fix(google-maps,gravatar): a11y misc fixes#802
Conversation
The script stats pages on scripts.nuxt.com count active hardware fingerprinting APIs (X Pixel: 4, Clarity: 5), but the first-party guide and v1 release notes were citing the wider entropy-weighted set (9 and 10). Use the stats-page numbers so both pages agree.
- Add optional `alt` prop on ScriptGoogleMapsStaticMap so authors can provide descriptive map labels instead of the hardcoded 'Google Maps'. - Add role="status" + aria-label="Loading avatar" to the Gravatar placeholder span so the loading state is announced to assistive tech. Follow-up to a11y audit from #798.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThis PR contains minor updates across documentation and Vue components. Two documentation files are updated with revised fingerprinting API counts for third-party providers. Three runtime components receive improvements: ScriptGoogleMapsStaticMap adds a customizable Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
harlan-zw
changed the title
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/docs/1.guides/2.first-party.md`:
- Line 8: The claim that "X Pixel accesses `navigator.getBattery()`" is
inaccurate; remove the `navigator.getBattery()` reference from the X Pixel
sentence (the fragment mentioning "X Pixel" and the backticked
`navigator.getBattery()`) and then either update the "4 browser fingerprinting
APIs" count to reflect the new list or replace the removed API with a currently
documented fingerprinting API supported by browsers (and add a citation/source
for that API); ensure the sentence text and the numeric count stay consistent
after the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9209a8ce-bace-4d94-a649-1f25f97c2356
📒 Files selected for processing (5)
docs/content/docs/1.guides/2.first-party.mddocs/content/docs/5.releases/1.v1.mdpackages/script/src/runtime/components/GoogleMaps/ScriptGoogleMapsStaticMap.vuepackages/script/src/runtime/components/ScriptGravatar.vuepackages/script/src/runtime/components/ScriptLoadingIndicator.vue
| ## The Problem | ||
|
|
||
| Every third-party script your site loads connects your users directly to external servers. Each request shares the user's IP address, and many scripts go further: the X Pixel accesses 9 browser fingerprinting APIs (including `navigator.getBattery()`{lang="ts"}), sets 5 tracking cookies (`muc_ads`, `guest_id_marketing`, `guest_id_ads`, `personalization_id`, `guest_id`), and phones home to 3 separate domains. Microsoft Clarity reads 10 fingerprinting APIs across 3 domains. Even Google Analytics at 154 KB sends data that can be correlated across sites. | ||
| Every third-party script your site loads connects your users directly to external servers. Each request shares the user's IP address, and many scripts go further: the X Pixel accesses 4 browser fingerprinting APIs (including `navigator.getBattery()`{lang="ts"}), sets 5 tracking cookies (`muc_ads`, `guest_id_marketing`, `guest_id_ads`, `personalization_id`, `guest_id`), and phones home to 3 separate domains. Microsoft Clarity reads 5 fingerprinting APIs across 3 domains. Even Google Analytics at 154 KB sends data that can be correlated across sites. |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Does X Pixel (Twitter/X tracking pixel) currently use navigator.getBattery API for fingerprinting in 2026
💡 Result:
No. In publicly available, authoritative documentation for X Pixel, there is no indication that X Pixel uses the Battery Status API (navigator.getBattery / BatteryManager) as part of its tracking or fingerprinting. Reasoning and evidence: 1) X Pixel is documented by X as a JavaScript tag for conversion/event tracking and attribution; the docs describe implementation steps and data sending, but do not mention navigator.getBattery or any Battery Status API usage [1]. 2) The Battery Status API is widely discussed as a potential fingerprinting surface (i.e., the API exists and can be used by any site that chooses to) but that general capability is not evidence that X Pixel does so [2]. 3) A best-effort search for explicit references to X Pixel using navigator.getBattery did not find any source-level claim linking X Pixel to navigator.getBattery (most results discuss X Pixel at a higher level or other fingerprinting vectors) [1][2]. Important caveat: Absence of public documentation is not proof that no code path exists. X’s pixel code is served/executed dynamically from their infrastructure, and X Pixel may change over time; however, based on the official X Pixel documentation available, there is currently no cited evidence that X Pixel uses navigator.getBattery in 2026 [1].
Citations:
- 1: https://business.x.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites
- 2: https://empirium.io/blog/mobile-device-fingerprinting
Fix the X Pixel navigator.getBattery() fingerprinting claim
- The snippet’s statement that X Pixel accesses
navigator.getBattery()isn’t supported by X’s publicly documented pixel/conversion tracking behavior, and the Battery Status API is deprecated/removed in major browsers. - Remove
navigator.getBattery()from the example (and re-check the “4 fingerprinting APIs” count) or replace it with APIs backed by current, citable sources.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/content/docs/1.guides/2.first-party.md` at line 8, The claim that "X
Pixel accesses `navigator.getBattery()`" is inaccurate; remove the
`navigator.getBattery()` reference from the X Pixel sentence (the fragment
mentioning "X Pixel" and the backticked `navigator.getBattery()`) and then
either update the "4 browser fingerprinting APIs" count to reflect the new list
or replace the removed API with a currently documented fingerprinting API
supported by browsers (and add a citation/source for that API); ensure the
sentence text and the numeric count stay consistent after the change.
1 participant
🔗 Linked issue
Related to a11y audit follow-up from #798
❓ Type of change
📚 Description
Two medium-priority a11y gaps from the audit.
ScriptGoogleMapsStaticMaphad a hardcodedalt="Google Maps", leaving screen-reader users without map context; now exposes an optionalaltprop (default unchanged).ScriptGravatar's fallback<span>placeholder had no semantics while loading; now getsrole="status"andaria-label="Loading avatar".Note
Branch was accidentally based on #801, so the diff includes that typo fix too. Resolves automatically once #801 merges.