19 Releases 21 Tags

RSS Feed

• v2.8.3-beta c1e73bda81

  Compare

  v2.8.3-beta - Security policy fixes for the web app Pre-Release

  fsylvain released this 2026-10-05 16:33:31 +02:00 | 60 commits to main since this release

  This release fixes the security headers added in v2.8.2-beta, which blocked parts of the web app in the browser.

  Improvements and fixes

  • The web app's icons now display again. They are bundled into the app instead of being fetched from an external icon service, which the security policy blocked.
  • The light and dark mode script in the page is now allowed by the security policy, so the color mode no longer fails to apply on load.
  • The security policy now allows WebAssembly, which parts of the web app need.

  Under the hood

  • Add a Vite plugin that bundles only the Lucide icons the app uses.
  • Compute a hash for each inline script in the served page and add it to the script-src directive, instead of allowing inline scripts in general.
  • Update the security headers tests.

  Upgrading

  • Replace the binary, or pull the new image. No schema change and no new environment variable.
  • If you are on v2.8.2-beta, upgrade: that version's policy broke icons and color mode.

  Downloads

  • checksums.txt
    608 B

    2026-10-05 16:34:06 +02:00
  • checksums.txt.sig
    89 B

    2026-10-05 16:34:06 +02:00
  • renewcms_v2.8.3-beta_darwin_amd64
    30 MiB

    2026-10-05 16:34:04 +02:00
  • renewcms_v2.8.3-beta_darwin_arm64
    29 MiB

    2026-10-05 16:34:06 +02:00
  • renewcms_v2.8.3-beta_linux_amd64
    30 MiB

    2026-10-05 16:34:01 +02:00
  • renewcms_v2.8.3-beta_linux_arm64
    29 MiB

    2026-10-05 16:34:02 +02:00
  • renewcms_v2.8.3-beta_windows_amd64.exe
    30 MiB

    2026-10-05 16:33:58 +02:00
  • renewcms_v2.8.3-beta_windows_arm64.exe
    29 MiB

    2026-10-05 16:33:59 +02:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)