openvibers/openvibe.search Commits

Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)

OP OpenVibers committed 26 Sept 2026 · f58f8198d6 · 4 files, +10 −7

CSP connect-src also allows https://events.openvibe.network, where release-watch opens its EventSource on the Events realtime stream (host.release.published). Nothing else in the policy changes.

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex e282110..48dce60 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "dotenv": "^16.4.7",
          "express": "^4.21.2",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.49.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.16.1"
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1"
        },
        "engines": {
          "node": ">=22.0.0"
@@@ -985,9 +985,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "1.16.1",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.16.1",
--      "integrity": "sha512-IB7/BBdIuDrpyLa4OqdoFu2hlkDEQhMvXCs7jqWC9BWlyWxDQbps/FpYqqIDENo5r+/MuNXQf1VAXCHXNwtpsA==",
++      "version": "1.17.1",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1",
++      "integrity": "sha512-IDwLw3PUxtqXS35QD0pnklsqHD+grHPk9RGpMJgihMXoY46+W5bcPO/2MN8AlCjHaO0WyNp0gYfp02il8Dy+rg==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex 0f116e0..51dc029 100644
---- a/package.json
++++ b/package.json
@@@ -21,7 +21,7 @@
      "dotenv": "^16.4.7",
      "express": "^4.21.2",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.49.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.16.1"
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1"
    },
    "engines": {
      "node": ">=22.0.0"
ddiff --git a/server/web/page.js b/server/web/page.js
iindex 6d77dc8..c853f2a 100644
---- a/server/web/page.js
++++ b/server/web/page.js
@@@ -21,7 +21,9 @@ const NETWORK = 'https://openvibe.network';
  // Cloudflare Web Analytics: Cloudflare injects its beacon at the edge and the privacy text says it may measure
  // performance; script-src loads the beacon, connect-src is where it reports.
  const CF_BEACON = 'https://static.cloudflareinsights.com', CF_REPORT = 'https://cloudflareinsights.com';
--const CSP = `default-src 'none'; script-src 'self' ${NETWORK} ${CF_BEACON}; connect-src 'self' ${NETWORK} ${CF_REPORT}; style-src 'unsafe-inline' ${NETWORK}; img-src 'self' data: https:; frame-src ${NETWORK}; form-action 'self' ${NETWORK}; base-uri 'none'; frame-ancestors 'none'`;
++// The Events realtime stream: release notifications (release-watch's EventSource, openvibe-shared 1.17).
++const EVENTS = 'https://events.openvibe.network';
++const CSP = `default-src 'none'; script-src 'self' ${NETWORK} ${CF_BEACON}; connect-src 'self' ${NETWORK} ${CF_REPORT} ${EVENTS}; style-src 'unsafe-inline' ${NETWORK}; img-src 'self' data: https:; frame-src ${NETWORK}; form-action 'self' ${NETWORK}; base-uri 'none'; frame-ancestors 'none'`;
  const frame = require('openvibe-shared/frame');
  const FRAME_INIT = `(function () {
    var tries = 0;
ddiff --git a/test/page.test.js b/test/page.test.js
iindex 31b55e0..2313955 100644
---- a/test/page.test.js
++++ b/test/page.test.js
@@@ -39,7 +39,8 @@ t('the front page is a search form, indexable, no-store, with a strict CSP', asy
      const csp = r.headers.get('content-security-policy');
      // Plus Cloudflare Web Analytics, which Cloudflare injects at the edge (the privacy text discloses it).
      assert.match(csp, /script-src 'self' https:\/\/openvibe\.network https:\/\/static\.cloudflareinsights\.com;/);
--    assert.match(csp, /connect-src 'self' https:\/\/openvibe\.network https:\/\/cloudflareinsights\.com;/);
++    // And the Events realtime stream, for release notifications (release-watch, openvibe-shared 1.17).
++    assert.match(csp, /connect-src 'self' https:\/\/openvibe\.network https:\/\/cloudflareinsights\.com https:\/\/events\.openvibe\.network;/);
      assert.ok(!/script-src[^;]*unsafe-inline/.test(csp), 'no inline script allowed');
      const scripts = [...r.text.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script>/gi)];
      for (const [, attrs, body] of scripts) {