openvibers/openvibe.tools Commits

Tools: every app allows openvibe.events for release notifications (plan T7) (#16)

OP OpenVibers committed 7 Oct 2026 · c32fad5562 · 8 files, +16 −16

Changes

ddiff --git a/apps/audio/server/index.js b/apps/audio/server/index.js
iindex b00d3c5..0c503bb 100644
---- a/apps/audio/server/index.js
++++ b/apps/audio/server/index.js
@@@ -98,8 +98,8 @@ app.use(helmet({
              fontSrc: ["'self'", "https://fonts.gstatic.com", "https://cdnjs.cloudflare.com"],
              imgSrc: ["'self'", "data:", "blob:", jobsRuntime.mediaOrigin()],     // job result previews are 302s to Media
              mediaSrc: ["'self'", "blob:", jobsRuntime.mediaOrigin()],
--            // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            connectSrc: ["'self'", "https://openvibe.network", "https://*.openvibe.tools", "https://events.openvibe.network"],
++            // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++            connectSrc: ["'self'", "https://openvibe.network", "https://*.openvibe.tools", "https://openvibe.events", "https://events.openvibe.network"],
              workerSrc: ["'self'", "blob:"],
              scriptSrcAttr: ["'unsafe-inline'"],
          },
ddiff --git a/apps/docs/server/index.js b/apps/docs/server/index.js
iindex 3c0b5b8..81b382c 100644
---- a/apps/docs/server/index.js
++++ b/apps/docs/server/index.js
@@@ -114,8 +114,8 @@ app.use(helmet({
              styleSrc: ["'self'", "'unsafe-inline'", "https://cdnjs.cloudflare.com", "https://fonts.googleapis.com", "https://fonts.gstatic.com"],
              fontSrc: ["'self'", "https://fonts.gstatic.com", "https://cdnjs.cloudflare.com"],
              imgSrc: ["'self'", "data:", "blob:"],
--            // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            connectSrc: ["'self'", "https://openvibe.network", "https://*.openvibe.tools", "https://events.openvibe.network"],
++            // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++            connectSrc: ["'self'", "https://openvibe.network", "https://*.openvibe.tools", "https://openvibe.events", "https://events.openvibe.network"],
              workerSrc: ["'self'", "blob:"],
              scriptSrcAttr: ["'unsafe-inline'"],
          },
ddiff --git a/apps/food/server/index.js b/apps/food/server/index.js
iindex aae6bcd..46f80ff 100644
---- a/apps/food/server/index.js
++++ b/apps/food/server/index.js
@@@ -84,8 +84,8 @@ app.use(helmet({
        styleSrc: ["'self'", "'unsafe-inline'", 'cdn.jsdelivr.net', 'unpkg.com', 'cdnjs.cloudflare.com', 'fonts.googleapis.com', 'fonts.gstatic.com'],
        fontSrc: ["'self'", 'fonts.gstatic.com', 'cdnjs.cloudflare.com'],
        imgSrc: ["'self'", 'data:', 'image.tmdb.org', '*.tile.openstreetmap.org', '*.basemaps.cartocdn.com', 'server.arcgisonline.com'],
--      // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--      connectSrc: ["'self'", 'nominatim.openstreetmap.org', 'https://openvibe.network', 'https://events.openvibe.network'],
++      // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++      connectSrc: ["'self'", 'nominatim.openstreetmap.org', 'https://openvibe.network', 'https://openvibe.events', 'https://events.openvibe.network'],
        scriptSrcAttr: ["'unsafe-inline'"],
      },
    },
ddiff --git a/apps/gateway/server/index.js b/apps/gateway/server/index.js
iindex 6be1aa8..55229df 100644
---- a/apps/gateway/server/index.js
++++ b/apps/gateway/server/index.js
@@@ -122,8 +122,8 @@ app.use(helmet({
              styleSrc: ["'self'", "'unsafe-inline'", "cdnjs.cloudflare.com", "fonts.googleapis.com", "fonts.gstatic.com"],
              fontSrc: ["'self'", "fonts.gstatic.com", "cdnjs.cloudflare.com"],
              imgSrc: ["'self'", "data:", "blob:", "https://openvibe.network", "https://openvibe.media"],
--            // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            connectSrc: ["'self'", "https://cloudflareinsights.com", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://openvibe.media", "https://openvibe.live", "https://openvibe.games", "https://events.openvibe.network"],
++            // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++            connectSrc: ["'self'", "https://cloudflareinsights.com", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://openvibe.media", "https://openvibe.live", "https://openvibe.games", "https://openvibe.events", "https://events.openvibe.network"],
              frameSrc: ["https://openvibe.network"], // the hidden /sso/check sign-in probe
              scriptSrcAttr: ["'unsafe-inline'"],
          },
ddiff --git a/apps/img/server/index.js b/apps/img/server/index.js
iindex 90d3bd0..6edd541 100644
---- a/apps/img/server/index.js
++++ b/apps/img/server/index.js
