2 commits

Author	SHA1	Message	Date
nesquena-hermes	8f89b4f825	Release v0.51.278 — Release IT (stage-p3g — repair inline PDF preview #3652) (#3684) ... * fix(ui): repair inline PDF preview (blob module loader + CSP worker-src) (#3652, #3649) Co-authored-by: sky <example@email.com> * docs(changelog): v0.51.278 — Release IT (stage-p3g, #3652 only); widen CSP test window --------- Co-authored-by: nesquena-hermes <[email protected]> Co-authored-by: sky <example@email.com>	2026-06-05 14:27:38 -07:00
Basit Mustafa	b072a6887c	fix(csp): add explicit manifest-src 'self' directive (#961) ... PR #920 added static/manifest.json and sw.js for PWA support. The CSP in _security_headers() had no explicit manifest-src directive, so browsers fell back to default-src 'self' and emitted a console warning on every page load. The fallback is functionally correct but non-compliant with CSP Level 3 best practice of declaring each directive explicitly. Adds manifest-src 'self' before base-uri. No origin set is changed. Regression test added alongside existing CSP coverage in test_pwa_manifest_csp.py. Co-authored with Claude Sonnet 4.6 / Anthropic.	2026-04-24 10:44:46 -07:00