New
- New Strict Content Security Policy setting (off by default) sends a strict
Content-Security-Policyheader with the admin and puts a fresh nonce on every script, with Extra Policy Sources for anything else your site needs. Plugin pages, fields, widgets, panels, modals and reports now load as same-origin modules instead ofblob:URLs, so they keep working under it. Needs API 1.1.14 #212