@jaypie/mcp 0.7.22 → 0.7.23
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -9,7 +9,7 @@ import { gt } from 'semver';
|
|
|
9
9
|
/**
|
|
10
10
|
* Docs Suite - Documentation services (skill, version, release_notes)
|
|
11
11
|
*/
|
|
12
|
-
const BUILD_VERSION_STRING = "@jaypie/mcp@0.7.
|
|
12
|
+
const BUILD_VERSION_STRING = "@jaypie/mcp@0.7.23#49c71f6f"
|
|
13
13
|
;
|
|
14
14
|
const __filename$1 = fileURLToPath(import.meta.url);
|
|
15
15
|
const __dirname$1 = path.dirname(__filename$1);
|
package/package.json
CHANGED
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
---
|
|
2
|
+
version: 1.2.31
|
|
3
|
+
date: 2026-02-18
|
|
4
|
+
summary: Add Cache-Control and Cross-Origin-Embedder-Policy security headers to JaypieDistribution
|
|
5
|
+
---
|
|
6
|
+
|
|
7
|
+
# @jaypie/constructs 1.2.31
|
|
8
|
+
|
|
9
|
+
## Fixes
|
|
10
|
+
|
|
11
|
+
- **JaypieDistribution**: Added `Cache-Control` (`no-store, no-cache, must-revalidate, proxy-revalidate`) and `Cross-Origin-Embedder-Policy` (`unsafe-none`) to the default security response headers, resolving ZAP baseline scan warnings [90004], [10015], and [10049].
|
package/skills/cdk.md
CHANGED
|
@@ -173,12 +173,14 @@ new JaypieNextJs(this, "App", {
|
|
|
173
173
|
|
|
174
174
|
`JaypieDistribution` ships with default security response headers via a `ResponseHeadersPolicy` (analogous to `helmet` for Express):
|
|
175
175
|
|
|
176
|
+
- Cache-Control (no-store, no-cache, must-revalidate, proxy-revalidate)
|
|
176
177
|
- HSTS (2-year max-age, includeSubDomains, preload)
|
|
177
178
|
- X-Content-Type-Options (nosniff)
|
|
178
179
|
- X-Frame-Options (DENY)
|
|
179
180
|
- Referrer-Policy (strict-origin-when-cross-origin)
|
|
180
181
|
- Content-Security-Policy (conservative defaults)
|
|
181
182
|
- Permissions-Policy (camera, microphone, geolocation, payment disabled)
|
|
183
|
+
- Cross-Origin-Embedder-Policy (unsafe-none)
|
|
182
184
|
- Cross-Origin-Opener-Policy (same-origin)
|
|
183
185
|
- Cross-Origin-Resource-Policy (same-origin)
|
|
184
186
|
- Server header removed
|