19 lines
990 B
Markdown
19 lines
990 B
Markdown
This release fixes the security headers added in v2.8.2-beta, which blocked parts of the web app in the browser.
|
|
|
|
## Improvements and fixes
|
|
|
|
- The web app's icons now display again. They are bundled into the app instead of being fetched from an external icon service, which the security policy blocked.
|
|
- The light and dark mode script in the page is now allowed by the security policy, so the color mode no longer fails to apply on load.
|
|
- The security policy now allows WebAssembly, which parts of the web app need.
|
|
|
|
## Under the hood
|
|
|
|
- Add a Vite plugin that bundles only the Lucide icons the app uses.
|
|
- Compute a hash for each inline script in the served page and add it to the `script-src` directive, instead of allowing inline scripts in general.
|
|
- Update the security headers tests.
|
|
|
|
## Upgrading
|
|
|
|
- Replace the binary, or pull the new image. No schema change and no new environment variable.
|
|
- If you are on v2.8.2-beta, upgrade: that version's policy broke icons and color mode.
|