H-Script 1.0.2 — security and demo mode

A maintenance update improving demo mode, Content Security Policy compatibility and release publication.

H-Script 1.0.2 has been released.

This maintenance release contains several important improvements to security, demo mode and internal system components.

Major changes

• demo administrator access details are now displayed on the login page;
• the demo administrator can inspect translations without changing them;
• demo-mode detection through APP_DEMO_MODE has been corrected;
• HTMX no longer executes JavaScript through eval;
• compatibility with a restrictive Content Security Policy has been improved;
• robots.txt delivery has been corrected;
• the application version is now managed centrally and displayed consistently;
• the unused _a-ddos module has been removed because it did not provide effective DDoS protection;
• public source publication checks have been strengthened;
• public release commits now receive descriptive titles based on their changes.

Updating

Production installations should use the exact Docker image tag 1.0.2 instead of the floating latest tag.

Create a backup of the database, configuration and user files before updating.