Reject numeric trust-proxy values that Fastify no longer honors and retain explicit boolean or address-based configuration. Bridge Nest and cookie type augmentation differences so the pre-push typecheck succeeds under TypeScript 6.
Add translate.googleapis.com to the connect-src Content-Security-Policy directive so the built-in eBook reader's translation feature can perform fetch requests without being blocked by CSP.
Closes#786
Disable default HSTS header in fastifyHelmet and register an onSend hook that includes Strict-Transport-Security only when request protocol is HTTPS. This prevents unencrypted HTTP setups and other services on the host from being forced onto HTTPS by browser HSTS caching.
Closes#760
The epub reader's "Define" feature relies on api.dictionaryapi.dev and
wiktionary.org. These domains were being blocked by the server's Content
Security Policy. Adding them to the connect-src directive allows the
client to successfully fetch word definitions.
Closes#403
Send injected empty JSON bodies as Buffer chunks so Nest Fastify parsers can consume them without crashing.
Acknowledge BookOrbit collection item updates locally instead of proxying synthetic tags upstream.
Closes#396
Inject an empty JSON object for requests that have an unsupported content type but zero content length. Fastify defaults to rejecting these with a 415 error.
Closes#348
The Content Security Policy was previously blocking external images,
preventing admin-configured OIDC provider icons from loading.
This allows https: images to be loaded while continuing to block
plain http: to maintain mixed-content protection.
Closes#131
neon