From 453628f0ed5f56ef070cdacfe58f1d87e1e9e575 Mon Sep 17 00:00:00 2001 From: Leon Krix Date: Thu, 29 Oct 2026 00:54:47 +0100 Subject: [PATCH] chore: update layout-guard and privacy-guard to version 0.4.0, enhance descriptions and functionality --- package.json | 4 ++-- pnpm-lock.yaml | 22 +++++++++++--------- pnpm-workspace.yaml | 9 ++++---- src/content/notes/how-this-site-is-built.mdx | 4 ++-- src/content/projects/layout-guard.yaml | 8 +++---- src/content/projects/privacy-guard.yaml | 8 +++---- src/content/projects/website.yaml | 9 ++++---- 7 files changed, 33 insertions(+), 31 deletions(-) diff --git a/package.json b/package.json index 510dc75..3173403 100644 --- a/package.json +++ b/package.json @@ -59,8 +59,8 @@ "husky": "^9.1.7", "lighthouse": "^13.5.0", "lint-staged": "^17.6.0", - "playwright-layout-guard": "0.3.0", - "playwright-privacy-guard": "0.3.0", + "playwright-layout-guard": "0.4.0", + "playwright-privacy-guard": "0.4.0", "prettier": "^3.9.10", "prettier-plugin-astro": "^1.1.2", "prettier-plugin-tailwindcss": "^0.8.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7e7ca6e..dc4fb71 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -267,11 +267,11 @@ importers: specifier: ^17.6.0 version: 17.6.0 playwright-layout-guard: - specifier: 0.3.0 - version: 0.3.0(@playwright/test@1.64.1) + specifier: 0.4.0 + version: 0.4.0(@playwright/test@1.64.1) playwright-privacy-guard: - specifier: 0.3.0 - version: 0.3.0(@playwright/test@1.64.1) + specifier: 0.4.0 + version: 0.4.0(@playwright/test@1.64.1) prettier: specifier: ^3.9.10 version: 3.9.10 @@ -3266,15 +3266,17 @@ packages: engines: {node: '>=20'} hasBin: true - playwright-layout-guard@0.3.0: - resolution: {integrity: sha512-sg+0xZ9Pp5EHi7LYabSZOPfn8klL7sDLaNh4pt7rvLvi4ssBLb746PppZRga2/a3TFWghEOIt50SDmzQX5Nemw==} + playwright-layout-guard@0.4.0: + resolution: {integrity: sha512-xGzaXPzOay80Qj7d4zJPBs1wfxZbL8zY7sf7K/CKU5XdLr1PAWX0BtaXbLmledJWOy2RGHlFUbmRV6mem16roA==} engines: {node: '>=20.19.0'} + hasBin: true peerDependencies: '@playwright/test': '>=1.45.0' - playwright-privacy-guard@0.3.0: - resolution: {integrity: sha512-2dG0A4ku7gw7SMULoY36aC3c+tL37F0eSWmZAGMfBleu9F8oG+U1cEMjKl4LzleMdEaK3zMDq3LYKio/gcsVyw==} + playwright-privacy-guard@0.4.0: + resolution: {integrity: sha512-1E7qPlGwfgUoFKjZ687FrdN4mtX3fjdf/rNZ6HwZc8nEsCQXS6TbNvNzDJRKk2VGyXEIL1Y+3EjAqopOFXjT5Q==} engines: {node: '>=20.19.0'} + hasBin: true peerDependencies: '@playwright/test': '>=1.45.0' @@ -7295,11 +7297,11 @@ snapshots: playwright-core@1.64.1: {} - playwright-layout-guard@0.3.0(@playwright/test@1.64.1): + playwright-layout-guard@0.4.0(@playwright/test@1.64.1): dependencies: '@playwright/test': 1.64.1 - playwright-privacy-guard@0.3.0(@playwright/test@1.64.1): + playwright-privacy-guard@0.4.0(@playwright/test@1.64.1): dependencies: '@playwright/test': 1.64.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 8904430..6c5c692 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,11 +1,12 @@ allowBuilds: esbuild: true workerd: true -# pnpm does not install a version that is younger than its minimum release age. playwright-privacy-guard -# is my own package and 0.3.0 was published on 2026-10-28: delete this entry once pnpm installs it -# without it (a few days after the release). +# pnpm does not install a version that is younger than its minimum release age. playwright-layout-guard +# and playwright-privacy-guard are my own packages and 0.4.0 of both was published on 2026-10-29: +# delete these entries once pnpm installs them without (a few days after the release). minimumReleaseAgeExclude: - - playwright-privacy-guard@0.3.0 + - playwright-layout-guard@0.4.0 + - playwright-privacy-guard@0.4.0 # miniflare (inside wrangler) pins undici 7.29.1 exactly, and 7.29.1 has known denial of service # findings (patched in 7.30.1; found by pnpm audit on 2026-10-24). Written as a range of the bad # versions, so it does nothing once miniflare asks for a patched version itself: then delete it. diff --git a/src/content/notes/how-this-site-is-built.mdx b/src/content/notes/how-this-site-is-built.mdx index c57200c..a0b246a 100644 --- a/src/content/notes/how-this-site-is-built.mdx +++ b/src/content/notes/how-this-site-is-built.mdx @@ -5,7 +5,7 @@ tag: 'Site ยท Overview' code: .github/workflows group: site order: 1 -updated: '2026-10-28' +updated: '2026-10-29' --- import ExternalLink from '@/components/ExternalLink.astro'; @@ -18,7 +18,7 @@ The shape is simple. The site is **static**: it is built once, and the result is `, lists what moved next to the browser's own score, saves a picture of the moved boxes and ends with an exit code for a pipeline. + - Released like a product, with semantic versioning, a changelog, CI on three browsers including the oldest supported Playwright, and publishing from GitHub Actions with npm provenance that only goes live when I approve it with two-factor authentication. technologies: [typescript, playwright, vitest, cicd, npm, git, eslint, prettier] code: status: public diff --git a/src/content/projects/privacy-guard.yaml b/src/content/projects/privacy-guard.yaml index 727f304..1fe07e1 100644 --- a/src/content/projects/privacy-guard.yaml +++ b/src/content/projects/privacy-guard.yaml @@ -11,10 +11,10 @@ stats: - value: '0' label: runtime dependencies highlights: - - Any request to another origin, cookie, entry in the storage of the device, violation of the content security policy or error on the page fails the test. The message names the host, the cookie or the