From d5ada610d8c4d3afa5997f2e8da3d04269724cb3 Mon Sep 17 00:00:00 2001 From: chen Date: Thu, 30 Jul 2026 23:49:54 +0800 Subject: [PATCH 1/4] docs: add [0.2.1] changelog for merged PRs since v0.2.0 --- CHANGELOG.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 612d049..b723d0c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.2.1] - 2026-07-30 + +### Added +- **Content-Security-Policy header** with nonce for inline bootstrap (#147) +- **highlight.js SRI pins** for script and theme (#145) +- **Playwright XSS tests** for `renderMarkdownSafe` (#151) + +### Changed +- **Structured `{error, code}` bodies** across all API blueprints (#146) +- CI regression gate excludes `composers-50` export benchmark (#148) + +### Fixed +- **HTTP 409** from `/api/set-workspace` when multiple WSGI workers are in use (#150) +- **Summary-cache fingerprint read-compare-write** serialised under a module lock (#158) + ## [0.2.0] - 2026-07-17 ### Added @@ -110,6 +125,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Replace silent `except Exception: pass` with structured logging in workspace and bubble load paths (#66, #76) - Decouple API handlers from private `_`-prefixed service internals (#73) -[Unreleased]: https://github.com/cppalliance/cppa-cursor-browser/compare/v0.2.0...HEAD +[Unreleased]: https://github.com/cppalliance/cppa-cursor-browser/compare/v0.2.1...HEAD +[0.2.1]: https://github.com/cppalliance/cppa-cursor-browser/compare/v0.2.0...v0.2.1 [0.2.0]: https://github.com/cppalliance/cppa-cursor-browser/compare/v0.1.0...v0.2.0 [0.1.0]: https://github.com/cppalliance/cppa-cursor-browser/releases/tag/v0.1.0 From 01e81d2c91acd79d20b35681ac54cf093125e421 Mon Sep 17 00:00:00 2001 From: star-med Date: Fri, 31 Jul 2026 02:38:15 +0800 Subject: [PATCH 2/4] address Will's feedback --- CHANGELOG.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b723d0c..7e002e1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,16 +10,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [0.2.1] - 2026-07-30 ### Added -- **Content-Security-Policy header** with nonce for inline bootstrap (#147) - **highlight.js SRI pins** for script and theme (#145) +- **Content-Security-Policy header** on every served HTML page — restrictive + default policy with per-response nonce for inline bootstrap; `frame-ancestors + 'none'` blocks iframe embedding and `img-src 'self' data:` blocks remote images + unless operators relax those directives in `build_content_security_policy` + (#147) - **Playwright XSS tests** for `renderMarkdownSafe` (#151) ### Changed -- **Structured `{error, code}` bodies** across all API blueprints (#146) +- **Structured `{error, code}` bodies** on workspaces, composers, search, export, + PDF, and config API routes (#146) - CI regression gate excludes `composers-50` export benchmark (#148) ### Fixed -- **HTTP 409** from `/api/set-workspace` when multiple WSGI workers are in use (#150) +- **Workspace page no longer crashes** when highlight.js fails to load (guards + `hljs.highlightElement` behind a typeof check) (#145) +- **HTTP 409** from `/api/set-workspace` when multiple WSGI workers are in use; + multi-worker deployments must set `WORKSPACE_PATH` or pass `--base-dir` at + startup (#150) - **Summary-cache fingerprint read-compare-write** serialised under a module lock (#158) ## [0.2.0] - 2026-07-17 From 5ab2a0c0761a7eddf3966424842defdddad10420 Mon Sep 17 00:00:00 2001 From: star-med Date: Fri, 31 Jul 2026 02:44:33 +0800 Subject: [PATCH 3/4] update content to the simple, clean --- CHANGELOG.md | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e002e1..85a21a3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,25 +11,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added - **highlight.js SRI pins** for script and theme (#145) -- **Content-Security-Policy header** on every served HTML page — restrictive - default policy with per-response nonce for inline bootstrap; `frame-ancestors - 'none'` blocks iframe embedding and `img-src 'self' data:` blocks remote images - unless operators relax those directives in `build_content_security_policy` - (#147) +- **Content-Security-Policy** on all served HTML pages — per-response nonce for + inline bootstrap; `frame-ancestors 'none'` blocks iframe embedding, + `img-src 'self' data:` blocks remote images (relax in + `build_content_security_policy`) (#147) - **Playwright XSS tests** for `renderMarkdownSafe` (#151) ### Changed - **Structured `{error, code}` bodies** on workspaces, composers, search, export, - PDF, and config API routes (#146) + PDF, and config routes (#146) - CI regression gate excludes `composers-50` export benchmark (#148) ### Fixed -- **Workspace page no longer crashes** when highlight.js fails to load (guards - `hljs.highlightElement` behind a typeof check) (#145) -- **HTTP 409** from `/api/set-workspace` when multiple WSGI workers are in use; - multi-worker deployments must set `WORKSPACE_PATH` or pass `--base-dir` at - startup (#150) -- **Summary-cache fingerprint read-compare-write** serialised under a module lock (#158) +- **highlight.js CDN miss** — workspace view skips `hljs.highlightElement` when + the script did not load (#145) +- **Multi-worker set-workspace** — `/api/set-workspace` returns HTTP 409; set + `WORKSPACE_PATH` or pass `--base-dir` at startup (#150) +- **Summary-cache fingerprint lock** — read-compare-write serialised under a + module lock (#158) ## [0.2.0] - 2026-07-17 From b692e30089ec3ea33c322bbb375ebc8301ab61a8 Mon Sep 17 00:00:00 2001 From: star-med Date: Fri, 31 Jul 2026 05:12:27 +0800 Subject: [PATCH 4/4] Clean up stringly-typed. --- CHANGELOG.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 85a21a3..64b0799 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added - **highlight.js SRI pins** for script and theme (#145) -- **Content-Security-Policy** on all served HTML pages — per-response nonce for +- **Content-Security-Policy** on all served HTML pages: per-response nonce for inline bootstrap; `frame-ancestors 'none'` blocks iframe embedding, `img-src 'self' data:` blocks remote images (relax in `build_content_security_policy`) (#147) @@ -23,11 +23,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - CI regression gate excludes `composers-50` export benchmark (#148) ### Fixed -- **highlight.js CDN miss** — workspace view skips `hljs.highlightElement` when +- **highlight.js CDN miss**: workspace view skips `hljs.highlightElement` when the script did not load (#145) -- **Multi-worker set-workspace** — `/api/set-workspace` returns HTTP 409; set +- **Multi-worker set-workspace**: `/api/set-workspace` returns HTTP 409; set `WORKSPACE_PATH` or pass `--base-dir` at startup (#150) -- **Summary-cache fingerprint lock** — read-compare-write serialised under a +- **Summary-cache fingerprint lock**: read-compare-write serialised under a module lock (#158) ## [0.2.0] - 2026-07-17