diff --git a/.env.example b/.env.example index eaab0ce..eac2d7f 100644 --- a/.env.example +++ b/.env.example @@ -24,6 +24,9 @@ ICHAVA_VITE_DEV=true # Lives in core's config (`ichava.prefix`) — set ICHAVA_BROWSER_PREFIX in core # .env or here; both read the same env var. ICHAVA_BROWSER_PREFIX=ichava +# Serve the browser page elsewhere, e.g. `app` for /app. The API stays under the +# prefix, and /{prefix}/icons redirects (301) to the new URL. Unset: /{prefix}/icons. +# ICHAVA_BROWSER_PATH= ICHAVA_BROWSER_PER_PAGE=60 ICHAVA_BROWSER_CACHE=3600 @@ -43,7 +46,7 @@ ICHAVA_DOMAINS= # ---------------------------------------------------------------------------- ICHAVA_API_PRETTY_PRINT=true ICHAVA_API_CORS_ENABLED=true -ICHAVA_API_CORS_ORIGINS=* +ICHAVA_API_CORS_ORIGINS="*" # ---------------------------------------------------------------------------- # HTTP request size guard (bytes) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6aed3de..7fb225e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to `ichava/icon-browser` follow [Keep a Changelog](https://k ### Fixed +- **Re-vendored `ichava/react-icon-browser` at `41b0a4b`** (react-icon-browser#214): one caret for every dropdown and popover, drawn in the panel's own colours over its edge and centred on the trigger (the header menus drew none), and the "Cookies & storage" notice moves by its grip or the arrow keys, inside the window, for the session. `inertia-app.*` rebuilt with `npm run build:prod` after a fresh `npm install --no-package-lock`, as `committed-build.yml` does. `zustand` is held at `>=5.0.15 <5.1.0`, the vendored library's own range: 5.1.0 (2026-11-06) changes the type react-icon-browser publishes for `useStore`, and a fresh build that took it would no longer match the committed bundle. + - **The browser page works under a host's nonce-based CSP.** A host that sends its own policy with a per-request nonce (`script-src 'self' 'nonce-…'`, as ichava.com does) hands that nonce to Vite; the page now puts it on the loader's `