From c3fd4874bc6bebcaf1a0289b087a223f6121ce1e Mon Sep 17 00:00:00 2001
From: Mark Eaton <1825+markeeaton@noreply.tildegit.org>
Date: Wed, 10 Jun 2026 16:56:18 +0000
Subject: [PATCH 01/13] switch source for Vue scripts so that they can be
 checked by renovate

---
 groups/home/bootstrap5/home1.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/groups/home/bootstrap5/home1.html b/groups/home/bootstrap5/home1.html
index 555691f..dcc0084 100644
--- a/groups/home/bootstrap5/home1.html
+++ b/groups/home/bootstrap5/home1.html
@@ -395,8 +395,8 @@
   <script src="https://kbcc-cuny.libanswers.com/load_chat.php?hash=f7d1629a91e178fd0f799322e803b6e7"></script>
 
   <!-- add Vue scripts -->
-  <!-- <script src="https://unpkg.com/vue@3/dist/vue.global.js"></script> development -->
-  <script src="https://unpkg.com/vue/dist/vue.global.prod.js"></script><!-- production -->
+  <!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.22/vue.global.js"></script> development script-->
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.22/vue.global.prod.js"></script> <!-- production script -->
   <script
     type="text/javascript"
     src="https://libapps.s3.amazonaws.com/sites/2365/include/home1.js"
-- 
2.40.1


From a54a6fe2de811fd2dcc9859fd71681ff2e9a2b94 Mon Sep 17 00:00:00 2001
From: Mark Eaton <MarkEEaton@users.noreply.github.com>
Date: Sat, 13 Jun 2026 23:45:57 -0400
Subject: [PATCH 02/13] Wrap CMS content box in v-pre to block Vue template
 injection

---
 groups/home/bootstrap5/home1.html | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/groups/home/bootstrap5/home1.html b/groups/home/bootstrap5/home1.html
index dcc0084..e487268 100644
--- a/groups/home/bootstrap5/home1.html
+++ b/groups/home/bootstrap5/home1.html
@@ -84,7 +84,10 @@
               data-light-src="https://libapps.s3.amazonaws.com/accounts/16298/images/xsmall-2.jpg"
               data-dark-src="https://d2jv02qf7xgjwx.cloudfront.net/accounts/16298/images/Kibbee_library_logo_inverted2.jpg"
             />
-            {{content_box_33471502}}
+            <!-- v-pre: LibGuides injects this content box server-side; this element sits
+                 inside the #app1 Vue root, so v-pre stops Vue from compiling the box's
+                 HTML as a template (prevents client-side template injection). -->
+            <div v-pre>{{content_box_33471502}}</div>
           </div>
           <!-- end of header div -->
         </div>
-- 
2.40.1


From a3512decace7ee27e8fe86ae89c47c35b7cc7de0 Mon Sep 17 00:00:00 2001
From: Mark Eaton <MarkEEaton@users.noreply.github.com>
Date: Sat, 13 Jun 2026 23:51:18 -0400
Subject: [PATCH 03/13] Add SRI hash and crossorigin to cdnjs Vue script

---
 groups/home/bootstrap5/home1.html | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/groups/home/bootstrap5/home1.html b/groups/home/bootstrap5/home1.html
index e487268..3c4fe9e 100644
--- a/groups/home/bootstrap5/home1.html
+++ b/groups/home/bootstrap5/home1.html
@@ -399,7 +399,12 @@
 
   <!-- add Vue scripts -->
   <!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.22/vue.global.js"></script> development script-->
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.22/vue.global.prod.js"></script> <!-- production script -->
+  <!-- production: SRI hash so a tampered/changed file won't execute; Renovate bumps version + hash together -->
+  <script
+    src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.22/vue.global.prod.js"
+    integrity="sha384-8b+88atXoPL4ijtVqe+2pA+PC8VNYSGqubRseMLV0qxfa5GMHeftEEHvk4eM4RFT"
+    crossorigin="anonymous"
+  ></script>
   <script
     type="text/javascript"
     src="https://libapps.s3.amazonaws.com/sites/2365/include/home1.js"
-- 
2.40.1


