Fix SecurityHeadersRouterTest.

Author: Yaytay

query-engine/docs/query-engine-compose.yml

@@ -50,7 +50,7 @@ services:
     - 16686:16686
 
   query-engine:
-    image: ghcr.io/yaytay/query-engine-design-mode:0.2.30-main
+    image: ghcr.io/yaytay/query-engine-design-mode:0.2.30-1-main
     ports:
     - 2000:8080
     volumes:

query-engine/src/main/java/uk/co/spudsoft/query/main/Version.java

@@ -34,7 +34,7 @@ public final class Version {
   /**
    * The project version, as set in the Maven pom.xml.
    */
-  public static final String MAVEN_PROJECT_VERSION = "0.2.30-main";
+  public static final String MAVEN_PROJECT_VERSION = "0.2.30-1-main";
 
   private Version() {
   }

query-engine/src/test/java/uk/co/spudsoft/query/web/SecurityHeadersRouterTest.java

@@ -220,7 +220,7 @@ void testHandleWithHttpsRequest() {
     handlerCaptor.getValue().handle(null);
 
     verify(responseHeaders).add("Strict-Transport-Security", "max-age=63072000");
-    verify(responseHeaders).add("Content-Security-Policy", "default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-hashes'; connect-src 'self'; script-src 'self' 'unsafe-eval'");
+    verify(responseHeaders).add("Content-Security-Policy", "default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-hashes'; connect-src 'self'; script-src 'self' 'unsafe-eval'; manifest-src 'self'");
     verify(responseHeaders).add("X-Frame-Options", "DENY");
     verify(responseHeaders).add("X-Content-Type-Options", "nosniff");
     verify(responseHeaders).add("Referrer-Policy", "same-origin");
@@ -250,7 +250,7 @@ void testHandleWithHttpRequest() {
 
     // Should not add HSTS for HTTP requests
     verify(responseHeaders, never()).add("Strict-Transport-Security", "max-age=63072000");
-    verify(responseHeaders).add("Content-Security-Policy", "default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-hashes'; connect-src 'self'; script-src 'self' 'unsafe-eval'");
+    verify(responseHeaders).add("Content-Security-Policy", "default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-hashes'; connect-src 'self'; script-src 'self' 'unsafe-eval'; manifest-src 'self'");
     verify(responseHeaders).add("X-Frame-Options", "DENY");
     verify(responseHeaders).add("X-Content-Type-Options", "nosniff");
     verify(responseHeaders).add("Referrer-Policy", "same-origin");