fix: add missing CSP style-src nonce and include static SVGs in wheel

CHANGELOG.md

@@ -10,6 +10,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [development]
 
+## [0.4.1] — 2026-07-27
+
+### Fixed
+
+- **CSP nonce chybí pro `style-src` v admin routách** — přidán `style-src 'self' 'nonce-{nonce}'` do CSP hlavičky pro `/admin` routy. Bez nonce prohlížeč blokoval všechny inline `<style>` tagy v admin šablonách.
+- **`web/static/` SVG soubory chybí v distribučním kole** — přidána sekce `[tool.setuptools.package-data]` do `pyproject.toml`, aby `volumen-icon.svg` a `volumen-logo.svg` byly součástí instalovaného wheelu. Admin panel dříve vracel 500 na `/admin/icon.svg` a `/admin/logo.svg`.
+
 ## [0.4.0] — 2026-07-26
 
 ### Added

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "volumen"
-version = "0.4.0"
+version = "0.4.1"
 description = "A small, file-based Markdown blog engine with a built-in admin."
 readme = "README.md"
 keywords = ["blog", "markdown", "fastapi", "cms", "static-blog", "toml", "rss", "json-feed", "engine"]
@@ -61,6 +61,9 @@ dev = [
 [tool.setuptools.packages.find]
 where = ["src"]
 
+[tool.setuptools.package-data]
+volumen = ["web/static/*"]
+
 
 [tool.ruff]
 line-length = 100

src/volumen/app.py

@@ -165,7 +165,13 @@ class GlobalSecurityHeadersMiddleware(BaseHTTPMiddleware):
         if request.url.path.startswith("/admin"):
             nonce = secrets.token_urlsafe(18)
             request.state.csp_nonce = nonce
-            csp = "; ".join(_BASE_CSP_DIRECTIVES + (f"script-src 'self' 'nonce-{nonce}'",))
+            csp = "; ".join(
+                _BASE_CSP_DIRECTIVES
+                + (
+                    f"script-src 'self' 'nonce-{nonce}'",
+                    f"style-src 'self' 'nonce-{nonce}'",
+                )
+            )
             response.headers["Content-Security-Policy"] = csp
 
         if self._cookie_secure:

uv.lock

@@ -897,7 +897,7 @@ wheels = [
 
 [[package]]
 name = "volumen"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi", extra = ["standard"] },