From 92f55c8cc622cbe9e0a3b51d69dd6476bc9c2cb2 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 29 Apr 2026 14:35:53 +0000 Subject: [PATCH 1/5] fix(deps): update dependency unpoly to v3.14.2 --- opal/static/thirdparty/package-lock.json | 8 ++++---- opal/static/thirdparty/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/opal/static/thirdparty/package-lock.json b/opal/static/thirdparty/package-lock.json index e8e2dc7da..f1bea5ba8 100644 --- a/opal/static/thirdparty/package-lock.json +++ b/opal/static/thirdparty/package-lock.json @@ -8,7 +8,7 @@ "dependencies": { "@fortawesome/fontawesome-free": "7.2.0", "bootstrap": "5.3.8", - "unpoly": "3.12.1" + "unpoly": "3.14.2" } }, "node_modules/@fortawesome/fontawesome-free": { @@ -51,9 +51,9 @@ } }, "node_modules/unpoly": { - "version": "3.12.1", - "resolved": "https://registry.npmjs.org/unpoly/-/unpoly-3.12.1.tgz", - "integrity": "sha512-32zcXt/uKqiYK0M/NnvxTMe8oAq/mklJkVCkR7Gm6SlNkuEH0d8UFVAwQtt3LVi+TEHqfLzkSsueOio+N4VdPw==", + "version": "3.14.2", + "resolved": "https://registry.npmjs.org/unpoly/-/unpoly-3.14.2.tgz", + "integrity": "sha512-UhclBPGqmkmJd3CMj6RgS+6oZbitzTXVLqP2V/sLW4x1dECVDcEzHwALDnPgGZ+/5Kc4EnOoKIM9xX95zsR2KA==", "license": "MIT" } } diff --git a/opal/static/thirdparty/package.json b/opal/static/thirdparty/package.json index 5b0d7f4bc..db72a0900 100644 --- a/opal/static/thirdparty/package.json +++ b/opal/static/thirdparty/package.json @@ -2,7 +2,7 @@ "dependencies": { "@fortawesome/fontawesome-free": "7.2.0", "bootstrap": "5.3.8", - "unpoly": "3.12.1" + "unpoly": "3.14.2" }, "scripts": { "postinstall": "node copy_distribution_files.js" From 7d76a95c1c5588a1cbb8938eeb4255e893db1bca Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Apr 2026 14:36:16 +0000 Subject: [PATCH 2/5] update static thirdparty files --- opal/static/thirdparty/unpoly/css/unpoly-bootstrap5.min.css | 4 ++-- opal/static/thirdparty/unpoly/css/unpoly.min.css | 4 ++-- opal/static/thirdparty/unpoly/js/unpoly-bootstrap5.min.js | 4 ++-- opal/static/thirdparty/unpoly/js/unpoly.min.js | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/opal/static/thirdparty/unpoly/css/unpoly-bootstrap5.min.css b/opal/static/thirdparty/unpoly/css/unpoly-bootstrap5.min.css index 741fb36c4..5a0c153a6 100644 --- a/opal/static/thirdparty/unpoly/css/unpoly-bootstrap5.min.css +++ b/opal/static/thirdparty/unpoly/css/unpoly-bootstrap5.min.css @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:8cb699269186916c0410dccf7aaff6d9f4814f30baf4c063a97573b10139d270 -size 187 +oid sha256:99408206714f87426c62ba9d4a6ad80a72bc85d35ddc54b9bfabca5a69be6ef5 +size 240 diff --git a/opal/static/thirdparty/unpoly/css/unpoly.min.css b/opal/static/thirdparty/unpoly/css/unpoly.min.css index 7e057cc54..1667e0c44 100644 --- a/opal/static/thirdparty/unpoly/css/unpoly.min.css +++ b/opal/static/thirdparty/unpoly/css/unpoly.min.css @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:aa733e8633eff66ac03f5c885be4bf8d0cbd49f28def7c9039d4236bd44a3949 -size 3344 +oid sha256:6db15609641e35e77cf3527434a974d7d40eb6ed462d6cd7b93b230a6ae3e004 +size 4010 diff --git a/opal/static/thirdparty/unpoly/js/unpoly-bootstrap5.min.js b/opal/static/thirdparty/unpoly/js/unpoly-bootstrap5.min.js index 33d422047..9ee5ba6e0 100644 --- a/opal/static/thirdparty/unpoly/js/unpoly-bootstrap5.min.js +++ b/opal/static/thirdparty/unpoly/js/unpoly-bootstrap5.min.js @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:4abdef5ef458c39dd45ec0b6a43aa6bf781dbdd691483a0df071f8e4f48d3976 -size 946 +oid sha256:2299f8e966a52ba366c7cb60474e142e1f56a41dc5ad5ca2ec2d0e299b735dc0 +size 993 diff --git a/opal/static/thirdparty/unpoly/js/unpoly.min.js b/opal/static/thirdparty/unpoly/js/unpoly.min.js index 56b6764a0..0f203dd18 100644 --- a/opal/static/thirdparty/unpoly/js/unpoly.min.js +++ b/opal/static/thirdparty/unpoly/js/unpoly.min.js @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:5aa05e1a4face1be3f966a7e0bc178a81beb28298bdf175e7bd69ce9049400eb -size 174718 +oid sha256:d763ebfb4dda74298865ba0e43f1651aec4564e5bd6e067ba9bfeecf850da526 +size 179172 From aade1461bfb149888975e34c938b457571e1822d Mon Sep 17 00:00:00 2001 From: Matthias Schoettle Date: Wed, 29 Apr 2026 11:25:17 -0400 Subject: [PATCH 3/5] add source maps --- opal/static/thirdparty/copy_distribution_files.js | 2 ++ opal/static/thirdparty/unpoly/css/unpoly.min.css.map | 3 +++ opal/static/thirdparty/unpoly/js/unpoly.min.js.map | 3 +++ 3 files changed, 8 insertions(+) create mode 100644 