v0.7.3

What's Changed

• fix(examples): remove unpkg Leaflet preload from exemple-masa-v2 by @bmatge in #50
• ci(security): add Trivy SCA + config scan and mcp-server audit (#56) by @bmatge in #67
• ci(security): add Gitleaks scan (CI + pre-commit) and incident runbook (#59) by @bmatge in #68
• ci(security): add Semgrep SAST and fix prototype pollution in JSON path helpers (#57) by @bmatge in #70
• ci(security): add CodeQL SAST workflow (#58) by @bmatge in #71
• ci(security): add eslint-plugin-security with tuned overrides (#60) by @bmatge in #72
• ci(security): add Trivy image scan workflow for Docker images (#62) by @bmatge in #74
• docs(security): SECURITY.md + dev guide + SARIF upload + badges (#63) by @bmatge in #75
• docs(security): extract reusable security baseline template (#64) by @bmatge in #79
• chore(deps): bump the production-dependencies group with 2 updates by @dependabot[bot] in #52
• chore(deps): bump hono from 4.12.11 to 4.12.12 in /mcp-server by @dependabot[bot] in #77
• chore(deps): bump @hono/node-server from 1.19.12 to 1.19.14 in /mcp-server by @dependabot[bot] in #78
• chore(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #47
• chore(deps): bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in #48
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #49
• chore(deps-dev): bump the dev-dependencies group with 4 updates by @dependabot[bot] in #51
• chore(deps-dev): bump jsdom from 28.1.0 to 29.0.2 by @dependabot[bot] in #54
• chore(deps): bump uuid from 11.1.0 to 13.0.0 by @dependabot[bot] in #53
• chore(deps): bump vitest stack to 4.1.4 by @bmatge in #80
• ci(deps): enable Dependabot Cargo for src-tauri by @bmatge in #81
• fix(security): type confusion on /auth/users and XSS in playground back-link by @bmatge in #91
• chore(deps): bump actions/github-script from 7 to 9 by @dependabot[bot] in #82
• chore(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #84
• chore(deps): bump the cargo-minor-patch group in /src-tauri with 2 updates by @dependabot[bot] in #85
• chore(deps): bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in #83
• chore(deps-dev): bump happy-dom from 20.8.9 to 20.9.0 in the dev-dependencies group by @dependabot[bot] in #86
• chore(deps-dev): bump better-sqlite3 from 11.10.0 to 12.9.0 by @dependabot[bot] in #87
• chore(deps): remove deprecated @types/uuid by @bmatge in #93
• chore(deps): bump vite-node from 3 to 6 by @bmatge in #95
• fix: ajouter la tuile dsfr-data-podium sur la page d'accueil des specs by @bmatge in #46
• fix(security): rate limiting on /logout and global /api safety net by @bmatge in #96
• fix(security): harden XSS and sanitization (code-scanning triage −18) by @bmatge in #97
• chore(lint): eliminate 110 ESLint warnings (#45 mechanical pass) by @bmatge in #98
• chore(security): add sca-advisory non-blocking CI job (closes #73) by @bmatge in #99
• chore(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #100
• chore(deps): bump actions/configure-pages from 4 to 6 by @dependabot[bot] in #101
• chore(deps): bump mysql2 from 3.20.0 to 3.22.0 by @dependabot[bot] in #104
• chore(deps-dev): bump prettier from 3.8.2 to 3.8.3 in the dev-dependencies group by @dependabot[bot] in #102
• feat(ci): add OWASP ZAP DAST workflow (closes #61) by @bmatge in #107
• chore(deps): bump hono from 4.12.12 to 4.12.14 in /mcp-server by @dependabot[bot] in #106
• feat(security): add SRI to CDN assets (closes #69) by @bmatge in #108
• feat(security): unified nginx security headers via include snippet by @bmatge in #109
• feat(security): CSRF protection via double-submit cookie (closes #92) by @bmatge in #110
• chore: release by @github-actions[bot] in #111
• chore(deps): upgrade server to Express 5 (closes #94) by @bmatge in #112
