hof 24.0.0-vite-beta.12 → 24.1.0

package/.eslintrc.hof-wrapper.js

@@ -0,0 +1,30 @@
+'use strict';
+
+/*
+ * NOTE: This file is a wrapper for the default Hof ESLint config.
+ * It is used to override rules for specific files in the Hof repo that are
+ * not compatible with the default config.
+ * This can be removed once the hof-config-eslint default config is updated
+ * to support these files.
+ */
+
+const baseConfig = require('./node_modules/eslint-config-hof/default.js');
+
+module.exports = {
+  ...baseConfig,
+  overrides: [
+    ...(baseConfig.overrides || []),
+    {
+      files: [
+        'build/tasks/vite/index.js',
+        'build/tasks/vite/vite.config.js',
+        'test/frontend/toolkit/vitest.config.js'
+      ],
+      rules: {
+        'import/no-unresolved': 'off',
+        'node/no-missing-import': 'off',
+        'node/no-missing-require': 'off'
+      }
+    }
+  ]
+};

package/CHANGELOG.md

@@ -1,4 +1,64 @@
-## 2025-11-18, Version 24.0.0 (Stable), @PaolaDMadd-Pro @Rhodine-orleans-lindsay
+## 2026-06-17, Version 24.0.0 (Stable), @gregwolversonHO, @nzorba
+
+⚠️ Major release which removes nodemailer dependency and email functionality
+
+### Changed
+- Removed built-in email functionality from HOF, including the emailer component and transport implementations.
+- Removed `nodemailer` and related transport dependencies from HOF.
+
+### Breaking Changes
+- Services that previously relied on HOF email functionality must now implement and maintain their own email sending logic. 
+- Services should migrate to [Gov.uk Notify](https://www.notifications.service.gov.uk) to send notification emails
+
+## 2026-05-12, Version 23.1.0 (Stable), @gregwolversonHO
+
+### Changed
+- Replaced nodemailer-ses-transport library with @aws-sdk/client-sesv2 to remove dependency on deprecated aws-sdk-v2 library
+- Replaced usage of nodemailer-ses-transport in the [emailer ses client](./components/emailer/transports/ses.js).
+
+## 2026-04-16, Version 23.0.4 (Stable), @PaolaDMadd-Pro
+
+### Fixed
+- Decoupled session timeout keep alive from analytics configuration.
+- Updated CSP defaults to always include `connect-src 'self'` so same-origin keep alive requests are allowed.
+- Updated GA CSP behavior to **extend** `connect-src` with analytics endpoints when `gaTagId` is set, rather than replacing defaults.
+
+### Changed
+- Improved timeout dialog refresh behavior:
+  * On keep alive success, `timeSessionRefreshed` is updated and timeout controller logic is restarted.
+  * On keep alive failure a console.error is triggered.
+
+### Tests
+- Added integration regression coverage for CSP:
+  * `gaTagId` set: GA and region analytics `connect-src` endpoints are present.
+  * `gaTagId` not set: default `connect-src 'self'` remains and GA region endpoints are absent.
+- Added frontend Jest coverage for timeout refresh behavior:
+  * Success path (`$.get().done`) updates refresh time and calls controller.
+
+
+## 2026-03-18, Version 23.0.3 (Stable), @vinodhasamiyappan-ho
+
+### Security
+- Upgraded WebdriverIO from v4 to v5, resolving security vulnerabilities caused by transitive dependencies (`minimist@0.0.10`, `form-data@~2.3.2`) in `webdriverio@4.14.4`.
+
+### Changed
+- Migrated to WebdriverIO v5 (`webdriverio@5.23.0`), requiring the following compatibility updates:
+  - Refactored all functional tests to use async/await and the new WebdriverIO v5 command API.
+  - Updated test utilities and browser setup for async execution and modern WebdriverIO patterns.
+  - Removed deprecated synchronous and promise-chaining test code.
+  - Improved test isolation and reliability by ensuring each test runs with a fresh app and browser instance.
+- Enhanced sessionDialog Jest tests with new and improved negative test scenarios
+
+## 2026-03-17, Version 23.0.2 (Stable), @vivekkumar-ho
+
+### Fixed
+- Improved session secret validation so missing or blank values now fail fast with a clearer startup error.
+- Reused the validated session secret consistently across cookie parsing, session encryption, and Redis session storage.
+
+## 2025-03-04, Version 23.0.1 (Stable), @PaolaDMadd-Pro @Rhodine-orleans-lindsay
+### ⚠️ Versioning Notice
+v23.0.1 is published as a patch due to a prior publishing issue.
+This is the official major release that replaces a previously published beta-tagged v23.0.0, and it should be treated as such in terms of features and breaking changes.
 ### Changed
 - Replaced Browserify with Vite
   - removed browserify dependencies including in tests
@@ -6,8 +66,79 @@
 - Updated readme.md
 - Potential **breaking changes**:
   - Node version required for Vite is `20.19.0 || >=22.12.0`
+  - Updated engine requirements to use node to `>=20.19.0`
   - Vite uses Rollup in production and requires optional rollup dependencies to be loaded. Setting `--ignore-optional flag`  in Dockerfiles will result in "Module not found" errors in CI/CD or Docker.
 
