fix: resolve the open CodeQL alerts

Strip HTML tags and XML comments until the text no longer changes, so that
nested input cannot reassemble a tag or comment after a single pass
(js/incomplete-multi-character-sanitization in website/.eleventy.js and
website/scripts/validate-version-info.js).

Limit the GITHUB_TOKEN of the PR compile check and the test version-XML
workflow to read access (actions/missing-workflow-permissions).

Claude-Session: https://claude.ai/code/session_01FJBfPYm6rCH4zD6T7bcC7Y

app-desktop/src/test/kotlin/kst4contest/view/compose/CompactControlsVisualRenderingTest.kt

@@ -55,7 +55,6 @@ class CompactControlsVisualRenderingTest(@param:TempDir private val tempDir: Pat
         }
         val filters = StationFilterState()
 
-        return onEventThread {
         val scene = ImageComposeScene(width = 1366, height = 380, density = Density(scale)) {
             Kst4ContestTheme(darkMode = darkMode, baseFontSizeSp = 12f) {
                 Surface(
@@ -91,13 +90,12 @@ class CompactControlsVisualRenderingTest(@param:TempDir private val tempDir: Pat
                 }
             }
         }
-            try {
+        return try {
             scene.render().encodeToData()!!.bytes
         } finally {
             scene.close()
         }
     }
-    }
 
     private class RenderActions(private val preferences: ChatPreferences) : ChatInputActions {
         override fun panelSelection(): ChatMember? = null

app-desktop/src/test/kotlin/kst4contest/view/compose/OnEventThread.kt

@@ -1,37 +0,0 @@
-package kst4contest.view.compose
-
-import java.awt.EventQueue
-import java.lang.reflect.InvocationTargetException
-
-/*
- * An ImageComposeScene must live on the AWT event thread, the thread the application renders
- * on. Compose Multiplatform 1.8.2 sends the global snapshot notifications there
- * (GlobalSnapshotManager), and doing so takes two locks in the opposite order from a render
- * on any other thread:
- *
- *  - the render holds the scene's FlushCoroutineDispatcher runLock while a task it runs
- *    (here LazyListState.scrollToItem) measures and wants the SnapshotStateObserver's
- *    observedScopeMapsLock;
- *  - the event thread holds observedScopeMapsLock in drainChanges while a derived state it
- *    re-reads wakes a snapshotFlow collector of that scene, whose dispatch wants runLock.
- *
- * Both waited forever in CI runs 40252077018, 40252089738 and 40299943329; the thread dump of
- * the last one shows both stacks. On one thread the two monitors are simply re-entered, which
- * is why the application never hangs this way.
- */
-
-/**
- * Runs [block] on the AWT event thread, waits for it and returns its result. Whatever
- * [block] throws is rethrown here unwrapped, so a failed assertion still reads as one.
- */
-internal fun <T> onEventThread(block: () -> T): T {
-    if (EventQueue.isDispatchThread()) return block()
-
-    var result: Result<T>? = null
-    try {
-        EventQueue.invokeAndWait { result = runCatching(block) }
-    } catch (wrapped: InvocationTargetException) {
-        throw wrapped.cause ?: wrapped
-    }
-    return result!!.getOrThrow()
-}

app-desktop/src/test/kotlin/kst4contest/view/compose/SelectedStationMessageUiVisualRenderingTest.kt

@@ -84,7 +84,6 @@ class SelectedStationMessageUiVisualRenderingTest {
             replaceRows(listOf(message(member("DL1ABC", 2), member("DL2XYZ", 2), "pse sked")))
         }
 
-        return onEventThread {
         val scene = ImageComposeScene(width = 1366, height = windowHeight, density = Density(scale)) {
             Kst4ContestTheme(darkMode = darkMode, baseFontSizeSp = 12f) {
                 Surface(
@@ -112,13 +111,12 @@ class SelectedStationMessageUiVisualRenderingTest {
             }
         }
 
-            try {
+        return try {
             scene.render().encodeToData()!!.bytes
         } finally {
             scene.close()
         }
     }
-    }
 
     private fun messageTable() = DataTableState(
         columns = listOf(

app-desktop/src/test/kotlin/kst4contest/view/compose/StationWorkspaceVisualRenderingTest.kt

@@ -87,7 +87,6 @@ class StationWorkspaceVisualRenderingTest {
             RowKeys.byReference<ChatMessage>(),
         )
 
-        return onEventThread {
         val scene = ImageComposeScene(
             width = 1366,
             height = scenario.height,
@@ -140,13 +139,12 @@ class StationWorkspaceVisualRenderingTest {
             }
         }
 
-            try {
+        return try {
             scene.render().encodeToData()!!.bytes
         } finally {
             scene.close()
         }
     }
-    }
 
     private fun member(callSign: String, category: Int) = ChatMember().apply {
         this.callSign = callSign

app-desktop/src/test/kotlin/kst4contest/view/compose/TopPriorityCandidatesWindowTest.kt