• feat(docker): nginx non-root (closes #66) by @bmatge in #113
• chore(lint): type 12 no-explicit-any in dashboard + monitoring (#45 phase 1) by @bmatge in #114
• chore(lint): type 16 no-explicit-any (#45 phase 2+3) by @bmatge in #115
• chore(lint): type 13 no-explicit-any in builder-carto (#45 phase 3b) by @bmatge in #116
• chore(lint): type 7 no-explicit-any in chart-renderers (#45 phase 4a) by @bmatge in #117
• chore(lint): type 11 no-explicit-any in core components (#45 phase 4b.1) by @bmatge in #118
• chore(lint): type 26 no-explicit-any in dsfr-data-map-layer (#45 phase 4b.2) by @bmatge in #119
• chore(lint): eliminate last 24 no-explicit-any — CLOSE #45 by @bmatge in #120
• chore(deps): bump elkjs from 0.8.2 to 0.11.1 by @dependabot[bot] in #103
• chore(deps-dev): bump vite from 6.4.2 to 8.0.8 by @dependabot[bot] in #105
• chore(ci): strip nosemgrep-suppressed findings from Semgrep SARIF by @bmatge in #121
• feat(map): sovereign-only mode + osm-fr preset + third-party licenses (#27) by @bmatge in #122
• feat(builder): inline section summaries + compact source row + preview polish (#24) by @bmatge in #124
• feat(header): 'Beta {version}' badge and drop experimental warning by @bmatge in #125
• chore: release by @github-actions[bot] in #123
• fix(docker): chown html/public + auto-fix beacon-logs volume perms by @bmatge in #126
• chore(front): narrower sidemenu + fix TS rootDir warning from version import by @bmatge in #127
• chore: release by @github-actions[bot] in #128
• fix(header): afficher Connexion dans le menu mobile by @bmatge in #130
• chore: release by @github-actions[bot] in #129
• fix(apps): align DSFR template + enable OS dark/light (v0.7.1) by @bmatge in #131
• chore(deps): bump zaproxy/action-baseline from 0.14.0 to 0.15.0 by @dependabot[bot] in #138
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #137
• chore(deps): bump the cargo-minor-patch group in /src-tauri with 2 updates by @dependabot[bot] in #141
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates by @dependabot[bot] in #142
• chore(deps): bump the production-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #139
• feat(builder): tri par champ libre + ordre source preserve by @bmatge in #145
• chore(deps): bump ip-address and express-rate-limit by @dependabot[bot] in #143
• chore(deps): bump ip-address and express-rate-limit in /mcp-server by @dependabot[bot] in #144
• chore(deps): bump uuid from 13.0.0 to 14.0.0 by @dependabot[bot] in #135
• chore(deps): bump tauri from 2.11.0 to 2.11.1 in /src-tauri by @dependabot[bot] in #146
• chore(deps): bump hono from 4.12.14 to 4.12.18 in /mcp-server by @dependabot[bot] in #147
• fix(favorites): builder-carto sauvegarde + alignement noms champs serveur by @bmatge in #150
• feat(favorites): partage public d'un favori (sources publiques) — issue #148 partie 1/2 by @bmatge in #151
• chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /mcp-server by @dependabot[bot] in #153
• fix(ci): SRI manquants + Gitleaks OSS pour le miroir mef-snum-miweb by @bmatge in #165
• fix(core): inclut dsfr-data-join dans le bundle core by @bmatge in #163
• fix(core): rend visible l'erreur de configuration "id" manquant by @bmatge in #162
• chore(deps): bump the production-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #166
• chore(deps): bump the cargo-minor-patch group across 1 directory with 4 updates by @dependabot[bot] in #167
• chore(deps): bump qs from 6.15.0 to 6.15.2 in /mcp-server by @dependabot[bot] in #164
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates by @dependabot[bot] in #160
• fix(map-popup): lazy lookup du enfant (closes #156) by @bmatge in #170
• chore(ci): bump Node 20 -> 24 sur workflows + Dockerfiles (closes #169) by @bmatge in #171
