07
 
 ### Changed
@@ -2505,7 +2554,9 @@ This enables analytics filtering and CSP hardening for the audit environment.
 
 <!-- Link references -->
 
-[Unreleased]: https://github.com/netwk-pro/netwk-pro.github.io/compare/v1.26.13...HEAD
+[Unreleased]: https://github.com/netwk-pro/netwk-pro.github.io/compare/v1.26.15...HEAD
+[1.26.15]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.15
+[1.26.14]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.14
 [1.26.13]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.13
 [1.26.12]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.12
 [1.26.11]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.26.11

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@networkpro/web",
   "private": false,
-  "version": "1.26.13",
+  "version": "1.26.15",
   "description": "Locking Down Networks, Unlocking Confidence™ | Security, Networking, Privacy — Network Pro Strategies",
   "keywords": [
     "advocacy",
@@ -89,33 +89,33 @@
     "pre-push": "bash scripts/hooks/pre-push.sh"
   },
   "dependencies": {
-    "dompurify": "^3.3.2",
-    "posthog-js": "^1.359.1",
+    "dompurify": "^3.3.3",
+    "posthog-js": "^1.360.1",
     "semver": "^7.7.4",
-    "svelte": "5.53.7"
+    "svelte": "5.53.11"
   },
   "devDependencies": {
     "@eslint/compat": "^2.0.3",
-    "@eslint/js": "9.39.2",
+    "@eslint/js": "10.0.1",
     "@lhci/cli": "^0.15.1",
     "@playwright/test": "^1.58.2",
     "@sveltejs/adapter-netlify": "^6.0.4",
     "@sveltejs/adapter-vercel": "^6.3.3",
-    "@sveltejs/kit": "2.53.4",
-    "@sveltejs/vite-plugin-svelte": "^6.2.4",
+    "@sveltejs/kit": "2.54.0",
+    "@sveltejs/vite-plugin-svelte": "^7.0.0",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/svelte": "^5.3.1",
-    "@vitest/coverage-v8": "4.0.18",
+    "@vitest/coverage-v8": "4.1.0",
     "autoprefixer": "^10.4.27",
     "browserslist": "^4.28.1",
-    "eslint": "9.39.2",
+    "eslint": "10.0.3",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^62.7.1",
-    "eslint-plugin-svelte": "^3.15.0",
+    "eslint-plugin-jsdoc": "^62.8.0",
+    "eslint-plugin-svelte": "^3.15.2",
     "globals": "^17.4.0",
     "globby": "^16.1.1",
     "jsdom": "28.1.0",
-    "lightningcss": "^1.31.1",
+    "lightningcss": "^1.32.0",
     "markdownlint": "^0.40.0",
     "markdownlint-cli2": "0.21.0",
     "npm-run-all": "^4.1.5",
@@ -127,16 +127,14 @@
     "stylelint": "^17.4.0",
     "stylelint-config-html": "^1.1.0",
     "stylelint-config-recommended": "^18.0.0",
-    "stylelint-order": "^7.0.1",
+    "stylelint-order": "^8.0.0",
     "svelte-check": "^4.4.5",
     "svelte-eslint-parser": "^1.6.0",
     "svelte-preprocess": "^6.0.3",
     "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vite-plugin-devtools-json": "^1.0.0",
+    "vite": "^8.0.0",
     "vite-plugin-lightningcss": "^0.0.5",
-    "vite-tsconfig-paths": "^6.1.1",
-    "vitest": "4.0.18"
+    "vitest": "4.1.0"
   },
   "overrides": {
     "basic-ftp": "^5.2.0",
@@ -146,7 +144,7 @@
     "lodash": "^4.17.23",
     "minimatch": ">=10.2.1",
     "qs": "^6.14.1",
-    "tar": "^7.5.9",
+    "tar": "^7.5.11",
     "tmp": "^0.2.4"
   }
 }

package/scripts/checkEnv.js

@@ -12,10 +12,9 @@ This file is part of Network Pro.
  *
  * @module scripts/
  * @author Scott Lopez
- * @updated 2025-05-21
+ * @updated 2026-03-12
  */
 
