From ec9ad454758f6fa3c021a2e80bfd86406704b3e7 Mon Sep 17 00:00:00 2001
From: ralksta <ralksta@users.noreply.github.com>
Date: Sun, 15 Feb 2026 22:19:07 +0100
Subject: [PATCH] fix: allow inline scripts in CSP for Next.js hydration

script-src 'self' was blocking all Next.js inline hydration scripts,
preventing client-side JS from running. This caused fade-in items to
stay at opacity:0 (empty grid). Added 'unsafe-inline' until Next.js
App Router supports nonce-based CSP.
---
 next.config.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/next.config.ts b/next.config.ts
index 7ec3e89..e726c8f 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -4,7 +4,7 @@ import type { NextConfig } from 'next';
 // Locks down the public-facing site to only trusted sources.
 const cspDirectives = [
   "default-src 'self'",
-  "script-src 'self'",
+  "script-src 'self' 'unsafe-inline'",
   "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
   "font-src 'self' https://fonts.gstatic.com",
   "img-src 'self' data:",