@revenuecat/purchases-ui-js 4.17.0 → 4.17.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/components/web-view/WebView.svelte +4 -2
  2. package/package.json +1 -1
package/dist/components/web-view/WebView.svelte CHANGED
@@ -233,7 +233,9 @@
233
233
  <!--
234
234
  `allow-scripts allow-same-origin` runs the bundle under its own origin (for
235
235
  same-origin fetch/XHR); restricting it to that origin relies on the bundle's
236
- CSP. `referrerpolicy`/`allow` and the omitted sandbox flags limit leakage and
236
+ CSP. `strict-origin` sends only the host page's origin (never its path or
237
+ query), which the components CDN uses to let the bundle fetch() from the
238
+ host's root domain. `allow` and the omitted sandbox flags limit leakage and
237
239
  block top navigation.
238
240
  -->
239
241
  <iframe
@@ -241,7 +243,7 @@
241
243
  title={props.name ?? "Web view"}
242
244
  src={safeUrl}
243
245
  sandbox="allow-scripts allow-same-origin"
244
- referrerpolicy="no-referrer"
246
+ referrerpolicy="strict-origin"
245
247
  allow=""
246
248
  ></iframe>
247
249
  </div>
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "@revenuecat/purchases-ui-js",
3
3
  "description": "Web components for Paywalls. Powered by RevenueCat",
4
4
  "private": false,
5
- "version": "4.17.0",
5
+ "version": "4.17.1",
6
6
  "author": {
7
7
  "name": "RevenueCat, Inc."
8
8
  },