6 Releases 6 Tags

RSS Feed

• v0.4.2 bce4f5e223

  Compare

  v0.4.2 Stable

  petrbalvin released this 2026-07-27 08:38:11 +00:00 | 0 commits to main since this release

  Fixed

  • web/templates/*.jinja missing from distribution wheel — added web/templates/*.jinja to [tool.setuptools.package-data] in pyproject.toml. After a fresh install from PyPI the admin panel returned 500 because Jinja2Templates could not find any templates.
  • Duplicate script-src / style-src in admin CSP — the nonce-augmented directives used to be appended after the base ones, so the browser (which honours the first occurrence) ignored the nonce and blocked every inline JS/CSS. They are now replaced: script-src and style-src are filtered out of the base CSP and the nonce versions are appended as the only occurrence.
  • CSP nonce generated after template rendering — request.state.csp_nonce is now set in GlobalSecurityHeadersMiddleware.dispatch() before call_next(request) so templates see it during rendering. Previously it was generated afterwards, so csp_nonce was an empty string in the template context and every inline script was blocked.
  • Missing nonce attribute on <script> in list.html.jinja and settings.html.jinja — inline scripts in these templates now carry nonce="{{ csp_nonce | default('') }}" so they match the nonce in the CSP header.
  • Bootstrap admin.password_hash ignored when users.toml is empty — Users.all now falls back to the bootstrap admin even when users.toml exists but is empty (e.g. right after volumen init, which creates the file via Path.touch()). Previously the first login after a clean install failed.
  • admin_context did not pass users_exist — the login page showed the “No users configured” warning even when authentication worked. Added "users_exist": users_obj.any to the admin template context.
  • Inline style="..." blocked by strict admin CSP — the admin templates used inline style="..." attributes (and one card.style.display = ... JS assignment) which the new strict style-src 'self' 'nonce-…' directive blocks. Replaced every offending attribute with a utility class in the <style> block (page-head-actions, form-options, form-inline, form-hidden, form-spaced, flex-spacer, btn-static, btn-danger-text, text-fg-strong, badge-inline, h3-section, mt-3, is-hidden); the dynamic background-image: url(...) on .post-cover now flows through a --cover-url custom property (style="--cover-url: …") which CSP3 does not treat as an inline style application.
  • /favicon.ico returned 404 — browsers auto-request /favicon.ico even when the page declares an explicit <link rel="icon">. Added a tiny route in create_app() that serves the packaged web/static/volumen-icon.svg with Content-Type: image/svg+xml and a 1-day Cache-Control; added the matching <link rel="icon" type="image/svg+xml" href="/favicon.ico"> to the admin layout so the tab gets the volumen icon instead of a generic placeholder.
  • Sidebar version label rendered as bare v — admin_context did not include the package VERSION, so the footer <div class="sidebar-version">v{{ version }}</div> rendered as just v with no number behind it. Added "version": VERSION to the context.

  Downloads

  • volumen-0.4.2-py3-none-any.whl
    80 KiB

    2026-07-27 08:39:17 +00:00
  • volumen-0.4.2.tar.gz
    100 KiB

    2026-07-27 08:39:17 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)