diff --git a/CHANGELOG.md b/CHANGELOG.md index ba70c5a..79218b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,11 @@ --- +## [v0.42.2] — 2026-04-10 + +### Bug Fixes +- **CSP blocking inline event handlers** (PR #209): `script-src 'self'` blocked all 55+ inline `onclick=` handlers in `index.html`, making the settings panel, sidebar navigation, and most interactive controls non-functional. Added `'unsafe-inline'` to `script-src`. Also restores `https://cdn.jsdelivr.net` to `script-src` and `style-src` for Mermaid.js and Prism.js (dropped in v0.42.1). + ## [v0.42.1] — 2026-04-11 ### Bug Fixes diff --git a/static/index.html b/static/index.html index b3e01cf..d4fb02e 100644 --- a/static/index.html +++ b/static/index.html @@ -14,7 +14,7 @@