fix(report): make filter buttons legible and open advisories in a new tab (2.3.1)

[Ali Bahaloo (alibahaloo)]

Two defects found while live-testing the 2.3.0 HTML report. Both are in generated output only — no interface change — so this also bumps VERSION to 2.3.1 per the release runbook.

1. Filter button labels were invisible until clicked

Reported symptom: the Impacted / Needs review / Not impacted buttons appeared as blank white rectangles, only becoming readable once pressed.

Root cause was a mistake in our stylesheet, not a browser quirk. The report declared:

:root { color-scheme: light dark; }

…while the page hardcodes light body colours (color: #1b1b1b; background: #f7f7f8) and implements no dark theme at all. That declaration tells the browser the page supports dark mode, so it styled form controls for dark mode — white text — against the #fff background set on .controls button. That rule set a background but never a color, and font: inherit does not carry colour, so nothing overrode the user agent. Only the pressed button escaped, because it explicitly sets color: #fff on a dark background.

Reproduced before changing anything, under prefers-color-scheme: dark:

Button	color	background
All (3) (pressed)	rgb(255,255,255)	rgb(31,78,120)
Impacted (1)	rgb(255,255,255)	rgb(255,255,255) ←
Needs review (1)	rgb(255,255,255)	rgb(255,255,255) ←
Not impacted (1)	rgb(255,255,255)	rgb(255,255,255) ←

Fixed at both levels: color-scheme: light, so the report stops advertising support it does not have; and an explicit color on the buttons, so they are correct regardless of user agent or scheme. The explicit colour is the real fix — it does not depend on colour-scheme behaviour.

Verified under dark mode after the fix: unpressed buttons compute to 17.2:1 contrast, the pressed button to 8.7:1. Both above WCAG AAA (7:1).

Also adds :hover and :focus-visible states. Overriding the user-agent button style had removed both the hover feedback (a button with none reads as broken) and the focus ring, leaving keyboard users with no visible focus indicator.

2. Advisory links replaced the report in the same tab

target="_blank" was missing. A reader working through a filtered list lost their filter and scroll position on every advisory they opened — which is most of the point of the report. rel="noreferrer noopener" was already present and is the required companion, so the opened page gets no handle back to the report.

Regression tests are confirmed non-vacuous

Rather than only checking they pass after the fix, I reintroduced both defects in memory and confirmed 5 of 8 new tests fail:

• the CSS tests parse the .controls button declaration block and assert an explicit color distinct from its background, so a future edit that drops it fails instead of shipping invisible text again;
• the link tests assert every anchor carries both target and rel, and that an advisory with no URL renders no anchor at all.

Tests: 236 → 244, green under CI's unittest discover -s tests.

Constitution compliance (v2.2.0)

• I. Standard-Library-First — PASS. CSS and HTML string changes only; no dependency added.
• II. Cross-Platform Parity — PASS. The fix removes reliance on user-agent colour decisions, so rendering is now less platform-dependent than before.
• III. CLI-First — N/A. No CLI surface, flag, or exit code changes.
• IV. Conservative & Traceable — N/A. No verdict logic touched; matching.py and psirt.py are untouched.
• V. Secrets Hygiene — PASS. No credential path involved; the existing report hygiene tests still pass.
• Quality Gates — PASS. Both fixes carry tests proven to fail against the pre-fix code. No README or docs/index.html change needed — neither documents report styling.

Note for after merge

Merging makes main 2.3.1. Users only receive it once the tag is pushed and the Release workflow publishes it, since caia --update discovers releases via /releases/latest.

🤖 Generated with Claude Code