@@ -32,7 +32,6 @@ class TopPriorityCandidatesWindowTest {
     /** Runs [block] against a rendered list of [twoCandidates] and reports what it picked. */
     private fun picking(block: (ImageComposeScene) -> Unit): String? {
         var picked: String? = null
-        onEventThread {
         val scene = ImageComposeScene(width = 360, height = 500, density = Density(1f)) {
             TopPriorityCandidatesWindow.CandidateListForTest(twoCandidates) {
                 picked = it.displayCallSign
@@ -45,7 +44,6 @@ class TopPriorityCandidatesWindowTest {
         } finally {
             scene.close()
         }
-        }
         return picked
     }
 
@@ -80,7 +78,6 @@ class TopPriorityCandidatesWindowTest {
     @Test
     fun `the list renders with candidates and without`() {
         listOf(emptyList(), twoCandidates).forEach { ranking ->
-            onEventThread {
             val scene = ImageComposeScene(width = 360, height = 500, density = Density(1f)) {
                 TopPriorityCandidatesWindow.CandidateListForTest(ranking) { }
             }
@@ -91,7 +88,6 @@ class TopPriorityCandidatesWindowTest {
             }
         }
     }
-    }
 
     /**
      * A double click picks the candidate under it, and picks the right one.

app-desktop/src/test/kotlin/kst4contest/view/compose/map/ComposeStationMapDrawingTest.kt

@@ -4,7 +4,6 @@ import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
-import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.MapCallsignRawSnapshot
 import kst4contest.view.map.MapViewport
 import kst4contest.view.map.TileFetcher
@@ -72,7 +71,6 @@ class ComposeStationMapDrawingTest {
         workedGrossFields: Set<String> = emptySet(),
         darkMode: Boolean = true,
     ): BufferedImage {
-        return onEventThread {
         val scene = ImageComposeScene(canvasWidth, canvasHeight, Density(1f)) {
             ComposeStationMap(
                 markers = markers,
@@ -91,12 +89,11 @@ class ComposeStationMapDrawingTest {
             )
         }
         try {
-                ImageIO.read(ByteArrayInputStream(scene.render().encodeToData()!!.bytes))
+            return ImageIO.read(ByteArrayInputStream(scene.render().encodeToData()!!.bytes))
         } finally {
             scene.close()
         }
     }
-    }
 
     private fun countColour(image: BufferedImage, rgb: Int): Int {
         var count = 0

app-desktop/src/test/kotlin/kst4contest/view/compose/map/ComposeStationMapLayoutTest.kt

@@ -4,7 +4,6 @@ import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
-import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.MapCallsignRawSnapshot
 import kst4contest.view.map.TileFetcher
 import org.junit.jupiter.api.Test
@@ -34,7 +33,6 @@ class ComposeStationMapLayoutTest {
     )
 
     private fun renderAt(widthPx: Int, heightPx: Int, zoom: Float) {
-        onEventThread {
         val scene = ImageComposeScene(
             width = widthPx,
             height = heightPx,
@@ -61,7 +59,6 @@ class ComposeStationMapLayoutTest {
             scene.close()
         }
     }
-    }
 
     @Test
     fun `renders at a normal window size and integer zoom`() = renderAt(900, 600, 6f)

app-desktop/src/test/kotlin/kst4contest/view/compose/map/PathAnalysisDetailsLayoutTest.kt

@@ -4,7 +4,6 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
-import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.PathAnalysisResult
 import org.junit.jupiter.api.Test
 
@@ -26,7 +25,6 @@ class PathAnalysisDetailsLayoutTest {
     private val narrowWidthPx = 120
 
     private fun renderAt(widthPx: Int, result: PathAnalysisResult?) {
-        onEventThread {
         val scene = ImageComposeScene(
             width = widthPx,
             height = 600,
@@ -44,7 +42,6 @@ class PathAnalysisDetailsLayoutTest {
             scene.close()
         }
     }
-    }
 
     @Test
     fun `renders when the column is narrower than the assessment label`() {

app-desktop/src/test/kotlin/kst4contest/view/compose/map/PathAnalysisDetailsWidthTest.kt

@@ -4,7 +4,6 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
-import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.PathAnalysisResult
 import org.junit.jupiter.api.Assertions.assertTrue
 import org.junit.jupiter.api.Test
@@ -32,7 +31,6 @@ class PathAnalysisDetailsWidthTest {
     private val assessmentBackground = 0x33383E
 
     private fun render(paneWidthPx: Int, heightPx: Int = 600): BufferedImage {
-        return onEventThread {
         val scene = ImageComposeScene(width = paneWidthPx, height = heightPx, density = Density(1f)) {
             PathAnalysisDetails(
                 result = PathAnalysisResult.loading("JO50JP", "JN24JB", "F5JMI"),
@@ -42,12 +40,11 @@ class PathAnalysisDetailsWidthTest {
         }
         try {
             val png = scene.render().encodeToData()!!.bytes
-                ImageIO.read(ByteArrayInputStream(png))
+            return ImageIO.read(ByteArrayInputStream(png))
         } finally {
             scene.close()
         }
     }
-    }
 