+## 2026-02-23, Version 22.14.1 (Stable), @vivekkumar-ho
+
+### Security
+
+- Upgraded Jest to address a security issue: uncontrolled resource consumption in `braces`.
+- Previous dependency chain (via transitive deps) could pin `braces` to `2.3.2` (from `jest@26.6.3` → `micromatch@3.1.10` → `braces@^2.3.1`), while the earliest fixed `braces` version is `3.0.3`.
+- Jest upgrade updates the transitive dependency chain so `braces` can be resolved to a fixed version (`>= 3.0.3`).
+- Updates patch and minor dependency versions
+
+## 2026-01-27, v22.14.0 (Stable), @rayhannurrohmanho
+
+### Added
+- Created the amountWithUnitSelect component.
+- Separated the amountWithUnitSelect component logic into into hooks, utils, and validators - all documented via JSDoc.
+- Created templates and partials for the amountWithUnitSelect component.
+- Configured template mixin for amountWithUnitSelect component.
+- Added sandbox example for the amountWithUnitSelect component.
+- Documented the amountWithUnitSelect component in readme.
+- Added tests for the amountWithUnitSelect components.
+
+### Changed
+- Added optional parent key ('pKey') parameter to the template-mixins.js 'optionGroup' function to allow the assignment of a group component's parent's properties.
+- Modified validation to check if a "groupedFieldsWithOptions" property exists (and is set to true) for a component with "options" before the "equals" validator is applied to the component. 
+
+## 2025-12-09, Version 22.13.0 (Stable), @Rhodine-orleans-lindsay
+### Changed
+- Updated cookie banner view to follow GOV.UK design system. Updated cookieSettings.js to allow for different confirmation text based on whether cookies were accepted or rejected
+- Added inputmode='numeric' to date component
+- Added span for checkbox error messages
+- Updated imported javascript
+- Added data-module attribute for govuk-skip-link for screen readers
+- Removed aria-polite=live for character-count and removed pattern attribute for date input
+- Replaced deprecated govuk-header__link--service-name with govuk-header__service-name
+- Added a modifier for phone text input styles that accept sequences of digits
+- Added govuk-template--rebranded class to govuk template html to enable govuk rebrand styles:
+  - Updated header and footer to follow GOV.UK design system as part of rebrand
+
+## 2025-11-20, Version 22.12.0 (Stable), @dk4g @jamiecarterHO
+
+### Infrastructure  
+- Updated CI/CD pipeline to test against Node.js 20.x, 22.x, and 24.x
+- Updated Redis testing versions to 7 and 8
+- Added `NODE_VERSION` environment variable for consistent Node.js version across jobs
+- Updated release process to use Node.js 24 for tagging and publishing operations
+
+### Security
+  - Replaced deprecated `crypto.createCipher`/`crypto.createDecipher` with `crypto.createCipheriv`/`crypto.createDecipheriv`
+  - Added proper initialisation vector (IV) handling for enhanced security
+  - Enforced 32-byte session secret requirement for AES-256 encryption compatibility
+  - Removed insecure default session secret ('changethis') - now requires explicit configuration
+
+### Migration Notes
+- **Session Reset Required**: Due to enhanced encryption security, existing user sessions will be invalidated and users will need to re-authenticate after this update
+- **Session Secret**: You must now set a unique `SESSION_SECRET` environment variable of exactly 32 bytes for encryption compatibility. 
+For testing purposes, you can use the following command to generate a random value. For production environments, consult a security expert or refer to official cryptographic guidelines to generate a secure secret
+`node -e "console.log(require('crypto').randomBytes(16).toString('hex'))"`
+
+## 2025-11-15, Version 22.11.0 (Stable), @Rhodine-orleans-lindsay
+
+### Changed
+- Updated custom session-timeout handling so that custom behaviours are not blocked by a `404` middleware error.
+
+### Added
+- Added a `CUSTOM_SESSION_EXPIRY` environment variable so that a time other than the redis session ttl can be used for the session timeout. **IMPORTANT**: The `CUSTOM_SESSION_EXPIRY` variable must always be a time before the redis session ttl would expire so that behaviours can run before the `SESSION_TIMEOUT` middleware is triggered.
+- Added a `USE_CUSTOM_SESSION_TIMEOUT` that is `false` by default. When set to `true` the '/session-timeout' page can run before the session expires without triggering a `404` middleware error.
+
+   - 🎬 Action:
+      - For custom session timeout handling that is not linked to the redis session ttl, The following variables must be set: `CUSTOM_SESSION_EXPIRY` to the relevant expiry time e.g.600 and `USE_CUSTOM_SESSION_TIMEOUT` to true.
+      - If a behaviour is required on the '/session-timeout` step, the '/session-timeout' step must be set in the project's index.js, along with any relevant behaviours.
+
 ## 2025-10-10, Version 22.10.4 (Stable), @dk4g
 ### Security
 - Upgraded axios version to address a security vulnerability

