Skip to content

3.13.112

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Aug 22:31
· 315 commits to v3 since this release
3.13.112
28377cc

Release 3.13.112 — CSP-clean dev toolbar (#115)

The injected dev toolbar now renders styled and functional under the framework's
own default default-src 'self' CSP in ALL four frameworks. Its CSS and JS move
out of the injected HTML into external /__dev/toolbar.css + /__dev/toolbar.js
routes (served with explicit content-types, never through the HTML renderer so
the toolbar is not injected into its own assets), every event is wired via
addEventListener, and the live reloader is gated on a data-reload attribute
(suppressed on the AI port). Previously Python, Node and Ruby emitted inline
style=, onclick= and <script>, which the strict default CSP silently blocked —
the toolbar rendered unstyled and non-functional with the console full of CSP
violations. A shared contract invariant (devadmin-toolbar-csp-clean) locks the
property across all four.

Assets 2
Loading