From 848a098a42165a10aa63c1382d6d18d57df4282d Mon Sep 17 00:00:00 2001
From: Max Burri <burri@puzzle.ch>
Date: Wed, 1 Jul 2026 09:29:50 +0200
Subject: [PATCH 1/2] fix: make the middleware matcher regex match index pages

---
 app/middleware.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/middleware.ts b/app/middleware.ts
index 0dfbc5f5f..f081184f9 100644
--- a/app/middleware.ts
+++ b/app/middleware.ts
@@ -64,6 +64,12 @@ export function middleware(request: NextRequest) {
 
 export const config = {
   matcher: [
+    // The negative-lookahead pattern below gets compiled by Next.js (when i18n
+    // is configured) into a regex that requires two path segments (locale +
+    // rest), which silently excludes bare locale-root paths like "/", "/de",
+    // "/en". Add those explicitly so they still go through the middleware.
+    "/",
+    "/(de|fr|it|en)",
     {
       source: "/((?!_next/static|_next/image|favicon\\.ico).*)",
       missing: [

From f950003446c319b780470ec373ca8fc4d8ec7517 Mon Sep 17 00:00:00 2001
From: Max Burri <burri@puzzle.ch>
Date: Wed, 1 Jul 2026 09:48:34 +0200
Subject: [PATCH 2/2] doc: add changelog entry

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad618f37c..d0519e0d2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,9 @@ You can also check the
 
 ## Unreleased
 
+- Fixes
+  - Correctly set CSP headers for index pages
+
 ## 6.5.0 – 2026-06-01
 
 - Features