From 2571c52ac1f9b4b73e553708bf9e10bfceba679a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:39:39 +0000
Subject: [PATCH 1/3] chore(npm): bump axe-core from 4.13.0 to 4.14.0

Bumps [axe-core](https://github.com/dequelabs/axe-core) from 4.13.0 to 4.14.0.
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/dequelabs/axe-core/compare/v4.13.0...v4.14.0)

---
updated-dependencies:
- dependency-name: axe-core
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4bad6d78..3a11c378 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,7 +6,7 @@
     "": {
       "devDependencies": {
         "@tailwindcss/cli": "^4.3.3",
-        "axe-core": "^4.13.0",
+        "axe-core": "^4.14.0",
         "tailwindcss": "^4.3.3"
       }
     },
@@ -742,9 +742,9 @@
       }
     },
     "node_modules/axe-core": {
-      "version": "4.13.0",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.13.0.tgz",
-      "integrity": "sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A==",
+      "version": "4.14.0",
+      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.14.0.tgz",
+      "integrity": "sha512-9WTZxEjsZ7b13TH8JPmbV2z8CHbl80/2hm3XPEG4JgNdQLK81IBRXmSxHfMAOkSqQeRxT/0dwNDz2GOm3zzpcQ==",
       "dev": true,
       "license": "MPL-2.0",
       "engines": {
diff --git a/package.json b/package.json
index 1c89b7a7..bd6ccde8 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
   },
   "devDependencies": {
     "@tailwindcss/cli": "^4.3.3",
-    "axe-core": "^4.13.0",
+    "axe-core": "^4.14.0",
     "tailwindcss": "^4.3.3"
   }
 }

From fe074f5cb20e67d55c65f4591333a2720c1e9295 Mon Sep 17 00:00:00 2001
From: Adam Hernandez <adam@Hernandez-Partners.local>
Date: Thu, 15 Oct 2026 16:52:24 -0700
Subject: [PATCH 2/3] fix: include visible text in accessible control names

Keep visible labels within the accessible names of the user menu, home link, story-arc preview and release issue links for axe-core 4.14. Preserve destination and layout behavior, test rendered attribute escaping, and update exact-name assertions without removing existing scenarios.
---
 src/pullbox/ui/templates/base.html            |  2 +-
 .../ui/templates/partials/app_sidebar.html    |  2 +-
 .../partials/story_arc_catalog_results.html   |  2 +-
 .../partials/whats_new_release_tables.html    |  2 +-
 tests/e2e/test_gcd_api_arcs.py                |  2 +-
 tests/e2e/test_gcd_local_arcs.py              |  6 +-
 tests/e2e/test_sidebar_shell.py               | 64 ++++++++++++++++++
 tests/e2e/test_story_arc_catalog_page.py      |  8 +--
 tests/e2e/test_whats_new_issue_state.py       |  3 +
 tests/ui/test_sidebar_shell_ui_routes.py      | 65 ++++++++++++++++++-
 tests/ui/test_story_arc_catalog_ui.py         | 51 +++++++++++++++
 tests/ui/test_whats_new_issue_state.py        | 38 ++++++++++-
 12 files changed, 231 insertions(+), 14 deletions(-)

