Features:

• Allow configuring "named" policies, and applying different policies to different endpoints #172, #173, #185
• Allow customizing the HeaderPolicyCollection just before it is applied, customizing per request #174, #185
• Make adding directives to Content-Security-Policy idempotent to avoid duplicates #169
• Add AddDefaultApiSecurityHeaders() for adding default headers to APIs #183, #184
• Add AddPermissionsPolicyWithRecommendedDirectives() and PermissionsPolicyBuilder.AddDefaultSecureDirectives() for adding secure Permissions-Policy directives in bulk #183, #184
• NetEscapades.AspNetCore.SecurityHeaders now has an icon, thanks @khalidabuhakmeh! #195
• Allow accessing an IServiceProvider when configuring a SecurityHeaderPolicyBuilder #200
• Adds support for Trusted Types to Content-Security-Policy (#216, #218)

Build updates:

• Allow building from forks #232
• Fix release generation #231, #235, #236
• Fix recording test results #221
• Define version in the build project instead #223
• Generate SBOM #222
• Generate SBOM attestation #224
• Generate artifact provenance attestation #225
• Automatically create releases #229
• Fix incorrect dependency on obsolete Microsoft.AspNetCore.Mvc.Razor package #205 (Thanks @trejjam)
• Update documentation #214 (Thanks @schwastek)

Changes from 1.0.0-preview.4 to 1.0.0:

• Allow building from forks #232
• Fix release generation #231, #235, #236

All NuGet packages are available on https://www.nuget.org. You can view the build provenance attestation for the NuGet packages here.

The Software Bill of Materials (SBOM) is available for each package in CycloneDX format. View the provenance attestations for the SBOMs here:

• NetEscapades.AspNetCore.SecurityHeaders SBOM
• NetEscapades.AspNetCore.SecurityHeaders.TagHelpers SBOM

[!NOTE] You cannot assert the provenance of the .nupkg packages downloaded from nuget.org directly. First, you must remove the .signature.p7s file, as described here.