From 8d8351f5a1f6bbd0f174f6dd07d4ec3576adb262 Mon Sep 17 00:00:00 2001
From: Mark Eaton <MarkEEaton@users.noreply.github.com>
Date: Sun, 14 Jun 2026 00:09:10 -0400
Subject: [PATCH 04/13] Add rel=noopener noreferrer to target=_blank links

---
 groups/home/bootstrap5/home1.html | 10 ++++++++++
 groups/home/bootstrap5/home1.js   |  1 +
 2 files changed, 11 insertions(+)

diff --git a/groups/home/bootstrap5/home1.html b/groups/home/bootstrap5/home1.html
index 3c4fe9e..bce9770 100644
--- a/groups/home/bootstrap5/home1.html
+++ b/groups/home/bootstrap5/home1.html
@@ -61,6 +61,7 @@
                     v-bind:aria-label="item.description + (item.target_blank ? ' (opens in new tab)' : '')"
                     v-bind:href="item.link"
                     v-bind:target="item.target_blank"
+                    v-bind:rel="item.target_blank ? 'noopener noreferrer' : null"
                   >
                     <hamburger-component v-bind:item="item"></hamburger-component>
                   </a>
@@ -209,6 +210,7 @@
                       <a
                         href="http://kbcc.ezproxy.cuny.edu/login?url=https://search.ebscohost.com/login.aspx?authtype=ip,uid&custid=s9000138&profile=ehost&defaultdb=a9h"
                         target="_blank"
+                        rel="noopener noreferrer"
                         class="ga-library-links"
                         aria-label="Academic Search Complete (opens in new tab)"
                       >
@@ -220,6 +222,7 @@
                       <a
                         href="http://kbcc.ezproxy.cuny.edu/login?url=https://search.proquest.com/usmajordailies/advanced/news/fromDatabasesLayer?accountid=38336"
                         target="_blank"
+                        rel="noopener noreferrer"
                         class="ga-library-links"
                         aria-label="US Newspapers (opens in new tab)"
                       >
@@ -231,6 +234,7 @@
                       <a
                         href="http://www.nytimes.com/passes"
                         target="_blank"
+                        rel="noopener noreferrer"
                         class="ga-library-links"
                         aria-label="NY Times Free Pass (opens in new tab)"
                       >
@@ -290,6 +294,7 @@
                 aria-label="Instagram (opens in new tab)"
                 href="https://www.instagram.com/kbcclibrary/"
                 target="_blank"
+                rel="noopener noreferrer"
               >
                 <i aria-hidden="true" class="fab fa-instagram"></i>
               </a>
@@ -297,6 +302,7 @@
                 aria-label="Goodreads (opens in new tab)"
                 href="https://www.goodreads.com/user/show/51717966-kingsborough-library"
                 target="_blank"
+                rel="noopener noreferrer"
               >
                 <i aria-hidden="true" class="fab fa-goodreads"></i>
               </a>
@@ -304,6 +310,7 @@
                 aria-label="TikTok (opens in new tab)"
                 href="https://www.tiktok.com/@kbcclibrary?lang=en"
                 target="_blank"
+                rel="noopener noreferrer"
               >
                 <i aria-hidden="true" class="fab fa-tiktok"></i>
               </a>
@@ -311,6 +318,7 @@
                 aria-label="YouTube (opens in new tab)"
                 href="https://www.youtube.com/channel/UCpeJWrnzLXEizw8cMvVp-_Q/videos"
                 target="_blank"
+                rel="noopener noreferrer"
               >
                 <i aria-hidden="true" class="fab fa-youtube"></i>
               </a>
@@ -318,6 +326,7 @@
                 aria-label="Spotify (opens in new tab)"
                 href="https://open.spotify.com/user/313lfmvr4ezmkb2mhodzd5ubzg4a"
                 target="_blank"
+                rel="noopener noreferrer"
               >
                 <i aria-hidden="true" class="fab fa-spotify"></i>
               </a>
@@ -327,6 +336,7 @@
             <a
               href="https://www.cuny.edu"
               target="_blank"
+              rel="noopener noreferrer"
               aria-label="CUNY (opens in new tab)"
             >
               <img
diff --git a/groups/home/bootstrap5/home1.js b/groups/home/bootstrap5/home1.js
index 4b1b62c..8012bb9 100644
--- a/groups/home/bootstrap5/home1.js
+++ b/groups/home/bootstrap5/home1.js
@@ -81,6 +81,7 @@ const navigComponent = {
                  v-bind:aria-label="item.description + (item.target_blank ? ' (opens in new tab)' : '')"
                  v-bind:href="item.link"
                  v-bind:target="item.target_blank"
+                 v-bind:rel="item.target_blank ? 'noopener noreferrer' : null"
               >
                 <div class="bigger-fancy-text">
                   <i v-bind:class="item.icon" aria-hidden="true"></i>
-- 
2.40.1


