Release#476
Conversation
* fix: handle unhandled fetch rejections on view counter calls and filter Google Translate proxy errors in Sentry * fix: harden CSP and security headers - Replace connect-src wildcard with explicit allowlist to prevent data exfiltration - Remove unsafe-eval from production script-src (keep for dev HMR only) - Add missing directives: object-src, base-uri, form-action, frame-ancestors, upgrade-insecure-requests - Add google-analytics.com to script-src and img-src for GTM chain-loading and tracking pixels - Drop data: from worker-src to prevent code execution bypass - Set X-XSS-Protection to 0 per OWASP recommendation - Upgrade Referrer-Policy to strict-origin-when-cross-origin - Add Permissions-Policy header to disable unused browser APIs * fix: move commitlint from pre-commit to commit-msg hook The hook was in pre-commit where the commit message doesn't exist yet, causing commitlint to validate previous commits instead of the current one. Also fix argument from $2 to $1 as commit-msg receives the message file path as the first argument. * fix: restore unsafe-eval in CSP for production runtime A bundled dependency uses new Function() during useMemo in blog post rendering, causing EvalError on Vercel preview deployments. * chore: bump prisma, sentry, and pnpm versions * chore: regenerate sitemap
# Conflicts: # next.config.js
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
No description provided.