test: render every ImageComposeScene on the AWT event thread

The rare CI hang is a lock-order deadlock in Compose Multiplatform 1.8.2,
shown by the thread dump of run 40299943329:

- the test thread renders the scene and holds the FlushCoroutineDispatcher
  runLock while LazyListState.scrollToItem measures and wants the
  SnapshotStateObserver's observedScopeMapsLock;
- the AWT event thread sends the global snapshot notifications and holds
  observedScopeMapsLock in drainChanges while a re-read derived state wakes
  the scene's snapshotFlow collector, whose dispatch wants runLock.

The application renders on the event thread, where both monitors are simply
re-entered. The tests now do the same: onEventThread builds, renders and
closes each scene there and rethrows what the block throws.

Claude-Session: https://claude.ai/code/session_01FJBfPYm6rCH4zD6T7bcC7Y

.github/workflows/nightly-artifacts.yml

@@ -32,6 +32,9 @@ jobs:
   test:
     name: Test (Java 21, headless)
     runs-on: ubuntu-latest
+    # A healthy run takes about four minutes. The per-test limit in build.gradle.kts names
+    # a hanging test; this cap covers a hang outside any test, such as in Gradle itself.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout
@@ -108,8 +111,10 @@ jobs:
             exit 1
           fi
 
+      # Also on cancelled(): the job timeout cancels a hanging run, and the reports of the
+      # classes that did finish carry the timed-out tests' full stacks.
       - name: Keep the test reports on a failure
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@v7
         with:
           name: test-results

.github/workflows/pr-compile-check.yml

@@ -6,6 +6,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -155,6 +158,9 @@ jobs:
   test:
     name: Test (Java 21, headless)
     runs-on: ubuntu-latest
+    # A healthy run takes about four minutes. The per-test limit in build.gradle.kts names
+    # a hanging test; this cap covers a hang outside any test, such as in Gradle itself.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout
@@ -283,8 +289,10 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+      # Also on cancelled(): the job timeout cancels a hanging run, and the reports of the
+      # classes that did finish carry the timed-out tests' full stacks.
       - name: Keep the test reports on a failure
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@v7
         with:
           name: test-results

.github/workflows/tagged-release.yml

@@ -24,6 +24,9 @@ jobs:
   test:
     name: Test (Java 21, headless)
     runs-on: ubuntu-latest
+    # A healthy run takes about four minutes. The per-test limit in build.gradle.kts names
+    # a hanging test; this cap covers a hang outside any test, such as in Gradle itself.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout
@@ -127,8 +130,10 @@ jobs:
             exit 1
           fi
 
+      # Also on cancelled(): the job timeout cancels a hanging run, and the reports of the
+      # classes that did finish carry the timed-out tests' full stacks.
       - name: Keep the test reports on a failure
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@v7
         with:
           name: test-results

.github/workflows/test-publish-version-xml.yml

@@ -3,6 +3,10 @@ name: TEST publish-version-xml (local only)
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  issues: read
+
 jobs:
   publish-version-xml:
     name: Publish Version Info XML via WebDAV

app-desktop/src/test/kotlin/kst4contest/view/compose/CompactControlsVisualRenderingTest.kt

@@ -55,6 +55,7 @@ class CompactControlsVisualRenderingTest(@param:TempDir private val tempDir: Pat
         }
         val filters = StationFilterState()
 
+        return onEventThread {
             val scene = ImageComposeScene(width = 1366, height = 380, density = Density(scale)) {
                 Kst4ContestTheme(darkMode = darkMode, baseFontSizeSp = 12f) {
                     Surface(
@@ -90,12 +91,13 @@ class CompactControlsVisualRenderingTest(@param:TempDir private val tempDir: Pat
                     }
                 }
             }
-        return try {
+            try {
                 scene.render().encodeToData()!!.bytes
             } finally {
                 scene.close()
             }
         }
+    }
 
     private class RenderActions(private val preferences: ChatPreferences) : ChatInputActions {
         override fun panelSelection(): ChatMember? = null