opal/static/thirdparty/unpoly/css/unpoly.min.css.map create mode 100644 opal/static/thirdparty/unpoly/js/unpoly.min.js.map diff --git a/opal/static/thirdparty/copy_distribution_files.js b/opal/static/thirdparty/copy_distribution_files.js index 5edad5065..2ad5d69ef 100644 --- a/opal/static/thirdparty/copy_distribution_files.js +++ b/opal/static/thirdparty/copy_distribution_files.js @@ -22,8 +22,10 @@ dependencies.set('@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2', 'f dependencies.set('@fortawesome/fontawesome-free/webfonts/fa-regular-400.woff2', 'fontawesomefree/webfonts/fa-regular-400.woff2') // Unpoly dependencies.set('unpoly/unpoly.min.css', 'unpoly/css/unpoly.min.css') +dependencies.set('unpoly/unpoly.min.css.map', 'unpoly/css/unpoly.min.css.map') dependencies.set('unpoly/unpoly-bootstrap5.min.css', 'unpoly/css/unpoly-bootstrap5.min.css') dependencies.set('unpoly/unpoly.min.js', 'unpoly/js/unpoly.min.js') +dependencies.set('unpoly/unpoly.min.js.map', 'unpoly/js/unpoly.min.js.map') dependencies.set('unpoly/unpoly-bootstrap5.min.js', 'unpoly/js/unpoly-bootstrap5.min.js') const modules_directory = path.join(process.cwd(), 'node_modules') diff --git a/opal/static/thirdparty/unpoly/css/unpoly.min.css.map b/opal/static/thirdparty/unpoly/css/unpoly.min.css.map new file mode 100644 index 000000000..ffb2958a8 --- /dev/null +++ b/opal/static/thirdparty/unpoly/css/unpoly.min.css.map @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:dea24c7b0c310920ed8bedc5c548f7be0c928f162f1408f94ce59a090b7b99c4 +size 12200 diff --git a/opal/static/thirdparty/unpoly/js/unpoly.min.js.map b/opal/static/thirdparty/unpoly/js/unpoly.min.js.map new file mode 100644 index 000000000..c9f8de3c4 --- /dev/null +++ b/opal/static/thirdparty/unpoly/js/unpoly.min.js.map @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4b9386eb64abcfa27ff3efa1590682ffebcc52e17c6859b32130b9673f76e56d +size 687086 From a83727720513a39a0678e21fc8b47a34b026ebef Mon Sep 17 00:00:00 2001 From: Matthias Schoettle Date: Wed, 29 Apr 2026 11:37:01 -0400 Subject: [PATCH 4/5] block scripts in fragments --- opal/static/js/global.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/opal/static/js/global.js b/opal/static/js/global.js index eae2e1079..71f3cd9ec 100644 --- a/opal/static/js/global.js +++ b/opal/static/js/global.js @@ -7,6 +7,9 @@ See: https://getbootstrap.com/docs/5.3/components/tooltips/#enable-tooltips */ +// https://unpoly.com/script-security +up.script.config.scriptElementPolicy = 'block' + up.compiler('[data-bs-toggle="tooltip"]', (element) => { let tooltip = new bootstrap.Tooltip(element) From 3b199e286541164d960f901f3460c7bc6fa8c26e Mon Sep 17 00:00:00 2001 From: Matthias Schoettle Date: Wed, 29 Apr 2026 12:54:35 -0400 Subject: [PATCH 5/5] fix reuse problems --- .pre-commit-config.yaml | 18 +++++++++--------- REUSE.toml | 2 ++ 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index a2cbcc320..385c51101 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -2,15 +2,6 @@ # # SPDX-License-Identifier: AGPL-3.0-or-later -exclude: | - (?x)( - ^( - \.vscode/launch\.json - |manage\.py - |opal/static/thirdparty/.*/.* - ) - ) - repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v6.0.0 @@ -19,6 +10,9 @@ repos: - id: check-merge-conflict - id: check-shebang-scripts-are-executable - id: check-json + exclude: + glob: + - .vscode/launch.json - id: check-toml - id: check-yaml args: ['--unsafe'] @@ -26,6 +20,9 @@ repos: args: ['--django'] - id: double-quote-string-fixer - id: end-of-file-fixer + exclude: + glob: + - opal/static/thirdparty/**/* - id: trailing-whitespace - repo: https://github.com/abravalheri/validate-pyproject @@ -77,6 +74,9 @@ repos: rev: v1.45.1 hooks: - id: typos + exclude: + glob: + - opal/static/thirdparty/**/* # use local virtual env for flake8 and mypy to reuse the same configuration (and dependencies) - repo: local diff --git a/REUSE.toml b/REUSE.toml index c22a557b5..d082b70ae 100644 --- a/REUSE.toml +++ b/REUSE.toml @@ -101,8 +101,10 @@ SPDX-License-Identifier = "MIT" path = [ "opal/static/thirdparty/unpoly/css/unpoly-bootstrap5.min.css", "opal/static/thirdparty/unpoly/css/unpoly.min.css", + "opal/static/thirdparty/unpoly/css/unpoly.min.css.map", "opal/static/thirdparty/unpoly/js/unpoly-bootstrap5.min.js", "opal/static/thirdparty/unpoly/js/unpoly.min.js", + "opal/static/thirdparty/unpoly/js/unpoly.min.js.map", ] precedence = "override" SPDX-FileCopyrightText = "Copyright (c) 2014-2021 Henning Koch"