Apply latest heavy updates cleanly (#41)

Author: kascit

static/css/dui.css

@@ -40,7 +40,7 @@ export function appendScriptOnce({
   }
 
   const script = document.createElement("script");
-  const policy = window.__staticLoaderPolicy;
+  const policy = window.__defaultPolicy;
   script.src = policy ? policy.createScriptURL(src) : src;
   script.async = async;
   script.defer = defer;

static/css/main.css

@@ -51,7 +51,7 @@ function setButtonIcon(button, iconClass) {
 }
 
 function makeSvgFromMarkup(markup) {
-  const p = window.__staticLoaderPolicy;
+  const p = window.__defaultPolicy;
   const safeString =
     p && typeof p.createHTML === "function" ? p.createHTML(markup) : markup;
   const doc = new DOMParser().parseFromString(safeString, "image/svg+xml");

static/js/core/resource-loader.js

@@ -648,7 +648,7 @@ var ASK_AI_ICON_SVG =
   '<svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 text-primary" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.813 15.904L9 18l-1.813-2.096a5.5 5.5 0 117.626 0L13 18l-.813-2.096M12 8v4m0 3h.01" /></svg>';
 
 function parseSvgString(svgString) {
-  var p = window.__staticLoaderPolicy;
+  var p = window.__defaultPolicy;
   var safeString =
     p && typeof p.createHTML === "function"
       ? p.createHTML(svgString)
@@ -1285,7 +1285,7 @@ function loadSearchLibraries(callback) {
       }
 
       var script = document.createElement("script");
-      var p = window.__staticLoaderPolicy;
+      var p = window.__defaultPolicy;
       script.src =
         p && typeof p.createScriptURL === "function"
           ? p.createScriptURL(safeSrc)

static/js/data/taxonomy-playlist.js

@@ -61,7 +61,7 @@ async function requestNotificationPermission() {
 
 async function setupServiceWorker(swPath) {
   try {
-    const policy = window.__staticLoaderPolicy;
+    const policy = window.__defaultPolicy;
     const safePath = policy ? policy.createScriptURL(swPath) : swPath;
     await navigator.serviceWorker.register(safePath);
     const registration = await navigator.serviceWorker.ready;