-import { basename } from 'path';
 import { fileURLToPath } from 'url';
 
 const validEnvs = new Set(['dev', 'test', 'ci', 'prod', 'preview']);
@@ -30,9 +29,7 @@ const validEnvs = new Set(['dev', 'test', 'ci', 'prod', 'preview']);
  * }}
  */
 export function checkEnv() {
-  const current = process.env.ENV_MODE;
-  let mode = current;
-  let valid = false;
+  let mode = process.env.ENV_MODE;
   let wasDefaulted = false;
 
   if (!mode) {
@@ -42,14 +39,16 @@ export function checkEnv() {
     console.warn("⚠️ ENV_MODE not set. Defaulting to 'dev'.");
   }
 
-  valid = validEnvs.has(mode);
+  const allowed = [...validEnvs].sort();
+  const valid = validEnvs.has(mode);
 
   if (valid) {
-    const tag = wasDefaulted ? '[info]' : '[ok]';
-    console.log(`${tag} ENV_MODE is set to: "${mode}"`);
+    console.log(
+      `${wasDefaulted ? '[info]' : '[ok]'} ENV_MODE is set to: "${mode}"`,
+    );
   } else {
     console.error(
-      `❌ Invalid ENV_MODE "${mode}". Must be one of: ${[...validEnvs].join(', ')}`,
+      `❌ Invalid ENV_MODE "${mode}". Must be one of: ${allowed.join(', ')}`,
     );
   }
 
@@ -57,11 +56,12 @@ export function checkEnv() {
     mode,
     valid,
     wasDefaulted,
-    allowed: [...validEnvs].sort(),
+    allowed,
   };
 }
 
-// ✅ Run only if called directly via CLI
-if (basename(fileURLToPath(import.meta.url)) === basename(process.argv[1])) {
+const thisFile = fileURLToPath(import.meta.url);
+
+if (process.argv[1] && thisFile === process.argv[1]) {
   checkEnv();
 }

package/src/app.html

@@ -53,7 +53,10 @@
       content="bx4ham0zkpvzztzu213bhpt76m9siq" />
     <!-- cspell:enable -->
 
-    <meta name="generator" content="SvelteKit 2.53.4" />
+    <meta name="generator" content="SvelteKit 2.54.0" />
+
+    <!-- Temporary banner -->
+    <script src="https://keepandroidopen.org/banner.js" defer></script>
 
     <script src="/disableSw.js"></script>
 

package/src/hooks.server.js

@@ -51,7 +51,7 @@ export async function handle({ event, resolve }) {
 
   const cspDirectives = [
     "default-src 'self';",
-    "script-src 'self' 'unsafe-inline' https://us.i.posthog.com https://us-assets.i.posthog.com;",
+    "script-src 'self' 'unsafe-inline' https://us.i.posthog.com https://us-assets.i.posthog.com https://keepandroidopen.org;",
     "style-src 'self' 'unsafe-inline';",
     "img-src 'self' data:;",
     "connect-src 'self' https://us.i.posthog.com https://us-assets.i.posthog.com;",
@@ -66,7 +66,7 @@ export async function handle({ event, resolve }) {
   // 🧪 Looser CSP for local/CI test environments
   if (isDebug) {
     cspDirectives[1] =
-      "script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:* ws://localhost:*;";
+      "script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:* ws://localhost:* https://keepandroidopen.org;";
     cspDirectives[2] = "style-src 'self' 'unsafe-inline' http://localhost:*;";
     cspDirectives[3] = "img-src 'self' data: http://localhost:*;";
     cspDirectives[4] =
@@ -75,7 +75,8 @@ export async function handle({ event, resolve }) {
 
