- SheetJS <script> now carries a sha384 integrity hash and crossorigin so a
compromised/MITM'd CDN cannot inject code.
- Adds a CSP meta: default-src 'self'; script-src limited to self +
cdn.sheetjs.com; style-src self + Google Fonts (+inline for app styles);
font-src gstatic; object-src 'none'; base-uri 'self'.
Verified headless against localhost: no CSP violations, SheetJS loads with
a valid integrity digest, app.js renders normally.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Move inline style.cssText to semantic classes (cal-legend, cal-header-cell,
cal-day-tag-label, cal-btn-row) in calendar.js
- Buttons "FT"/"BU" → "Feiertag"/"Betriebsurl." for clarity
- Decorative turntable/mixer SVG header art in index.html
- style.css build-out for the new classes
- Initial README content
- Dev port 3000 → 3001
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ferdi2goandClaude Opus 4.8