package/README.md

@@ -4,6 +4,9 @@
 [![npm version](https://badge.fury.io/js/hof.svg)](https://badge.fury.io/js/hof)
 [![Known Vulnerabilities](https://snyk.io/test/npm/hof/badge.svg)](https://snyk.io/test/npm/hof)
 
+> **WARNING - Breaking change from v24.0.0:** HOF no longer includes built-in email functionality and no longer depends on `nodemailer`.
+> Services must provide and maintain their own email sending implementation using [GOV.UK Notify](https://docs.notifications.service.gov.uk/node.html).
+
 HOF (Home Office Forms) is a framework designed to assist developers in creating form-based workflows in a rapid, repeatable and secure way. It aims to reduce simple applications as much as possible to being configuration-only.
 
 ## Server Settings
@@ -60,7 +63,8 @@ It is recommended to alias `hof-build` to an npm script in your package.json.
 
 ## Tasks
 
-- `vite` - compiles client-side js with vite in development and rollup in production. Requires node version `^20.19.0 || >=22.12.0`.
+- `vite` - compiles client-side js with vite.
+ Requires node version `^20.19.0 || >=22.12.0`.
 - `sass` - compiles sass
 - `images` - copies images from ./assets/images directory to ./public/images
 - `translate` - compiles translation files
@@ -70,6 +74,20 @@ Note: For SASS compilation it's possible to additionally configure the following
 - `quietDeps` - This controls whether you get deprecation warning shown in the console output, if set to false (default) SASS deprecation warnings will be shown in the console, if set to true then deprecation warnings will not be shown in the console output.
 - `sourceMaps` - This controls whether the build will output css sourcemaps to help with debugging. These will be output to the same directory as the css output as a .map file. This option is not currently available in production.
 
