From 4e7faed781649dcb539c1d25897cba9dd542d49d Mon Sep 17 00:00:00 2001
From: SkateSpots <skatespots>
Date: Mon, 2 Nov 2026 00:30:52 +0700
Subject: [PATCH] release: 1.7.83

---
 distribution/README.md     | 6 +++---
 index.html                 | 1 +
 package-lock.json          | 4 ++--
 package.json               | 2 +-
 public/_headers            | 2 +-
 public/download/index.html | 4 ++--
 release-notes.txt          | 7 +++++++
 src/lib/mapTiles.ts        | 4 ++--
 8 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/distribution/README.md b/distribution/README.md
index a187005..44998b2 100644
--- a/distribution/README.md
+++ b/distribution/README.md
@@ -7,10 +7,10 @@ account is required.
 
 - Forge: <https://git.skate-spots.org/skatespots/SkateSpots>
 - Latest release: <https://git.skate-spots.org/skatespots/SkateSpots/releases/latest>
-- Signed APK (1.7.82):
-  <https://git.skate-spots.org/skatespots/SkateSpots/releases/download/v1.7.82/SkateSpots-1.7.82.apk>
+- Signed APK (1.7.83):
+  <https://git.skate-spots.org/skatespots/SkateSpots/releases/download/v1.7.83/SkateSpots-1.7.83.apk>
 - SHA-256:
-  `13eb14520a5c3a9c23dff65840b8eacdf399e816841594c86ed3c4a4aeb85e5b`
+  `1fe70588adea237045b117ccdf013811b87a8368caf6b1148a7ab7da0a6250c3`
 
 The APK is signed with the same key as the Zapstore build. Installing an
 F-Droid-signed build over it would require uninstalling SkateSpots and losing
diff --git a/index.html b/index.html
index 2825b99..8853cbf 100644
--- a/index.html
+++ b/index.html
@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
+    <meta name="referrer" content="strict-origin-when-cross-origin" />
     <title>SkateSpots — Open-sourced Skate Community App</title>
 
     <!--
diff --git a/package-lock.json b/package-lock.json
index 26ece6e..781b581 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.7.82",
+  "version": "1.7.83",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.7.82",
+      "version": "1.7.83",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",
diff --git a/package.json b/package.json
index e871b3a..137fbe5 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.7.82",
+  "version": "1.7.83",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",
diff --git a/public/_headers b/public/_headers
index e05f5ee..afba8c2 100644
--- a/public/_headers
+++ b/public/_headers
@@ -2,7 +2,7 @@
   Content-Security-Policy: default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https: wss:; media-src 'self' blob: https:; frame-src 'self' https:; worker-src 'self' blob:; manifest-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
   X-Content-Type-Options: nosniff
   X-Frame-Options: DENY
-  Referrer-Policy: no-referrer
+  Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: geolocation=(self), camera=(self), microphone=()
 
 # Cache the proxied mint directory so we don't hammer the rate-limited API.
diff --git a/public/download/index.html b/public/download/index.html
index 3bf07d7..cff3463 100644
--- a/public/download/index.html
+++ b/public/download/index.html
@@ -98,10 +98,10 @@
 
       <a
         class="download"
-        href="https://git.skate-spots.org/skatespots/SkateSpots/releases/download/v1.7.82/SkateSpots-1.7.82.apk"
+        href="https://git.skate-spots.org/skatespots/SkateSpots/releases/download/v1.7.83/SkateSpots-1.7.83.apk"
         rel="noopener"
       >
-        <span>Download SkateSpots-1.7.82.apk · 60 MB</span>
+        <span>Download SkateSpots-1.7.83.apk · 60 MB</span>
         <span aria-hidden="true">↓</span>
       </a>
 
diff --git a/release-notes.txt b/release-notes.txt
index a079087..a5e4466 100644
--- a/release-notes.txt
+++ b/release-notes.txt
@@ -1,3 +1,10 @@
+🛹 OpenStreetMap tiles load again
+- OSM was refusing the app because tile requests sent no Referer. The app now sends only the site origin (strict-origin-when-cross-origin), which satisfies OSM's tile policy without exposing page paths.
+- A fresh osm-v3 tile cache means previously cached "Access blocked" tiles are never reused.
+- OpenStreetMap remains the basemap; no CARTO or other provider was added.
+
+---
+
 🛹 Orange wheel icon restored
 - The app header, mobile header, splash screen and footer now use the orange SkateSpots wheel again.
 - The same orange artwork is used for the PWA icons, Apple touch icon, app install metadata and Zapstore listing.
diff --git a/src/lib/mapTiles.ts b/src/lib/mapTiles.ts
index 7666c6d..38a037c 100644
--- a/src/lib/mapTiles.ts
+++ b/src/lib/mapTiles.ts
@@ -1,7 +1,7 @@
 /**
  * OpenStreetMap basemap configuration.
  *
- * Keep the OSM tile provider. `osm-v2` intentionally changes the cache
+ * Keep the OSM tile provider. `osm-v3` intentionally changes the cache
  * namespace so old cached "Access blocked" tiles are never reused; it does not
  * change the tile source.
  */
@@ -10,6 +10,6 @@ export const MAP_TILE_URL =
 
 export const MAP_TILE_SUBDOMAINS = 'abc';
 
-export const MAP_TILE_CACHE_NAMESPACE = 'osm-v2';
+export const MAP_TILE_CACHE_NAMESPACE = 'osm-v3';
 
 export const MAP_TILE_ATTRIBUTION = '&copy; OpenStreetMap contributors';