app-desktop/src/test/kotlin/kst4contest/view/compose/OnEventThread.kt

@@ -0,0 +1,37 @@
+package kst4contest.view.compose
+
+import java.awt.EventQueue
+import java.lang.reflect.InvocationTargetException
+
+/*
+ * An ImageComposeScene must live on the AWT event thread, the thread the application renders
+ * on. Compose Multiplatform 1.8.2 sends the global snapshot notifications there
+ * (GlobalSnapshotManager), and doing so takes two locks in the opposite order from a render
+ * on any other thread:
+ *
+ *  - the render holds the scene's FlushCoroutineDispatcher runLock while a task it runs
+ *    (here LazyListState.scrollToItem) measures and wants the SnapshotStateObserver's
+ *    observedScopeMapsLock;
+ *  - the event thread holds observedScopeMapsLock in drainChanges while a derived state it
+ *    re-reads wakes a snapshotFlow collector of that scene, whose dispatch wants runLock.
+ *
+ * Both waited forever in CI runs 40252077018, 40252089738 and 40299943329; the thread dump of
+ * the last one shows both stacks. On one thread the two monitors are simply re-entered, which
+ * is why the application never hangs this way.
+ */
+
+/**
+ * Runs [block] on the AWT event thread, waits for it and returns its result. Whatever
+ * [block] throws is rethrown here unwrapped, so a failed assertion still reads as one.
+ */
+internal fun <T> onEventThread(block: () -> T): T {
+    if (EventQueue.isDispatchThread()) return block()
+
+    var result: Result<T>? = null
+    try {
+        EventQueue.invokeAndWait { result = runCatching(block) }
+    } catch (wrapped: InvocationTargetException) {
+        throw wrapped.cause ?: wrapped
+    }
+    return result!!.getOrThrow()
+}

app-desktop/src/test/kotlin/kst4contest/view/compose/SelectedStationMessageUiVisualRenderingTest.kt

@@ -84,6 +84,7 @@ class SelectedStationMessageUiVisualRenderingTest {
             replaceRows(listOf(message(member("DL1ABC", 2), member("DL2XYZ", 2), "pse sked")))
         }
 
+        return onEventThread {
             val scene = ImageComposeScene(width = 1366, height = windowHeight, density = Density(scale)) {
                 Kst4ContestTheme(darkMode = darkMode, baseFontSizeSp = 12f) {
                     Surface(
@@ -111,12 +112,13 @@ class SelectedStationMessageUiVisualRenderingTest {
                 }
             }
 
-        return try {
+            try {
                 scene.render().encodeToData()!!.bytes
             } finally {
                 scene.close()
             }
         }
+    }
 
     private fun messageTable() = DataTableState(
         columns = listOf(

app-desktop/src/test/kotlin/kst4contest/view/compose/StationWorkspaceVisualRenderingTest.kt

@@ -87,6 +87,7 @@ class StationWorkspaceVisualRenderingTest {
             RowKeys.byReference<ChatMessage>(),
         )
 
+        return onEventThread {
             val scene = ImageComposeScene(
                 width = 1366,
                 height = scenario.height,
@@ -139,12 +140,13 @@ class StationWorkspaceVisualRenderingTest {
                 }
             }
 
-        return try {
+            try {
                 scene.render().encodeToData()!!.bytes
             } finally {
                 scene.close()
             }
         }
+    }
 
     private fun member(callSign: String, category: Int) = ChatMember().apply {
         this.callSign = callSign

app-desktop/src/test/kotlin/kst4contest/view/compose/TopPriorityCandidatesWindowTest.kt

@@ -32,6 +32,7 @@ class TopPriorityCandidatesWindowTest {
     /** Runs [block] against a rendered list of [twoCandidates] and reports what it picked. */
     private fun picking(block: (ImageComposeScene) -> Unit): String? {
         var picked: String? = null
+        onEventThread {
             val scene = ImageComposeScene(width = 360, height = 500, density = Density(1f)) {
                 TopPriorityCandidatesWindow.CandidateListForTest(twoCandidates) {
                     picked = it.displayCallSign
@@ -44,6 +45,7 @@ class TopPriorityCandidatesWindowTest {
             } finally {
                 scene.close()
             }
+        }
         return picked
     }
 
@@ -78,6 +80,7 @@ class TopPriorityCandidatesWindowTest {
     @Test
     fun `the list renders with candidates and without`() {
         listOf(emptyList(), twoCandidates).forEach { ranking ->
+            onEventThread {
                 val scene = ImageComposeScene(width = 360, height = 500, density = Density(1f)) {
                     TopPriorityCandidatesWindow.CandidateListForTest(ranking) { }
                 }
@@ -88,6 +91,7 @@ class TopPriorityCandidatesWindowTest {
                 }
             }
         }
+    }
 