From 6105e7551c0652fa51945239e57759b13919c582 Mon Sep 17 00:00:00 2001
From: Mark Eaton <MarkEEaton@users.noreply.github.com>
Date: Sun, 14 Jun 2026 00:15:49 -0400
Subject: [PATCH 05/13] Use https for ezproxy and nytimes links

---
 groups/home/bootstrap5/home1.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/groups/home/bootstrap5/home1.html b/groups/home/bootstrap5/home1.html
index bce9770..a734de3 100644
--- a/groups/home/bootstrap5/home1.html
+++ b/groups/home/bootstrap5/home1.html
@@ -208,7 +208,7 @@
                   <ul class="link-list">
                     <li>
                       <a
-                        href="http://kbcc.ezproxy.cuny.edu/login?url=https://search.ebscohost.com/login.aspx?authtype=ip,uid&custid=s9000138&profile=ehost&defaultdb=a9h"
+                        href="https://kbcc.ezproxy.cuny.edu/login?url=https://search.ebscohost.com/login.aspx?authtype=ip,uid&custid=s9000138&profile=ehost&defaultdb=a9h"
                         target="_blank"
                         rel="noopener noreferrer"
                         class="ga-library-links"
@@ -220,7 +220,7 @@
                     </li>
                     <li>
                       <a
-                        href="http://kbcc.ezproxy.cuny.edu/login?url=https://search.proquest.com/usmajordailies/advanced/news/fromDatabasesLayer?accountid=38336"
+                        href="https://kbcc.ezproxy.cuny.edu/login?url=https://search.proquest.com/usmajordailies/advanced/news/fromDatabasesLayer?accountid=38336"
                         target="_blank"
                         rel="noopener noreferrer"
                         class="ga-library-links"
@@ -232,7 +232,7 @@
                     </li>
                     <li>
                       <a
-                        href="http://www.nytimes.com/passes"
+                        href="https://www.nytimes.com/passes"
                         target="_blank"
                         rel="noopener noreferrer"
                         class="ga-library-links"
-- 
2.40.1


From 68d669166a7abee98394b67b0b6ec0a0fde4fde7 Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Fri, 26 Jun 2026 21:09:32 -0400
Subject: [PATCH 06/13] Update dependency prettier to v3.8.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 151b182..b337272 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,6 @@
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-vue": "^10.0.0",
     "globals": "^17.3.0",
-    "prettier": "3.8.4"
+    "prettier": "3.8.5"
   }
 }
-- 
2.40.1


From 33afa575b28919b51eb1b7664581c052a2533baf Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Sat, 27 Jun 2026 16:37:18 -0400
Subject: [PATCH 07/13] Update dependency prettier to v3.9.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b337272..7150a2f 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,6 @@
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-vue": "^10.0.0",
     "globals": "^17.3.0",
-    "prettier": "3.8.5"
+    "prettier": "3.9.0"
   }
 }
-- 
2.40.1


From 0f0db332d24c8b6083a9046242b0f49ea4382663 Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Sun, 28 Jun 2026 00:00:11 -0400
Subject: [PATCH 08/13] Update dependency prettier to v3.9.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7150a2f..c9bc84d 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,6 @@
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-vue": "^10.0.0",
     "globals": "^17.3.0",
-    "prettier": "3.9.0"
+    "prettier": "3.9.1"
   }
 }
-- 
2.40.1


From bc863fbd3c65476b96bbfcfaa2328c8ee6fe5c61 Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Sun, 28 Jun 2026 18:41:37 -0400
Subject: [PATCH 09/13] Update dependency vue to v3.5.39

