Amruth Pillai 61f481055a fix(server): serve untrusted uploads as downloads ...

S3 and Vercel Blob hand back the content type the client declared at
upload time, and the upload proxy served it inline on the app origin, so
an uploaded text/html or image/svg+xml file could run script as the app.

Only raster images (gif, jpeg, png, webp) now render inline; everything
else, PDFs included, is served as an application/octet-stream
attachment. The check runs at serve time, so it also covers objects
stored before this change.

2026-09-29 22:07:00 +02:00

..

src

fix(server): serve untrusted uploads as downloads

2026-09-29 22:07:00 +02:00

package.json

chore: remove unused UI parts, dependencies and turbo tasks, and share escapeHtml

2026-09-29 10:21:20 +02:00

tsconfig.json

Squashed commit of the following:

2026-05-19 13:14:21 +02:00

tsdown.config.ts

feat(server): convert legacy style rules with a manual script instead of at startup

2026-09-29 16:57:21 +02:00

turbo.json

fix: restore MCP OAuth registration and authorization (#3421)

2026-09-05 09:33:15 -07:00

vitest.config.ts

Release v5.2.8 (#3375)

2026-08-24 21:44:16 +02:00