Concerns: pushword/admin, pushword/admin-block-editor, pushword/api, pushword/conversation, pushword/core, pushword/newsletter, pushword/quiz, pushword/static-generator, pushword/version, @pushword/js-helper
Anonymous quiz-result writes now require the per-page signature embedded in rendered HTML. Affects statically published sites using pushword/quiz. Run pw:static after updating.
Page clone/promote, media rotate, newsletter contact/campaign mutations and version restore/reset now accept POST only and validate _token. Affects sites linking to those routes from custom admin templates or tools. Replace links with POST forms and use the token identifiers rendered by the bundled templates.
Interactive media uploads now accept only AVIF, CR2, CSV, GIF, GPX, JPEG, MOV, MP4, PDF, PNG, SVG, TXT, WebM, WebP and ZIP with matching detected content types. Affects sites uploading another format. Convert it to an allowed format before uploading.
Generated static Caddy and Apache configurations now include CSP, HSTS and Permissions-Policy while allowing forms to reach base_live_url. Affects sites maintaining their own root Caddyfile. Copy the security headers from vendor/pushword/dev-app/Caddyfile; set CADDY_LIVE_ORIGIN when forms post to a separate live origin.