• build(docker): propage VITE_PROXY_URL et VITE_LIB_URL au build Docker (#168 PR-1) by @bmatge in #172
• build(docker): proxy d'entreprise build-time + CSP self-hostable (#168 PR-2) by @bmatge in #173
• build: fail-fast sur variables d'env requises (#168 PR-3) by @bmatge in #174
• docs: aligner doc sur l'épic #168 self-hostable by @bmatge in #175
• fix(app-sidemenu): wrapping des libellés longs dans le menu du guide by @bmatge in #176
• build(node): honore HTTP_PROXY/HTTPS_PROXY/NO_PROXY au runtime (#168 PR-4) by @bmatge in #178
• docs(self-hosted): section dédiée + annotations DÉSACTIVABLE nginx (#168 PR-5) by @bmatge in #179
• build: séparer PROXY_BASE_URL / PROXY_BASE_URL_EMBED / BEACON_BASE_URL (#180) by @bmatge in #181
• docs: refonte README orienté audiences + checklist post-déploiement by @bmatge in #207
• ci(pages): header/footer statiques sur GitHub Pages uniquement (post-build) by @bmatge in #210
• docs(pages): nav Specs↔Guide + redirect /guide/ + README pointe vers Pages by @bmatge in #211
• epic(ux): feedback systémique sur les 3 critiques de l'audit UX (#182) by @bmatge in #212
• epic(ux): wording naturel du Builder (batch 1 de #183) by @bmatge in #213
• fix(ui): restore French accents on UI strings + CI grep check (closes #192) by @bmatge in #214
• feat(sources): edit existing manual sources (closes #186) by @bmatge in #215
• epic(ux): wording Sources batch 3 — modales API + jointures (closes #183) by @bmatge in #216
• fix(ux): polish batch — 6 quick wins de la salve 2 de l'audit UX by @bmatge in #217
• fix(ux): polish batch 3 — map warning + palette swatches + smart defaults by @bmatge in #218
• docs(builder): doc URL in generated code + reclassify minor changeset to patch (closes #209, closes #188) by @bmatge in #219
• chore: release by @github-actions[bot] in #136
• fix(ci): exclude CHANGELOG.md from check:accents by @bmatge in #220
• Add esm.sh CDN support and docker-compose override auto-merge by @bmatge in #221
• feat(core): epic A — tableur "wide" en HTML pur (unpivot + compute + series-field) by @bmatge in #236
• feat(mcp): generate_widget_code connaît la prep de données (normalize + unpivot) by @bmatge in #237
• fix(mcp): 404 (au lieu de 400) sur session inconnue → recovery auto après redémarrage by @bmatge in #238
• feat(builder-ia): assistant Albert agentique (structured outputs + tools) + refonte UX du chat by @bmatge in #239
• Feat/builder ia albert by @bmatge in #241
• fix(builder-ia): hauteur mini + scroll au lieu du 100vh rigide by @bmatge in #240
• chore(ci): check:accents non bloquant + restreint au contenu des balises HTML by @bmatge in #242
• feat(guide): toggle pour masquer les jeux de données de démo dans les builders by @bmatge in #243
• fix(tabular): fallback to client-side aggregation for unsafe field names by @bmatge in #244
• feat(proxy): support custom headers for unknown API hosts via CORS proxy by @bmatge in #252
• fix(sources): format d'auth OpenDataSoft (Authorization: Apikey) by @bmatge in #254
• chore(deps): bump log from 0.4.30 to 0.4.31 in /src-tauri in the cargo-minor-patch group by @dependabot[bot] in #245
• chore(deps): bump hono from 4.12.18 to 4.12.23 in /mcp-server by @dependabot[bot] in #251
• chore(deps): bump the production-dependencies group with 2 updates by @dependabot[bot] in #247
• chore(deps): bump helmet from 8.1.0 to 8.2.0 by @dependabot[bot] in #248
• chore(deps): bump undici from 7.25.0 to 8.3.0 by @dependabot[bot] in #250
• chore(deps-dev): bump lint-staged from 16.4.0 to 17.0.7 by @dependabot[bot] in #249
• chore(deps-dev): bump the dev-dependencies group with 7 updates by @dependabot[bot] in #246

New Contributors

• @dependabot[bot] made their first contribution in #52
• @github-actions[bot] made their first contribution in #111

Full Changelog: v0.5.0...v0.7.3