fix: relax csp

Co-authored-by: public-glueops-renovatebot[bot] <186083205+public-glueops-renovatebot[bot]@users.noreply.github.com>

Dockerfile

@@ -1,7 +1,7 @@
 #################################
 # Builder: Go + Node in one
 #################################
-FROM golang:1.25.3-alpine@sha256:aee43c3ccbf24fdffb7295693b6e33b21e01baec1b2a55acc351fde345e9ec34 AS builder
+FROM golang:1.25.4-alpine AS builder
 
 RUN apk add --no-cache \
     bash git ca-certificates tzdata \

Makefile

@@ -28,8 +28,8 @@ SDK_PKG      ?= ${BIN}                      # package name inside the SDK
 
 UI_SSG_ROUTES ?= /,/login,/docs,/pricing
 
-# Go versioning (go.mod uses major.minor; you’re on 1.25.3)
+# Go versioning (go.mod uses major.minor; you’re on 1.25.4)
-GO_VERSION   ?= 1.25.3
+GO_VERSION   ?= 1.25.4
 
 # SDK / package settings (TypeScript)
 SDK_TS_OUTDIR     ?= sdk/ts

go.mod

@@ -1,6 +1,6 @@
 module github.com/glueops/autoglue
 
-go 1.25.3
+go 1.25.4
 
 require (
 	github.com/alexedwards/argon2id v1.0.0

internal/api/mw_security.go

@@ -49,7 +49,7 @@ func SecurityHeaders(next http.Handler) http.Handler {
 				"default-src 'self'",
 				"base-uri 'self'",
 				"form-action 'self'",
-				"script-src 'self'",
+				"script-src 'self' 'unsafe-inline'",
 				"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
 				"img-src 'self' data: blob:",
 				"font-src 'self' data: https://fonts.gstatic.com",

postgres/Dockerfile

@@ -1,4 +1,4 @@
-FROM postgres:latest@sha256:feff5b24fedd610975a1f5e743c51a4b360437f4dc3a11acf740dcd708f413f6
+FROM postgres:17.6@sha256:00bc86618629af00d2937fdc5a5d63db3ff8450acf52f0636ec813c7f4902929
 
 RUN cd /var/lib/postgresql/ && \
     openssl req -new -text -passout pass:abcd -subj /CN=localhost -out server.req -keyout privkey.pem && \

sdk/ts/package.json

@@ -16,6 +16,6 @@
     "prepare": "npm run build"
   },
   "devDependencies": {
-    "typescript": "^4.0 || ^5.0"
+    "typescript": "5.9.3"
   }
 }