Skip to content

v1.13.0

Choose a tag to compare

View all tags
@emmpaul emmpaul released this 20 Jul 23:25
v1.13.0
f868406
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

1.13.0 (2026-07-20)

Features

  • add CSP_EXTRA_FONT_SRC to allow-list an external font host (#654) (00f25ba)
  • declare base-uri, form-action and object-src in the csp (#652) (86017d8)
  • deny framing by default with frame-ancestors and X-Frame-Options (#656) (a4ec64f)
  • proxy remote images so img-src can drop the https: wildcard (#655) (a65b3d6)
  • send hsts on secure responses and default the secure session cookie (#659) (7ee77dd)
  • set a content-security-policy header on web responses (#650) (51bc293)

Bug Fixes

  • fork worktrees from the remote base branch (#642) (edf1639), closes #639
  • give the browser-written cookies samesite and secure flags (#657) (082b967)
  • refuse a candidate release below develop's baseline (#638) (87dbcb6)
  • stop background writes from cancelling the visit in flight (#646) (560e39f)

Performance

  • run the local Pest gate in parallel like CI does (#649) (4d4889c)

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.13.0

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

Assets 2
Loading