Bump NetEscapades.AspNetCore.SecurityHeaders from 1.2.0 to 1.3.0

[dependabot]

Updated NetEscapades.AspNetCore.SecurityHeaders from 1.2.0 to 1.3.0.

Release notes

Sourced from NetEscapades.AspNetCore.SecurityHeaders's releases.

1.3.0

Changes in 1.3.0:

Features:

• Add API for registering an async policy selector #​259 (Thanks @​jchannon)
• Update Content-Security-Policy builders to encourage correct directives and to flag incorrect directives #​272
• Add OverInsecureHttp() and OverInsecureWs() scheme sources to CSP builders #​273

Changes in 1.2.0:

Features:

• Add support for child-src to Content-Security-Policy #​259
• Allow multiple calls to AddSecurityHeadersPolicies() for registering named polices #​250

Fixes:

• Fix typos in ReadMe #​256 (Thanks @​jt-pt-dev)

Changes in 1.1.0

Features:

• Add AddRange() to SourceCollection #​240, #​242 (Thanks @​rankobp)
• Improve CSP documentation #​241 (Thanks @​Meir017)
• Add X-Frame-Options ALLOW-FROM with correct method name AddFrameOptionsAllowFrom() #​244

Changes in 1.0.0

This marks the first major release of the NetEscapades.AspNetCore.SecurityHeaders. For simplicity, all the changes since 0.24.0 are included below.

Breaking Changes:

• Drop support for .NET Standard 2.0, raises minimum framework to .NET Core 3.1 #​167, #​171
• Removed "document header" functionality, in favour of always adding all headers #​186
• Remove X-XSS-Protection from default headers and mark obsolete #​168
• Add cross-origin-opener-policy: same-origin to default headers #​184
• Mark Feature-Policy as obsolete #​187
• Mark Expect-CT as obsolete #​197
• Make nonce generation lazy on call to HttpContext.GetNonce() #​198
• Remove ambient-light-sensor=() from DefaultSecureDirectives() for permissions policy #​203 (Thanks damienbod!)
• Update COOP, COEP, and CORP for AddDefaultSecurityHeaders() and AddDefaultApiSecurityHeaders() #​204 (Thanks damienbod!)
• Removes obsolete APIs (#​217)

Features:

• Allow configuring "named" policies, and applying different policies to different endpoints #​172, #​173, #​185
• Allow customizing the HeaderPolicyCollection just before it is applied, customizing per request #​174, #​185
• Make adding directives to Content-Security-Policy idempotent to avoid duplicates #​169
• Add AddDefaultApiSecurityHeaders() for adding default headers to APIs #​183, #​184
• Add AddPermissionsPolicyWithRecommendedDirectives() and PermissionsPolicyBuilder.AddDefaultSecureDirectives() for adding secure Permissions-Policy directives in bulk #​183, #​184
• NetEscapades.AspNetCore.SecurityHeaders now has an icon, thanks @​khalidabuhakmeh! #​195
• Allow accessing an IServiceProvider when configuring a SecurityHeaderPolicyBuilder #​200
• Adds support for Trusted Types to Content-Security-Policy (#​216, #​218)
  ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)