---
 groups/home/bootstrap5/home1.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/groups/home/bootstrap5/home1.html b/groups/home/bootstrap5/home1.html
index a734de3..b1012ac 100644
--- a/groups/home/bootstrap5/home1.html
+++ b/groups/home/bootstrap5/home1.html
@@ -408,11 +408,11 @@
   <script src="https://kbcc-cuny.libanswers.com/load_chat.php?hash=f7d1629a91e178fd0f799322e803b6e7"></script>
 
   <!-- add Vue scripts -->
-  <!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.22/vue.global.js"></script> development script-->
+  <!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.39/vue.global.js"></script> development script-->
   <!-- production: SRI hash so a tampered/changed file won't execute; Renovate bumps version + hash together -->
   <script
-    src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.22/vue.global.prod.js"
-    integrity="sha384-8b+88atXoPL4ijtVqe+2pA+PC8VNYSGqubRseMLV0qxfa5GMHeftEEHvk4eM4RFT"
+    src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.39/vue.global.prod.js"
+    integrity="sha512-NYZnkTaHT7T7wdMh75aoOtsZgppz/bLLEtHLGmdmAjir8DBrmM5xWaqx7zmcN6ADBGcWbB5ullPznC6LJj9hlg=="
     crossorigin="anonymous"
   ></script>
   <script
-- 
2.40.1


From 50a6b23c72d09b240111ced07da7baf36aa6ddd1 Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Tue, 30 Jun 2026 18:08:06 -0400
Subject: [PATCH 10/13] Update dependency prettier to v3.9.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c9bc84d..61099d0 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,6 @@
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-vue": "^10.0.0",
     "globals": "^17.3.0",
-    "prettier": "3.9.1"
+    "prettier": "3.9.4"
   }
 }
-- 
2.40.1


From 1ab6d61af5ff632d5d448a76d4ee87876585595e Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Thu, 9 Jul 2026 12:18:25 -0400
Subject: [PATCH 11/13] Update dependency prettier to v3.9.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 61099d0..bee16d0 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,6 @@
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-vue": "^10.0.0",
     "globals": "^17.3.0",
-    "prettier": "3.9.4"
+    "prettier": "3.9.5"
   }
 }
-- 
2.40.1


From 5ca7d2d9170c47256b5516674cb22c3a64c46094 Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Tue, 21 Jul 2026 08:55:53 -0400
Subject: [PATCH 12/13] Update dependency prettier to v3.9.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index bee16d0..42c7c48 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,6 @@
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-vue": "^10.0.0",
     "globals": "^17.3.0",
-    "prettier": "3.9.5"
+    "prettier": "3.9.6"
   }
 }
-- 
2.40.1


From a0ea867276759b1e0135ffba03d6c8cdf6c7c0ea Mon Sep 17 00:00:00 2001
From: Renovate Bot <b7jl@sdf.org>
Date: Sat, 8 Aug 2026 19:47:48 -0400
Subject: [PATCH 13/13] Update dependency vue to v3.5.41

---
 groups/home/bootstrap5/home1.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/groups/home/bootstrap5/home1.html b/groups/home/bootstrap5/home1.html
index b1012ac..53fc90a 100644
--- a/groups/home/bootstrap5/home1.html
+++ b/groups/home/bootstrap5/home1.html
@@ -408,11 +408,11 @@
   <script src="https://kbcc-cuny.libanswers.com/load_chat.php?hash=f7d1629a91e178fd0f799322e803b6e7"></script>
 
   <!-- add Vue scripts -->
-  <!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.39/vue.global.js"></script> development script-->
+  <!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.41/vue.global.js"></script> development script-->
   <!-- production: SRI hash so a tampered/changed file won't execute; Renovate bumps version + hash together -->
   <script
-    src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.39/vue.global.prod.js"
-    integrity="sha512-NYZnkTaHT7T7wdMh75aoOtsZgppz/bLLEtHLGmdmAjir8DBrmM5xWaqx7zmcN6ADBGcWbB5ullPznC6LJj9hlg=="
+    src="https://cdnjs.cloudflare.com/ajax/libs/vue/3.5.41/vue.global.prod.js"
+    integrity="sha512-wVJFMtjV/zJhYFxXU3yfljFSqVvz+ukCqeVPplFyRr2opuk1qiADdXs+QmuwrI/r1ipyumss3exbm218HBNA9A=="
     crossorigin="anonymous"
   ></script>
   <script
-- 
2.40.1