Danijel Martinek cd61b31e65 fix(cms): thread a per-request nonce through the admin CSP ...

The prod CSP emitted script-src 'strict-dynamic' with no nonce seed,
blocking every Payload admin script (A8). Reuse the shared nonce-based
withSecurityHeaders: Payload admin pages are always dynamically
rendered, so Next propagates the nonce read from the forwarded
request's CSP header onto the admin's scripts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 17:25:04 +02:00

..

src

fix(cms): thread a per-request nonce through the admin CSP

2026-07-10 17:25:04 +02:00

AGENTS.md

docs(agents): write per-app AGENTS.md for cms, web-next, web-tanstack, storybook

2026-05-05 10:00:28 +02:00

eslint.config.js

chore: repair pre-existing lint failures blocking the lint gate

2026-07-10 16:21:26 +02:00

instrumentation.ts

fix(otel): consolidate to single OTel SDK init at instrumentation.register hook

2026-05-11 12:38:17 +02:00

middleware.ts

fix(cms): thread a per-request nonce through the admin CSP

2026-07-10 17:25:04 +02:00

next-env.d.ts

chore(core-cms): regenerate Payload types with consentState field

2026-05-26 11:46:39 +02:00

next.config.mjs

feat(cms): Sentry server instrumentation + withSentryConfig + R38 PII test

2026-05-07 20:14:56 +02:00

package.json

build: bump vitest past GHSA-5xrq-8626-4rwp; coverage-v8 everywhere

2026-07-10 16:44:48 +02:00

tsconfig.json

chore(tsconfig): migrate off deprecated baseUrl

2026-05-08 09:44:00 +02:00

tsconfig.tsbuildinfo

feat(core-consent): add PayloadConsent, RecordingConsent and DI binders

2026-05-19 12:39:31 +00:00

turbo.json

build(turbo): add boundaries enforcement matching ESLint dependency graph

2026-05-05 11:59:44 +02:00

vitest.config.ts

feat(apps): add unit tests for providers + bind-production + cms config

2026-05-05 16:34:19 +02:00