Julien G. de2f5f1347 fix(security): relax Referrer-Policy and document HSTS_INCLUDE_SUBDOMAINS (#862) (#863) ...

- Change Helmet default from no-referrer to strict-origin-when-cross-origin
  so browsers send the origin on cross-origin requests, allowing Google Maps
  API key restrictions by HTTP referrer to work correctly
- Document HSTS_INCLUDE_SUBDOMAINS in all deployment artifacts:
  .env.example, docker-compose.yml, README.md, unraid-template.xml,
  charts/values.yaml, charts/configmap.yaml, wiki/Environment-Variables.md

2026-04-23 18:39:11 +02:00

..

assets

refactor: move airports.json out of server/data into server/assets

2026-04-18 02:02:09 +02:00

public

chore(CRLF): normalize index.html line endings to LF

2026-04-05 04:35:17 +02:00

scripts

docs: add full wiki with 74 pages, assets, and CI workflow

2026-04-20 10:11:53 +02:00

src

fix(security): relax Referrer-Policy and document HSTS_INCLUDE_SUBDOMAINS (#862) (#863)

2026-04-23 18:39:11 +02:00

tests

fix(journey,pdf): journey reorder sort_order + PDF multi-day transport (#848)

2026-04-23 10:53:32 +02:00

.env.example

fix(security): relax Referrer-Policy and document HSTS_INCLUDE_SUBDOMAINS (#862) (#863)

2026-04-23 18:39:11 +02:00

package-lock.json

chore: bump version to 3.0.7 [skip ci]

2026-04-23 09:07:40 +00:00

package.json

chore: bump version to 3.0.7 [skip ci]

2026-04-23 09:07:40 +00:00

reset-admin.js

Stabilize core: better-sqlite3, versioned migrations, graceful shutdown

2026-03-22 17:52:24 +01:00

tsconfig.json

some fixes

2026-03-30 06:59:24 +02:00

vitest.config.ts

refactor(mcp): replace direct DB access with service layer calls

2026-04-04 18:12:53 +02:00