From 8f5a93195144f47db546c5033183d23e249771c1 Mon Sep 17 00:00:00 2001 From: Catherine Renelle <32781029+catrenelle@users.noreply.github.com> Date: Mon, 9 Mar 2026 08:20:22 -0400 Subject: [PATCH] Allow dark mode theme script via CSP hash The inline script in app.html that applies the dark mode class before paint is not covered by SvelteKit's nonce system. Whitelist it by its SHA-256 hash instead. Co-Authored-By: Claude Opus 4.6 --- svelte.config.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/svelte.config.js b/svelte.config.js index 2cabbfe..52687ff 100644 --- a/svelte.config.js +++ b/svelte.config.js @@ -12,7 +12,7 @@ const config = { csp: { directives: { 'default-src': ['self'], - 'script-src': ['self'] + 'script-src': ['self', 'sha256-PDIMa2Wg+qyPaCjQ/EcSk+qN0Ftomecz3B0NZzZHivs='] } } }