+Vite outputs JavaScript sourcemaps as a .js.map file to the same directory as the js bundle.
+
+Debugging example (in hof.settings or your build config)
+```js
+  "build": {
+    "sass": {
+      "sourceMaps": true
+    },
+    "js": {
+      "sourceMaps": true
+    }
+  }
+```
+
 ## Watch
 
 You can additionally run a `watch` task to start a server instance, which will automatically restart based on changes to files. This will also re-perform the tasks above when relevant files change.
@@ -104,6 +122,13 @@ Alternatively you can define a path to a local config file by passing a `--confi
 ```
 hof-build --config /path/to/my/config.js
 ```
+Any task can be disabled by setting its configuration to `false` (or any falsy value).
+
+```js
+module.exports = {
+  sass: false,
+};
+```
 
 ### Configuration options
 
@@ -845,7 +870,7 @@ Kubernetes healthcheck URLs are provided as defaults if no overrides are supplie
 |----------|-------------|---------|---------|
 | `SHOW_COOKIES_BANNER` | Controls whether the cookies banner is displayed | Auto-detected based on GA tags | `true`, `false` |
 
-**Behavior:**
+**Behaviour:**
 - If `SHOW_COOKIES_BANNER` is explicitly set, that value is used
 - If not set, banner is automatically shown when `GA_TAG` or `GA_4_TAG` is present
 - If no GA tags are configured, banner is hidden by default
@@ -990,6 +1015,85 @@ Using the translation key `fields.field-name.label` will return different values
 
