1. 11 Jul, 2026 2 commits
    • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#6096) · 00f1cbb6
      Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.
      - [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)
      
      ---
      updated-dependencies:
      - dependency-name: golang.org/x/crypto
        dependency-version: 0.52.0
        dependency-type: direct:production
      ...
      
      Signed-off-by: dependabot[bot] <support@github.com>
      Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
      dependabot[bot] committed
    • fix(web): allow user-activated top navigation for custom home iframe (#5955) · ca971413
      The custom home page URL iframe only allows allow-forms/allow-popups/
      allow-popups-to-escape-sandbox/allow-scripts, without allow-top-navigation*.
      As a result, target="_top" nav/menu links inside the (admin-configured,
      trusted) embedded page cannot navigate the top-level window on desktop
      browsers, while some mobile browsers still allow it via allow-popups —
      causing inconsistent behavior rather than an intended restriction.
      
      Add allow-top-navigation-by-user-activation so user-clicked top-level
      links work consistently across devices. This token only permits
      user-activated top navigation and does NOT grant same-origin access,
      so it avoids the security concern of allow-same-origin.
      
      Co-authored-by: 贺. <kuang@M1.local>
      Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
      乾L committed
  2. 10 Jul, 2026 12 commits
  3. 09 Jul, 2026 5 commits
  4. 08 Jul, 2026 5 commits
  5. 07 Jul, 2026 16 commits