Changelog

Copy Markdown View Source

v0.2.0 (2026-10-28)

  • The macaw logo in the docs and the README (macaw#175).
  • Macaw.Plug.SecurityHeaders options, all additive; with none, every header is as before (#1):
    • csp_mode: :enforce (default), :report_only or :off;
    • permissions: changes Permissions-Policy features by name, and permissions_policy/1 renders one;
    • preset: :compatible, Phoenix's put_secure_browser_headers set plus HSTS over https, with every other option on top.
  • Script hashes on a policy without script-src follow default-src, or with neither write none, rather than a script-src that forbids every other script.
  • Breaking: an unknown Macaw.Plug.SecurityHeaders option raises at init/1 instead of being ignored.

v0.1.4 (2026-10-28)

  • The README opens with the early-release notice (macaw#174).

v0.1.3 (2026-10-28)

  • Spec and README links to the public home, github.com/dcoai/macaw_plug, and the install snippet from Hex (macaw#171, #173).
  • Package metadata for Hex: the public home, the changelog link, the files shipped, and docs with ex_doc (macaw_compose#155).

v0.1.2 (2026-10-27)

  • Adopt surfex; fix policy/2's empty script-src; v0.1.2 (part of macaw_compose#65)

v0.1.1 (2026-10-27)

  • macaw_plug 0.1.1: HSTS through headers:, hashes before the plug, dynamic proxy lists never raise

v0.1.0 (2026-10-26)

  • macaw_plug 0.1.0: ClientIp, RateLimit, SecurityHeaders