From a8eb1470654dfc591facfe98328953e65ae1e210 Mon Sep 17 00:00:00 2001
From: Mike Benner <36419818+mikebenner@users.noreply.github.com>
Date: Wed, 4 Nov 2026 09:59:21 -0800
Subject: [PATCH] Pin leaflet.heat to 0.2.0 so the map loads again (#188)

leaflet.heat 1.0.0 was published to npm on 2026-11-03 and is ESM-only
(it starts with `import * as e from "leaflet"`). The pages loaded it
unversioned from unpkg as a classic <script>, so unpkg started serving
1.0.0. That throws "Cannot use import statement outside a module", which
leaves L.heatLayer undefined. map-view.html calls L.heatLayer at the top
level before the map gets a view, so the live map is a blank grey box,
and the heatmap page fails to load nodes.

Pin 0.2.0, the release these pages were written against, and add an
SRI hash so a future upstream change can't break or alter the pages.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 meshview/static/heatmap.html     | 4 +++-
 meshview/templates/map-view.html | 4 +++-
 meshview/templates/node.html     | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/meshview/static/heatmap.html b/meshview/static/heatmap.html
index 9ec27c7..3acd84c 100644
--- a/meshview/static/heatmap.html
+++ b/meshview/static/heatmap.html
@@ -104,7 +104,9 @@ body { background:var(--mesh-page); color:var(--mesh-text); }
 <div id="legend"></div>
 
 <script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
-<script src="https://unpkg.com/leaflet.heat/dist/leaflet-heat.js"></script>
+<script src="https://unpkg.com/leaflet.heat@0.2.0/dist/leaflet-heat.js"
+        integrity="sha384-mFKkGiGvT5vo1fEyGCD3hshDdKmW3wzXW/x+fWriYJArD0R3gawT6lMvLboM22c0"
+        crossorigin="anonymous"></script>
 <script>
 const map = L.map("map");
 L.tileLayer("https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png", {
diff --git a/meshview/templates/map-view.html b/meshview/templates/map-view.html
index 9a7f8fb..0ec4951 100644
--- a/meshview/templates/map-view.html
+++ b/meshview/templates/map-view.html
@@ -298,7 +298,9 @@ a.mesh-inspector-packet:hover { background:var(--mesh-soft); }
 <script src="https://unpkg.com/leaflet-polylinedecorator@1.6.0/dist/leaflet.polylinedecorator.js"
         integrity="sha384-FhPn/2P/fJGhQLeNWDn9B/2Gml2bPOrKJwFqJXgR3xOPYxWg5mYQ5XZdhUSugZT0"
         crossorigin></script>
-<script src="https://unpkg.com/leaflet.heat/dist/leaflet-heat.js"></script>
+<script src="https://unpkg.com/leaflet.heat@0.2.0/dist/leaflet-heat.js"
+        integrity="sha384-mFKkGiGvT5vo1fEyGCD3hshDdKmW3wzXW/x+fWriYJArD0R3gawT6lMvLboM22c0"
+        crossorigin="anonymous"></script>
 <script src="/static/portmaps.js"></script>
 
 <script>
diff --git a/meshview/templates/node.html b/meshview/templates/node.html
index b67d44f..d89a815 100644
--- a/meshview/templates/node.html
+++ b/meshview/templates/node.html
@@ -242,7 +242,9 @@
 
 <script src="https://cdn.jsdelivr.net/npm/echarts@5.5.0/dist/echarts.min.js"></script>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js"></script>
-<script src="https://unpkg.com/leaflet.heat/dist/leaflet-heat.js"></script>
+<script src="https://unpkg.com/leaflet.heat@0.2.0/dist/leaflet-heat.js"
+        integrity="sha384-mFKkGiGvT5vo1fEyGCD3hshDdKmW3wzXW/x+fWriYJArD0R3gawT6lMvLboM22c0"
+        crossorigin="anonymous"></script>
 <script src="/static/portmaps.js"></script>
 
 <script>