github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-10-28 21:40:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Remove third-party Work Sans import from plugin styles (#12087)

Browse Source 
@penpot/plugin-styles loaded Work Sans from fonts.bunny.net via a remote
@import in core/fonts.css, which every plugin built with the package
fetched at runtime. That broke air-gapped deployments, leaked user IPs
to a third party, and forced deployments to widen the CSP style-src
and font-src directives introduced in #11374.

Drop the remote import and use the system-ui stack instead of
'Work Sans' in the same package (both in core/fonts.css for code
blocks and in core/generic.css for the base typography, which relied
on the same webfont), so plugins no longer reach any external domain
and 'self' is enough for both CSP directives.

Verified by bundling the package entry point with esbuild using the
same options as tools/scripts/build-css.mjs: the produced styles.css
is balanced, contains system-ui, and contains no external import.

Closes #12023

Signed-off-by: ump45nose <1729065730@qq.com>
This commit is contained in:
ump45nose 2026-10-09 09:38:05 -07:00 committed by GitHub
parent d7ccc0f3a6
commit 1125f72d81
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/libs/plugins-styles/src/lib/core/fonts.css
View File

@ -1,5 +1,3 @@
@import url('https://fonts.bunny.net/css?family=work-sans:400,500&display=swap');
:root {
/* Font weight */
--font-weight-regular: 400;
@ -14,7 +12,7 @@
}
code {
font-family: 'Work Sans', sans-serif;
font-family: system-ui, sans-serif;
}
.display {

2
plugins/libs/plugins-styles/src/lib/core/generic.css
View File

@ -1,6 +1,6 @@
html,
body {
font-family: 'Work Sans', sans-serif;
font-family: system-ui, sans-serif;
font-optical-sizing: auto;
font-style: normal;
margin: 0;