     /**
      * A double click picks the candidate under it, and picks the right one.

app-desktop/src/test/kotlin/kst4contest/view/compose/map/ComposeStationMapDrawingTest.kt

@@ -4,6 +4,7 @@ import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
+import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.MapCallsignRawSnapshot
 import kst4contest.view.map.MapViewport
 import kst4contest.view.map.TileFetcher
@@ -71,6 +72,7 @@ class ComposeStationMapDrawingTest {
         workedGrossFields: Set<String> = emptySet(),
         darkMode: Boolean = true,
     ): BufferedImage {
+        return onEventThread {
             val scene = ImageComposeScene(canvasWidth, canvasHeight, Density(1f)) {
                 ComposeStationMap(
                     markers = markers,
@@ -89,11 +91,12 @@ class ComposeStationMapDrawingTest {
                 )
             }
             try {
-            return ImageIO.read(ByteArrayInputStream(scene.render().encodeToData()!!.bytes))
+                ImageIO.read(ByteArrayInputStream(scene.render().encodeToData()!!.bytes))
             } finally {
                 scene.close()
             }
         }
+    }
 
     private fun countColour(image: BufferedImage, rgb: Int): Int {
         var count = 0

app-desktop/src/test/kotlin/kst4contest/view/compose/map/ComposeStationMapLayoutTest.kt

@@ -4,6 +4,7 @@ import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
+import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.MapCallsignRawSnapshot
 import kst4contest.view.map.TileFetcher
 import org.junit.jupiter.api.Test
@@ -33,6 +34,7 @@ class ComposeStationMapLayoutTest {
     )
 
     private fun renderAt(widthPx: Int, heightPx: Int, zoom: Float) {
+        onEventThread {
             val scene = ImageComposeScene(
                 width = widthPx,
                 height = heightPx,
@@ -59,6 +61,7 @@ class ComposeStationMapLayoutTest {
                 scene.close()
             }
         }
+    }
 
     @Test
     fun `renders at a normal window size and integer zoom`() = renderAt(900, 600, 6f)

app-desktop/src/test/kotlin/kst4contest/view/compose/map/PathAnalysisDetailsLayoutTest.kt

@@ -4,6 +4,7 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
+import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.PathAnalysisResult
 import org.junit.jupiter.api.Test
 
@@ -25,6 +26,7 @@ class PathAnalysisDetailsLayoutTest {
     private val narrowWidthPx = 120
 
     private fun renderAt(widthPx: Int, result: PathAnalysisResult?) {
+        onEventThread {
             val scene = ImageComposeScene(
                 width = widthPx,
                 height = 600,
@@ -42,6 +44,7 @@ class PathAnalysisDetailsLayoutTest {
                 scene.close()
             }
         }
+    }
 
     @Test
     fun `renders when the column is narrower than the assessment label`() {

app-desktop/src/test/kotlin/kst4contest/view/compose/map/PathAnalysisDetailsWidthTest.kt

@@ -4,6 +4,7 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
+import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.PathAnalysisResult
 import org.junit.jupiter.api.Assertions.assertTrue
 import org.junit.jupiter.api.Test
@@ -31,6 +32,7 @@ class PathAnalysisDetailsWidthTest {
     private val assessmentBackground = 0x33383E
 
     private fun render(paneWidthPx: Int, heightPx: Int = 600): BufferedImage {
+        return onEventThread {
             val scene = ImageComposeScene(width = paneWidthPx, height = heightPx, density = Density(1f)) {
                 PathAnalysisDetails(
                     result = PathAnalysisResult.loading("JO50JP", "JN24JB", "F5JMI"),
@@ -40,11 +42,12 @@ class PathAnalysisDetailsWidthTest {
             }
             try {
                 val png = scene.render().encodeToData()!!.bytes
-            return ImageIO.read(ByteArrayInputStream(png))
+                ImageIO.read(ByteArrayInputStream(png))
             } finally {
                 scene.close()
             }
         }
+    }
 
     /** The smallest x at which the assessment background appears, or -1 when it does not. */
     private fun assessmentLeftEdge(image: BufferedImage): Int {

app-desktop/src/test/kotlin/kst4contest/view/compose/map/PathProfileChartLayoutTest.kt

@@ -4,6 +4,7 @@ import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.ui.ImageComposeScene
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.Density
+import kst4contest.view.compose.onEventThread
 import org.junit.jupiter.api.Test
 
