v1.1.31

Security

• Pagefind search results now scheme-validate their link href — a sanitizeUrl() guard parses each result URL with the native URL constructor and allow-lists only http:/https: (falling back to #) before HTML-escaping, blocking javascript:/data: URIs from a poisoned index. Defense-in-depth.

Accessibility

• The /download/ version pill now reads as the link it is: color-inverting :hover, a 2px --focus-ring :focus-visible outline, a prefers-reduced-motion-gated scale(0.96) :active press, and a descriptive title.

Dependencies

• Dev-only prettier bump 3.8.4 → 3.9.1 (minor/patch group) — manifest + lockfile only, all gates pass unchanged.