[JuliusHenke]

Summary

• The relay marker tooltip in layer-construction.ts was passed to Leaflet as a HTML string. Nicknames are limited to [0-9a-zA-Z]{1,19} by the vendored parser, so this is not exploitable today (low severity, defense in depth), but THREAT_MODEL.md forbids Leaflet string tooltips for relay-derived fields.
• The tooltip is now a text node, like the country usage layer. Tests read textContent, and a new test checks that markup in a nickname is not interpreted.

Testing

• yarn install --immutable, yarn build, yarn lint: pass.
• yarn test:run: 347/347 pass (Chromium browser tests included).
• Backend ./gradlew test and Docker builds were not run: Maven Central returned 429 and there is no Docker daemon in this environment. The change touches only frontend/src.

Deployment notes

None.

Suggested labels: bug, frontend (hardening, not a vulnerability fix).

---

Generated by Claude Code

[JuliusHenke]

The code/snyk (JuliusHenke) status is red with "Code test limit reached". That is the Snyk account's usage quota, not a finding in this diff (a 4-line change in layer-construction.ts plus tests). There is no code fix for it, and I have no means to re-run the Snyk check. It should pass once the quota resets or someone re-triggers it. Lint, build and all 347 frontend tests pass locally.

---

Generated by Claude Code

[JuliusHenke]

frontend_build_deploy and Deploy Preview are the same failure: the Firebase preview deploy step got 403 AUTH_PERMISSION_DENIED (serviceusage.services.get on the Firebase Hosting API). That is the deploy service account's permissions, not this diff, which only changes layer-construction.ts and its test. The build, lint and tests pass locally and there is no code fix for it here. I can't re-run the check, so it needs a maintainer to re-run it once the service account has access.

---

Generated by Claude Code