diff --git a/src/pullbox/ui/templates/base.html b/src/pullbox/ui/templates/base.html
index ef34fa3f..09ca6a4e 100644
--- a/src/pullbox/ui/templates/base.html
+++ b/src/pullbox/ui/templates/base.html
@@ -536,7 +536,7 @@ <h2 class="mt-1 text-sm font-semibold text-pb-text">Activity</h2>
       {#- User dropdown -#}
       {% if user %}
       <div x-data="{ open: false }" class="relative">
-        <button @click="open = !open" @click.outside="open = false" aria-label="User menu"
+        <button @click="open = !open" @click.outside="open = false" aria-label="User menu for {{ user.username }}"
                 class="flex items-center gap-2 px-3 py-2 rounded-lg font-sans font-medium text-sm text-pb-text-sec hover:bg-pb-card-hover hover:text-pb-text transition-colors">
           <svg class="w-5 h-5" fill="none" stroke="currentColor" stroke-width="1.5" viewBox="0 0 24 24" aria-hidden="true" focusable="false">
             <path stroke-linecap="round" stroke-linejoin="round"
diff --git a/src/pullbox/ui/templates/partials/app_sidebar.html b/src/pullbox/ui/templates/partials/app_sidebar.html
index 0eae8227..cf0671e9 100644
--- a/src/pullbox/ui/templates/partials/app_sidebar.html
+++ b/src/pullbox/ui/templates/partials/app_sidebar.html
@@ -190,7 +190,7 @@
 >
   <a
     href="/"
-    aria-label="Pullbox — home"
+    aria-label="Pullbox v{{ version }} — home"
     data-testid="sidebar-logo-link"
     class="app-sidebar-brand shrink-0 no-underline"
     :class="showSidebarLabels ? '' : 'app-sidebar-brand-collapsed px-0'"
diff --git a/src/pullbox/ui/templates/partials/story_arc_catalog_results.html b/src/pullbox/ui/templates/partials/story_arc_catalog_results.html
index ddb94586..ec9515c4 100644
--- a/src/pullbox/ui/templates/partials/story_arc_catalog_results.html
+++ b/src/pullbox/ui/templates/partials/story_arc_catalog_results.html
@@ -44,7 +44,7 @@ <h3 class="add-series-result-title">
             {% if result.existing_id %}
               {{ comicvine_in_library_badge() }}
             {% else %}
-              <a href="{{ result.preview_url|default('/story-arcs/catalog/' ~ result.metadata.provider_id) }}" class="btn-primary btn-sm add-series-result-add" aria-label="Preview {{ result.metadata.title }}">Preview members</a>
+              <a href="{{ result.preview_url|default('/story-arcs/catalog/' ~ result.metadata.provider_id) }}" class="btn-primary btn-sm add-series-result-add" aria-label="Preview members of {{ result.metadata.title }}">Preview members</a>
             {% endif %}
           {% endif %}
         {% endcall %}
diff --git a/src/pullbox/ui/templates/partials/whats_new_release_tables.html b/src/pullbox/ui/templates/partials/whats_new_release_tables.html
index 82a41406..b163427a 100644
--- a/src/pullbox/ui/templates/partials/whats_new_release_tables.html
+++ b/src/pullbox/ui/templates/partials/whats_new_release_tables.html
@@ -134,7 +134,7 @@
                 <div class="mt-1 flex flex-wrap items-center justify-end gap-2">
                   <span data-testid="whats-new-issue-state" class="badge {{ 'badge-success' if release.local_issue.state == 'owned' else 'badge-muted' }}">{{ release.local_issue.label }}</span>
                   {% if release.local_issue.issue_id %}
-                  <a data-testid="whats-new-local-issue" class="btn-ghost btn-sm whitespace-nowrap" href="/issues/{{ release.local_issue.issue_id }}" aria-label="View {{ release.series.title }} issue {{ release.issue_number }}">View issue</a>
+                  <a data-testid="whats-new-local-issue" class="btn-ghost btn-sm whitespace-nowrap" href="/issues/{{ release.local_issue.issue_id }}" aria-label="View issue {{ release.issue_number }} of {{ release.series.title }}">View issue</a>
                   {% endif %}
                   {% if release.grab_selection %}
                   <button type="button" class="btn-primary btn-sm" data-testid="whats-new-grab"
diff --git a/tests/e2e/test_gcd_api_arcs.py b/tests/e2e/test_gcd_api_arcs.py
index 54f84709..a5936016 100644
--- a/tests/e2e/test_gcd_api_arcs.py
+++ b/tests/e2e/test_gcd_api_arcs.py
@@ -70,7 +70,7 @@ def test_gcd_api_search_review_reorder_skip_and_accessibility(
     expect(page.locator("html")).to_have_attribute(
         "data-theme", os_scheme if theme == "system" else theme
     )
-    link = page.get_by_role("link", name="Preview Civil War", exact=True)
+    link = page.get_by_role("link", name="Preview members of Civil War", exact=True)
     expect(link).to_be_visible()
     assert_no_axe_violations(page, name=f"gcd-api-arc-search-{theme}-{width}", include=["#content"])
     link.click()
diff --git a/tests/e2e/test_gcd_local_arcs.py b/tests/e2e/test_gcd_local_arcs.py
index f2bf0c81..be42af5a 100644
--- a/tests/e2e/test_gcd_local_arcs.py
+++ b/tests/e2e/test_gcd_local_arcs.py
@@ -84,9 +84,11 @@ def test_gcd_search_review_reorder_skip_and_caveat(
     page.set_viewport_size({"width": width, "height": 900})
     page.goto(f"{seeded_server}/story-arcs/add?q=Civil+War&source=gcd_local")
     page.evaluate("theme => applyTheme(theme)", theme)
-    expect(page.get_by_role("link", name="Preview Civil War [Marvel]", exact=True)).to_be_visible()
+    expect(
+        page.get_by_role("link", name="Preview members of Civil War [Marvel]", exact=True)
+    ).to_be_visible()
     assert_no_axe_violations(page, name=f"gcd-arc-search-{theme}-{width}", include=["#content"])
-    page.get_by_role("link", name="Preview Civil War [Marvel]", exact=True).click()
+    page.get_by_role("link", name="Preview members of Civil War [Marvel]", exact=True).click()
     page.wait_for_url("**/story-arcs/catalog/gcd_local/4")
     expect(
         page.get_by_text("GCD publication order is a starting point", exact=False)
diff --git a/tests/e2e/test_sidebar_shell.py b/tests/e2e/test_sidebar_shell.py
index fb701712..34111baa 100644
--- a/tests/e2e/test_sidebar_shell.py
+++ b/tests/e2e/test_sidebar_shell.py
@@ -2,6 +2,9 @@
 
