This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
Affected surfaces
Summary
AI summaryUpdates Patch Changes, Minor Changes, and https://github.com/marcusbellamyshaw-cell across a mixed release.
Full changelog
Minor Changes
-
#1577
79fc8b5Thanks @marcusbellamyshaw-cell! - Adds offset pagination togetEmDashCollectionfor numbered archive routesgetEmDashCollectionnow accepts anoffsetoption alongsidelimit, so you can render numbered archive URLs like/page/2or/tag/security/page/3without walking cursors or over-fetching from the start:const perPage = 20; const { entries, hasMore } = await getEmDashCollection("posts", { limit: perPage, offset: (page - 1) * perPage, orderBy: { published_at: "desc" }, });Results now include a
hasMoreboolean wheneverlimitis set, so you can show a "next page" link without an extra count query.offsetis ignored when acursoris supplied — cursor (keyset) pagination still wins.
Patch Changes
-
#1558
e659a5cThanks @marcusbellamyshaw-cell! - Fixes EmDash overriding security headers set by the host site (#1393). The baselineX-Content-Type-Options,Referrer-Policy, andPermissions-Policyheaders were applied unconditionally, overwriting stricter values a host had already set on its own routes. These headers are now applied only when the host hasn't set them — matching the existingContent-Security-Policybehavior — so a host's own values win while EmDash still provides defaults when none are set. -
#1636
d8487f9Thanks @MA2153! - Fixesctx.cronbeing undefined duringastro devunder the@astrojs/cloudflareadapter, which silently prevented plugins from scheduling cron tasks and stopped thecronhook from ever firing in local dev. The in-process scheduler now keys off Astro's command rather than Vite's, so plugin cron, scheduled publishing, and cleanup run again. -
Updated dependencies [
f5566e8,d063b51,43a70d4]:- @emdash-cms/[email protected]
- @emdash-cms/[email protected]
- @emdash-cms/[email protected]
Security Fixes
- EmDash no longer overrides host‑set security headers (`X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`); defaults applied only when missing.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About emdash
All releases →Related context
Earlier breaking changes
- v@emdash-cms/[email protected] Requires Cloudflare Workers sites to add Cron Trigger and update entry point for scheduled publishing.
- [email protected] Schema migration adds `locale` and `translation_group` columns to `_emdash_bylines`.
- [email protected] Byline hydration now strictly per-locale, suppressing cross‑locale fallback.
- v@emdash-cms/[email protected] Changes `_emdash_content_bylines.byline_id` to store translation_group instead of row id, enforcing strict per-locale credit hydration.
- v@emdash-cms/[email protected] Registry install handler fails closed on non-conforming aggregator release records.
Beta — feedback welcome: [email protected]