From 01d1fba70f24bb92503626c8139e8020b25f5fad Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Wed, 27 May 2026 15:25:39 +1000
Subject: [PATCH 1/3] docs: align fingerprint API counts with stats pages
 (#793)

The script stats pages on scripts.nuxt.com count active hardware
fingerprinting APIs (X Pixel: 4, Clarity: 5), but the first-party
guide and v1 release notes were citing the wider entropy-weighted
set (9 and 10). Use the stats-page numbers so both pages agree.
---
 docs/content/docs/1.guides/2.first-party.md | 2 +-
 docs/content/docs/5.releases/1.v1.md        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/content/docs/1.guides/2.first-party.md b/docs/content/docs/1.guides/2.first-party.md
index b97969f42..7a208358e 100644
--- a/docs/content/docs/1.guides/2.first-party.md
+++ b/docs/content/docs/1.guides/2.first-party.md
@@ -5,7 +5,7 @@ description: Route third-party script traffic through a reverse proxy on your do
 
 ## The Problem
 
-Every third-party script your site loads connects your users directly to external servers. Each request shares the user's IP address, and many scripts go further: the X Pixel accesses 9 browser fingerprinting APIs (including `navigator.getBattery()`{lang="ts"}), sets 5 tracking cookies (`muc_ads`, `guest_id_marketing`, `guest_id_ads`, `personalization_id`, `guest_id`), and phones home to 3 separate domains. Microsoft Clarity reads 10 fingerprinting APIs across 3 domains. Even Google Analytics at 154 KB sends data that can be correlated across sites.
+Every third-party script your site loads connects your users directly to external servers. Each request shares the user's IP address, and many scripts go further: the X Pixel accesses 4 browser fingerprinting APIs (including `navigator.getBattery()`{lang="ts"}), sets 5 tracking cookies (`muc_ads`, `guest_id_marketing`, `guest_id_ads`, `personalization_id`, `guest_id`), and phones home to 3 separate domains. Microsoft Clarity reads 5 fingerprinting APIs across 3 domains. Even Google Analytics at 154 KB sends data that can be correlated across sites.
 
 Ad blockers rightfully block these requests, which breaks analytics for sites that depend on them.
 
diff --git a/docs/content/docs/5.releases/1.v1.md b/docs/content/docs/5.releases/1.v1.md
index 84b2909ad..7205ad27c 100644
--- a/docs/content/docs/5.releases/1.v1.md
+++ b/docs/content/docs/5.releases/1.v1.md
@@ -11,7 +11,7 @@ Nuxt Scripts v1 is the first stable release, pushing the ecosystem forward for b
 
 Every third-party script request exposes your users data to [fingerprinting](https://firstpartysimulator.net/learn).
 
-Different providers are more intrusive, for example, the X Pixel accesses 9 browser fingerprinting APIs (including `navigator.getBattery()`{lang="ts"}), sets 5 tracking cookies, and makes requests to 3 separate domains. Microsoft Clarity reads 10 fingerprinting APIs across 3 domains.
+Different providers are more intrusive, for example, the X Pixel accesses 4 browser fingerprinting APIs (including `navigator.getBattery()`{lang="ts"}), sets 5 tracking cookies, and makes requests to 3 separate domains. Microsoft Clarity reads 5 fingerprinting APIs across 3 domains.
 
 First-party mode acts as a **reverse proxy**: Nuxt bundles scripts at build time and serves them from your domain, while runtime requests are securely forwarded through your server. Data sent to third-party servers gets anonymised: IPs (`180.233.124.74` -> `180.233.124.0`), browser versions (`Mozilla/5.0 (compatible; Chrome/120.0)`{lang="ts"}) and more. This is **auto-enabled** for all scripts that support it.
 

From f6f4a13cb74bae4da03562421ae0d5953e03e8de Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Wed, 27 May 2026 15:27:45 +1000
Subject: [PATCH 2/3] fix: ScriptLoadingIndicator style binding typo

---
 .../script/src/runtime/components/ScriptLoadingIndicator.vue    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/script/src/runtime/components/ScriptLoadingIndicator.vue b/packages/script/src/runtime/components/ScriptLoadingIndicator.vue
index c77d81432..97c2609d9 100644
--- a/packages/script/src/runtime/components/ScriptLoadingIndicator.vue
+++ b/packages/script/src/runtime/components/ScriptLoadingIndicator.vue
@@ -16,7 +16,7 @@ const styles = computed(() => ({
 </script>
 
 <template>
-  <div class="loader" :styles="styles" aria-label="Loading..." role="status" />
+  <div class="loader" :style="styles" aria-label="Loading..." role="status" />
 </template>
 
 <style scoped>

From d8e92e7277ccc452481a7c81cb7457014e684619 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Wed, 27 May 2026 15:28:38 +1000
Subject: [PATCH 3/3] fix(a11y): GoogleMapsStaticMap alt prop + Gravatar
 fallback aria

- Add optional `alt` prop on ScriptGoogleMapsStaticMap so authors can
  provide descriptive map labels instead of the hardcoded 'Google Maps'.
- Add role="status" + aria-label="Loading avatar" to the Gravatar
  placeholder span so the loading state is announced to assistive tech.

Follow-up to a11y audit from #798.
---
 .../components/GoogleMaps/ScriptGoogleMapsStaticMap.vue    | 7 ++++++-
 packages/script/src/runtime/components/ScriptGravatar.vue  | 2 ++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMapsStaticMap.vue b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMapsStaticMap.vue
index 96a663ef8..4f3c67501 100644
--- a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMapsStaticMap.vue
+++ b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMapsStaticMap.vue
@@ -99,6 +99,10 @@ const props = withDefaults(defineProps<{
    * Additional attributes for the `<img>` element.
    */
   imgAttrs?: ImgHTMLAttributes & ReservedProps & Record<string, unknown>
+  /**
+   * Alt text for the map image. Override to provide a more descriptive label for screen readers.
+   */
+  alt?: string
 }>(), {
   zoom: 15,
   scale: 2,
@@ -106,6 +110,7 @@ const props = withDefaults(defineProps<{
   objectFit: 'cover',
   width: 640,
   height: 400,
+  alt: 'Google Maps',
 })
 
 defineSlots<{
@@ -232,7 +237,7 @@ const src = computed(() => {
 const imgAttributes = computed(() => {
   return defu(props.imgAttrs, {
     src: src.value,
-    alt: 'Google Maps',
+    alt: props.alt,
     loading: props.loading,
     style: {
       width: '100%',
diff --git a/packages/script/src/runtime/components/ScriptGravatar.vue b/packages/script/src/runtime/components/ScriptGravatar.vue
index 324d47796..93eddc2a1 100644
--- a/packages/script/src/runtime/components/ScriptGravatar.vue
+++ b/packages/script/src/runtime/components/ScriptGravatar.vue
@@ -58,6 +58,8 @@ onMounted(() => {
   >
   <span
     v-else
+    role="status"
+    aria-label="Loading avatar"
     :style="{ display: 'inline-block', width: `${size}px`, height: `${size}px`, borderRadius: '50%', background: '#e0e0e0' }"
   />
 </template>