From 72852ac317a75baa3efffd7d2080490a636acfc2 Mon Sep 17 00:00:00 2001
From: Raul Jimenez Ortega <rjimenez@esri.com>
Date: Thu, 5 Nov 2026 10:35:28 +0100
Subject: [PATCH] chore: pin ote-events v0.8.2 instead of v0.6.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two feature releases behind. Every attribute and property the reader uses
— layout, group-events, fields-preview, fields-detail, show-past, sort,
event-actions, theme, plus events/eventActions/eventClassName/eventBadges
— is unchanged in 0.8.2, checked against the widget's source rather than
its changelog.

What the bump is actually for: dompurify 3.4.14 → 3.4.17 on the path every
feed-supplied string takes to the DOM; non-ASCII ids and URLs surviving the
render path unencoded, which matters for a reader whose feeds are Spanish;
and an http:// image on this https page falling back to the placeholder
instead of leaving a broken frame.

It does not bring the 0.5/0.6 spec fields: the widget targets OTE 0.4.0
(oteSpecVersion in its package.json), so speakers, recordings,
contributing and D032 pricing are still unrendered whatever version is
pinned. Tracked in #13.

Verified in a browser against the four registered feeds in cards, list and
calendar views: 200 upcoming events render, no console errors.

Refs #13

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CHANGELOG.md | 12 ++++++++++++
 app.js       |  2 +-
 index.html   |  2 +-
 package.json |  2 +-
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b863bdc..e2b1835 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # OTE Reader changelog
 
+## 0.10.1 - 2026-11-05
+
+### Changed
+
+- Updated the pinned `<ote-events>` build from v0.6.0 to v0.8.2. The widget
+  API the reader uses is unchanged; what it brings is a `dompurify` security
+  bump on the path every feed-supplied string takes to the DOM, non-ASCII
+  `id`s and URLs surviving the render path unencoded, and an `http://` image
+  on this `https` page falling back to the placeholder instead of leaving a
+  broken frame. Verified in a browser against the four registered feeds in
+  all three views.
+
 ## 0.10.0 - 2026-11-04
 
 ### Fixed
diff --git a/app.js b/app.js
index 69a33e7..42aea68 100644
--- a/app.js
+++ b/app.js
@@ -1,7 +1,7 @@
 (function () {
   'use strict';
 
-  var APP_VERSION = '0.10.0';
+  var APP_VERSION = '0.10.1';
   var DEMO_MODE = new URLSearchParams(location.search).get('demo') === '1' || location.pathname.replace(/\/+$/, '').endsWith('/demo');
   var STORAGE = DEMO_MODE ? 'ote-reader-demo-state-v1' : 'ote-reader-state-v1';
   var INSTALL_DISMISSED = 'ote-reader-install-dismissed-v1';
diff --git a/index.html b/index.html
index 149dc21..21d0b0d 100644
--- a/index.html
+++ b/index.html
@@ -287,7 +287,7 @@ <h3>Instalación</h3>
   </section>
 </dialog>
 
-<script type="module" src="https://tools.opentechevents.org/embed/v0.6.0/ote-events.js"></script>
+<script type="module" src="https://tools.opentechevents.org/embed/v0.8.2/ote-events.js"></script>
 <script src="app.js"></script>
 </body>
 </html>
diff --git a/package.json b/package.json
index 3f98386..a74b5f7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ote-reader",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "private": true,
   "type": "module",
   "description": "Attendee-facing PWA for subscribing to OpenTechEvents feeds.",