From e3270012e919c41d7ae926309ffb6ce479c1e051 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Tue, 21 Jul 2026 22:09:45 -0400
Subject: [PATCH] CHANGELOG: document the style-src CSP fix

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DY9UMTuF43Ekc2U4E1eDwX
---
 CHANGELOG.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e2c5c5..e72e216 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,3 +19,19 @@ would plausibly want. Newest first.
   **Re-vendor if:** your site uses the default built-in relay list (i.e. you
   don't pass your own `vault-relays`/`discovery-relays` attributes). If you
   already pass your own relay list, this doesn't affect you.
+
+- **Fix: widget completely unstyled (giant logo, unstyled buttons) under a
+  strict `style-src` CSP.** `element.ts` injected its CSS as an inline
+  `<style>` tag inside the shadow root on every render. A host with
+  `style-src 'self'` and no `'unsafe-inline'` silently drops an inline
+  `<style>`'s rules entirely — visible as the brand SVG rendering at its raw
+  ~590×119px intrinsic size instead of the intended 20px-tall lockup, with
+  every other shadow-DOM element similarly falling back to unstyled browser
+  defaults. Switched to building the stylesheet once as a `CSSStyleSheet` and
+  assigning it via `adoptedStyleSheets`, which isn't subject to `style-src`.
+  (`e8712f9`)
+  **Re-vendor if:** your site's CSP sets `style-src` without `'unsafe-inline'`
+  (check your CSP header/meta tag). If your `style-src` already includes
+  `'unsafe-inline'`, or you have no CSP, this was invisible to you either
+  way, but re-vendoring is still a good idea (this fix also drops needless
+  per-render CSS reparsing).