This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Light signalThe release adds a scheduled publishing sweep and mandates Cloudflare Workers sites to add a Cron Trigger plus update their entry point for this feature.
Why it matters: Operators must modify Worker configurations before the new version, or publishing will fail; failure triggers affect all content slated for automated publication.
Summary
AI summaryUpdates Minor Changes, Patch Changes, and https://github.com/ascorbic across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Requires Cloudflare Workers sites to add Cron Trigger and update entry point for scheduled publishing. Requires Cloudflare Workers sites to add Cron Trigger and update entry point for scheduled publishing. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Adds scheduled publishing sweep that transitions content to published at its due time. Adds scheduled publishing sweep that transitions content to published at its due time. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Dependency | Low |
Updated dependencies; emdash upgraded to version 0.19.0. Updated dependencies; emdash upgraded to version 0.19.0. Source: llm_adapter@2026-06-12 Confidence: high |
— |
Full changelog
Minor Changes
-
#1312
c39789cThanks @ascorbic! - Drive scheduled publishing from a real heartbeat instead of request side effects (#1303).Content scheduled via the admin now actually transitions to
publishedwhen its time arrives. Previously nothing promoted the row —statusstayedscheduledandpublished_atstayed null forever.A new sweep (
publishDueContent) promotes due content and runs alongside the existing cron tick and system cleanup:- Node / single-process: the timer-based scheduler already drives it — no action needed.
- Cloudflare Workers: a
scheduled()handler driven by a Cron Trigger now runs the sweep. The request-drivenPiggybackScheduleris gone, so there are no maintenance side effects on visitor requests.
@emdash-cms/cloudflareships a Worker entry that wraps Astro's handler with thescheduled()handler (@emdash-cms/cloudflare/worker, pluscreateScheduledHandler()for hand-assembled Workers). When a cache provider is configured, the handler also purges edge-cache tags for whatever it published, so stale snapshots produced before the scheduled time are evicted.Migration for existing Cloudflare sites. New sites get this from the templates. Existing deployments must update two files:
// src/worker.ts export { default, PluginBridge } from "@emdash-cms/cloudflare/worker";// wrangler.jsonc "triggers": { "crons": ["* * * * *"] }Without the Cron Trigger, scheduled publishing and plugin cron do not run on Workers.
Scheduled publishing matches manual publishing exactly: it fires
content:afterPublishhooks (search indexing, webhooks, syndication), and records the scheduled time aspublished_aton first publication rather than the (later) sweep time. The sweep claims each row atomically before promoting it, so an entry unscheduled or rescheduled just before its time is never published, and overlapping sweeps can't double-publish. Localastro devkeeps running the timer-driven sweep even under the Cloudflare adapter (where production relies on the Cron Trigger).Each tick promotes at most 100 items per collection (a large backlog drains over successive ticks) so a single Worker invocation can't exhaust its CPU/subrequest budget, and edge-cache tags are purged incrementally after each collection's batch rather than only at the end. On Node, the maintenance interval is capped at 60s so scheduled-publish latency matches the Cloudflare Cron Trigger cadence instead of lagging up to five minutes when no plugin cron is due.
Patch Changes
Breaking Changes
- Removal of `PiggybackScheduler` in Cloudflare Worker entry; existing deployments must replace with `@emdash-cms/cloudflare/worker` and add a Cron Trigger (`"crons": ["* * * * *"]`) to wrangler.jsonc.
- Minimum version bump: @emdash-cms/cloudflare now requires Node.js >= 18.17 or equivalent Cloudflare Workers runtime supporting Cron Triggers.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About emdash
All releases →Related context
Earlier breaking changes
- [email protected] Schema migration adds `locale` and `translation_group` columns to `_emdash_bylines`.
- [email protected] Byline hydration now strictly per-locale, suppressing cross‑locale fallback.
- v@emdash-cms/[email protected] Changes `_emdash_content_bylines.byline_id` to store translation_group instead of row id, enforcing strict per-locale credit hydration.
- v@emdash-cms/[email protected] Registry install handler fails closed on non-conforming aggregator release records.
- v@emdash-cms/[email protected] Menu and menu-item API responses now camelCase, breaking clients expecting snake_case keys.
Beta — feedback welcome: [email protected]