Expect WebKit's plain-http cross-origin-isolation warning in the console guard

Release-Bump: major

e2e-tests/console-guard.ts

@@ -12,10 +12,14 @@ import { expect, test as base, type BrowserContext, type Page } from "@playwrigh
 const problems: string[] = [];
 const allowed: RegExp[] = [];
 
-// The one message the stack itself provokes: the runner reaches `web`/`proxy` by container name over
+// The messages the stack itself provokes: the runner reaches `web`/`proxy` by container name over
 // plain http, and only a `localhost` origin is trustworthy without TLS — so Chromium drops the COOP
-// header the app sends and says so on every page. Over https, where a deployment serves, it applies.
+// header the app sends, and WebKit reports the page not cross-origin isolated, on every page. Over
-const EXPECTED = [/^console\.error: The Cross-Origin-Opener-Policy header has been ignored/];
+// https, where a deployment serves, the header applies.
+const EXPECTED = [
+  /^console\.error: The Cross-Origin-Opener-Policy header has been ignored/,
+  /^console\.warning: This document is not cross-origin isolated because the document is not a secure context/,
+];
 
 // Allow a message for the current test only, when the page under test provokes it on purpose.
 export function allowConsole(...patterns: RegExp[]): void {

package-lock.json

@@ -7,7 +7,7 @@
       "name": "plainpages",
       "dependencies": {
         "@larvit/log": "2.3.0",
-        "ejs": "6.0.1",
+        "ejs": "7.0.2",
         "lucide-static": "1.70.0",
         "postgres": "3.4.9"
       },
@@ -409,9 +409,9 @@
       }
     },
     "node_modules/ejs": {
-      "version": "6.0.1",
+      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/ejs/-/ejs-6.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/ejs/-/ejs-7.0.2.tgz",
-      "integrity": "sha512-UaaM14yby8U3k02ihS1Bmj5Kz2d7CCQM1scxpgs4Mhkq8F1wR2gl3+Ts4h5Ne4Mnt7M9m4Dw7jsuMr3+xO4vZA==",
+      "integrity": "sha512-LcDSEP6Oclb9sTiSyG0MpG0RuKvLDRxCOOt+2sIk+kdk1rMkFU8SRnT0qaNt5zvU0LOV1YXXOvIoZL/sKwabvw==",
       "license": "Apache-2.0",
       "bin": {
         "ejs": "bin/cli.js"

package.json

@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "@larvit/log": "2.3.0",
-    "ejs": "6.0.1",
+    "ejs": "7.0.2",
     "lucide-static": "1.70.0",
     "postgres": "3.4.9"
   },