 # HOF Components
 
+## AmountWithUnitSelect Component
+
+> **Available from version 22.14.0**
+
+A component for handling the rendering, processing, and validation of a text input (amount) field and a select-dropdown input field (unit) used in HOF applications.
+
+### Usage
+
+In your fields config:
+
+```js
+const amountWithUnitSelectComponent = require("hof").components.amountWithUnitSelect;
+
+module.exports = {
+  "amountWithUnitSelect-field": amountWithUnitSelectComponent("amountWithUnitSelect", {
+    mixin: 'input-amount-with-unit-select',
+    amountLabel: "Amount:", // If not specified, defaults to 'Amount'
+    unitLabel: "Unit:", // If not specified, defaults to 'Unit'
+    options: [
+      { "null": "Select..." }, // If a null option is not specified, a default null option with the label 'Select...' is included in the options
+      { "label": "untranslated option label 1", "value": "1" },
+      { "label": "untranslated option label 2", "value": "2" }
+    ],
+    hint: "E.g: 5 Kilogram", 
+    legend: 'Enter An Amount',
+    isPageHeading: 'true',
+    amountOptional: 'false', // If not specified, defaults to false if the required validator is not applied, otherwise true
+    unitOptional: 'true', // If not specified, defaults to false if the required validator is not applied, otherwise true
+    validate: ['alphanum']
+  }),
+};
+```
+
+The above example will create a new AmountWithUnitSelect component with the key `'amountWithUnitSelect-field'`.
+It will set the AmountWithUnitSelect component's text input label to `'Amount:'` (instead of the default `'Amount'`) and the select input label to `'Unit:'` (instead of the default `'Unit'`).
+The component's Select input will have the dropdown options `'Select...'` (mapping to the value `'null'`), `'untranslated option label 1'` (mapping to the value `'1'`), and `'untranslated option label 2'` (mapping to the value `'2'`).
+The component's hint text will be set to `'E.G: 5 Kilogram'`, the field title/legend will be set to `'Enter An Amount'`, and the page heading will be the field's title.
+In terms of validation, the text input (amount) will have the `'required'` validator applied, but the select input (unit) will not (a value will not be required to be selected), and the text field will have the `'alphanum'` validator applied.
+
+### Configuration
+
+The following optional configuration options are supported:
+
+- `validate {String|Array}` – Validators to use on the text input field. The `'alphanum'` and `'required'` validators are likely to be used.  
+- `template` – An absolute path to an alternate template.
+- `amountLabel {String}` – A custom label for the text input field (amount). Defaults to `'Amount'` if omitted. This can also be specified and defined in the field translations. 
+- `unitLabel {String}` – A custom label for the select input field (unit). Defaults to `'Unit'` if omitted. This can also be specified and defined in the field translations.
+- `options {Array}` – A list of labels and corresponding values (options) for the select input field to present. Each option has the format `{ "label": "", "value": ""}`. The default/null option is defined with the format `{ "null": "Select" }` (where the text `'Select'` is the label and can be modified). If the null option is not defined, a default null option will be included in the options with the label `'Select...'`. This can also be specified and defined in the field translations.
+- `hint {String}` – Hint text displayed for both fields. This can also be specified and defined in the field translations.
+- `legend {String}` – Legend text displayed for both fields. This can also be specified and defined in the field translations.
+- `isPageHeading {Boolean}` – Sets the legend as the page heading on single-page questions.
+- `amountOptional {Boolean}` – The text input (amount) defaults to `''` (empty string) if omitted. Defaults to `false`. If the `'required'` validator is defined in the `validate` configuration option, then this configuration is ignored (both fields are made mandatory).
+- `unitOptional {Boolean}` – The select input (unit) defaults to `null` if omitted. Defaults to `false`. If the `'required'` validator is defined in the `validate` configuration option, then this configuration is ignored (both fields are made mandatory).
+
+### Validation Error Messages
+
+In Validation.json (within the translations):
+
+```js
+"amountWithUnitSelect": {
+  "default": "Enter the amount in the correct format; for example, 10 Litres",
+  "alphanum": "The amount must not contain any special characters",
+  "required": "Enter an amount and a unit value"
+},
+"amountWithUnitSelect-unit": {
+  "default": "A valid value must be selected as the amount unit",
+  "required": "A unit must be selected for the amount"
+},
+"amountWithUnitSelect-amount": {
+  "alphanum": "The amount must not be an alphanum"
+}
+```
+
+Validation error messages can be defined for a specific child component that errored by adding a JSON object with a key that has the component's name (I.E. `'amountWithUnitSelect'`) followed by a hyphen and the child component's name (I.E. '-amount' or '-unit'). So to define an error message, for the `'required'` validation error, for specifically the unit component, an `'amountWithUnitSelect-unit'` object can be created (like in the example above) with a validator's name and the error message to show for it respectively, set as a key:value pair in the object (E.G. `"required": "A unit must be selected for the amount" within "amountWithUnitSelect-unit"` - like in the example). 
+Validation error messages defined specifically for child components, for a given type of validation error, (such as `'required'` for `'amountWithUnitSelect-unit'`) will take precedence over error messages defined for the same validation error in the parent. So in this case, the `"required": "Enter an amount and a unit value"` validation message defined in the `"amountWithUnitSelect"` JSON object in the above example will not show when the `"amountWithUnitSelect-unit"` `'required'` validation error message is defined. If there was no `'required'` error message defined for, say, the `"amountWithUnitSelect-amount"` object (like in the example above), the `"amountWithUnitSelect"` object's `'required'` error message would show if the `'required'` validation error is triggered on the 'amount' child component (I.E. When an amount value is not provided).
+The `'default'` catch all validation error message can also be defined in a similar manner for the child components to override the parent component's defined `'default'` error message.
+
+So the example above will create a scenario where `'required'` validation errors triggered on the 'unit' field will display the error message `"A unit must be selected for the amount"` (specified in the `"amountWithUnitSelect-unit"` JSON object). Any `'required'` validation errors triggered on the 'amount' field will display the error message `"Enter an amount and a unit value"` (specified in the `"amountWithUnitSelect"` JSON object - as there is no `'required'` error message defined specifically for the 'amount' field (withing `"amountWithUnitSelect-amount"`)).
+
 ## Date Component
 
