mirror of
https://github.com/baptisteArno/typebot.io.git
synced 2026-07-21 21:13:45 +08:00
Baptiste ArnaudandGitHub
d039794797
## What changed - Upgraded Next.js from 16.1.6 to 16.2.9 across the Next-consuming packages and lockfile. - Hardened builder response headers by disabling the powered-by header, adding CSP directives, setting same-origin CORS for non-API pages, and applying no-store headers to public entry assets/routes. - Blocked OPTIONS, TRACE, and TRACK in the builder proxy with a 405 response and an explicit Allow header. ## Why This addresses TAC scan findings around framework disclosure, cache behavior, response hardening, and risky HTTP methods on builder routes. ## Validation - `bunx nx typecheck builder` passed. - `bunx nx typecheck` currently fails on an unrelated landing-page telemetry header typing issue at `apps/landing-page/src/features/telemetry/server/trackPageView.ts:85` (`"Set-Cookie"` is not in `TypedHeaders<ResponseHeaderMap>`).