 from __future__ import annotations
 
+import json
+import re
+from typing import TYPE_CHECKING
 from urllib.parse import parse_qs, urlparse
 
 import pytest
@@ -12,12 +15,73 @@
 from tests.e2e.pages.import_page import ImportPage
 from tests.e2e.pages.series_list import SeriesListPage
 
+if TYPE_CHECKING:
+    from playwright.sync_api import Page
+
 pytestmark = pytest.mark.e2e
 
 
 class TestSidebarShell:
     """Behavior-first E2E checks for the persistent sidebar shell."""
 
+    @pytest.mark.parametrize("theme", ["light", "dark"])
+    def test_shell_accessible_names_survive_collapsed_and_mobile_layouts(
+        self,
+        authed_page: Page,
+        seeded_server: str,
+        theme: str,
+    ) -> None:
+        authed_page.set_viewport_size({"width": 1280, "height": 800})
+        authed_page.add_init_script(
+            f"localStorage.setItem('pullbox-theme', {json.dumps(theme)});"
+            "localStorage.setItem('sidebarOpen', 'true');"
+        )
+        shell = AppShellPage(authed_page, seeded_server)
+        shell.goto("/series")
+        expect(authed_page.locator("html")).to_have_attribute("data-theme", theme)
+
+        user_menu = authed_page.get_by_role("button", name=re.compile(r"^User menu"))
+        username = user_menu.locator("span")
+        logo_copy = authed_page.locator("[data-sidebar-logo-label]")
+        version = authed_page.locator("[data-testid='sidebar-brand-version']")
+        expect(username).to_be_visible()
+        expect(username).to_have_text("admin")
+        expect(logo_copy).to_be_visible()
+        expect(version).to_be_visible()
+        version_text = version.inner_text().strip()
+        assert version_text.startswith("v")
+        logo_name = f"Pullbox {version_text} — home"
+        expect(user_menu).to_have_accessible_name("User menu for admin")
+        expect(shell.logo_link).to_have_accessible_name(logo_name)
+
+        shell.collapse_toggle.click()
+        expect(logo_copy).to_be_hidden()
+        expect(shell.logo_link).to_be_visible()
+        expect(shell.logo_link).to_have_accessible_name(logo_name)
+        expect(user_menu).to_have_accessible_name("User menu for admin")
+        shell.collapse_toggle.click()
+        expect(logo_copy).to_be_visible()
+
+        authed_page.set_viewport_size({"width": 390, "height": 844})
+        authed_page.get_by_role("button", name="Open navigation menu", exact=True).click()
+        expect(shell.mobile_backdrop).to_be_visible()
+        expect(logo_copy).to_be_visible()
+        expect(version).to_be_visible()
+        expect(shell.logo_link).to_have_accessible_name(logo_name)
+        expect(username).to_be_hidden()
+        expect(user_menu).to_have_accessible_name("User menu for admin")
+
+        shell.mobile_backdrop.click(position={"x": 380, "y": 400})
+        expect(shell.mobile_backdrop).to_be_hidden()
+        sign_out = authed_page.get_by_role("button", name="Sign out", exact=True)
+        user_menu.focus()
+        expect(user_menu).to_be_focused()
+        user_menu.press("Enter")
+        expect(sign_out).to_be_visible()
+        user_menu.press("Enter")
+        expect(sign_out).to_be_hidden()
+        expect(user_menu).to_be_focused()
+
     def test_sidebar_shell_recovers_when_initial_stylesheet_request_fails(