 A component for handling the rendering and processing of 3-input date fields used in HOF Applications.
@@ -1151,162 +1255,17 @@ Translations for field labels are looked for in the following order:
 - `fields.${key}.label`
 - `fields.${key}.legend`
 
-## Emailer Component
-
-HOF behaviour to send emails
-
-### Usage
-
-```js
-const EmailBehaviour = require('hof').components.emailer;
-
-// configure email behaviour
-const emailer = EmailBehaviour({
-  transport: 'ses',
-  transportOptions: {
-    accessKeyId: '...',
-    secretAccessKey: '...'
-  },
-  template: path.resolve(__dirname, './views/emails/confirm.html'),
-  from: 'confirmation@homeoffice.gov.uk',
-  recipient: 'customer-email',
-  subject: 'Application Successful'
-});
-
-// in steps config
-steps: {
-  ...
-  '/confirm': {
-    behaviours: ['complete', emailer],
-    next: '/confirmation',
-    ...
-  },
-  ...
-}
-```
-
-### Options
-
-In addition to the options passed to `hof-emailer`, the following options can be used:
-
-- `recipient` - _Required_ - defines the address to which email will be sent. This can be set either as a key to retrieve an email address from the session, or explicitly to an email address.
-- `template` - _Required_ - defines the mustache template used to render the email content.
-- `subject` - defines the subject line of the email.
-- `parse` - parses the session model into an object used to populate the template.
-
-`recipient` and `subject` options can also be defined as functions, which will be passed a copy of the session model and a translation function as arguments, and should return a string value.
-
-```js
-// use a translated value for the email subject line
-const emailer = EmailBehaviour({
-  // ...
-  subject: (model, translate) => translate("email.success.subject"),
-});
-```
-
-## HOF Emailer
-
-An emailer service for HOF applications.
-
-### Installation
-
-```bash
-$ npm install hof-emailer --save
-```
-
-### Usage
-
-```js
-// first create an emailer instance
-const Emailer = require("hof").components.email.emailer;
-const emailer = new Emailer({
-  from: "sender@example.com",
-  transport: "smtp",
-  transportOptions: {
-    host: "my.smtp.host",
-    port: 25,
-  },
-});
-
-// then you can use your emailer to send emails
-const to = "recipient@example.com";
-const body = "This is the email body";
-const subject = "Important email!";
-emailer.send(to, body, subject).then(() => {
-  console.log(`Email sent to ${to}!`);
-});
-```
-
-### Options
-
-- `from`: <String>: Address to send emails from. Required.
-- `transport`: <String>: Select what mechanism to use to send emails. Defaults: 'smtp'.
-- `transportOptions`: <Object>: Set the options for the chosen transport, as defined below. Required.
-- `layout`: <String>: Optional path to use a custom layout for email content.
-
-### Transports
-
-The following transport options are available:
-
-#### `smtp`
-
-[nodemailer](https://github.com/nodemailer/nodemailer)
-
-##### Options
-
-- `host` <String>: Address of the mailserver. Required.
-- `port` <String|Number>: Port of the mailserver. Required.
-- `ignoreTLS` <Boolean>: Defaults to false.
-- `secure` <Boolean>: Defaults to true.
-- `auth.user` <String>: Mailserver authorisation username.
-- `auth.pass` <String>: Mailserver authorisation password.
-
-#### `ses`
-
-[nodemailer-ses-transport](https://github.com/andris9/nodemailer-ses-transport)
-
-##### Options
-
-- `accessKeyId` <String>: AWS accessKeyId. Required.
-- `secretAccessKey` <String>: AWS accessKeyId. Required.
-- `sessionToken` <String>
-- `region` <String>. Defaults to 'eu-west-1'.
-- `httpOptions` <String>
-- `rateLimit` <String>
-- `maxConnections` <String>
-
-#### `debug`
-
-A development option to write the html content of the email to a file for inspection.
-
-`transport: 'debug'`
-
-##### debug options
-
-- `dir` <String>: The location to save html to. Default: `./.emails`. This directory will be created if it does not exist.
-- `open` <Boolean>: If set to true, will automatically open the created html file in a browser.
-
-##### debug example
-
-```
-transport: 'debug'
-transportOptions: {
-  dir: './emails',
-  open: true
-}
-```
-
-#### `stub`
-
-Disables sending email. No options are required.
-
 ## Session Timeout Warning Component
 HOF component for customising session timeout related pages
 This feature allows you to customise the content related to the session timeout warning, including the messages displayed in the session timeout warning dialog and on the exit page after a user exits the form due to a session timeout.
 
