# [0.2.1] - 2026-10-18

### Added

- **Secret scanning in CI.** A gitleaks job scans the whole history on every push and pull request
  to `main` and `develop`; reviewed test fixtures are listed in `.gitleaksignore`.

### Changed

- **Core requires the SDK at `v0.1.0`**, the version it declares, instead of `v0.0.0`, so a plugin
  in its own repository can fetch core once the module tags (`apps/backend/core/vX.Y.Z`,
  `apps/backend/sdk/vX.Y.Z`) are pushed. The release guide covers tagging them.

### Fixed

- **Browser uploads work behind the shipped CSPs.** The dashboard, storefront and Caddy policies
  only allowed connections to their own origin, so every upload to object storage was refused.
  `UPLOAD_ORIGINS` in the root `.env` names the hosts uploads go to and joins `connect-src` in all
  three; dev allows its local hosts on its own. `./skelet release` now passes a Dockerfile's build
  arguments through from your shell or the root `.env`, which it never did.
- **The demo storefront's tab icon is Skelet's**, not the Vercel triangle create-next-app left behind.

[0.2.1]: https://github.com/skeletg/skelet/compare/v0.2.0...v0.2.1

---

From the Skelet changelog: https://skelet.dev/changelog/0.2.1/