 /**
@@ -18,6 +19,7 @@ import org.junit.jupiter.api.Test
 class PathProfileChartLayoutTest {
 
     private fun renderAt(widthPx: Int, heightPx: Int) {
+        onEventThread {
             val scene = ImageComposeScene(
                 width = widthPx,
                 height = heightPx,
@@ -31,6 +33,7 @@ class PathProfileChartLayoutTest {
                 scene.close()
             }
         }
+    }
 
     @Test
     fun `renders at the height the window gives it`() = renderAt(800, 210)

app-desktop/src/test/kotlin/kst4contest/view/compose/map/StationMapBodyLayoutTest.kt

@@ -15,6 +15,7 @@ import androidx.compose.ui.unit.dp
 import kst4contest.view.compose.SplitterOrientation
 import kst4contest.view.compose.SplitterPane
 import kst4contest.view.compose.SplitterState
+import kst4contest.view.compose.onEventThread
 import kst4contest.view.map.MapCallsignRawSnapshot
 import kst4contest.view.map.PathAnalysisResult
 import kst4contest.view.map.TileFetcher
@@ -88,6 +89,7 @@ class StationMapBodyLayoutTest {
     }
 
     private fun renderAt(widthPx: Int, heightPx: Int, pathAnalysisVisible: Boolean = true) {
+        onEventThread {
             val scene = ImageComposeScene(width = widthPx, height = heightPx, density = Density(1f)) {
                 Body(pathAnalysisVisible)
             }
@@ -97,6 +99,7 @@ class StationMapBodyLayoutTest {
                 scene.close()
             }
         }
+    }
 
     @Test
     fun `renders at the window's minimum size`() = renderAt(900, 600)

build.gradle.kts

@@ -141,6 +141,28 @@ subprojects {
             }
             testUserHome.mkdirs()
         }
+        /*
+         * A test that never returns must fail by name instead of holding the job until
+         * GitHub kills it after six hours: Nightly #302 hung in :app-desktop:test for over
+         * an hour, and the log named only the task. The limit is far above the slowest test
+         * (under four seconds). SEPARATE_THREAD also ends a test whose thread ignores
+         * interruption, such as a busy loop or a blocked native call, and the failure's
+         * cause carries that thread's stack, so it shows where the test stood.
+         */
+        systemProperty("junit.jupiter.execution.timeout.default", "2m")
+        systemProperty("junit.jupiter.execution.timeout.thread.mode.default", "SEPARATE_THREAD")
+        /*
+         * The timed-out thread's stack shows where a test waits, not who it waits for: the
+         * rare CI hang in SelectedStationMessageUiVisualRenderingTest blocks on a monitor
+         * that another thread holds. On a timeout JUnit prints all threads to the test's
+         * standard output, which lands in its XML report (the test-results artifact).
+         */
+        systemProperty("junit.jupiter.execution.timeout.threaddump.enabled", "true")
+        // The default short format prints only the first frame of each cause, which for a
+        // timed-out test is the line it hung in but not the call that blocked there.
+        testLogging {
+            exceptionFormat = org.gradle.api.tasks.testing.logging.TestExceptionFormat.FULL
+        }
         finalizedBy(checkTestUserHome)
     }
 

packaging/aur/kst4contest-git/PKGBUILD

@@ -7,12 +7,22 @@ arch=('x86_64')
 url="https://github.com/HamRadioOnline/kst4contest"
 license=('GPL-3.0-only')
 depends=('gst-plugins-base' 'gst-plugins-good')
-makedepends=('java-environment=21' 'git')
+makedepends=('git')
 provides=('kst4contest')
 conflicts=('kst4contest' 'kst4contest-bin')
 source=("kst4contest::git+https://github.com/HamRadioOnline/kst4contest.git")
 sha256sums=('SKIP')
 
+# The launcher is built with Temurin, not with the system JDK. Arch's openjdk links
+# jpackage's launcher library against the shared libstdc++, and that build aborts
+# with "pure virtual method called" (SIGABRT, core dump) in a static destructor when
+# the application exits; Temurin links libstdc++ statically, like the CI packages.
+# The _x86_64 arrays are deliberate: aur-publish.yml rewrites the plain sha256sums=
+# line on every release and would drop a second entry there.
+_temurin=21.0.13+9
+source_x86_64=("https://github.com/adoptium/temurin21-binaries/releases/download/jdk-${_temurin/+/%2B}/OpenJDK21U-jdk_x64_linux_hotspot_${_temurin/+/_}.tar.gz")
+sha256sums_x86_64=('d7f5d5cf865a2902b70ff549b97586a7d3f234e016f041ab447ea740c7d66d1c')
+
 pkgver() {
     cd "${srcdir}/kst4contest"
     BASE=$(grep -m1 '^version=' gradle.properties \
@@ -23,7 +33,7 @@ pkgver() {
 build() {
     cd "${srcdir}/kst4contest"
 
