Following a deprecation from GitHub:
> ! Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: erlef/setup-beam@v1. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Have just a bin icon, and rely on drag and drop.
This solves a massive performance issue with the page, which is
traceable to the Fluxon dropdowns, particularly the Class.merge logic
used to merge Tailwind classes
⏺ Here's a breakdown of each directive:
┌─────────────────┬────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Directive │ Value │ Purpose │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ default-src │ 'self' │ Fallback for any resource type not explicitly listed — only allow from the app's own origin │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ script-src │ 'self' │ JavaScript can only be loaded from the app's origin (no external scripts, no inline) │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ style-src │ 'self' 'unsafe-inline' https://rsms.me │ Stylesheets from the app's origin, inline styles (needed by LiveView), and the https://rsms.me/inter/ hosted on rsms.me │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ font-src │ 'self' https://rsms.me │ Font files from the app's origin and rsms.me (Inter font) │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ img-src │ 'self' data: https://lastfm.freetls.fastly.net │ Images from the app's origin, data: URIs (inline base64 images), and Last.fm's CDN for album/artist artwork │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ connect-src │ 'self' │ XHR/fetch/WebSocket connections only to the app's origin (covers LiveView's WebSocket) │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ frame-ancestors │ 'self' │ The app can only be embedded in iframes by itself (clickjacking protection) │
├─────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ base-uri │ 'self' │ Restricts <base> tag to the app's origin (prevents base tag injection attacks) │
└─────────────────┴────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
Notable things not allowed by this policy:
- No inline <script> tags or eval()
- No external JavaScript from CDNs
- No embedding in third-party iframes
- No connections to external APIs from the browser (all external API calls go through the server)
Claudio Ortolina