ci(release): publish latest release

Author: hello-happy-puppy

RELEASE

@@ -1,6 +1,6 @@
 IPFS hash of the deployment:
-- CIDv0: `QmUUmgx7Hpd5Pjf88zjfcg8Gq9Entkz4G8Tq6GdNPaYgaT`
-- CIDv1: `bafybeic3hkurdl6na3vwj2o4esg6xwdz4ydvekpbsym25u6gz4cz2gyl7a`
+- CIDv0: `QmdDx5deWHGDuMypAwMLmaRE34Gxyr6CeyKSLoECMepymr`
+- CIDv1: `bafybeig5e7qt2nzdxmxfwobch2bemw724ebwkvfy7mcrv6kr5sxevhaioe`
 
 The latest release is always mirrored at [app.uniswap.org](https://app.uniswap.org).
 
@@ -10,5 +10,5 @@ You can also access the Uniswap Interface from an IPFS gateway.
 Your Uniswap settings are never remembered across different URLs.
 
 IPFS gateways:
-- https://bafybeic3hkurdl6na3vwj2o4esg6xwdz4ydvekpbsym25u6gz4cz2gyl7a.ipfs.dweb.link/
-- [ipfs://QmUUmgx7Hpd5Pjf88zjfcg8Gq9Entkz4G8Tq6GdNPaYgaT/](ipfs://QmUUmgx7Hpd5Pjf88zjfcg8Gq9Entkz4G8Tq6GdNPaYgaT/)
+- https://bafybeig5e7qt2nzdxmxfwobch2bemw724ebwkvfy7mcrv6kr5sxevhaioe.ipfs.dweb.link/
+- [ipfs://QmdDx5deWHGDuMypAwMLmaRE34Gxyr6CeyKSLoECMepymr/](ipfs://QmdDx5deWHGDuMypAwMLmaRE34Gxyr6CeyKSLoECMepymr/)

VERSION

@@ -1 +1 @@
-web/5.153.4
+web/5.153.5

apps/web/functions/app.test.ts

@@ -32,7 +32,9 @@ describe('frame protection headers', () => {
     const app = buildApp()
     const res = await app.request('/')
 
-    expect(res.headers.get('Content-Security-Policy')).toBe("frame-ancestors 'self' https://app.safe.global")
+    expect(res.headers.get('Content-Security-Policy')).toBe(
+      "frame-ancestors 'self' https://app.safe.global https://dexscreener.com https://*.dexscreener.com",
+    )
   })
 
   it('sets X-Frame-Options header on SPA routes', async () => {
@@ -46,7 +48,9 @@ describe('frame protection headers', () => {
     const app = buildApp()
     const res = await app.request('/swap')
 
-    expect(res.headers.get('Content-Security-Policy')).toBe("frame-ancestors 'self' https://app.safe.global")
+    expect(res.headers.get('Content-Security-Policy')).toBe(
+      "frame-ancestors 'self' https://app.safe.global https://dexscreener.com https://*.dexscreener.com",
+    )
     expect(res.headers.get('X-Frame-Options')).toBe('SAMEORIGIN')
   })
 

apps/web/functions/app.ts

@@ -44,9 +44,21 @@ interface AppConfig {
 // frame-ancestors cannot be enforced via <meta> CSP tags (W3C spec) — it
 // must be an HTTP response header. Cloudflare Workers returns responses
 // with immutable headers, so we clone into a mutable Response.
+// Origins allowed to iframe-embed the app. Whitelisting an embedder
+// relaxes clickjacking protection for that origin — treat additions as a
+// deliberate product/security tradeoff.
+// A wildcard host-source does not match the apex domain, so dexscreener.com
+// needs both the apex and the subdomain-wildcard entries.
+const ALLOWED_FRAME_ANCESTORS = [
+  "'self'",
+  'https://app.safe.global',
+  'https://dexscreener.com',
+  'https://*.dexscreener.com',
+]
+
 function withFrameProtection(res: Response): Response {
   const headers = new Headers(res.headers)
-  headers.set('Content-Security-Policy', "frame-ancestors 'self' https://app.safe.global")
+  headers.set('Content-Security-Policy', `frame-ancestors ${ALLOWED_FRAME_ANCESTORS.join(' ')}`)
   headers.set('X-Frame-Options', 'SAMEORIGIN')
   return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
 }