@nitronjs/framework 0.3.9 → 0.3.10

package/lib/View/View.js

@@ -731,8 +731,8 @@ class View {
         runtimeScript += `</script>`;
 
         if (hasFlightPayload) {
-            const escapedPayload = flightPayload.replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
-            runtimeScript += `<script${nonceAttr}>window.__NITRON_FLIGHT__=${JSON.stringify(escapedPayload)};</script>`;
+            const safePayload = JSON.stringify(flightPayload).replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
+            runtimeScript += `<script${nonceAttr}>window.__NITRON_FLIGHT__=${safePayload};</script>`;
         }
 
         const refreshScript = this.#isDev
@@ -823,7 +823,7 @@ ${refreshScript}${vendorScript}${hmrScript}${consumerScript}${spaScript}${devInd
                 images: hasWildcard ? ["*"] : urls,
                 scripts: hasWildcard ? ["*"] : urls,
                 connect: hasWildcard ? ["*"] : urls,
-                frames: hasWildcard ? ["*"] : [],
+                frames: hasWildcard ? ["*"] : urls,
             };
         }
         else {
@@ -849,9 +849,9 @@ ${refreshScript}${vendorScript}${hmrScript}${consumerScript}${spaScript}${devInd
         const imgSrc = buildSrc(["'self'", "data:", "blob:"], whitelist.images);
         const scriptSrc = buildSrc(["'self'", `'nonce-${nonce}'`], whitelist.scripts);
         const connectSrcFinal = buildSrc([connectSrc], whitelist.connect);
-        const frameSrc = whitelist.frames.length 
-            ? (whitelist.frames.includes("*") ? "*" : whitelist.frames.join(" ")) 
-            : "'none'";
+        const frameSrc = whitelist.frames.length
+            ? buildSrc(["'self'"], whitelist.frames)
+            : "'self'";
 
         const csp = [
             "default-src 'self'",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nitronjs/framework",
-	"version": "0.3.9",
+	"version": "0.3.10",
 	"description": "NitronJS is a modern and extensible Node.js MVC framework built on Fastify. It focuses on clean architecture, modular structure, and developer productivity, offering built-in routing, middleware, configuration management, CLI tooling, and native React integration for scalable full-stack applications.",
 	"bin": {
 		"njs": "./cli/njs.js"