         self,
         authed_page,
diff --git a/tests/e2e/test_story_arc_catalog_page.py b/tests/e2e/test_story_arc_catalog_page.py
index aba7ade8..9235503c 100644
--- a/tests/e2e/test_story_arc_catalog_page.py
+++ b/tests/e2e/test_story_arc_catalog_page.py
@@ -136,7 +136,7 @@ def test_catalog_results_use_add_series_card_layout(
     card = results.locator(".add-series-result-card").first
     title = card.locator(".add-series-result-title").bounding_box()
     meta = card.locator(".add-series-result-meta").bounding_box()
-    action = card.get_by_role("link", name="Preview Numbering Event").bounding_box()
+    action = card.get_by_role("link", name="Preview members of Numbering Event").bounding_box()
     bounds = card.bounding_box()
     assert title and meta and action and bounds
     assert meta["y"] >= title["y"] + title["height"], "Metadata belongs below the title"
@@ -170,7 +170,7 @@ def test_catalog_results_use_add_series_card_layout(
     assert page.locator("#content").evaluate(
         "element => element.scrollWidth <= element.clientWidth"
     )
-    expect(card.get_by_role("link", name="Preview Numbering Event")).to_be_visible()
+    expect(card.get_by_role("link", name="Preview members of Numbering Event")).to_be_visible()
     assert_no_axe_violations(page, name="arc-search-mobile", include=["#content"])
     page.screenshot(path=str(output / "mobile.png"), full_page=True)
 
@@ -194,9 +194,9 @@ def test_keyboard_catalog_add_and_refresh_preserve_reviewed_order(
     expect(cover).to_have_attribute(
         "src", "https://comicvine.gamespot.com/a/uploads/story-arcs/42.jpg"
     )
-    expect(page.get_by_role("link", name="Preview Numbering Event")).to_be_visible()
+    expect(page.get_by_role("link", name="Preview members of Numbering Event")).to_be_visible()
     query.press("Tab")
-    page.get_by_role("link", name="Preview Numbering Event").focus()
+    page.get_by_role("link", name="Preview members of Numbering Event").focus()
     page.keyboard.press("Enter")
     page.wait_for_url("**/story-arcs/catalog/comicvine_api/42")
     expect(
diff --git a/tests/e2e/test_whats_new_issue_state.py b/tests/e2e/test_whats_new_issue_state.py
index 7bfb0cde..bacd313e 100644
--- a/tests/e2e/test_whats_new_issue_state.py
+++ b/tests/e2e/test_whats_new_issue_state.py
@@ -129,6 +129,9 @@ def test_real_release_state_links_reflow_and_accessibility(
     expect(linked.get_by_test_id("whats-new-local-issue")).to_have_attribute(
         "href", f"/issues/{issue_ids[0]}"
     )
+    expect(linked.get_by_test_id("whats-new-local-issue")).to_have_accessible_name(
+        "View issue 1 of Atlas Deluxe"
+    )
     assert page.evaluate("document.documentElement.scrollWidth <= window.innerWidth + 1")
     assert_no_axe_violations(page, name=f"release-issue-state-{theme}-{width}")
     page.screenshot(
diff --git a/tests/ui/test_sidebar_shell_ui_routes.py b/tests/ui/test_sidebar_shell_ui_routes.py
index ad69ec22..b33f7f42 100644
--- a/tests/ui/test_sidebar_shell_ui_routes.py
+++ b/tests/ui/test_sidebar_shell_ui_routes.py
@@ -5,12 +5,21 @@
 import os
 import re
 import sys
+from html.parser import HTMLParser
 from pathlib import Path
 from types import SimpleNamespace
+from typing import TYPE_CHECKING
 from unittest.mock import AsyncMock, patch
 
