Allow data: URLs for CSP font-src

package.json

@@ -55,18 +55,18 @@
     "@hebcal/locales": "^5.0.1",
     "@hebcal/rest-api": "^5.1.2",
     "@hebcal/triennial": "^5.1.2",
-    "better-sqlite3": "^11.2.1",
+    "better-sqlite3": "^11.3.0",
     "dayjs": "^1.11.13",
     "ejs": "^3.1.10",
     "emoji-flag": "^1.1.0",
     "etag": "^1.8.1",
     "fastest-levenshtein": "^1.0.16",
-    "geo-tz": "^8.0.2",
+    "geo-tz": "^8.1.1",
     "geolite2-redist": "^3.1.1",
     "google-protobuf": "^3.21.4",
     "haversine": "^1.1.1",
     "http-errors": "^2.0.0",
-    "ini": "^4.1.3",
+    "ini": "^5.0.0",
     "koa": "^2.15.3",
     "koa-better-response-time": "^1.2.0",
     "koa-bodyparser": "^4.4.1",
@@ -79,7 +79,7 @@
     "koa-timeout-v2": "^1.0.0",
     "maxmind": "^4.3.21",
     "murmurhash3": "^0.5.0",
-    "mysql2": "^3.11.0",
+    "mysql2": "^3.11.1",
     "nodemailer": "^6.9.15",
     "nodemailer-html-to-text": "^3.2.0",
     "pdfkit": "^0.15.0",

src/app-www.js

@@ -231,7 +231,7 @@ app.use(async function strictContentSecurityPolicy(ctx, next) {
       ` frame-ancestors https: data:;` +
       ` frame-src https: data:;` +
       ` img-src 'self' https: data:;` +
-      ` font-src 'self' https://fonts.gstatic.com/;` +
+      ` font-src 'self' data: https://fonts.gstatic.com/;` +
       ` object-src 'none';` +
       ` base-uri 'none'`;
     ctx.set('Content-Security-Policy', csp);