v1.13.0-rc.1

1.13.0-rc.1 (2026-07-20)

Features

• add CSP_EXTRA_FONT_SRC to allow-list an external font host (#654) (00f25ba)
• declare base-uri, form-action and object-src in the csp (#652) (86017d8)
• deny framing by default with frame-ancestors and X-Frame-Options (#656) (a4ec64f)
• proxy remote images so img-src can drop the https: wildcard (#655) (a65b3d6)

---

🚧 Release candidate

This is a release candidate, published for testing ahead of 1.13.0. It is not supported for production — run it against a copy of your data, not your live workspace, and expect it to be superseded without notice. Self-hosters should stay on the latest stable release.

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.13.0-rc.1

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.