 import pytest
 
+import pullbox
+from pullbox.models.user import User
+
+if TYPE_CHECKING:
+    from httpx import AsyncClient
+    from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
+
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
 
 pytest_plugins = ["conftest_security"]
@@ -37,6 +46,27 @@
 )
 
 
+class _ShellLabelParser(HTMLParser):
+    def __init__(self) -> None:
+        super().__init__(convert_charrefs=True)
+        self.user_menus: list[dict[str, str | None]] = []
+        self.logo_links: list[dict[str, str | None]] = []
+        self.text: list[str] = []
+        self.has_injected_markup = False
+
+    def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+        values = dict(attrs)
+        if tag == "button" and (values.get("aria-label") or "").startswith("User menu"):
+            self.user_menus.append(values)
+        if tag == "a" and values.get("data-testid") == "sidebar-logo-link":
+            self.logo_links.append(values)
+        if "data-label-x" in values:
+            self.has_injected_markup = True
+
+    def handle_data(self, data: str) -> None:
+        self.text.append(data)
+
+
 @pytest.mark.asyncio
 class TestSidebarShellRouteContracts:
     """Verify the shared sidebar shell renders a stable, standardized contract."""
@@ -175,7 +205,7 @@ async def test_series_page_renders_standardized_sidebar_shell(
             "justify-center rounded-lg p-0"
         ) in response.text
         assert re.search(
-            r'aria-label="User menu"[^>]*font-sans[^>]*font-medium',
+            r'aria-label="User menu for testuser"[^>]*font-sans[^>]*font-medium',
             response.text,
         )
         assert (
@@ -196,6 +226,39 @@ async def test_series_page_renders_standardized_sidebar_shell(
         assert "window.__autoSearching" not in response.text
         assert 'x-data="{ sidebarOpen:' not in response.text
 
+    @pytest.mark.parametrize(
+        "username",
+        ["testuser", 'reader" onfocus="alert(1)"><i data-label-x>&'],
+        ids=["normal", "escaped"],
+    )
+    async def test_shell_accessible_labels_include_rendered_text_and_escape_attributes(
+        self,
+        authenticated_client: AsyncClient,
+        sec_db: async_sessionmaker[AsyncSession],
+        sec_user: User,
+        username: str,
+    ) -> None:
+        async with sec_db() as session:
+            stored_user = await session.get(User, sec_user.id)
+            assert stored_user is not None
+            stored_user.username = username
+            await session.commit()
+
+        response = await authenticated_client.get("/series")
+        assert response.status_code == 200
+        parsed = _ShellLabelParser()
+        parsed.feed(response.text)
+        parsed.close()
+
+        assert len(parsed.user_menus) == 1
+        assert len(parsed.logo_links) == 1
+        assert parsed.user_menus[0]["aria-label"] == f"User menu for {username}"
+        assert parsed.logo_links[0]["aria-label"] == f"Pullbox v{pullbox.__version__} — home"
+        assert username in parsed.text
+        assert f"v{pullbox.__version__}" in parsed.text
+        assert "onfocus" not in parsed.user_menus[0]
+        assert not parsed.has_injected_markup
+
     async def test_reader_gate_hides_reading_sidebar_entry(
         self,
         authenticated_client,
diff --git a/tests/ui/test_story_arc_catalog_ui.py b/tests/ui/test_story_arc_catalog_ui.py
index de15874b..e95fc66b 100644
--- a/tests/ui/test_story_arc_catalog_ui.py
+++ b/tests/ui/test_story_arc_catalog_ui.py
@@ -6,6 +6,7 @@
 import re
 import sys
 from dataclasses import replace
+from html.parser import HTMLParser
 from typing import TYPE_CHECKING
 from unittest.mock import AsyncMock, Mock
 
