release: v0.1.1213 — unbreak hosted assets and the anti-flash script

[kojiwakayama]

Version bump only — deno.json + src/utils/version-constant.ts, same two files as v0.1.1212.

Ships four merged PRs. Merging this dispatches veryfront-code-released to veryfront-server and the job-runner; a promotion PR pinning the resulting artifact still follows before anything is live.

What ships

#3455 — CSP floor report-only until opt-in. #3417 shipped the floor enforced and it blocked assets on ~100 hosted projects at once — stock photography, video, object storage, embeds — including veryfront's own marketing site. Only codersociety and tomcode had declared security.csp. The remedy required a republish, because a hosted project serves config from its deployed release. Projects that declared a policy keep the enforced header; everyone else gets -Report-Only with a byte-identical policy.

#3456 — no window global during SSR. next-themes renders its anti-flash script with nonce={typeof window === 'undefined' ? nonce : ''}; the stub made that take the browser branch, emitting nonce="", which CSP blocks. Still reproducing on codersociety.com as of now, hash sha256-Rcq79NsqIRfp7JA/RMr/1IFEj6q7YAyDVrf6BpzxXwM=.

#3457 — config-resolution instrumentation. Names which of four branches produced an absent project config, and warns when a request silently falls back to platform-default security headers. Diagnostic for a preview serving the wrong CSP on ~a third of renders, where six hypotheses have already been falsified.

#3461 — derive passive CSP origins from released source. Pure function; nothing consumes it yet, so no served policy changes.

Plus #3458 (eval/cli gated-metric diagnostics), which was already on main.

Risk

#3455 reduces enforcement for projects that never configured CSP. That is the intended fix and what unblocks the ~100 projects, but it goes to every hosted project at once. VERYFRONT_CSP_ENFORCE ends the rollout when adoption justifies it.

Summary by CodeRabbit

• Chores
  • Updated the application version to 0.1.1213.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• src/html/hydration-script-builder/hydration-runtime.generated.ts is excluded by !**/*.generated.*

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bcfea115-26cc-4f87-85c4-63c6509fdb10

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The release version was incremented from 0.1.1212 to 0.1.1213 in package metadata and the exported VERSION constant.

Changes

Release version synchronization

Layer / File(s)	Summary
Update release version deno.json, src/utils/version-constant.ts	The package version and exported VERSION constant now use 0.1.1213.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• veryfront/veryfront-code#3452: Updates the same package and exported version constant for a sequential release.
• veryfront/veryfront-code#3434: Updates the release version in the same two files.
• veryfront/veryfront-code#3346: Updates the package version and exported VERSION constant for a release.

Suggested reviewers: kwakayama, copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the release version and the main fixes for hosted assets and the anti-flash script.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v0.1.1213

---

_{Comment @coderabbitai help to get the list of available commands.}