@@@ -103,8 +103,8 @@ app.use(helmet({
              styleSrc: ["'self'", "'unsafe-inline'", "https://cdnjs.cloudflare.com", "https://fonts.googleapis.com", "https://fonts.gstatic.com"],
              fontSrc: ["'self'", "https://fonts.gstatic.com", "https://cdnjs.cloudflare.com"],
              imgSrc: ["'self'", "data:", "blob:", jobsRuntime.mediaOrigin()],   // job result previews are 302s to Media
--            // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            connectSrc: ["'self'", "https://openvibe.network", "https://*.openvibe.tools", "https://events.openvibe.network"],
++            // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++            connectSrc: ["'self'", "https://openvibe.network", "https://*.openvibe.tools", "https://openvibe.events", "https://events.openvibe.network"],
              workerSrc: ["'self'", "blob:"],
              scriptSrcAttr: ["'unsafe-inline'"],
          },
ddiff --git a/apps/maps/server/index.js b/apps/maps/server/index.js
iindex 2f5aa40..bb1fbdc 100644
---- a/apps/maps/server/index.js
++++ b/apps/maps/server/index.js
@@@ -79,8 +79,8 @@ app.use(helmet({
        scriptSrc: ["'self'", "'unsafe-inline'", "unpkg.com", "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "static.cloudflareinsights.com", "https://openvibe.network"],
        styleSrc: ["'self'", "'unsafe-inline'", "unpkg.com", "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "fonts.googleapis.com"],
        imgSrc: ["'self'", "data:", "blob:", "*.tile.openstreetmap.org", "*.basemaps.cartocdn.com", "server.arcgisonline.com", "image.tmdb.org", "*.wp.com"],
--      // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--      connectSrc: ["'self'", "nominatim.openstreetmap.org", "api.weather.gov", "api.open-meteo.com", "*.tile.openstreetmap.org", "*.basemaps.cartocdn.com", "server.arcgisonline.com", "https://openvibe.network", "https://events.openvibe.network"],
++      // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++      connectSrc: ["'self'", "nominatim.openstreetmap.org", "api.weather.gov", "api.open-meteo.com", "*.tile.openstreetmap.org", "*.basemaps.cartocdn.com", "server.arcgisonline.com", "https://openvibe.network", "https://openvibe.events", "https://events.openvibe.network"],
        fontSrc: ["'self'", "fonts.gstatic.com", "cdnjs.cloudflare.com", "cdn.jsdelivr.net"],
        frameSrc: ["'none'"],
        scriptSrcAttr: ["'unsafe-inline'"],
ddiff --git a/apps/text/server/index.js b/apps/text/server/index.js
iindex 3aed56d..98f2321 100644
---- a/apps/text/server/index.js
++++ b/apps/text/server/index.js
@@@ -66,8 +66,8 @@ app.use(helmet({
              styleSrc: ["'self'", "'unsafe-inline'", "cdnjs.cloudflare.com", "fonts.googleapis.com", "fonts.gstatic.com"],
              fontSrc: ["'self'", "fonts.gstatic.com", "cdnjs.cloudflare.com"],
              imgSrc: ["'self'", "data:", "blob:"],
--            // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            connectSrc: ["'self'", "https://openvibe.network", "https://api.exchangerate-api.com", "https://events.openvibe.network"],
++            // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++            connectSrc: ["'self'", "https://openvibe.network", "https://api.exchangerate-api.com", "https://openvibe.events", "https://events.openvibe.network"],
              frameSrc: ["'none'"],
              scriptSrcAttr: ["'unsafe-inline'"],
          },
ddiff --git a/apps/yt/server/index.js b/apps/yt/server/index.js
iindex 8d5cf1e..6e6e718 100644
---- a/apps/yt/server/index.js
++++ b/apps/yt/server/index.js
@@@ -81,8 +81,8 @@ app.use(helmet({
              styleSrc: ["'self'", "'unsafe-inline'", "https://cdnjs.cloudflare.com", "https://fonts.googleapis.com", "https://fonts.gstatic.com"],
              fontSrc: ["'self'", "https://fonts.gstatic.com", "https://cdnjs.cloudflare.com"],
              imgSrc: ["'self'", "data:", "https://i.ytimg.com", "https://img.youtube.com", "https://*.ggpht.com", "https://openvibe.network", "https://openvibe.media"],
--            // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            connectSrc: ["'self'", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://cloudflareinsights.com", "https://events.openvibe.network"],
++            // openvibe.events (and events.openvibe.network until this app pins openvibe-shared 2.13.0): release notifications.
++            connectSrc: ["'self'", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://cloudflareinsights.com", "https://openvibe.events", "https://events.openvibe.network"],
              frameSrc: ["https://openvibe.network"], // the hidden /sso/check sign-in probe
              scriptSrcAttr: ["'unsafe-inline'"],
          },