v14.0.1

CHANGELOG.md

@@ -21,6 +21,17 @@ Please document your changes in this format:
 
 ## [Unreleased]
 
+## [14.0.1] - 2024-03-25
+### Fixed
+- Nginx configuration improvements @nicksellen https://codeberg.org/karrot/karrot-frontend/commit/f3404300a03d811afe6e2380f7c285db5c812078
+  - get the client ip from X-Forwarded-For header if it comes from
+    a trusted proxy (assuming all IANA private networks are trusted)
+  - doesn't pass X-Forwarded-Proto any more
+    this configuration doesn't support https anyway so scheme is
+    always http, and it prevents passthrough of the X-Forwarded-Proto
+    header from the proxy in front of it
+  - give /bundlesize.html it's own CSP
+
 ## [14.0.0] - 2024-03-22
 ### Changed
 - Move main repository and CI to codeberg @nicksellen
@@ -963,7 +974,8 @@ After months of planning and programming, the first version of ~the foodsaving t
 [#2663]: https://github.com/karrot-dev/karrot-frontend/issues/2663
 [#2677]: https://github.com/karrot-dev/karrot-frontend/issues/2677
 
-[Unreleased]: https://github.com/karrot-dev/karrot-frontend/compare/v14.0.0...HEAD
+[Unreleased]: https://github.com/karrot-dev/karrot-frontend/compare/v14.0.1...HEAD
+[14.0.1]: https://github.com/karrot-dev/karrot-frontend/compare/v14.0.0...v14.0.1
 [14.0.0]: https://github.com/karrot-dev/karrot-frontend/compare/v13.0.1...v14.0.0
 [13.0.1]: https://github.com/karrot-dev/karrot-frontend/compare/v13.0.0...v13.0.1
 [13.0.0]: https://github.com/karrot-dev/karrot-frontend/compare/v12.1.0...v13.0.0

package.json

@@ -2,7 +2,7 @@
   "private": true,
   "name": "karrot-frontend",
   "productName": "Karrot",
-  "version": "14.0.0",
+  "version": "14.0.1",
   "description": "Karrot is a free and open-source tool for grassroots initiatives and groups of people that want to coordinate face-to-face activities on a local, autonomous and voluntary basis.",
   "author": "Karrot Team <[email protected]>",
   "homepage": "https://karrot.world/",