diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-04-18 13:09:09 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-04-18 13:09:09 +0300 |
| commit | eef784ac6a72a8223fe094f79c72d58d8d91a4d0 (patch) | |
| tree | 6e276b20bcf675fe6b170a2a3fc1ecc12599a1ac /plugins | |
| parent | 3f4cea474e488dfbe892e833deace49b4c8be513 (diff) | |
| download | community.vyos.net-eef784ac6a72a8223fe094f79c72d58d8d91a4d0.tar.gz community.vyos.net-eef784ac6a72a8223fe094f79c72d58d8d91a4d0.zip | |
Address Copilot review: preconnect order + staging-gate cookies-policy script
Two fixes flagged by the Copilot reviewer on #35:
1. Preconnect hints were appended to the end of <head> while the GTM
loader is prepended to the top, so GTM's async script creation
fired before the browser ever saw the preconnect tags — they
provided no benefit. Switches insert-preconnect-hints to
prepend_child and adds `after = "insert-google-tag-manager-head"`
so the widget runs after GTM and its prepend pushes GTM down to
position 1. Result: preconnects land at the top of <head>, ahead
of the GTM loader.
2. The Cookiebot cd.js script embedded directly in
site/legal/cookies-policy.md rendered on every profile, so a
staging visitor who hit /legal/cookies-policy/ would leak their
IP to consent.cookiebot.com. Replaces the inline <script> with a
<div id="cookie-declaration-placeholder"></div> and adds a new
insert-cookiebot-declaration widget (profile = "live", page =
"legal/cookies-policy.md") that replaces the placeholder with
the real script element only on live builds. Staging now emits
zero Cookiebot markup on the cookies-policy page.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Diffstat (limited to 'plugins')
0 files changed, 0 insertions, 0 deletions