This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryUpdates Patch Changes, https://github.com/ascorbic, and Minor Changes across a mixed release.
Full changelog
Minor Changes
-
#1461
b01aa9bThanks @ascorbic! - Fixes registry installs failing with "Plugin manifest has changed since you consented" for plugins that declare hook-registration capabilities (email transport, email events, page fragments) or read user records. Plugin bundles now declare their access as a structureddeclaredAccesscontract that the registry record, the install-consent dialog, and the sandbox all read consistently, so every capability a plugin declares is shown for consent and enforced — no capability is silently dropped. Re-publish affected plugins to adopt the new bundle format; existing installs are unaffected. -
#1425
3e344afThanks @swissky! - Repeater fields supportimagesub-fields with the media picker (#1424)Repeater rows previously rendered every non-scalar sub-field as a plain text
input, so galleries had to be built from hand-pasted URLs. Image sub-fields
now render the same media-picker UI as top-level image fields (select,
preview, change, remove) and store the same MediaValue shape — legacy string
URLs keep working.Includes:
imagein the schema-builder sub-field type select, the shared
ImageFieldRendererextracted out ofContentEditorfor reuse, and the
sub-field type whitelists in core (REPEATER_SUB_FIELD_TYPES+ the API Zod
enum) extended — the Zod enum also gains the previously missingurlentry
that the builder already offered.
Patch Changes
-
#1447
141aa11Thanks @ascorbic! - Fixes@atcutepeer dependency warnings on install (#1435)Installing EmDash pulled in mismatched
@atcutepackage versions, sopnpm install/npm installreported unmet peer warnings for@atcute/identityand@atcute/lexicons. The bundled@atcutedependencies are now aligned on v2 and installs are clean. If your project also depends on@atcutepackages directly, note they have moved to v2 (@atcute/client5,@atcute/lexicons2,@atcute/atproto4,@atcute/oauth-node-client2). -
#1492
7688f0bThanks @ascorbic! - Fixes a read-your-writes gap with database read replication: the session bookmark cookie is now persisted even when page rendering throws after a successful write, so an immediately-following request can't read pre-write state from a lagging replica. -
#1459
c7166b0Thanks @mvanhorn! - Fix scheduled entries staying hidden after their scheduled time (#1402)isVisible()readscheduledAtviadataStr, which returned an empty string for theDatethe loader produced, so entries whose scheduled time had passed never became visible. The visibility check now reads the scheduled time correctly. -
#1458
9c994adThanks @mvanhorn! - Fixnpx emdash typescrash caused by the schema endpoint envelope (#1188)The
/schemaroute returned an enveloped JSON body whileclient.request()already unwraps the.datafield, soemdash typesreceivedundefinedand crashed. The route now returns the un-enveloped shape the client expects. -
#1489
eddaf91Thanks @ascorbic! - Fixes admin pages hanging indefinitely (and eventually returning 524 timeouts) on Cloudflare Workers. The worker-lifetime caches for site settings and search-index health could be left holding a request that never completed (for example when a visitor's request was cancelled mid-load), which then stalled every later request served by that worker until it was recycled. These caches now keep resolved values rather than in-flight requests, so a cancelled or interrupted request can no longer wedge the rest. -
#1481
afc3a0fThanks @MA2153! - Fixes collectionwherefilters to apply every taxonomy key instead of silently dropping all but the first. Filtering by two or more taxonomies (e.g.{ category: ["news"], region: ["emea"] }) now returns the intersection — entries tagged in each taxonomy — matching how field and byline filters already compose. -
#1498
3d423a7Thanks @ascorbic! - Reduces redundant database queries when rendering content pages: widget areas are now request-cached, taxonomy term usage-counts are fetched once per request instead of once per taxonomy widget, andgetTermsForEntriesreuses already-hydrated terms instead of re-querying. Fewer round trips per page on every backend. -
#1492
7688f0bThanks @ascorbic! - Adds anrpc.countServer-Timing metric reporting physical database round trips, distinct fromdb.count(logical queries). Backends that batch (the new Durable Objects SQL driver coalesces same-turn reads into one round trip) can now surface how many round trips a request actually made. -
#1504
8807701Thanks @swissky! - Adds image entries to per-collection sitemaps. When a content entry has an SEO image, the sitemap now emits it as a Google<image:image>entry, helping Google discover and index page images for Google Images. -
Updated dependencies [
141aa11,ddf8f0d,68840a9,eaedec0,8bb20c4,fb31240,022fd66,5d8358b,ce96271,b2e65ac,589d07f,d6269e7,325c673,af4af50,c48604b,52ea731,acfeb89,6c1fe5c,6246774,b01aa9b,3e344af,5f7cd11,263392f,eddadf8]:- @emdash-cms/[email protected]
- @emdash-cms/[email protected]
- @emdash-cms/[email protected]
- @emdash-cms/[email protected]
- @emdash-cms/[email protected]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About emdash
All releases →Related context
Earlier breaking changes
- v@emdash-cms/[email protected] Requires Cloudflare Workers sites to add Cron Trigger and update entry point for scheduled publishing.
- [email protected] Schema migration adds `locale` and `translation_group` columns to `_emdash_bylines`.
- [email protected] Byline hydration now strictly per-locale, suppressing cross‑locale fallback.
- v@emdash-cms/[email protected] Changes `_emdash_content_bylines.byline_id` to store translation_group instead of row id, enforcing strict per-locale credit hydration.
- v@emdash-cms/[email protected] Registry install handler fails closed on non-conforming aggregator release records.
Beta — feedback welcome: [email protected]