@netlify/plugin-csp-nonce 1.2.8 → 1.2.10

package/README.md

@@ -92,6 +92,7 @@ If your HTML does not contain the `nonce` attribute on the `<script>` tags that
 - The request method is `GET`
 - The `content-type` response header starts with `text/html`
 - The path of the request is satisfied by the `path` config option, and not included in the `excludedPath` config option
+- This site does not use [Split Testing](https://docs.netlify.com/site-deploys/split-testing/). There is a [known limitation](https://docs.netlify.com/edge-functions/limits/#feature-limitations) that requests to sites with Split Testing enabled will not execute edge functions.
 
 ### Controlling rollout
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "private": false,
   "name": "@netlify/plugin-csp-nonce",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "description": "Use a nonce for the script-src and style-src directives of your Content Security Policy.",
   "main": "index.js",
   "repository": {

package/src/__csp-nonce.ts

@@ -4,7 +4,7 @@ import type { Config, Context } from "netlify:edge";
 // @ts-ignore
 import { randomBytes } from "node:crypto";
 // @ts-ignore
-import { HTMLRewriter } from "https://ghuc.cc/worker-tools/html-rewriter@0.1.0-pre.17/index.ts";
+import { HTMLRewriter } from "https://ghuc.cc/worker-tools/html-rewriter@0.1.0-pre.19/index.ts";
 
 // @ts-ignore
 import inputs from "./__csp-nonce-inputs.json" assert { type: "json" };
@@ -179,7 +179,7 @@ const excludedExtensions = [
 
 export const config: Config = {
   path: params.path,
-  excludedPath: ["/.netlify/*", `**/*.(${excludedExtensions.join("|")})`]
+  excludedPath: ["/.netlify*", `**/*.(${excludedExtensions.join("|")})`]
     .concat(params.excludedPath)
     .filter(Boolean),
   handler,