@@ -20,6 +21,7 @@
 from pullbox.models.metadata_source import MetadataSourceConfig
 from pullbox.models.story_arc import IssueStoryArc, StoryArc
 from pullbox.providers.metadata.comicvine import ComicVineError
+from pullbox.providers.story_arcs import StoryArcSearchResult
 from pullbox.services.auth_service import SESSION_COOKIE_NAME, AuthService
 from pullbox.services.story_arc_catalog import StoryArcCatalogService
 from tests.sqlite_schema import create_test_schema
@@ -34,6 +36,19 @@
 pytest_plugins = ["conftest_security"]
 
 
+class _CatalogLinkParser(HTMLParser):
+    def __init__(self) -> None:
+        super().__init__(convert_charrefs=True)
+        self.nodes: list[tuple[str, dict[str, str | None]]] = []
+        self.text: list[str] = []
+
+    def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+        self.nodes.append((tag, dict(attrs)))
+
+    def handle_data(self, data: str) -> None:
+        self.text.append(data)
+
+
 @pytest.fixture
 async def sec_db(tmp_path_factory):
     # Cache/account sessions must not invalidate the request's shared StaticPool connection.
@@ -212,6 +227,42 @@ async def test_catalog_search_renders_provider_cover_and_missing_cover_fallback(
     assert response.text.count('class="add-series-result-cover-empty"') == 1
 
 
+@pytest.mark.parametrize(
+    "title",
+    ["Numbering Event", 'Event" onfocus="alert(1)"><i data-label-x>&'],
+    ids=["normal", "escaped"],
+)
+async def test_catalog_preview_link_name_includes_visible_label_and_escapes_title(
+    authenticated_client: AsyncClient,
+    catalog_provider: CatalogProvider,
+    monkeypatch: pytest.MonkeyPatch,
+    title: str,
+) -> None:
+    monkeypatch.setattr(
+        catalog_provider,
+        "search_story_arcs_page",
+        AsyncMock(return_value=([StoryArcSearchResult(provider_id="42", title=title)], 1)),
+    )
+    response = await authenticated_client.get(
+        "/story-arcs/add?q=event", headers={"HX-Request": "true"}
+    )
+
+    assert response.status_code == 200
+    parser = _CatalogLinkParser()
+    parser.feed(response.text)
+    links = [
+        attrs
+        for tag, attrs in parser.nodes
+        if tag == "a" and "add-series-result-add" in (attrs.get("class") or "").split()
+    ]
+    assert len(links) == 1
+    assert links[0]["aria-label"] == f"Preview members of {title}"
+    assert links[0]["href"] == "/story-arcs/catalog/comicvine_api/42"
+    assert "Preview members" in parser.text
+    assert "onfocus" not in links[0]
+    assert not any("data-label-x" in attrs for _, attrs in parser.nodes)
+
+
 async def test_catalog_preview_uses_review_workspace_and_separate_canonical_root(
     authenticated_client: AsyncClient, catalog_provider: CatalogProvider
 ):
diff --git a/tests/ui/test_whats_new_issue_state.py b/tests/ui/test_whats_new_issue_state.py
index 7d1bcba0..8262f7b8 100644
--- a/tests/ui/test_whats_new_issue_state.py
+++ b/tests/ui/test_whats_new_issue_state.py
@@ -2,6 +2,7 @@
 
 import re
 from datetime import UTC, date, datetime
+from html.parser import HTMLParser
 
 import pytest
 
@@ -17,6 +18,19 @@
 pytest_plugins = ["conftest_security"]
 
