fix(security): CSP functional truth, desktop crypto, doc-truth hardening (v1.24.2) - #284

Merged

qnbs merged 21 commits into

mainfrom

fix/csp-truth-hardening-v1.24.2

Jul 29, 2026

Commits on Jul 29, 2026

fix(security): CSP functional truth — wasm-unsafe-eval + frame-src blob: (F-01..F-04)

qnbs
and
claude
committed
docs(ci): CSP gate-governance table + post-mortem (F-04 follow-through)

qnbs
and
claude
committed
fix(security): desktop API-key PBKDF2 + doc truth-up (F-05, F-06, F-07)

qnbs
and
claude
committed
fix(security): connect-src completeness — LanguageTool port + HF hosts (F-08)

qnbs
and
claude
committed
fix(security): self-host DuckDB-WASM instead of unversioned CDN (F-09)

qnbs
and
claude
committed
fix(docs): unify canonical Vercel URL + add drift gate (F-10)

qnbs
and
claude
committed
chore(ci): dedupe Storybook build, fix rebrand header, fix broken test-runner invocation (F-12)

qnbs
and
claude
committed
docs: record worker-generation duplication as tracked debt (F-14)

qnbs
and
claude
committed
docs(ci): non-blocking-gate exit criteria table (F-13, part 1/2)

qnbs
and
claude
committed
fix(ci): update stale check-doc-metrics.d.mts declarations (CI-caught, F-10 follow-up)

qnbs
and
claude
committed
fix(security): case-insensitive inline-script detection (CodeQL-caught, WS-1 follow-up)

qnbs
and
claude
committed
fix(security): tolerate malformed-but-valid closing script tags (CodeQL follow-up)

qnbs
and
claude
committed
chore: review-loop refinements from CodeRabbit/CodeAnt (WS-8/WS-9/WS-10 follow-up)

qnbs
and
claude
committed
chore(test): raise coverage ratchet to CI-measured values (F-13, part 2/2)

qnbs
and
claude
committed
chore(release): bump version to 1.24.2

qnbs
and
claude
committed
docs: WS-11 re-audit close-out + post-mortem (all 14 findings)

qnbs
and
claude
committed
fix: hostname-boundary regex + comment format (CodeRabbit) + missing coverage (Codecov)

qnbs
and
claude
committed
docs: doc-truth + markdownlint fixes from CodeRabbit's second review wave

qnbs
and
claude
committed
fix(a11y): use pre-vetted nav-active tokens for Writer VC/ProForge toggle contrast

qnbs
and
claude
committed
docs: mark the a11y color-contrast finding as fixed in TODO.md

qnbs
and
claude
committed
fix(a11y): apply nav-active contrast fix to desktop ProForge/Focus-Mode toggles

qnbs
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): CSP functional truth, desktop crypto, doc-truth hardening (v1.24.2) - #284

fix(security): CSP functional truth, desktop crypto, doc-truth hardening (v1.24.2)#284
qnbs merged 21 commits into
mainfrom
fix/csp-truth-hardening-v1.24.2

Commits on Jul 29, 2026

fix(security): CSP functional truth — wasm-unsafe-eval + frame-src blob: (F-01..F-04)

docs(ci): CSP gate-governance table + post-mortem (F-04 follow-through)

fix(security): desktop API-key PBKDF2 + doc truth-up (F-05, F-06, F-07)

fix(security): connect-src completeness — LanguageTool port + HF hosts (F-08)

fix(security): self-host DuckDB-WASM instead of unversioned CDN (F-09)

fix(docs): unify canonical Vercel URL + add drift gate (F-10)

chore(ci): dedupe Storybook build, fix rebrand header, fix broken test-runner invocation (F-12)

docs: record worker-generation duplication as tracked debt (F-14)

docs(ci): non-blocking-gate exit criteria table (F-13, part 1/2)

fix(ci): update stale check-doc-metrics.d.mts declarations (CI-caught, F-10 follow-up)

fix(security): case-insensitive inline-script detection (CodeQL-caught, WS-1 follow-up)

fix(security): tolerate malformed-but-valid closing script tags (CodeQL follow-up)

chore: review-loop refinements from CodeRabbit/CodeAnt (WS-8/WS-9/WS-10 follow-up)

chore(test): raise coverage ratchet to CI-measured values (F-13, part 2/2)

chore(release): bump version to 1.24.2

docs: WS-11 re-audit close-out + post-mortem (all 14 findings)

fix: hostname-boundary regex + comment format (CodeRabbit) + missing coverage (Codecov)

docs: doc-truth + markdownlint fixes from CodeRabbit's second review wave

fix(a11y): use pre-vetted nav-active tokens for Writer VC/ProForge toggle contrast

docs: mark the a11y color-contrast finding as fixed in TODO.md

fix(a11y): apply nav-active contrast fix to desktop ProForge/Focus-Mode toggles