[cameri]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

nostream@3.15.0

Minor Changes

• #1068 d6b98ab Thanks @aikido-autofix! - feat(web): set security headers on every web response

  The web app now sends Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy, X-DNS-Prefetch-Control, X-Permitted-Cross-Domain-Policies and the cross-origin isolation headers through Helmet.

  The app's own nonce-based Content-Security-Policy remains the single CSP on a response: Helmet's default policy is disabled, because a second CSP would intersect with the app's and block the nonce'd inline scripts the dashboard uses. Embedding the web UI in another origin is now refused by X-Frame-Options; the dashboard's own Grafana frame is unaffected.

Patch Changes

• #1067 0832ffd Thanks @Ferryx349! - fix(payments): accept LNbits 1.x callback bodies

  LNbits 1.x sends the payment object as a JSON string inside the webhook body.
  The callback route now allows a top-level JSON string, the controller parses it
  before validation, and the body schema accepts and strips LNbits' extra payment
  fields while still requiring a valid payment_hash.

  Non-JSON string bodies still return 400 Malformed body; the HMAC query check
  and the invoice lookup from LNbits remain unchanged.

Summary by CodeRabbit

• Documentation
  • Added release notes for version 3.15.0, covering security headers for web responses and LNbits 1.x callback-body handling.
  • The notes describe support for top-level JSON-string callback bodies, validation of payment data, and a 400 Malformed body response for non-JSON strings.
  • They also clarify that the existing HMAC query check and LNbits invoice lookup remain unchanged.

[greptile-apps]

This PR does not match any of the 1 configured review trigger rule.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

This change prepares the 3.15.0 release. It updates the package version and changelog with notes on web security headers and LNbits 1.x callback handling. It removes the changesets for those changes.

Changes: Release metadata

Layer / File(s)	Summary
Version and release notes package.json, CHANGELOG.md, .changeset/lnbits-callback-body.md, .changeset/web-security-headers.md	The package version changes to 3.15.0. The changelog documents Helmet security headers and LNbits 1.x callback handling. Both related changesets are removed.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Possibly related issues

• [BUG] LNbits >= 1.0 webhook is rejected with 400: body is a JSON-encoded string and the schema is strict #1066: The changelog documents support for JSON-encoded strings and extra payment fields in LNbits 1.x callbacks.
• security: own the two Aikido autofix PRs (#1068 security headers, #1069 workflow_run) #1070: The changelog includes release notes for the Helmet security headers tracked by this issue.

Possibly related PRs

• cameri/nostream#1067: This PR implements the LNbits callback changes documented in the release notes.

Merge Risk: Minimal · up to a7c8d

This release-metadata update bumps the version to 3.15.0 and adds changelog notes. It changes no runtime behavior and is ready to merge.

Architecture risk: Low · up to 0a771

The change affects 2 systems.

Changed systems: CHANGELOG.md, package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — CHANGELOG.md (service) was modified; 1 changed file maps to changed impact.
• observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in CHANGELOG.md: Adds the 3.15.0 minor-change notes describing Helmet security headers on web responses and the continued use of the app’s nonce-based CSP with Helmet’s default CSP disabled.
• observed — Modified behavior in CHANGELOG.md: Adds patch notes for LNbits 1.x callbacks: top-level JSON strings are parsed before validation; extra payment fields are stripped while payment_hash remains required; non-JSON strings return 400 Malformed body. The notes state that HMAC query validation and invoice lookup remain unchanged.
• observed — Modified behavior in package.json: The package version changes from 3.14.0 to 3.15.0.
• observed — Modified behavior in .changeset/lnbits-callback-body.md: Removed the changeset declaring a nostream patch release and describing LNbits 1.x callback-body handling.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title identifies the release, which is the main purpose of the PR.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

_{A rabbit reads the changelog bright,
Three-fifteen hops into sight.
Headers guard the web’s front door,
Callbacks parse their strings once more.
Changesets tuck away to rest,
A neat release, prepared with zest.}

Recent review info

Automatic approval policy

Commit: a7c8d453525c.

Setting	Effective value	Source
Automatic approvals	Enabled	Global configuration
Merge risk	Minimal	Global configuration
Security risk	Not set	Global configuration

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7357acb8-bf01-4c64-b0eb-530ffec10bab

Commits

Reviewing files that changed from the base of the PR and between 0a77199 and a7c8d45.

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.