static/js/features/search-loader.js

@@ -35,16 +35,15 @@
     {% endif %}
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    
     {% if nonce != "" %}
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'nonce-{{ nonce }}' 'strict-dynamic' 'unsafe-inline' 'wasm-unsafe-eval' https://dhanur.me blob: https://*.dhanur.me https://www.googletagmanager.com https://www.google-analytics.com https://giscus.app https://utteranc.es https://static.cloudflareinsights.com https://gist.github.com https://asciinema.org https://challenges.cloudflare.com https://*.cloudflare.com https://*.sentry-cdn.com; style-src 'nonce-{{ nonce }}' data: https://*.dhanur.me https://fonts.googleapis.com https://giscus.app; style-src-attr 'unsafe-inline'; font-src 'self' data: https://*.dhanur.me https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://*.dhanur.me https://*.sentry.io https://browser.sentry-cdn.com https://www.google-analytics.com https://stats.g.doubleclick.net https://analytics.ahrefs.com; manifest-src 'self' https://*.dhanur.me; frame-src 'self' https://giscus.app https://utteranc.es https://www.youtube.com https://codepen.io https://www.openstreetmap.org https://asciinema.org https://challenges.cloudflare.com; worker-src 'self' blob: https://*.dhanur.me; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; require-trusted-types-for 'script'; trusted-types static-loader dompurify giscus googletagmanager sentry 'allow-duplicates';">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'nonce-{{ nonce }}' 'strict-dynamic' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://dhanur.me https://*.dhanur.me https://www.googletagmanager.com https://www.google-analytics.com https://giscus.app https://utteranc.es https://static.cloudflareinsights.com https://gist.github.com https://asciinema.org https://challenges.cloudflare.com https://*.cloudflare.com https://*.sentry-cdn.com; style-src 'nonce-{{ nonce }}' data: https://*.dhanur.me https://fonts.googleapis.com https://giscus.app; style-src-attr 'unsafe-inline'; font-src 'self' data: https://*.dhanur.me https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://*.dhanur.me https://*.sentry.io https://browser.sentry-cdn.com https://www.google-analytics.com https://stats.g.doubleclick.net https://analytics.ahrefs.com; manifest-src 'self' https://*.dhanur.me; frame-src 'self' https://giscus.app https://utteranc.es https://www.youtube.com https://codepen.io https://www.openstreetmap.org https://asciinema.org https://challenges.cloudflare.com; worker-src 'self' blob: https://*.dhanur.me; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; require-trusted-types-for 'script'; trusted-types default dompurify giscus googletagmanager sentry 'allow-duplicates';">
     {% endif %}
     <meta name="referrer" content="strict-origin-when-cross-origin">
-    <script nonce="">
+    <script>
       (function(){
-        if (window.trustedTypes && window.trustedTypes.createPolicy && !window.__staticLoaderPolicy) {
+        if (window.trustedTypes && window.trustedTypes.createPolicy) {
           try {
-            window.__staticLoaderPolicy = window.trustedTypes.createPolicy('static-loader', {
+            window.__defaultPolicy = window.trustedTypes.createPolicy('default', {
               createScriptURL: function(s) { return s; },
               createHTML: function(s) { return s; }
             });
@@ -57,7 +56,7 @@
     <link rel="preconnect" href="https://auth.dhanur.me" crossorigin>
     {% set theme_colorset = self::get_theme_colorset(config=config) | trim %}
     {%- set cookie_domain = config.base_url | replace(from="https://", to="") | replace(from="http://", to="") -%}
-    <script nonce="" data-cookie-domain="{{ cookie_domain }}"
+    <script data-cookie-domain="{{ cookie_domain }}"
             data-default-colorset="{{ theme_colorset }}"
             data-webmcp-compat="1">
 {{ load_data(path="static/js/core/boot.js") | safe }}
@@ -137,12 +136,12 @@
     {# Google Analytics and Sentry are loaded client-side only after cookie consent. #}
     {# Ahrefs Analytics: lightweight site-analytics script, no consent gate required. #}
     {% if config.extra.ahrefs_analytics_key is defined and config.extra.ahrefs_analytics_key != "" %}
-    <script data-telemetry="ahrefs" nonce="">
+    <script data-telemetry="ahrefs">
       (function(){
         function load(){
           var s=document.createElement("script");
           var url = "https://analytics.ahrefs.com/analytics.js";
-          var p = window.__staticLoaderPolicy;
+          var p = window.__defaultPolicy;
           s.src = p ? p.createScriptURL(url) : url;
           s.async=true;
           s.setAttribute("data-key","{{ config.extra.ahrefs_analytics_key | safe }}");
@@ -202,10 +201,8 @@
 
       <link rel="preload" href="{{ get_url(path="css/main.css") | safe }}" as="style">
     <link rel="stylesheet" href="{{ get_url(path="css/main.css") | safe }}">
-    <link rel="preload" href="{{ get_url(path="css/lqip.css") | safe }}" as="style" onload="this.onload=null;this.rel='stylesheet'">
-    <noscript><link rel="stylesheet" href="{{ get_url(path="css/lqip.css") | safe }}"></noscript>
-      <link rel="preload" href="{{ get_url(path="css/font-awesome.subset.css") | safe }}" as="style" onload="this.onload=null;this.rel='stylesheet'">
-    <noscript><link rel="stylesheet" href="{{ get_url(path="css/font-awesome.subset.css") | safe }}"></noscript>
+    <link rel="stylesheet" href="{{ get_url(path="css/lqip.css") | safe }}">
+    <link rel="stylesheet" href="{{ get_url(path="css/font-awesome.subset.css") | safe }}">
 
     <meta name="js-modules"
             data-katex-css="{{ get_url(path="css/katex.min.css") | safe }}"

static/js/shell.min.js

@@ -22,8 +22,8 @@
     {% if config.build_search_index and not is_export %}
     <div class="px-2 pt-4 pb-0 flex flex-col items-center gap-2">
         <div class="w-full flex items-center gap-2">
-            <label
-                for="search-modal"
+            <button
+                type="button"
                 class="sidebar-search-trigger input w-full flex items-center justify-between gap-3 text-left cursor-pointer transition"
                 aria-label="Search"
                 data-search-open="true"
@@ -38,7 +38,7 @@
                     <kbd class="kbd kbd-xs">D</kbd>
                     <kbd class="kbd kbd-xs">K</kbd>
                 </span>
-            </label>
+            </button>
         </div>
     </div>
     {% endif %}