   // 🧩 Hardened CSP for audit environment — no analytics, no CSP reporting
   if (isAudit) {
-    cspDirectives[1] = "script-src 'self' 'unsafe-inline';";
+    cspDirectives[1] =
+      "script-src 'self' 'unsafe-inline' https://keepandroidopen.org;";
     cspDirectives[2] = "style-src 'self' 'unsafe-inline';";
     cspDirectives[3] = "img-src 'self' data:;";
     cspDirectives[4] = "connect-src 'self';";

package/src/service-worker.js

@@ -46,6 +46,7 @@ const IGNORE_PATHS = new Set([
   '/webfonts/fa-brands-400.ttf',
   '/webfonts/fa-solid-900.ttf',
   '/7cbb39ce-750b-43da-83b8-8980e5554d4d.txt',
+  '/b173de6c44c144c1b186841b88d51c67.txt',
   '/robots.txt',
   '/sitemap.xml',
   '/CNAME',
@@ -73,7 +74,7 @@ const ASSETS = [
         if (isDev)
           console.warn('[SW] URL parse failed, skipping path:', path, err);
         excludedAssets.push(path);
-        return true;
+        return false;
       }
     }),
   ),
@@ -135,7 +136,9 @@ async function cacheAssetsSafely(cache, assets, required = []) {
             : `[SW] Failed to cache ${asset}: Unknown error`;
 
         if (isDev) {
-          throw new Error(msg);
+          throw err instanceof Error
+            ? new Error(msg, { cause: err })
+            : new Error(msg);
         } else {
           console.warn(msg);
         }
@@ -163,10 +166,13 @@ sw.addEventListener('install', (event) => {
   event.waitUntil(
     (async () => {
       const cache = await caches.open(CACHE);
-      let cachedPaths = [];
 
       try {
-        cachedPaths = await cacheAssetsSafely(cache, ASSETS, REQUIRED_ASSETS);
+        const cachedPaths = await cacheAssetsSafely(
+          cache,
+          ASSETS,
+          REQUIRED_ASSETS,
+        );
         if (isDev) console.log('[SW] Cached assets:', cachedPaths);
       } catch (err) {
         if (isDev) throw err;

package/vite.config.js

@@ -7,15 +7,14 @@ This file is part of Network Pro.
 ========================================================================= */
 
 import { sveltekit } from '@sveltejs/kit/vite';
-import { resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+//import { resolve } from 'node:path';
+//import { fileURLToPath } from 'node:url';
 import { defineConfig } from 'vite';
-import devtoolsJson from 'vite-plugin-devtools-json';
+//import devtoolsJson from 'vite-plugin-devtools-json';
 import lightningcssPlugin from 'vite-plugin-lightningcss';
-import tsconfigPaths from 'vite-tsconfig-paths'; // tsconfig/jsconfig alias support
 
 // Compute absolute project root
-const projectRoot = fileURLToPath(new URL('.', import.meta.url));
+//const projectRoot = fileURLToPath(new URL('.', import.meta.url));
 
 export default defineConfig(({ mode }) => {
   // --- 🧩 Log Build Environment Info -------------------------------------
@@ -49,13 +48,15 @@ export default defineConfig(({ mode }) => {
 
   return {
     envPrefix: ['PUBLIC_'],
+    resolve: {
+      tsconfigPaths: true,
+    },
     plugins: [
-      tsconfigPaths(),
-      devtoolsJson({
-        projectRoot: resolve(projectRoot),
-        normalizeForWindowsContainer: true,
-        uuid: 'ad0db4f4-6172-4c1e-ae17-26b1bee53764',
-      }),
+      //devtoolsJson({
+      //projectRoot: resolve(projectRoot),
+      //normalizeForWindowsContainer: true,
+      //uuid: 'ad0db4f4-6172-4c1e-ae17-26b1bee53764',
+      //}),
       sveltekit(),
       lightningcssPlugin({
         minify: ['production', 'audit'].includes(mode),