openvibers/openvibe.vip Commits

Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)

OP OpenVibers committed 26 Sept 2026 · f2a386ea64 · 3 files, +7 −6

CSP connect-src also allows https://events.openvibe.network, where release-watch opens its EventSource on the Events realtime stream (host.release.published). Nothing else in the policy changes.

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex f8afbea..8043c65 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,7 +16,7 @@
          "jsonwebtoken": "^9.0.2",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.49.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.11.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.16.1"
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1"
        },
        "engines": {
          "node": ">=22.0.0"
@@@ -1008,9 +1008,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "1.16.1",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.16.1",
--      "integrity": "sha512-IB7/BBdIuDrpyLa4OqdoFu2hlkDEQhMvXCs7jqWC9BWlyWxDQbps/FpYqqIDENo5r+/MuNXQf1VAXCHXNwtpsA==",
++      "version": "1.17.1",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1",
++      "integrity": "sha512-IDwLw3PUxtqXS35QD0pnklsqHD+grHPk9RGpMJgihMXoY46+W5bcPO/2MN8AlCjHaO0WyNp0gYfp02il8Dy+rg==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex 9180e8e..501341e 100644
---- a/package.json
++++ b/package.json
@@@ -28,7 +28,7 @@
      "jsonwebtoken": "^9.0.2",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.49.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.11.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.16.1"
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.17.1"
    },
    "engines": {
      "node": ">=22.0.0"
ddiff --git a/server/app.js b/server/app.js
iindex 77f9afd..020804d 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -72,9 +72,10 @@ function createApp(opts = {}) {
      app.use((req, res, next) => {
          res.setHeader('X-Content-Type-Options', 'nosniff');
          res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
++        // connect-src events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
          res.setHeader('Content-Security-Policy', [
              "default-src 'self'", "script-src 'self' 'unsafe-inline' https://openvibe.network", "style-src 'self' 'unsafe-inline' https://openvibe.network",
--            "img-src 'self' data: https:", "connect-src 'self' https://openvibe.network", "frame-src 'self' https://openvibe.network",
++            "img-src 'self' data: https:", "connect-src 'self' https://openvibe.network https://events.openvibe.network", "frame-src 'self' https://openvibe.network",
              "frame-ancestors 'self'", "object-src 'none'", "base-uri 'self'", "form-action 'self' https://openvibe.network https:",
          ].join('; '));
          next();