 ### Usage
 
-To enable and customise the session timeout behavior, you need to set the component and translations in your project's `hof.settings.json` file:
+By default, the session timeout is set to the redis session ttl. To bypass this and display the session timeout message before the redis session ttl the following environment variables must be set:
+`CUSTOM_SESSION_EXPIRY` - e.g. `600`. Configure to expire before the project's redis session ttl.
+`USE_CUSTOM_SESSION_TIMEOUT` -  `false` by default. When set to `true` the '/session-timeout' page can run before the session expires without triggering a `404` middleware error.
+
+To enable and customise the session timeout behaviour, you need to set the component and translations in your project's `hof.settings.json` file:
 ```json
  "behaviours": [
     "hof/components/session-timeout-warning"
@@ -1326,6 +1285,36 @@ By default, the framework uses the standard content provided by HOF. If you wish
   "saveExitFormContent": true // allows you to customise the content on the save-and-exit page
 ```
 
+To override the default session-timeout page completely, the path to the session-timeout.html should be set in the views property in the hof.settings.json file e.g. 
+```json
+ "behaviours": [
+    "hof/components/session-timeout-warning"
+  ],
+  "translations": "./apps/common/translations",
+   "views": ["./apps/common/views"], // allows you to override the HOF default session-timeout page and use a custom one from the specified views
+   ...
+```
+or in the project's `server.js` e.g.
+```js
+settings.views = path.resolve(__dirname, './apps/common/views');
+```
+
+
+### Session Timeout Keep-alive and CSP
+
+From version 23.0.4 , session timeout keep alive is now independent of analytics tags.
+
+- Default CSP always includes: `connect-src 'self'`
+- If `GA_TAG` (`gaTagId`) is configured:
+  - Google Analytics endpoints are added to `connect-src`.
+- If `GA_TAG` is not configured: Only default same-origin `connect-src` is used (no GA region endpoints).
+
+### Timeout Dialog Behavior
+When a user clicks **Stay on this page** in the timeout dialog:
+
+- If keep-alive succeeds:  session refresh timestamp is updated and the timeout countdown/controller is restarted.
+
+
 ### Customising content in `pages.json`
 Once the variables are set, you can customise the session timeout warning and exit messages in your project's pages.json:
 
@@ -1603,6 +1592,7 @@ currency
 select
 input-text
 input-date
+input-amount-with-unit-select
 input-text-compound
 input-text-code
 input-number

package/build/tasks/images/index.js

@@ -4,20 +4,34 @@
 const fs = require('fs');
 const chalk = require('chalk');
 const spawn = require('../../lib/spawn');
-const mkdir = require('../../lib/mkdir');
 
 module.exports = config => {
   if (!config.images) {
     return Promise.resolve();
   }
+  const imagesOutput = config.images.out;
 
