microsoft/simplechat v0.229.062

v0.229.062

Repository: microsoft/simplechat

Tag: v0.229.062

Published: 2025-09-26T19:50:46Z

Prerelease: no

Release notes:

Bug Fixes

• Enhanced Citations CSP Fix
• Fixed Content Security Policy (CSP) violation that prevented enhanced citations PDF documents from being displayed in iframe modals.
• Issue: CSP directive frame-ancestors 'none' blocked PDF endpoints from being embedded in iframes, causing console errors: "Refused to frame '...' because an ancestor violates the following Content Security Policy directive: 'frame-ancestors 'none''".
• Root Cause: Enhanced citations use iframes to display PDF documents via /api/enhanced_citations/pdf endpoint, but the restrictive CSP policy prevented same-origin iframe embedding.
• Solution: Changed CSP configuration from frame-ancestors 'none' to frame-ancestors 'self', allowing same-origin framing while maintaining security against external clickjacking attacks.
• Security Impact: No reduction in security posture - external websites still cannot embed application content, only same-origin framing is now allowed.
• Benefits: Enhanced citations PDF modals now display correctly without CSP violations, improved user experience for document viewing.
• (Ref: config.py SECURITY_HEADERS, test_enhanced_citations_csp_fix.py, CSP policy update)