@adobe/helix-config 5.8.0 → 5.9.1

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [5.9.1](https://github.com/adobe/helix-config/compare/v5.9.0...v5.9.1) (2026-01-07)
+
+
+### Bug Fixes
+
+* trust custom review host ([#350](https://github.com/adobe/helix-config/issues/350)) ([6ec7d2d](https://github.com/adobe/helix-config/commit/6ec7d2d5d85f186df3c5adc6980f4e7923378817))
+
+# [5.9.0](https://github.com/adobe/helix-config/compare/v5.8.0...v5.9.0) (2026-01-07)
+
+
+### Features
+
+* add trusted origins header in delivery and pipeline scope ([#349](https://github.com/adobe/helix-config/issues/349)) ([0a4a8c1](https://github.com/adobe/helix-config/commit/0a4a8c1b39a597f1b43fd11ca5978c0e167db9e3))
+
 # [5.8.0](https://github.com/adobe/helix-config/compare/v5.7.0...v5.8.0) (2025-12-17)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "5.8.0",
+  "version": "5.9.1",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -39,7 +39,7 @@
     "@eslint/config-helpers": "0.5.0",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/git": "10.0.1",
-    "@semantic-release/npm": "13.1.2",
+    "@semantic-release/npm": "13.1.3",
     "c8": "10.1.3",
     "eslint": "9.4.0",
     "husky": "9.1.7",

package/src/config-merge.js

@@ -14,7 +14,7 @@
 /**
  * @typedef RootProperty
  * @property {boolean} atomic whether the property should be overwritten atomically
- * @property {boolean} isModified whether the property need special merging
+ * @property {boolean} isModifier whether the property need special merging
  */
 
 const ROOT_PROPERTIES = {

package/src/config-view.js

@@ -554,6 +554,44 @@ async function computeSiteAdminRoles(ctx, siteConfig, admin, orgConfig, configGr
   return ret;
 }
 
+/**
+ * Compute the trusted hosts for the given site.
+ * @param {string} org The org name
+ * @param {strinf} site The site name
+ * @param {SiteConfig} siteConfig The site config
+ * @returns {string[]} The trusted hosts
+ */
+function computeTrustedHosts(org, site, siteConfig) {
+  const trustedHosts = [
+    `*--${site}--${org}.aem.page`,
+    `*--${site}--${org}.aem.live`,
+    `*--${site}--${org}.aem.reviews`,
+    `*--${site}--${org}.aem.network`,
+  ];
+
+  if (siteConfig.cdn?.preview?.host) {
+    trustedHosts.push(siteConfig.cdn.preview.host);
+  }
+
+  if (siteConfig.cdn?.review?.host) {
+    trustedHosts.push(siteConfig.cdn.review.host);
+  }
+
+  if (siteConfig.cdn?.live?.host) {
+    trustedHosts.push(siteConfig.cdn.live.host);
+  }
+
+  if (siteConfig.cdn?.prod?.host) {
+    trustedHosts.push(siteConfig.cdn.prod.host);
+  }
+
+  if (siteConfig.sidekick?.trustedHosts) {
+    trustedHosts.push(...siteConfig.sidekick.trustedHosts);
+  }
+
+  return trustedHosts;
+}
+
 export async function getConfigResponse(ctx, opts) {
   const {
     ref, site, org, scope,
@@ -647,6 +685,7 @@ export async function getConfigResponse(ctx, opts) {
         'x-hlx-repo': config.code.repo,
         'x-hlx-auth-hash-preview': canonicalArrayString(config.access, 'preview', 'tokenHash'),
         'x-hlx-auth-hash-live': canonicalArrayString(config.access, 'live', 'tokenHash'),
+        'x-hlx-trusted-hosts': computeTrustedHosts(org, site, config).join(','),
       },
     });
   }
@@ -716,6 +755,7 @@ export async function getConfigResponse(ctx, opts) {
       access: config.access,
       legacy: config.legacy,
       lastModified: siteConfig.lastModified,
+      trustedHosts: computeTrustedHosts(org, site, config),
     };
     if (config.features) {
       pipelineConfig.features = config.features;