Merge pull request #566 from Baroshem/chore/2.1.3

chore(release): 2.1.3

.github/workflows/pr-pkg-new.yml

@@ -1,12 +1,13 @@
 name: Publish Approved Pull Requests
 on:
+  workflow_dispatch:
   pull_request_review:
     types: [submitted]
 
 jobs:
   check:
     # First, trigger a permissions check on the user approving the pull request.
-    if: github.event.review.state == 'approved'
+    if: (github.event_name == 'workflow_dispatch' || github.event.review.state == 'approved')
     runs-on: ubuntu-latest
     outputs:
       has-permissions: ${{ steps.checkPermissions.outputs.require-result }}

CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+
+## v2.1.3
+
+[compare changes](https://github.com/Baroshem/nuxt-security/compare/v2.1.2...v2.1.3)
+
+### 🩹 Fixes
+
+- #564 resolves issue with element.replace on non-string elements ([#564](https://github.com/Baroshem/nuxt-security/issues/564))
+
+### ❤️ Contributors
+
+- Lawren <[email protected]>
+

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-security",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -48,6 +48,7 @@
     "dev:preview": "nuxi preview playground",
     "dev:docs": "rm -rf dist && cd docs && yarn dev",
     "lint": "eslint .",
+    "release": "yarn lint && yarn test && yarn prepack && changelogen --release && npm publish && git push --follow-tags",
     "test": "vitest run --silent",
     "test:watch": "vitest watch",
     "stackblitz": "cd .stackblitz && yarn && yarn dev"
@@ -68,6 +69,7 @@
     "@nuxt/schema": "^3.11.2",
     "@nuxt/test-utils": "^3.12.0",
     "@types/node": "^18.18.1",
+    "changelogen": "^0.5.7",
     "eslint": "^8.50.0",
     "nuxt": "^3.11.2",
     "typescript": "^5.4.5",

src/runtime/nitro/plugins/40-cspSsrNonce.ts

@@ -52,6 +52,10 @@ export default defineNitroPlugin((nitroApp) => {
     const sections = ['body', 'bodyAppend', 'bodyPrepend', 'head'] as Section[]
     for (const section of sections) {
       html[section] = html[section].map((element) => {
+        // Skip non-string elements
+        if (typeof element !== 'string') {
+          return element;
+        }
         // Add nonce to all link tags
         element = element.replace(LINK_RE, (match, rest) => {
           return `<link nonce="${nonce}"` + rest