November 7, 2026 · 3.0.0-beta.21

Stricter protections in packaged builds.

Production releases now enforce tighter renderer and OAuth policies, while development keeps local hot reload and DevTools.

• Improved

  Packaged builds block inline scripts and limit renderer connections to the app. Development keeps local hot reload and DevTools. Inline style attributes remain available for Velora's dynamic layout.

• New

  CSP violations are recorded in local diagnostics by directive, origin, and source location, without saving full URLs or query strings.

• Improved

  OAuth continues to use an ephemeral 127.0.0.1 callback. The redirect policy accepts HTTPS and loopback HTTP and rejects other HTTP destinations.