Danijel Martinek 00fcc9d9a1 fix(core-shared): set CSP on forwarded request headers for nonce ...

Next.js only injects the nonce into its own scripts when it can read it
from the request's Content-Security-Policy header. Setting the CSP only
on the response left hydration scripts un-nonced in production (A9).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 17:24:01 +02:00

..

src

fix(core-shared): set CSP on forwarded request headers for nonce

2026-07-10 17:24:01 +02:00

AGENTS.md

docs(adr): rename ADR-012 — drop Lazar; update title + content + cross-refs

2026-05-13 10:07:37 +02:00

eslint.config.js

refactor: rename eslint-config + typescript-config to core-eslint + core-typescript

2026-05-05 10:37:07 +02:00

package.json

build: bump vitest past GHSA-5xrq-8626-4rwp; coverage-v8 everywhere

2026-07-10 16:44:48 +02:00

tsconfig.json

feat(core-shared): add defineErrorMiddleware factory + export t

2026-05-06 11:43:45 +02:00

turbo.json

feat(core-shared): scaffold empty package with exports + tags

2026-05-04 20:29:57 +02:00

vitest.config.ts

fix(coverage): exempt .d.ts files from diff coverage gate

2026-05-18 18:26:50 +00:00