mirror of
https://github.com/ruvnet/RuView.git
synced 2026-10-23 15:13:03 -05:00
Dan Alec
8e846a9a36
Three independent fixes that each resolve a red job on main. Security floors (v2/Cargo.lock, v2/Cargo.toml) cargo audit reported 10 advisories across three transitive crates: quinn-proto 0.11.15, rustls 0.23.45 and wasmtime 36.0.16. Bump to 0.11.18 / 0.23.46 / 36.0.18. All three arrive through midstreamer-quic = 0.3, so only the lockfile enforces them; v2/Cargo.toml now records the floors so a plain `cargo update` cannot walk them back without explanation. Dashboard accessibility 18 axe failures (3 browsers x 6 views): 58 role=switch toggles with no accessible name, two unlabelled range inputs, low-contrast timestamp / chip / badge text, and two scrollable regions with no keyboard access. The welcome modal also left the accessibility tree only by fading to opacity 0. A closed state at opacity 0 still gets scanned, and axe composes the semi-transparent text over the darkened backdrop, which produced a false color-contrast failure (ratio 1.55 reported where the real ratio was ~17:1). It now leaves via visibility, and connectedCallback exposes a `ready` attribute once its async storage read settles so the smoke test stops sampling the modal mid-transition. README visual asset validation The workflow regenerates the 20 SVGs and requires byte-identical output. scripts/render-readme-visuals.py stripped unused CSS rules but left the trailing newline behind, so 14 removed rules collapsed into 16 blank lines. The producer now consumes the orphan newline and the assets are regenerated (94,576 -> 94,027 bytes). Verified locally: cargo audit 0.22.2 exits 0, cargo check --workspace --no-default-features --all-targets is clean, the README renderer is idempotent with verify passing, and the axe suite is 18/18 across chromium, firefox and webkit on six consecutive runs.