@forge/csp

Index: package/out/csp/csp-injection-service.js
===================================================================
--- package/out/csp/csp-injection-service.js
+++ package/out/csp/csp-injection-service.js
@@ -32,8 +32,16 @@
         'fedramp-stg': 'https://api-media.stg.atlassian-us-gov-mod.com',
         'fedramp-prod': 'https://api-media.atlassian-us-gov-mod.com',
         ...makeICHosts((env, icOptions) => `https://media-api.${getICDomain(env, icOptions)}`)
     },
+    ATLASSIAN_ASSETS_MEDIA_HOST: {
+        dev: 'https://assets-media.stg.atlassian.com',
+        stg: 'https://assets-media.stg.atlassian.com',
+        prod: 'https://assets-media.atlassian.com',
+        'fedramp-stg': 'https://assets-media.stg.atlassian-us-gov-mod.com',
+        'fedramp-prod': 'https://assets-media.atlassian-us-gov-mod.com',
+        ...makeICHosts((env, icOptions) => `https://assets-media.${getICDomain(env, icOptions)}`)
+    },
     ATLASSIAN_ANALYTICS_GATEWAY_HOST: {
         dev: 'https://as.dev.atl-paas.net',
         stg: 'https://as.staging.atl-paas.net',
         prod: 'https://as.atlassian.com',
@@ -148,8 +156,9 @@
         getAtlassianHost('ATLASSIAN_API_GATEWAY_HOST', microsEnv, icOptions),
         getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions),
         getAtlassianHost('ATLASSIAN_EMOJIS_HOST', microsEnv, icOptions),
         ...getReactionsImageHost(microsEnv, icOptions),
+        getAtlassianHost('ATLASSIAN_ASSETS_MEDIA_HOST', microsEnv, icOptions),
         getAtlassianHost('ATLASSIAN_TEAM_AVATAR_HOST', microsEnv, icOptions),
         getAtlassianHost('ATLASSIAN_TEAM_HEADER_HOST', microsEnv, icOptions),
         ...getFOSHostDownload(microsEnv, icOptions),
         ...getFOSCDNUrls(microsEnv, icOptions)

Index: package/package.json
===================================================================
--- package/package.json
+++ package/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@forge/csp",
-  "version": "6.3.0-experimental-ccd5143",
+  "version": "6.3.1-next.0",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
   "license": "SEE LICENSE IN LICENSE.txt",
@@ -10,10 +10,10 @@
     "compile": "tsc -b -v",
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "9.4.0-next.6-experimental-ccd5143",
-    "@forge/manifest": "13.3.1-next.0-experimental-ccd5143",
+    "@forge/cli-shared": "9.4.0-next.8",
+    "@forge/manifest": "13.3.1-next.1",
     "@types/jest": "^29.5.14",
     "@types/node": "20.19.1",
     "cheerio": "^1.2.0",
     "typescript": "5.9.2"

Index: package/out/csp/csp-injection-service.d.ts.map
===================================================================
--- package/out/csp/csp-injection-service.d.ts.map
+++ package/out/csp/csp-injection-service.d.ts.map
@@ -1,1 +1,1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA4L1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAajG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,iBAAiB;IA4ElB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAsGV;CACH"}
\ No newline at end of file
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA0M1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAcjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,iBAAiB;IA4ElB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAsGV;CACH"}
\ No newline at end of file

Index: package/CHANGELOG.md
===================================================================
--- package/CHANGELOG.md
+++ package/CHANGELOG.md
@@ -1,6 +1,12 @@
 # @forge/csp
 
+## 6.3.1-next.0
+
+### Patch Changes
+
+- 873db00: Allow Jira Assets object icons (`assets-media.atlassian.com`) by default in the Custom UI `img-src` CSP directive across all environments (dev, staging, prod, FedRAMP and IC). Apps rendering Assets icons no longer need to declare this Atlassian-owned domain under `permissions.external.images`, so it no longer counts toward the external image domain limit (ECO-1691).
+
 ## 6.3.0
 
 ### Minor Changes