script, says which company is behind it, and ends with the exact setting that would allow it if it is meant. - - Extracted from the browser tests of this site, which promise no cookies, nothing stored and no other origin. It replaced the hand-written privacy and error tests there, and now watches every one of the browser tests instead of one loop over the pages. Canary tests make a page misbehave on purpose and expect the guard to fail them. - - Goes beyond a privacy test. It also rates security headers and the content security policy, finds scripts without an integrity attribute, forms that send elsewhere, sensitive browser APIs, canvas and audio fingerprinting, and values that must not leave. Results come as a readable message, an HTML and JSON report per test, a report for the whole run and a baseline for projects that leak today. Everything a test allowed on purpose is listed with its reason, so an exception cannot hide. - - Released like a product, with semantic versioning and a changelog from changesets, CI on three browsers and three Node versions including the oldest supported Playwright, which found a bug that the newest one hides, and publishing from GitHub Actions with npm provenance. A release is staged and only goes live when I approve it with two-factor authentication. + - Fails a test on a request to another origin, a cookie, anything stored on the device, a policy violation or an error on the page. The message names the host, the cookie or the script, the company behind it, and the setting that would allow it if it is meant. + - Extracted from the browser tests of this site, where it now watches every test. Canary tests make a page misbehave on purpose, and everything a test allows is listed with its reason. + - Tried on 29 public pages in three browsers next to a record that Playwright keeps without the package. Nothing the browser did was missing from the report, and the four faults the trial found are fixed. The same scan runs without a test as `npx playwright-privacy-guard scan
`. + - Released like a product, with semantic versioning, a changelog, CI on three browsers including the oldest supported Playwright, and publishing from GitHub Actions with npm provenance that only goes live when I approve it with two-factor authentication. technologies: [typescript, playwright, vitest, cicd, npm, git, eslint, prettier] code: status: public diff --git a/src/content/projects/website.yaml b/src/content/projects/website.yaml index a435dde..12f7e19 100644 --- a/src/content/projects/website.yaml +++ b/src/content/projects/website.yaml @@ -8,13 +8,12 @@ stats: label: security headers grade (securityheaders.com) - value: '95+' label: Lighthouse score in every category (mobile, enforced in CI) - - value: '2,900+' + - value: '3,000+' label: automated tests (unit, build output, browser, accessibility) highlights: - - Static portfolio built with Astro, TypeScript, React islands and Tailwind CSS, hosted on Cloudflare, with a command palette (Ctrl K) and a small terminal that load only when they are opened. Its content is typed YAML that is validated at build time, so a typo fails the build instead of shipping. - - Every change goes through a pull request and automated gates before it goes live, from linting, type checks and unit tests to build-output checks (security headers, CSP, legal pages), end-to-end tests with accessibility scans and two guards (my own open source packages) in every test, one that fails when anything on any page moves or changes size and one that fails when a page talks to another origin, sets a cookie or stores anything, Lighthouse budgets, CodeQL, dependency review and OpenSSF Scorecard. After the deployment a live check of the published site (headers, redirects, legal pages, contact form, certificate, domain, mail DNS) runs every few hours, plus a weekly link check. - - A contact form without any third-party service. A Cloudflare Function validates the message with the same rules as the browser, checks origin, a signed time token, a honeypot and a rate limit, and hands it to my own mailbox over SMTP. - - Privacy and security by design with a strict content security policy, HSTS, no cookies of its own, self-hosted fonts and obfuscated contact data. + - Static portfolio built with Astro, TypeScript, React islands and Tailwind CSS on Cloudflare, with a command palette (Ctrl K) and a small terminal that load only when they are opened. Its content is typed YAML that is validated at build time, so a typo fails the build instead of shipping. + - Every change goes through a pull request and automated gates before it goes live, from linting, type checks, unit, build-output and end-to-end tests with accessibility scans, Lighthouse budgets, CodeQL and dependency review. Two of my own open source packages guard every browser test, one against anything that moves and one against leaks to other origins. A live check of the published site runs every few hours. + - A contact form without any third-party service. A Cloudflare Function validates the message, checks a signed time token, a honeypot and a rate limit, and hands it to my own mailbox. Strict content security policy, HSTS, no cookies of its own and self-hosted fonts. - Five browser games in the [Playground](/#playground) further down this page, written as tested pure functions, playable with the keyboard, with nothing stored on your device. How they and this site are built is written up in [Behind the scenes](/notes/). technologies: [