openvibers/openvibe.host Commits

Pins: openvibe-shared 1.17.0 -> 1.17.1 (release notifications)

OP OpenVibers committed 26 Sept 2026 · 5d53eefced · 5 files, +13 −8

CSP connect-src also allows https://events.openvibe.network, where release-watch opens its EventSource on the Events realtime stream (host.release.published). Nothing else in the policy changes.

Changes

ddiff --git a/docs/release-notifications.md b/docs/release-notifications.md
iindex ea4d0a1..d8de72c 100644
---- a/docs/release-notifications.md
++++ b/docs/release-notifications.md
@@@ -126,8 +126,10 @@ All commands run on the production host. None of them prints a secret.
  ## Before a site pins openvibe-shared 1.17.0
  
  The tab's EventSource is subject to the site's Content-Security-Policy, so `connect-src` must allow
--`https://events.openvibe.network`. As of 2026-09-26, Live and Community allow it. Network, Wiki, Blog, Codes,
--Search, Reviews, VIP, Tips, Host (Stage B dashboard), News, Deals and Coupons do not. Without it, the
++`https://events.openvibe.network`. As of 2026-09-26, every site whose pages load release-watch under a CSP
++allows it: Live and Community first, then, with their 1.17.1 pins, Network, Wiki, Blog, Codes, Search, Reviews,
++VIP, Tips, Host (Stage B dashboard), News, Deals, Coupons, Trade and the Tools apps. Chat, Media, Games,
++OpenRe.Stream and Sites send no CSP with those pages. A new site needs it too. Without it, the
  browser refuses the stream and logs one CSP error per page load (the browser check counts it).
  release-watch then stops, with state `blocked`, and keeps polling. Add the origin in the same change that
  moves the pin, or set `data-events="off"` on the `ov-release` meta tag.
ddiff --git a/package-lock.json b/package-lock.json
iindex 41214e9..5acfc0f 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -18,7 +18,7 @@
          "express-rate-limit": "^7.5.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.58.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.11.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.0"
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1"
        },
        "bin": {
          "ovhost": "bin/ovhost"
@@@ -1437,9 +1437,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "1.17.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.0",
--      "integrity": "sha512-y/sFF7Ji+lj3Vd1L94Dd0Pn35W6YBzV0wR81AwHUcfcLNbjrrihUuSG5Y01g/GWxmQigOgvUrLXUkCZu8AybQg==",
++      "version": "1.17.1",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1",
++      "integrity": "sha512-IDwLw3PUxtqXS35QD0pnklsqHD+grHPk9RGpMJgihMXoY46+W5bcPO/2MN8AlCjHaO0WyNp0gYfp02il8Dy+rg==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex 863392d..b8c6b66 100644
---- a/package.json
++++ b/package.json
@@@ -33,7 +33,7 @@
      "express-rate-limit": "^7.5.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.58.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.11.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.0"
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1"
    },
    "engines": {
      "node": ">=22.0.0"
ddiff --git a/server/app.js b/server/app.js
iindex ec0fda3..a087973 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -51,7 +51,8 @@ const DASHBOARD_CSP = {
      'style-src': ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'],
      'font-src': ["'self'", 'data:', 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'],
      'img-src': ["'self'", 'data:', 'https:'],
--    'connect-src': ["'self'", 'https://openvibe.network'],
++    // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
++    'connect-src': ["'self'", 'https://openvibe.network', 'https://events.openvibe.network'],
      'frame-src': ["'self'", 'https://openvibe.network'],
      'frame-ancestors': ["'none'"],
      'object-src': ["'none'"],
ddiff --git a/test/host-secrets-dashboard.test.js b/test/host-secrets-dashboard.test.js
iindex d837bfb..2d9d6ca 100644
---- a/test/host-secrets-dashboard.test.js
++++ b/test/host-secrets-dashboard.test.js
@@@ -55,6 +55,8 @@ const ORIGIN = 'https://openvibe.host';
          assert.match(r.text, /Sign in with OpenVibe/);
          assert.match(r.text, /Stage C\) are not available/);
          assert.match(r.headers['content-security-policy'], /frame-ancestors 'none'/);
++        // Release notifications: release-watch's EventSource on the Events realtime stream (openvibe-shared 1.17).
++        assert.match(r.headers['content-security-policy'], /connect-src 'self' https:\/\/openvibe\.network https:\/\/events\.openvibe\.network;/);
          assert.strictEqual(r.headers['x-frame-options'], 'DENY');
          assert.strictEqual(r.headers['cache-control'], 'private, no-store');
          // The public front page is indexable, with a canonical URL; nothing behind sign-in is.