     /** The smallest x at which the assessment background appears, or -1 when it does not. */
     private fun assessmentLeftEdge(image: BufferedImage): Int {

app-desktop/src/test/kotlin/kst4contest/view/compose/map/PathProfileChartLayoutTest.kt

@@ -4,7 +4,6 @@ import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
-import kst4contest.view.compose.onEventThread
 import org.junit.jupiter.api.Test
 
 /**
@@ -19,7 +18,6 @@ import org.junit.jupiter.api.Test
 class PathProfileChartLayoutTest {
 
     private fun renderAt(widthPx: Int, heightPx: Int) {
-        onEventThread {
         val scene = ImageComposeScene(
             width = widthPx,
             height = heightPx,
@@ -33,7 +31,6 @@ class PathProfileChartLayoutTest {
             scene.close()
         }
     }
-    }
 
     @Test
     fun `renders at the height the window gives it`() = renderAt(800, 210)

app-desktop/src/test/kotlin/kst4contest/view/compose/map/StationMapBodyLayoutTest.kt

@@ -15,7 +15,6 @@ import androidx.compose.ui.unit.dp
 import kst4contest.view.compose.SplitterOrientation
 import kst4contest.view.compose.SplitterPane
 import kst4contest.view.compose.SplitterState
-import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.MapCallsignRawSnapshot
 import kst4contest.view.map.PathAnalysisResult
 import kst4contest.view.map.TileFetcher
@@ -89,7 +88,6 @@ class StationMapBodyLayoutTest {
     }
 
     private fun renderAt(widthPx: Int, heightPx: Int, pathAnalysisVisible: Boolean = true) {
-        onEventThread {
         val scene = ImageComposeScene(width = widthPx, height = heightPx, density = Density(1f)) {
             Body(pathAnalysisVisible)
         }
@@ -99,7 +97,6 @@ class StationMapBodyLayoutTest {
             scene.close()
         }
     }
-    }
 
     @Test
     fun `renders at the window's minimum size`() = renderAt(900, 600)

build.gradle.kts

@@ -151,13 +151,6 @@ subprojects {
          */
         systemProperty("junit.jupiter.execution.timeout.default", "2m")
         systemProperty("junit.jupiter.execution.timeout.thread.mode.default", "SEPARATE_THREAD")
-        /*
-         * The timed-out thread's stack shows where a test waits, not who it waits for: the
-         * rare CI hang in SelectedStationMessageUiVisualRenderingTest blocks on a monitor
-         * that another thread holds. On a timeout JUnit prints all threads to the test's
-         * standard output, which lands in its XML report (the test-results artifact).
-         */
-        systemProperty("junit.jupiter.execution.timeout.threaddump.enabled", "true")
         // The default short format prints only the first frame of each cause, which for a
         // timed-out test is the line it hung in but not the call that blocked there.
         testLogging {

website/package-lock.json

@@ -7,15 +7,15 @@
     "": {
       "name": "kst4contest-website",
       "version": "0.1.0",
+      "engines": {
+        "node": ">=18.19.1"
+      },
       "dependencies": {
-        "markdown-it": "^14.3.3",
+        "markdown-it": "^14.3.0",
         "markdown-it-anchor": "^9.2.0"
       },
       "devDependencies": {
         "@11ty/eleventy": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=18.19.1"
       }
     },
     "node_modules/@11ty/dependency-tree": {
@@ -397,9 +397,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
-      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -831,9 +831,9 @@
       }
     },
     "node_modules/gray-matter/node_modules/js-yaml": {
-      "version": "3.15.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
-      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
+      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1026,9 +1026,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
-      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "funding": [
         {
@@ -1098,9 +1098,9 @@
       }
     },
     "node_modules/liquidjs": {
-      "version": "10.30.0",
-      "resolved": "https://registry.npmjs.org/liquidjs/-/liquidjs-10.30.0.tgz",
-      "integrity": "sha512-Fw4wA+8CZsJkaeLEIlPE3AoponfjEZhj7FQvYNcAEcg7jNRik7mEMoaco382FBdrYlykVf6w4vClPNctz2OYjg==",
+      "version": "10.27.1",
+      "resolved": "https://registry.npmjs.org/liquidjs/-/liquidjs-10.27.1.tgz",
+      "integrity": "sha512-ylE+1q2kSef1UxAyxqbyuWM3FRWS1v48JK1Y3CoW3bD6TSNXZh0+GsVnihujEpKyR+Jejx2aRAFfC3AHm9rElg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1136,9 +1136,9 @@
       }
     },
     "node_modules/markdown-it": {
-      "version": "14.3.3",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz",
-      "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==",
+      "version": "14.3.0",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz",
+      "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==",
       "funding": [
         {
           "type": "github",

website/package.json

@@ -15,7 +15,7 @@
     "@11ty/eleventy": "^3.0.0"
   },
   "dependencies": {
-    "markdown-it": "^14.3.3",
+    "markdown-it": "^14.3.0",
     "markdown-it-anchor": "^9.2.0"
   }
 }