RenewCMS/docs/releases/v2.8.3-beta.md

This release fixes the security headers added in v2.8.2-beta, which blocked parts of the web app in the browser.

Improvements and fixes

• The web app's icons now display again. They are bundled into the app instead of being fetched from an external icon service, which the security policy blocked.
• The light and dark mode script in the page is now allowed by the security policy, so the color mode no longer fails to apply on load.
• The security policy now allows WebAssembly, which parts of the web app need.

Under the hood

• Add a Vite plugin that bundles only the Lucide icons the app uses.
• Compute a hash for each inline script in the served page and add it to the script-src directive, instead of allowing inline scripts in general.
• Update the security headers tests.

Upgrading

• Replace the binary, or pull the new image. No schema change and no new environment variable.
• If you are on v2.8.2-beta, upgrade: that version's policy broke icons and color mode.