-    export JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name 'java-21-*' -type d | head -n 1)
+    export JAVA_HOME="${srcdir}/jdk-${_temurin}"
     export PATH="${JAVA_HOME}/bin:${PATH}"
 
     # A Gradle home inside $srcdir keeps the build independent of whatever the
@@ -31,7 +41,13 @@ build() {
     # cache, every dependency added since the last local build broke the package.
     export GRADLE_USER_HOME="${srcdir}/gradle-home"
 
-    ./gradlew --no-daemon -S :app-desktop:createDistributable
+    # The Java toolchain, and with it jpackage, would otherwise pick any JDK 21 it
+    # finds in /usr/lib/jvm, the system one included.
+    ./gradlew --no-daemon -S \
+        -Porg.gradle.java.installations.auto-detect=false \
+        -Porg.gradle.java.installations.auto-download=false \
+        -Porg.gradle.java.installations.paths="${JAVA_HOME}" \
+        :app-desktop:createDistributable
 
     # package() reads dist/KST4Contest. Application name, icon and the JDK
     # module list come from app-desktop/build.gradle.kts.

packaging/aur/kst4contest/PKGBUILD

@@ -7,16 +7,25 @@ arch=('x86_64')
 url="https://github.com/HamRadioOnline/kst4contest"
 license=('GPL-3.0-only')
 depends=('gst-plugins-base' 'gst-plugins-good')
-makedepends=('java-environment=21')
 provides=('kst4contest')
 conflicts=('kst4contest-bin' 'kst4contest-git')
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/HamRadioOnline/kst4contest/archive/refs/tags/v${pkgver}.tar.gz")
 sha256sums=('e702df24a29e6f914a43934df0095bc4adbd00a9f02df3a632816c832272e914')
 
+# The launcher is built with Temurin, not with the system JDK. Arch's openjdk links
+# jpackage's launcher library against the shared libstdc++, and that build aborts
+# with "pure virtual method called" (SIGABRT, core dump) in a static destructor when
+# the application exits; Temurin links libstdc++ statically, like the CI packages.
+# The _x86_64 arrays are deliberate: aur-publish.yml rewrites the plain sha256sums=
+# line on every release and would drop a second entry there.
+_temurin=21.0.13+9
+source_x86_64=("https://github.com/adoptium/temurin21-binaries/releases/download/jdk-${_temurin/+/%2B}/OpenJDK21U-jdk_x64_linux_hotspot_${_temurin/+/_}.tar.gz")
+sha256sums_x86_64=('d7f5d5cf865a2902b70ff549b97586a7d3f234e016f041ab447ea740c7d66d1c')
+
 build() {
     cd "${srcdir}/kst4contest-${pkgver}"
 
-    export JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name 'java-21-*' -type d | head -n 1)
+    export JAVA_HOME="${srcdir}/jdk-${_temurin}"
     export PATH="${JAVA_HOME}/bin:${PATH}"
 
     # A Gradle home inside $srcdir keeps the build independent of whatever the
@@ -24,7 +33,13 @@ build() {
     # cache, every dependency added since the last local build broke the package.
     export GRADLE_USER_HOME="${srcdir}/gradle-home"
 
-    ./gradlew --no-daemon -S :app-desktop:createDistributable
+    # The Java toolchain, and with it jpackage, would otherwise pick any JDK 21 it
+    # finds in /usr/lib/jvm, the system one included.
+    ./gradlew --no-daemon -S \
+        -Porg.gradle.java.installations.auto-detect=false \
+        -Porg.gradle.java.installations.auto-download=false \
+        -Porg.gradle.java.installations.paths="${JAVA_HOME}" \
+        :app-desktop:createDistributable
 
     # package() reads dist/KST4Contest. Application name, icon and the JDK
     # module list come from app-desktop/build.gradle.kts, so this PKGBUILD no

website/.eleventy.js

@@ -32,11 +32,26 @@ const MANUAL_PAGE_ORDER = {
     ]
 };
 
