Skip to content

Release Notes

Latest Changes

Breaking Changes

  • 📌 Load Swagger UI 5.34.0 and ReDoc 2.5.4 instead of the floating @5 and @2 tags. PR #72 by @matblack81.

Features

  • ✨ Let setup() load Swagger UI and ReDoc from custom asset URLs. PR #75 by @matblack81.

Docs

  • 📝 Add the documentation site skeleton with a strict build in CI. PR #78 by @matblack81.
  • 📝 Document the CSP violations caused by Markdown in Swagger UI descriptions. PR #77 by @matblack81.
  • 📝 Document setup()'s asset URL parameters and the manual wiring alternative. PR #76 by @matblack81.
  • 📝 Add a README note on keeping the stricter CSP outside the ReDoc page. PR #73 by @matblack81.
  • 🔥 Remove root_path_app example that relies on deprecated FastAPI(root_path=...). PR #62 by @matblack81.
  • 🔧 Replace old GitHub username in release notes links. PR #61 by @matblack81.

Internal

  • ⬆ Bump fastapi from 0.141.1 to 0.162.0. PR #74 by @matblack81.
  • ✅ Snapshot the pages every docs generator emits. PR #71 by @matblack81.
  • 🔥 Remove the leftover sync-pin markers from the workflows. PR #70 by @matblack81.
  • 👷 Install only the tests dependency group in the test workflows. PR #69 by @matblack81.
  • 🔧 Split the dev dependencies into a separate tests group. PR #68 by @matblack81.
  • 👷 Run the FastAPI master workflow daily. PR #67 by @matblack81.
  • ⬆ Bump certifi to 2026.10.23 and allow its name in typos. PR #66 by @matblack81.
  • ⬆ Bump certifi from 2026.6.17 to 2026.10.19. PR #65 by @dependabot[bot].
  • 👷 Add a weekly CI run against FastAPI master. PR #64 by @matblack81.
  • 👷 Test the latest FastAPI release in CI instead of the locked version. PR #63 by @matblack81.

1.0.4 (2026-10-16)

Internal

1.0.3 (2026-09-22)

Docs

  • 📝 Fix release notes link still pointing to the old uppercase filename. PR #44 by @matblack81.

Internal

1.0.2 (2026-08-12)

Internal

  • 👷 Tag CI action pins for sync tracking. PR #41 by @matblack81.
  • 👷 Sync CI, pre-commit, and release scripts workflows with the latest template. PR #40 by @matblack81.
  • 🐛 Fix release date defaulting to the date the script was imported. PR #39 by @matblack81.
  • 🐛 Fix partial release state when release notes write fails. PR #38 by @matblack81.

1.0.1 (2026-08-05)

Internal

  • ✅ Add test for all runnable examples. PR #36 by @matblack81.
  • ✅ Close remaining test coverage gaps in the package. PR #35 by @matblack81.
  • ♻️ Import Response types from fastapi in the remaining examples and README. PR #34 by @matblack81.
  • 🐛 Reject invalid bump types and cover prepare_release's untested error paths. PR #33 by @matblack81.
  • 🐛 Fix partial release state when release notes update fails. PR #32 by @matblack81.
  • 🔒️ Escape interpolated values in generated Swagger UI/ReDoc pages. PR #31 by @matblack81.
  • ✅ Prove PR test changes actually catch a regression before merging. PR #30 by @matblack81.
  • ⬆️ Bump tiangolo/latest-changes to 0.7.1. PR #29 by @matblack81.
  • ⬆ Bump fastapi from 0.139.2 to 0.140.0. PR #28 by @dependabot[bot].
  • ⬆ Bump the python-packages group with 5 updates. PR #27 by @dependabot[bot].
  • ⬆ Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 in the github-actions group. PR #26 by @dependabot[bot].

1.0.0 (2026-07-28)

🎉 First stable release of fastapi-csp-docs.

0.1.4 (2026-07-28)

Internal

0.1.3 (2026-07-10)

Refactors

  • ♻️ Align imports with FastAPI's public dependency contract. PR #13 by @matblack81.

Internal

  • 🔧 Add test coverage for setup()'s openapi and root_path edge cases. PR #12 by @matblack81.

0.1.2 (2026-07-09)

Internal

  • 🔧 Integrate Codecov for coverage tracking and update README. PR #10 by @matblack81.

0.1.1 (2026-07-08)

Docs

  • 📝 Update README badge styles and unwrap paragraphs. PR #8 by @matblack81.

0.1.0 (2026-07-08)

🚀 First official public release of fastapi-csp-docs.

FastAPI's built-in /docs, /redoc, and OAuth2 redirect pages embed inline <script>/<style> tags, breaking any Content-Security-Policy without 'unsafe-inline'. Even FastAPI's own "Custom Docs UI Static Assets" recipe only swaps CDN URLs for local ones, without removing that inline content. fastapi-csp-docs replaces all three pages with versions that load every script and stylesheet from a separate endpoint.

Features

  • ✨ setup(app, *, docs_url="/docs", redoc_url="/redoc"): one call replaces FastAPI's built-in /docs, /redoc, and OAuth2 redirect wiring, with no inline script or style left anywhere.
  • ✨ Fails fast on misconfiguration: setup() raises RuntimeError if the app's built-in docs aren't disabled first, instead of silently letting them shadow the CSP-safe routes.
  • ✨ CDN or fully self-hosted: works with the default jsdelivr CDN (script-src 'self' <cdn-host>) or entirely offline with your own static assets (script-src 'self', zero external origins).
  • ✨ Reverse-proxy / sub-app aware: doc URLs include the ASGI root_path computed per request, so mounting under a prefix (app.mount("/api", sub_app)) works out of the box.
  • ✨ Content generators (get_swagger_ui_html, get_swagger_ui_init_js, get_redoc_html, get_redoc_css, get_swagger_ui_oauth2_redirect_html, get_swagger_ui_oauth2_redirect_js) exported for manual wiring, enabling a fully self-hosted setup with no CDN at all.
  • ✨ get_redoc_html(disable_search=True): disables ReDoc's client-side search box, avoiding the Web Worker it runs in, which otherwise needs worker-src 'self' blob: in the CSP, since the worker is instantiated from a blob: URL with no separate file to point at instead.