Report is not truly offline by default because runtime assets load from CDNs

[dreizehnutters]

Summary

NmapView is positioned as a single generated HTML report, but the report is not truly offline by default because some runtime assets are fetched from external CDNs.

Problem

When report.html is opened without internet access, or in restricted environments, parts of the UI can fail because dependencies are loaded remotely instead of being bundled into the
generated artifact.

At the moment this affects the “single file / portable report” story in practice:

• opening the report on an air-gapped system is unreliable
• sharing the report across isolated environments is less predictable
• the current behavior is easy to misunderstand as “fully offline”

Current behavior

The generated report loads frontend/runtime dependencies from CDNs, for example:

• DataTables bundle
• Plotly
• Bootstrap CSS

So while the scan data itself remains embedded in the generated report, the UI is still network-dependent by default.

Expected behavior

One of these should be true:

1. The report should be fully self-contained by default, with required CSS/JS bundled into the generated artifact.
2. Or there should be an explicit build/runtime mode split:
   • default portable/offline mode
   • optional CDN-backed lighter mode

Why this matters

NmapView is especially useful in jump-box, internal, restricted, or otherwise messy environments. Those are also exactly the places where external CDN access is least reliable or undesirable.

Possible approaches

• vendor the runtime assets directly into the XSL-generated report
• ship a release artifact that inlines required CSS/JS