[maurerle]

This prepares the upcoming release of meshviewer v14

[github-actions]

Preview deployed: https://freifunk.github.io/meshviewer/pr-preview/pr-548/

Updated for commit ded9dea.

[rotanid]

Draft for the release notes of v14.0.0 — the release workflow auto-generates the "What's Changed" list, this block would go on top of the draft release once the tag lands:

This release focuses on security hardening, map features and internal modernization:

* security: escape untrusted text before HTML insertion, URL-encode template values,
  stop resolving ids to inherited object properties (#525)
* security: Docker image now sends Content-Security-Policy and other security headers;
  inline scripts and event handlers dropped
* embed: only accept navigation messages from the embedding page
* pwa: service-worker updates activate without closing all tabs; offline case handled in-app
* map: external GeoJSON layers can be loaded via URL (#476), with abortable in-flight requests
* map: vector maps are inverted in dark mode
* filters: values are normalized before comparing
* ci: npm audit fails on high/critical severity only (#537)
* eol: added Ubiquiti M5 devices (#473) and Linksys WRT160NL (#547)
* internal: remaining JS converted to TypeScript, eslint findings fixed (#507),
  code modernized (#477), utils decomposed into focused modules

One thing worth calling out explicitly for upgraders: vite-plugin-pwa went 1.3.0 → 2.0.0 (#515), a major bump of the build toolchain. Combined with the embed/navigation-message restriction and the dropped offline page, embeds that rely on the old message behavior should test before upgrading — that is also the honest justification for the major version bump.