Download table: put the full checksum in the DOM, truncate it with CSS - #2139
Merged
Merged
Conversation
The full SHA-256 lived only in a hover tooltip: keyboard users could not reach it, screen readers never heard it, nobody could copy it easily, and tippy put an invalid aria-expanded on the role-less div (axe aria-allowed-attr, WCAG 4.1.2). The truncated hash also used --bs-primary, which fails WCAG AA contrast for small text. Now the cell's text is the complete hash and only the rendering truncates (CSS ellipsis). The table looks the same as before, but screen readers announce the full value, double-click selects it for copying, and find-in-page matches it — no tooltip, no ARIA, default text color. The SHA-256 column header links to the release's checksums.txt so the full values are also visible at every viewport (WCAG 1.4.10 reflow). Also removes the tippy init for a.checksum, which matched nothing (checksums were divs).
Contributor
📝 Preview Deployment🔍 Full site preview: https://deploy-preview-2139.quarto.org |
createHeadingRow was assigning cell.outerHTML from a template literal containing an interpolated URL, the only place in this file that builds markup that way instead of createElement + .href/.innerText. Match the existing pattern so header cells are never built from unescaped strings. Also drops the WCAG 1.4.10 citation for the header link in the code comment - the mapping was shaky; the plain rationale stands on its own.
Contributor
📝 Preview Deployment🔍 Full site preview: https://deploy-preview-2139.quarto.org |
Contributor
|
Successfully created backport PR for |
cwickham
added a commit
that referenced
this pull request
Sep 23, 2026
#2139) (#2201) * Put the full checksum in the DOM, truncate it with CSS The full SHA-256 lived only in a hover tooltip: keyboard users could not reach it, screen readers never heard it, nobody could copy it easily, and tippy put an invalid aria-expanded on the role-less div (axe aria-allowed-attr, WCAG 4.1.2). The truncated hash also used --bs-primary, which fails WCAG AA contrast for small text. Now the cell's text is the complete hash and only the rendering truncates (CSS ellipsis). The table looks the same as before, but screen readers announce the full value, double-click selects it for copying, and find-in-page matches it — no tooltip, no ARIA, default text color. The SHA-256 column header links to the release's checksums.txt so the full values are also visible at every viewport (WCAG 1.4.10 reflow). Also removes the tippy init for a.checksum, which matched nothing (checksums were divs). * Build the checksum header link with DOM APIs, not an HTML string createHeadingRow was assigning cell.outerHTML from a template literal containing an interpolated URL, the only place in this file that builds markup that way instead of createElement + .href/.innerText. Match the existing pattern so header cells are never built from unescaped strings. Also drops the WCAG 1.4.10 citation for the header link in the code comment - the mapping was shaky; the plain rationale stands on its own. (cherry picked from commit 664eab8) Co-authored-by: Charlotte Wickham <charlotte.wickham@posit.co>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The site audit flagged two WCAG failures on
/docs/download/, both on the checksum cells:aria-expandedto the checksum<div>, which is invalid on an element with no role.--bs-primary(3.97:1 on white; small text needs 4.5:1).The deeper problem: the full SHA-256 lived only in a hover tooltip. Keyboard users could not reach it, screen readers never heard it, and copying it meant drag-selecting text inside a floating tooltip.
The fix: the cell's text is now the complete hash, and only the rendering truncates (
text-overflow: ellipsis). The tooltip, tippy init, and JS truncation are gone. The SHA-256 column header links to the release'schecksums.txt.We tried a copy button, an
aria-describedbyspan, and a<details>disclosure before settling here. This version won because it does both things at once with zero interactive machinery:Net diff: +17/−17 lines. Axe scan of the page is clean at 1440×900 and 390×844, light and dark.