This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryUpdates Patch Changes, https://github.com/swissky, and Minor Changes across a mixed release.
Full changelog
Minor Changes
- #2122
6bbf93aThanks @bimsonz! - Expose the host Astro project'strailingSlashconfig to plugins viactx.site.trailingSlash, so plugins that build absolute URLs (sitemaps, canonical, hreflang) can match the site's routing policy. Available to in-process and sandboxed plugins alike.
Patch Changes
-
#2037
b66d8a0Thanks @swissky! - Fixes oversized image renditions on Cloudflare: transforms without an explicit quality were encoded near-losslessly by the Images binding (a 2048px WebP came out ~900 KB instead of ~100 KB). Lossy transforms (WebP/AVIF/JPEG) now default to quality 85, matching Cloudflare's image-resizing default. PNG output keeps no explicit quality — an explicit PNG quality switches the binding to lossy PNG8, which is not a safe default for a lossless format. An explicit?q=in the request URL still wins for every format.Note: image responses are cached with
Cache-Control: immutable, max-age=31536000keyed on the request URL, so previously-served oversized renditions stay cached at the edge/browser until they expire. To benefit immediately after upgrading, purge the Cloudflare cache for your/_image*URLs (or the whole site cache). -
#2135
c37750cThanks @swissky! - Fixes a hang where a request cancelled mid-query on Cloudflare D1 could wedge the query-coalescing buffer: the flush timer scheduled by the cancelled request was dropped with it, leaving the coalescing flag stuck so every later query on the connection waited on a flush that never ran. The coalescing D1 and Durable Object SQL connections now treat a flush left pending past a short deadline as stranded and reschedule it, so a cancelled request can no longer stall subsequent queries. -
#2125
ba65fb8Thanks @swissky! - Fixes a site-wide hang on Cloudflare Workers with the default D1 config (d1({ binding: "DB" }), sessions disabled). Previously, a single request canceled while a D1 query was in flight could deadlock every subsequent D1 query on that Worker isolate — including EmDash's own per-request middleware — so all SSR pages hung until the isolate was recycled. Concurrent D1 queries on the default raw binding now run independently instead of being serialized behind a connection mutex, removing the deadlock. -
#2082
cf6e4faThanks @logelog! - Fixes production build warnings when database adapters do not provide the optional cold-start query coalescing dialect. -
Updated dependencies [
82827d3,fbb04ab,07c2b0f,460efe6,7b9e558,aa7ef09,c180240,039c5dc,b66d8a0,fc6cdfb,8d6b20b,6bbf93a,1b1ff42,e2c7549,6c96ac8,7ff08db,23a740a,6fb52b0,a27a5cc,4c57ee2,e52dea9,3f8b778,de44730,32be60b,d4c565e,b22a3d5,32f8261,4b7fd08,cf6e4fa,d303738,6a79b03,34b3017,6890edd,65be947,cfdb8f0,ca660c6,c4a2ffd,c24b7d3,84173dd,c350e86,e649af8]:
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About emdash
All releases →Related context
Earlier breaking changes
- v@emdash-cms/[email protected] Requires Cloudflare Workers sites to add Cron Trigger and update entry point for scheduled publishing.
- [email protected] Schema migration adds `locale` and `translation_group` columns to `_emdash_bylines`.
- [email protected] Byline hydration now strictly per-locale, suppressing cross‑locale fallback.
- v@emdash-cms/[email protected] Changes `_emdash_content_bylines.byline_id` to store translation_group instead of row id, enforcing strict per-locale credit hydration.
- v@emdash-cms/[email protected] Registry install handler fails closed on non-conforming aggregator release records.
Beta — feedback welcome: [email protected]