plain.htmx 0.10.4__tar.gz → 0.11.1__tar.gz

{plain_htmx-0.10.4 → plain_htmx-0.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plain.htmx
-Version: 0.10.4
+Version: 0.11.1
 Summary: Integrate HTMX with templates and views.
 Author-email: Dave Gaeddert <dave.gaeddert@dropseed.dev>
 License-Expression: BSD-3-Clause

{plain_htmx-0.10.4 → plain_htmx-0.11.1}/plain/htmx/CHANGELOG.md

@@ -1,5 +1,25 @@
 # plain-htmx changelog
 
+## [0.11.1](https://github.com/dropseed/plain/releases/plain-htmx@0.11.1) (2025-10-31)
+
+### What's changed
+
+- Added CSP nonce support to all htmx script tags for improved Content Security Policy compatibility ([10f642a](https://github.com/dropseed/plain/commit/10f642a097))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.11.0](https://github.com/dropseed/plain/releases/plain-htmx@0.11.0) (2025-10-29)
+
+### What's changed
+
+- Added Content Security Policy (CSP) nonce support for inline scripts and styles generated by htmx ([784f3dd](https://github.com/dropseed/plain/commit/784f3dd972))
+
+### Upgrade instructions
+
+- No changes required
+
 ## [0.10.4](https://github.com/dropseed/plain/releases/plain-htmx@0.10.4) (2025-10-20)
 
 ### What's changed

{plain_htmx-0.10.4 → plain_htmx-0.11.1}/plain/htmx/assets/htmx/plainhtmx.js

@@ -1,4 +1,11 @@
 (() => {
+  // Get nonce from our own script tag's data attribute
+  const nonce = document.currentScript?.getAttribute("data-csp-nonce");
+
+  // Configure htmx for CSP compatibility
+  htmx.config.inlineScriptNonce = nonce;
+  htmx.config.inlineStyleNonce = nonce;
+
   htmx.defineExtension("plain-views", {
     init() {
       // Set or append this extension to the body hx-ext automatically

plain_htmx-0.11.1/plain/htmx/templates/htmx/js.html

@@ -0,0 +1,18 @@
+{%- if DEBUG -%}
+<script src="{{ asset('htmx/vendor/src/htmx.js') }}" defer nonce="{{ csp_nonce }}"></script>
+{%- else -%}
+<script src="{{ asset('htmx/vendor/src/htmx.min.js') }}" defer nonce="{{ csp_nonce }}"></script>
+{%- endif -%}
+
+{%- if DEBUG -%}
+<script src="{{ asset('htmx/vendor/idiomorph/idiomorph.js') }}" defer nonce="{{ csp_nonce }}"></script>
+{%- else -%}
+<script src="{{ asset('htmx/vendor/idiomorph/idiomorph.min.js') }}" defer nonce="{{ csp_nonce }}"></script>
+{%- endif -%}
+<script src="{{ asset('htmx/vendor/idiomorph/idiomorph-htmx.js') }}" defer nonce="{{ csp_nonce }}"></script>
+
+{%- for extension in extensions -%}
+<script src="{{ asset('htmx/vendor/src/ext/' ~ extension ~ '.js') }}" defer nonce="{{ csp_nonce }}"></script>
+{%- endfor -%}
+
+<script src="{{ asset('htmx/plainhtmx.js') }}" defer nonce="{{ csp_nonce }}" data-csp-nonce="{{ csp_nonce }}"></script>

{plain_htmx-0.10.4 → plain_htmx-0.11.1}/plain/htmx/templates.py

@@ -24,6 +24,7 @@ class HTMXJSExtension(InclusionTagExtension):
         return {
             "DEBUG": settings.DEBUG,
             "extensions": kwargs.get("extensions", []),
+            "csp_nonce": context.get("request").csp_nonce,
         }
 
 

{plain_htmx-0.10.4 → plain_htmx-0.11.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "plain.htmx"
-version = "0.10.4"
+version = "0.11.1"
 description = "Integrate HTMX with templates and views."
 authors = [{name = "Dave Gaeddert", email = "dave.gaeddert@dropseed.dev"}]
 license = "BSD-3-Clause"

plain_htmx-0.10.4/plain/htmx/templates/htmx/js.html

@@ -1,18 +0,0 @@
-{%- if DEBUG -%}
-<script src="{{ asset('htmx/vendor/src/htmx.js') }}" defer></script>
-{%- else -%}
-<script src="{{ asset('htmx/vendor/src/htmx.min.js') }}" defer></script>
-{%- endif -%}
-
-{%- if DEBUG -%}
-<script src="{{ asset('htmx/vendor/idiomorph/idiomorph.js') }}" defer></script>
-{%- else -%}
-<script src="{{ asset('htmx/vendor/idiomorph/idiomorph.min.js') }}" defer></script>
-{%- endif -%}
-<script src="{{ asset('htmx/vendor/idiomorph/idiomorph-htmx.js') }}" defer></script>
-
-{%- for extension in extensions -%}
-<script src="{{ asset('htmx/vendor/src/ext/' ~ extension ~ '.js') }}" defer></script>
-{%- endfor -%}
-
-<script src="{{ asset('htmx/plainhtmx.js') }}" defer></script>