From c1e73bda812bab17aa16a721568b8c9ce286a985 Mon Sep 17 00:00:00 2001
From: Florian Sylvain <sylvainflorian@icloud.com>
Date: Mon, 5 Oct 2026 16:33:31 +0200
Subject: [PATCH] release: v2.8.3-beta Security policy fixes for the web app

---
 docs/release-notes.md        |  1 +
 docs/releases/v2.8.3-beta.md | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 docs/releases/v2.8.3-beta.md

diff --git a/docs/release-notes.md b/docs/release-notes.md
index 44ecc12..9c76633 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -33,3 +33,4 @@ Each body lives in `docs/releases/<tag>.md`. Publish with `tea releases create -
 | `v2.8.0-beta` | v2.8.0-beta - API keys and API reference |
 | `v2.8.1-beta` | v2.8.1-beta - Docker deployment |
 | `v2.8.2-beta` | v2.8.2-beta - Security headers and clearer log in errors |
+| `v2.8.3-beta` | v2.8.3-beta - Security policy fixes for the web app |
diff --git a/docs/releases/v2.8.3-beta.md b/docs/releases/v2.8.3-beta.md
new file mode 100644
index 0000000..cf375fe
--- /dev/null
+++ b/docs/releases/v2.8.3-beta.md
@@ -0,0 +1,18 @@
+This release fixes the security headers added in v2.8.2-beta, which blocked parts of the web app in the browser.
+
+## Improvements and fixes
+
+- The web app's icons now display again. They are bundled into the app instead of being fetched from an external icon service, which the security policy blocked.
+- The light and dark mode script in the page is now allowed by the security policy, so the color mode no longer fails to apply on load.
+- The security policy now allows WebAssembly, which parts of the web app need.
+
+## Under the hood
+
+- Add a Vite plugin that bundles only the Lucide icons the app uses.
+- Compute a hash for each inline script in the served page and add it to the `script-src` directive, instead of allowing inline scripts in general.
+- Update the security headers tests.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. No schema change and no new environment variable.
+- If you are on v2.8.2-beta, upgrade: that version's policy broke icons and color mode.