fix(security): audit batch B — SPA CSP + vite upgrade #21

Merged

cesnimda merged 1 commits from fix/audit-frontend into develop 2026-07-02 03:24:58 +02:00

Conversation 0 Commits 1 Files Changed 5

+561 -1125

cesnimda commented 2026-07-02 03:21:56 +02:00

Owner

Copy Link

Copy Source

Audit batch B (M-2, M-5): SPA CSP + security headers + gzip; theme bootstrap moved to /theme-init.js so script-src 'self' holds; vite 5->8 clears dev esbuild advisories (npm audit fully clean). Build verified.

🤖 Generated with Claude Code

Audit batch B (M-2, M-5): SPA CSP + security headers + gzip; theme bootstrap moved to /theme-init.js so script-src 'self' holds; vite 5->8 clears dev esbuild advisories (npm audit fully clean). Build verified. 🤖 Generated with Claude Code

cesnimda added 1 commit 2026-07-02 03:21:57 +02:00

fix(security): audit batch B — SPA CSP/security headers + vite upgrade ... 38a58871ac

Implements AUDIT_REPORT.md M-2 and M-5:
- M-2: CSP (script-src 'self'; frame-ancestors 'none'; object-src 'none'; ...),
  nosniff, X-Frame-Options DENY, Referrer-Policy on the SPA nginx, plus gzip for
  the bundle. The inline theme bootstrap moved to /theme-init.js so script-src
  'self' holds with no inline scripts.
- M-5: vite 5 -> 8 (+ plugin-react 6) — clears the dev-only esbuild advisories;
  npm audit now reports 0 vulnerabilities including dev deps. Build verified.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda merged commit b905c93884 into develop 2026-07-02 03:24:58 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

cesnimda

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cesnimda/Inboxintel#21