.vscode/settings.json

@@ -39,8 +39,7 @@
 		"frontend",
 		"components",
 		"island",
-		"backend",
+		"backend"
-		"csp"
 	],
 	"[ignore]": {
 		"editor.defaultFormatter": "foxundermoon.shell-format"

deno.json

@@ -40,7 +40,7 @@
 		"@deno/gfm": "jsr:@deno/gfm@^0.8.2",
 		"@jotsr/delayed": "jsr:@jotsr/delayed@^2.1.1",
 		"@jotsr/smart-css-bundler": "jsr:@jotsr/smart-css-bundler@^0.3.0",
-		"@preact/signals": "https://esm.sh/*@preact/signals@^1.2.3",
+		"@preact/signals": "npm:@preact/signals@^1.2.3",
 		"@preact/signals-core": "npm:@preact/signals-core@^1.6.1",
 		"@simplewebauthn/browser": "npm:@simplewebauthn/browser@^10.0.0",
 		"@simplewebauthn/server": "npm:@simplewebauthn/server@^10.0.0",
@@ -51,7 +51,7 @@
 		"@std/json": "jsr:@std/json@^0.224.1",
 		"@std/streams": "jsr:@std/streams@^0.224.5",
 		"@univoq/": "https://deno.land/x/univoq@0.2.0/",
-		"preact": "npm:preact@10.22.0",
+		"preact": "npm:preact@^10.22.1",
 		"univoq": "https://deno.land/x/univoq@0.2.0/mod.ts",
 		"web-push": "npm:web-push@^3.6.7"
 	},

src/csp/middleware.ts

@@ -19,7 +19,8 @@ export function useCsp(
         imgSrc: [
             ...trustedDomains,
             'data:',
-            'https:',
+            'https://picsum.photos',
+            'https://fastly.picsum.photos',
         ],
         fontSrc: [...trustedDomains, 'https://cdn.jsdelivr.net'],
         scriptSrc: ["'self'", "'strict-dynamic'"],