-  return new Promise((resolve, reject) => {
-    fs.stat(config.images.src, err => err ? reject(err) : resolve());
-  })
-    .then(() => mkdir(config.images.out))
-    .then(() => spawn('cp', ['-r', config.images.src, config.images.out]))
+  // Due to govuk rebrand logo, images are copied from multiple sources & mapping can cause 'File exists' error.
+  // Remove if exists as a file
+  if (fs.existsSync(imagesOutput) && !fs.lstatSync(imagesOutput).isDirectory()) {
+    fs.unlinkSync(imagesOutput);
+  }
+  // Ensure directory exists
+  if (!fs.existsSync(imagesOutput)) {
+    fs.mkdirSync(imagesOutput, { recursive: true });
+  }
+  const srcs = Array.isArray(config.images.src) ? config.images.src : [config.images.src];
+
+  return Promise.all(srcs.map(src => {
+    if (!fs.existsSync(src)) {
+      console.log(`${chalk.yellow('warning')}: Skipping missing images folder: ${src}`);
+      return Promise.resolve();
+    }
+    return spawn('cp', ['-r', `${src}/.`, imagesOutput]);
+  }))
     .catch(e => {
       if (e.code !== 'ENOENT') {
+        console.error(`${chalk.red('error')}: Failed to copy images - ${e.message}`);
         throw e;
       } else {
         console.log(`${chalk.yellow('warning')}: no images directory found at ${config.images.src}`);

package/build/tasks/vite/index.js

@@ -11,7 +11,10 @@ module.exports = config => {
   if(!config.production) {
     return vite.build({
       configFile: viteConfig,
-      mode: 'development'
+      mode: 'development',
+      build: {
+        sourcemap: config.js.sourceMaps
+      }
     });
   }
   return vite.build({

package/build/tasks/vite/vite.config.js

@@ -26,7 +26,7 @@ export default defineConfig({
     // Vite does not process and optimise static images and assets files, it uses a src/ folder.
     // the images and assets folders are therefore loaded at runtime from the public/ folder.
     // This should be resolved with the v5/nunjucks work so we can ignore these warnings for now.
-    // TO DO: Remove this when v5/nunjucks is implemented.
+    // TODO: Remove this when v5/nunjucks is implemented.
     {
       name: 'suppress-resolve-warnings',
       apply: 'build',
@@ -51,6 +51,7 @@ export default defineConfig({
   build: {
     outDir: publicDirectory,
     emptyOutDir: false,
+    sourcemap: false,
     rollupOptions: {
       input: {
         index: entryFile

package/build/tasks/watch/index.js

@@ -32,7 +32,14 @@ module.exports = config => {
   }, {});
 
   function triggersTask(file) {
-    return Object.keys(matchers).filter(key => match(file, matchers[key]));
+    return Object.keys(matchers).filter(key => {
+      const pattern = matchers[key];
+      // Only call minimatch if pattern is a non-empty string or array of strings
+      if (Array.isArray(pattern)) {
+        return pattern.some(p => typeof p === 'string' && p.length > 0 && match(file, p));
+      }
+      return typeof pattern === 'string' && pattern.length > 0 && match(file, pattern);
+    });
   }
 
   function restart() {
@@ -94,7 +101,7 @@ module.exports = config => {
     process.stdin.setEncoding('utf8');
     process.stdin.on('data', data => {
       const dataType = (data + '').trim().toLowerCase();
-      if (dataType  === config.watch.restart) {
+      if (dataType === config.watch.restart) {
         restart();
       }
     });

package/components/amount-with-unit-select/fields.js

@@ -0,0 +1,15 @@
+'use strict';
+
+module.exports = key => ({
+  [`${key}-amount`]: {
+    label: 'Amount',
+    autocomplete: 'off',
+    validate: []
+  },
+  [`${key}-unit`]: {
+    label: 'Unit',
+    groupedFieldsWithOptions: true,
+    options: {},
+    validate: []
+  }
+});