+// Removes HTML tags until none are left, so that nested input such as
+// "<<b>script>" cannot reassemble a tag after a single pass.
+function stripHtmlTags(value) {
+    let previous;
+    let current = value;
+
+    do {
+        previous = current;
+        current = current.replace(/<[^>]+>/g, "");
+    } while (current !== previous);
+
+    return current;
+}
+
 function markdownToPlainText(value) {
-    return (value || "")
+    const withoutLinks = (value || "")
         .replace(/!\[([^\]]*)\]\([^)]+\)/g, "$1")
-        .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
+        .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1");
-        .replace(/<[^>]+>/g, "")
+
+    return stripHtmlTags(withoutLinks)
         .replace(/[*_~`]/g, "")
         .replace(/\s+/g, " ")
         .trim();

website/package-lock.json

@@ -7,15 +7,15 @@
     "": {
       "name": "kst4contest-website",
       "version": "0.1.0",
-      "engines": {
-        "node": ">=18.19.1"
-      },
       "dependencies": {
-        "markdown-it": "^14.3.0",
+        "markdown-it": "^14.3.3",
         "markdown-it-anchor": "^9.2.0"
       },
       "devDependencies": {
         "@11ty/eleventy": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=18.19.1"
       }
     },
     "node_modules/@11ty/dependency-tree": {
@@ -397,9 +397,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.15",
+      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
-      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -831,9 +831,9 @@
       }
     },
     "node_modules/gray-matter/node_modules/js-yaml": {
-      "version": "3.15.0",
+      "version": "3.15.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
-      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1026,9 +1026,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
+      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
@@ -1098,9 +1098,9 @@
       }
     },
     "node_modules/liquidjs": {
-      "version": "10.27.1",
+      "version": "10.30.0",
-      "resolved": "https://registry.npmjs.org/liquidjs/-/liquidjs-10.27.1.tgz",
+      "resolved": "https://registry.npmjs.org/liquidjs/-/liquidjs-10.30.0.tgz",
-      "integrity": "sha512-ylE+1q2kSef1UxAyxqbyuWM3FRWS1v48JK1Y3CoW3bD6TSNXZh0+GsVnihujEpKyR+Jejx2aRAFfC3AHm9rElg==",
+      "integrity": "sha512-Fw4wA+8CZsJkaeLEIlPE3AoponfjEZhj7FQvYNcAEcg7jNRik7mEMoaco382FBdrYlykVf6w4vClPNctz2OYjg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1136,9 +1136,9 @@
       }
     },
     "node_modules/markdown-it": {
-      "version": "14.3.0",
+      "version": "14.3.3",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz",
-      "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==",
+      "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==",
       "funding": [
         {
           "type": "github",

website/package.json

@@ -15,7 +15,7 @@
     "@11ty/eleventy": "^3.0.0"
   },
   "dependencies": {
-    "markdown-it": "^14.3.0",
+    "markdown-it": "^14.3.3",
     "markdown-it-anchor": "^9.2.0"
   }
 }

website/scripts/validate-version-info.js

@@ -28,14 +28,29 @@ function extractTag(xml, tagName) {
     return match ? match[1].trim() : null;
 }
 
+// Applies the removal until nothing changes, so that nested input such as
+// "<!-<!---->-->" cannot leave a fresh comment behind after a single pass.
+function removeUntilStable(value, pattern) {
+    let previous;
+    let current = value;
+
+    do {
+        previous = current;
+        current = current.replace(pattern, "");
+    } while (current !== previous);
+
+    return current;
+}
+
 function assertWellFormedStructure(xml) {
     if (/&(?!amp;|lt;|gt;|quot;|apos;|#\d+;|#x[0-9a-f]+;)/i.test(xml)) {
         fail("the XML contains an unescaped ampersand");
     }
 
-    const withoutCommentsAndDeclaration = xml
+    const withoutCommentsAndDeclaration = removeUntilStable(
-        .replace(/<!--[\s\S]*?-->/g, "")
+        xml,
-        .replace(/<\?[\s\S]*?\?>/g, "");
+        /<!--[\s\S]*?-->|<\?[\s\S]*?\?>/g
+    );
 
     const tagPattern =
         /<\/?([A-Za-z_][\w:.-]*)(?:\s[^<>]*?)?\s*\/?>/g;