Starting with 2021.10 LTS, a strict Content Security Policy has been implemented for the Aimeos backend and for the Laravel frontend. This effectively prevents Cross-Site-Scripting (XSS) where foreign Javascript code is executed in the context of the page loaded by the users' browser and which is a common source of security incidents.
This also means that inline Javascript in any templates is ignored by browsers now and scripts, CSS, images, videos, etc. are only loaded from well-defined sources. To allow a new URL for any of those objects, you have to overwrite the frontend or backend page template and add the URL there:
To allow Javascript required by e.g. payment gateways like Stripe, a "nonce" is available to mark JS code within script tags as trusted. Other security improvements include hardening against potential CSRF attacks and SVG images are now sanitized when uploaded, so they doesn't contain any Javascript or external URLs.
To improve internationalization, it's now possible to translate all error messages with placeholders from the core, even those that are only logged. Furthermore, all log messages has been categorized to filter messages by their source effectively.
Last but not least, the catalog detail component can be configured to return a HTTP 404 status instead of displaying an error message that the product could not be found.