@forge/csp - npm Package Compare versions

Comparing version 2.1.2 to 2.1.3-next.0

CHANGELOG.md

 # @forge/csp
 
+## 2.1.3-next.0
+
+### Patch Changes
+
+- 6d9b010: Replace unpkg.com in the Content Security Policy for stylesheets in Forge custom UI with the Forge global URL.
+
 ## 2.1.2
@@ -4,0 +10,0 @@

out/csp/csp-injection-service.js

@@ -43,3 +43,7 @@ "use strict";
             ].join(' ');
-            const styleSrc = ["'self'", ...this.getExistingCSPDetails(types_1.ExternalCspType.STYLE_SRC, existingCSPDetails)].join(' ');
+            const styleSrc = [
+                "'self'",
+                this.getForgeGlobalCSP(microsEnv),
+                ...this.getExistingCSPDetails(types_1.ExternalCspType.STYLE_SRC, existingCSPDetails)
+            ].join(' ');
             const navigateTo = ["'self'"];
@@ -56,3 +60,3 @@ return [
                 `navigate-to ${navigateTo}`,
-                `style-src ${styleSrc} https://unpkg.com/@atlaskit/tokens@0.10.30/css/atlassian-light.css https://unpkg.com/@atlaskit/tokens@0.10.30/css/atlassian-dark.css`,
+                `style-src ${styleSrc}`,
                 `form-action 'self'`,
@@ -59,0 +63,0 @@ `sandbox allow-downloads allow-forms allow-modals allow-pointer-lock allow-same-origin allow-scripts`,

package.json

 {
   "name": "@forge/csp",
-  "version": "2.1.2",
+  "version": "2.1.3-next.0",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
@@ -14,4 +14,4 @@ "main": "out/index.js",
   "devDependencies": {
-    "@forge/cli-shared": "3.11.0",
-    "@forge/manifest": "4.10.0",
+    "@forge/cli-shared": "3.11.1-next.0",
+    "@forge/manifest": "4.11.0-next.0",
     "@types/jest": "^29.1.2"
@@ -18,0 +18,0 @@ },

New alerts

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

24985

increased by0.58%

Lines of code

321

increased by1.26%

Worsened metrics

Number of low quality alerts

2

increased by100%

No dependency changes