From dbc81a2ababb2fdfb0992562b00a69bca72cceb0 Mon Sep 17 00:00:00 2001 From: Michael Hoffmann Date: Thu, 19 Feb 2026 00:31:09 +0100 Subject: [PATCH 01/12] chore: Enable experimental CSP support Enable Astro's experimental Content Security Policy support and remove the `is:inline` directive from the theme toggle script so Astro can generate a hash for it. Inline scripts bypass Astro's CSP pipeline and would be blocked by the policy. Co-Authored-By: Claude --- astro.config.mjs | 3 +++ src/layouts/BaseLayout.astro | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/astro.config.mjs b/astro.config.mjs index b0d41a6..23a77cc 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -6,6 +6,9 @@ import rehypeSlug from "rehype-slug"; export default defineConfig({ site: "https://sentry.engineering", output: "static", + experimental: { + csp: true, + }, integrations: [sitemap()], image: { service: { diff --git a/src/layouts/BaseLayout.astro b/src/layouts/BaseLayout.astro index 3d9078f..b278e16 100644 --- a/src/layouts/BaseLayout.astro +++ b/src/layouts/BaseLayout.astro @@ -129,7 +129,7 @@ const footerLinks = [ - + { + plausibleScriptSrc && ( + <> + + + + ) + } diff --git a/src/styles/tailwind.css b/src/styles/tailwind.css index c04f833..d8a11bc 100644 --- a/src/styles/tailwind.css +++ b/src/styles/tailwind.css @@ -2,3 +2,51 @@ @plugin "@tailwindcss/typography"; @custom-variant dark (&:where(.dark, .dark *)); + +@font-face { + font-family: "JetBrains Mono"; + font-style: normal; + font-weight: 300; + font-display: swap; + src: url("/fonts/JetBrainsMono-Light.woff2") format("woff2"); +} + +@font-face { + font-family: "JetBrains Mono"; + font-style: normal; + font-weight: 400; + font-display: swap; + src: url("/fonts/JetBrainsMono-Regular.woff2") format("woff2"); +} + +@font-face { + font-family: "JetBrains Mono"; + font-style: italic; + font-weight: 400; + font-display: swap; + src: url("/fonts/JetBrainsMono-Italic.woff2") format("woff2"); +} + +@font-face { + font-family: "JetBrains Mono"; + font-style: normal; + font-weight: 500; + font-display: swap; + src: url("/fonts/JetBrainsMono-Medium.woff2") format("woff2"); +} + +@font-face { + font-family: "JetBrains Mono"; + font-style: normal; + font-weight: 600; + font-display: swap; + src: url("/fonts/JetBrainsMono-SemiBold.woff2") format("woff2"); +} + +@font-face { + font-family: "JetBrains Mono"; + font-style: normal; + font-weight: 700; + font-display: swap; + src: url("/fonts/JetBrainsMono-Bold.woff2") format("woff2"); +} From 4e2f5f897dd866bb218bf5f12cd32727fcfd6261 Mon Sep 17 00:00:00 2001 From: Michael Hoffmann Date: Fri, 20 Feb 2026 00:57:36 +0100 Subject: [PATCH 03/12] fix: Correct merge conflict resolution for BaseLayout Restore apple-touch-icon and manifest from main, remove nonexistent dark favicon. Co-Authored-By: Claude --- src/layouts/BaseLayout.astro | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/layouts/BaseLayout.astro b/src/layouts/BaseLayout.astro index 3a1add6..9bd8dbe 100644 --- a/src/layouts/BaseLayout.astro +++ b/src/layouts/BaseLayout.astro @@ -43,7 +43,8 @@ const plausibleScriptSrc = import.meta.env.PUBLIC_PLAUSIBLE_SCRIPT_SRC - + + { - plausibleScriptSrc && ( + import.meta.env.PUBLIC_PLAUSIBLE_SCRIPT_SRC && ( <> - + - - - From 4428519bb1189313614b79d4cd8e25045b7fdac1 Mon Sep 17 00:00:00 2001 From: Michael Hoffmann Date: Fri, 20 Feb 2026 01:24:09 +0100 Subject: [PATCH 11/12] fix(csp): Allow inline styles for Shiki and restrict img-src Shiki syntax highlighting generates inline style attributes on code tokens which cannot be individually hashed. Add unsafe-inline to style-src. Restrict img-src to self. Co-Authored-By: Claude --- astro.config.mjs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/astro.config.mjs b/astro.config.mjs index c9e02b4..24257eb 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -17,7 +17,13 @@ export default defineConfig({ "sha256-m+TqEPNJoIsN5pFYeHFt2az1Myng7rZ6Y/9yJIokBrk=", // Post list search ], }, - directives: ["connect-src 'self' https://plausible.io"], + styleDirective: { + resources: ["'self'", "'unsafe-inline'"], + }, + directives: [ + "connect-src 'self' https://plausible.io", + "img-src 'self'", + ], }, }, integrations: [sitemap()], From 3c566fb8eb51611a4b8b14d775f0443482c41240 Mon Sep 17 00:00:00 2001 From: Michael Hoffmann Date: Fri, 20 Feb 2026 01:24:42 +0100 Subject: [PATCH 12/12] chore(csp): Remove unnecessary img-src directive No default-src is set, so omitting img-src leaves images unrestricted. The restriction would break external images in blog posts without meaningful security benefit. Co-Authored-By: Claude --- astro.config.mjs | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/astro.config.mjs b/astro.config.mjs index 24257eb..7fdb3ea 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -20,10 +20,7 @@ export default defineConfig({ styleDirective: { resources: ["'self'", "'unsafe-inline'"], }, - directives: [ - "connect-src 'self' https://plausible.io", - "img-src 'self'", - ], + directives: ["connect-src 'self' https://plausible.io"], }, }, integrations: [sitemap()],