 
+class _ReleaseLinkParser(HTMLParser):
+    def __init__(self) -> None:
+        super().__init__(convert_charrefs=True)
+        self.nodes: list[tuple[str, dict[str, str | None]]] = []
+        self.text: list[str] = []
+
+    def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+        self.nodes.append((tag, dict(attrs)))
+
+    def handle_data(self, data: str) -> None:
+        self.text.append(data)
+
+
 @pytest.fixture
 def actions_enabled(monkeypatch):
     monkeypatch.setenv("PULLBOX_METADATA_WHATS_NEW_ACTIONS_ENABLED", "true")
@@ -25,11 +39,16 @@ def actions_enabled(monkeypatch):
     get_settings.cache_clear()
 
 
+@pytest.mark.parametrize(
+    "series_title",
+    ["Absolute Flash", 'Flash" onfocus="alert(1)"><i data-label-x>&'],
+    ids=["normal", "escaped"],
+)
 async def test_confirmed_release_links_issue_and_unresolved_row_stays_non_actionable(
-    authenticated_client, sec_db, actions_enabled
+    authenticated_client, sec_db, actions_enabled, series_title
 ):
     async with sec_db.begin() as session:
-        series = Series(title="Absolute Flash", sort_title="Absolute Flash")
+        series = Series(title=series_title, sort_title=series_title)
         session.add(series)
         await session.flush()
         identity = SeriesExternalIdentity(
@@ -40,6 +59,8 @@ async def test_confirmed_release_links_issue_and_unresolved_row_stays_non_action
             evidence_kind=IdentityEvidenceKind.USER_SELECTION,
         )
         source = _issue_summary()
+        assert isinstance(source["series"], dict)
+        source["series"]["title"] = series_title
         identity.external_id = str(source["series"]["locg_series_id"])
         issue = Issue(
             series_id=series.id,
@@ -80,6 +101,19 @@ async def test_confirmed_release_links_issue_and_unresolved_row_stays_non_action
     assert "Issue not linked" in unlinked
     assert 'data-testid="whats-new-local-issue"' not in unlinked
     assert 'data-testid="whats-new-grab"' not in response.text
+    parser = _ReleaseLinkParser()
+    parser.feed(response.text)
+    links = [
+        attrs
+        for tag, attrs in parser.nodes
+        if tag == "a" and attrs.get("data-testid") == "whats-new-local-issue"
+    ]
+    assert len(links) == 1
+    assert links[0]["aria-label"] == f"View issue 1 of {series_title}"
+    assert links[0]["href"] == f"/issues/{issue_id}"
+    assert "View issue" in parser.text
+    assert "onfocus" not in links[0]
+    assert not any("data-label-x" in attrs for _, attrs in parser.nodes)
 
 
 def test_grouping_retains_every_source_release_without_changing_cache():

From 136003f741f37ccedb955455576b8720512103e2 Mon Sep 17 00:00:00 2001
From: Adam Hernandez <adam@Hernandez-Partners.local>
Date: Thu, 15 Oct 2026 17:44:03 -0700
Subject: [PATCH 3/3] test: ignore read access time in archive preservation
 check

Keep exact bytes, identity, ownership, permissions and size checks, and compare modification/change timestamps at nanosecond precision. Reading the archive may legitimately update access time. Production behavior and all existing cases remain unchanged.
---
 .../metadata_identity/test_issue_file_metadata.py          | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/integration/metadata_identity/test_issue_file_metadata.py b/tests/integration/metadata_identity/test_issue_file_metadata.py
index dacda21b..40c3bd2c 100644
--- a/tests/integration/metadata_identity/test_issue_file_metadata.py
+++ b/tests/integration/metadata_identity/test_issue_file_metadata.py
@@ -127,7 +127,12 @@ async def control():
                 check_control=control,
                 progress=noop,
             )
-        assert (path.read_bytes(), path.stat()) == original
+        actual = path.read_bytes(), path.stat()
+        assert actual[0] == original[0]
+        # Reading may update atime; identity, ownership, mode and size must not change.
+        assert actual[1][:7] == original[1][:7]
+        assert actual[1].st_mtime_ns == original[1].st_mtime_ns
+        assert actual[1].st_ctime_ns == original[1].st_ctime_ns
 
 
 async def test_restart_recovers_published_result_without_repacking(identity_probe_db, tmp_path):