v1.0.0-beta.24

Released to production on August 26, 2026 at 05:01 CDT. See every commit in this release on GitHub

It also carries the changes cut as v1.0.0-beta.23.

New

• Sites: img-src is enforced on published sites (AGL-1152, closes AGL-1726)
• Sites: measurement beacons survive img-src enforcement
• Tooling: seed each site's approved image hosts from what it already loads
• Besigner: the editor warns before an unapproved image host is published
• Console: a site owner can say which external hosts its images come from
• Sites: the img-src allowlist becomes the site owner's, per site

Fixed

• Sites: the CSP spec's root require trips the module-boundary rule
• Sites: isolate the origin with COOP
• Console: a publish never dropped a custom domain's cached pages
• Console: the screens empty state matches the other three
• Console: one empty state across the four artifact lists
• Console: the org Data page rendered a completely blank body
• Tooling: two guards my own change tripped
• Sites: the measurement gate missed the field ad pixels actually use
• Console: the staff org list shows the plan an org reads as
• Documentation: docs.aglyn.com ships with no CSP and no nosniff at all
• Console: a stale tab stops being stuck on an expired-token error
• Tests: the hermetic-env scrubber stops leaking the private key

Performance

• Sites: the ISR window stops being the propagation mechanism
• Sites: a page with a collection block stops paying a serial read
• Sites: the enrichers stop queueing, and a phase stops mislabelling

Behind the scenes

• Platform: prune the self-host allowlist row org-lockdown no longer needs