32 lines
1.8 KiB
Plaintext
32 lines
1.8 KiB
Plaintext
Caterium v17.6.0 - Stability & Security
|
|
Date: 2026-09-07
|
|
Rollback baseline: v17.5.31
|
|
|
|
Security
|
|
- Closed the old bootstrap stored DOM-XSS path with shared SunSafe escaping/attribute helpers.
|
|
- Consolidated repeated esc() implementations onto one shared utility.
|
|
- Added safe DOM insertion helper for dynamic navigation/settings nodes.
|
|
- Restored the deployed caterium-create-employee Edge Function source to the project; secrets remain environment-only.
|
|
|
|
Stability
|
|
- Moved the oldest bootstrap business script out of index.html into legacy/bootstrap.js.
|
|
- Centralized PDF byte packaging in core/pdf-engine.js with one A4 geometry validator.
|
|
- Added static security and release checks plus Playwright E2E specifications and CI workflow.
|
|
- Preserved v17.5.31 as a separate rollback archive.
|
|
|
|
Performance
|
|
- Removed blocking offer-gallery-data.js Base64 payload.
|
|
- Removed unused offer-gallery/003.jpg through 010.jpg; retained the two images actually used.
|
|
- Added image lazy-loading/async decoding helper for noncritical images.
|
|
- Added targeted mobile overflow containment for category/view/settings strips.
|
|
|
|
PDF QA
|
|
- Offer templates light, editorial-grid, midnight-glass, emerald-gold generated as real PDF blobs and rendered back to images.
|
|
- Catalog PDF generated as A4 pages and rendered back to images.
|
|
- All generated pages opened successfully in PyMuPDF and use consistent A4 geometry.
|
|
- Browser print/PDF CSS rules remain explicitly A4 portrait/landscape according to document type.
|
|
|
|
Known technical debt
|
|
- PDF pages remain image-based, so text is not selectable/searchable. The two former binary writers are now one audited engine, but a later migration to a vendored library/vector-text PDF pipeline is still desirable.
|
|
- index.html/app-runtime.js still contain historical modules and should be split further in a future architecture release.
|