🐛 Patch Changes
- 135b9e3: Fix blank dashboard when exposing Manifest on a LAN IP over HTTP. Helmet's default CSP emitted
upgrade-insecure-requests, which browsers enforce on private IPv4 ranges (10.x, 172.16-31.x, 192.168.x) but relax for localhost — so the JS bundle was rewritten tohttps://and silently failed to load, leaving an empty<body>. The directive is now disabled; HTTPS deployments should enforce upgrades via HSTS at the reverse proxy instead.