and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
milestone

Toy Story 5 Scores Year's Biggest Opening ($160M/$312M Global) as Bad Bunny Plays Düsseldorf

| Bad Bunny

Toy Story 5 — featuring Bad Bunny as 'Pizza with Sunglasses' — opens to $160 million domestically over its June 20–22 debut weekend, plus $152 million internationally for a $312 million global bow. It's the biggest box-office opening of 2026 by a wide margin, the largest start in Toy Story franchise history (surpassing 2019's Toy Story 4 at $120 million), and the second-largest animated opening weekend ever behind 2018's Incredibles 2 ($182.7 million). The same weekend, Bad Bunny performs two sold-out nights at Merkur Spiel-Arena in Düsseldorf (June 20–21) — his first German stadium dates on the Debí Tirar Más Fotos World Tour — with 'Enséñame a Bailar' and 'Vuelve' as the nights' exclusive songs.

Media

Toy Story 5 — biggest box-office opening of 2026 ($312M global), June 20–22, 2026
Toy Story 5 — biggest box-office opening of 2026 ($312M global), June 20–22, 2026 — Gold Derby

Sources

View full Bad Bunny dashboard