Skip to content

emdash

[email protected] scope: emdash Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 27d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

astro cms emdash typescript

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates Patch Changes, Minor Changes, and https://github.com/marcusbellamyshaw-cell across a mixed release.

Full changelog

Minor Changes

  • #1577 79fc8b5 Thanks @marcusbellamyshaw-cell! - Adds offset pagination to getEmDashCollection for numbered archive routes

    getEmDashCollection now accepts an offset option alongside limit, so you can render numbered archive URLs like /page/2 or /tag/security/page/3 without walking cursors or over-fetching from the start:

    const perPage = 20;
    const { entries, hasMore } = await getEmDashCollection("posts", {
    	limit: perPage,
    	offset: (page - 1) * perPage,
    	orderBy: { published_at: "desc" },
    });
    

    Results now include a hasMore boolean whenever limit is set, so you can show a "next page" link without an extra count query. offset is ignored when a cursor is supplied — cursor (keyset) pagination still wins.

Patch Changes

  • #1558 e659a5c Thanks @marcusbellamyshaw-cell! - Fixes EmDash overriding security headers set by the host site (#1393). The baseline X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers were applied unconditionally, overwriting stricter values a host had already set on its own routes. These headers are now applied only when the host hasn't set them — matching the existing Content-Security-Policy behavior — so a host's own values win while EmDash still provides defaults when none are set.

  • #1636 d8487f9 Thanks @MA2153! - Fixes ctx.cron being undefined during astro dev under the @astrojs/cloudflare adapter, which silently prevented plugins from scheduling cron tasks and stopped the cron hook from ever firing in local dev. The in-process scheduler now keys off Astro's command rather than Vite's, so plugin cron, scheduled publishing, and cleanup run again.

  • Updated dependencies [f5566e8, d063b51, 43a70d4]:

Security Fixes

  • EmDash no longer overrides host‑set security headers (`X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`); defaults applied only when missing.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track emdash

Get notified when new releases ship.

Sign up free

About emdash

All releases →

Related context

Related tools

Earlier breaking changes

Beta — feedback welcome: [email protected]