This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryUpdates Patch Changes, Minor Changes, and https://github.com/ascorbic across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds `emdash-plugin update-package` CLI command for editing published plugin registry records. Adds `emdash-plugin update-package` CLI command for editing published plugin registry records. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Dependency | Low |
Updated dependency @emdash-cms/registry-client to version 0.2.0. Updated dependency @emdash-cms/registry-client to version 0.2.0. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Refactor | Low |
Refactors build pipeline validation to use a Zod schema for plugin default export checks. Refactors build pipeline validation to use a Zod schema for plugin default export checks. Source: llm_adapter@2026-05-28 Confidence: high |
— |
Full changelog
Minor Changes
-
#1126
cf3c706Thanks @ascorbic! - Addsemdash-plugin update-package, a CLI command for editing an already-published plugin's registry record (license, authors, security contacts, name, description, keywords) without cutting a new release. Without--yesit prints a diff and exits without writing; with--yesit writes the updated record to the publisher's PDS using atproto'sswapRecordprecondition (concurrent writes surface asSTALE_RECORDinstead of silently overwriting each other) and bumpslastUpdated. Optional fields use a "manifest absent = no change" policy: removing a key from the manifest doesn't wipe the published value, matchingpublishsemantics. Renaming a plugin via the manifest now surfaces a "looks like a rename" message listing the publisher's existing packages instead of a generic not-found, so publishers don't accidentally orphan releases under the old slug.The publishing client (
@emdash-cms/registry-client) gains aswapRecordparameter onputRecordandunsafePutRecordfor callers needing optimistic-concurrency writes.
Patch Changes
- #1145
463c7a2Thanks @ascorbic! - Refactors the build pipeline's runtime validation of the probed plugin's
default export to use a Zod schema. Error messages keep the same format
(hook "X" must be a function or { handler, ... },hook "X" has invalid FIELD VALUE (...)). Exotic-object entries (Date, RegExp,
Promise, class instances) now produce the wrong-shape error instead of
falling through to a misleading "missing handler" error. BigInt /
cyclic-object / function / symbol field values are rendered safely in
error messages instead of crashing with a TypeError. - Updated dependencies [
cf3c706]:- @emdash-cms/[email protected]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About emdash
All releases →Related context
Earlier breaking changes
- [email protected] Schema migration adds `locale` and `translation_group` columns to `_emdash_bylines`.
- [email protected] Byline hydration now strictly per-locale, suppressing cross‑locale fallback.
- v@emdash-cms/[email protected] Changes `_emdash_content_bylines.byline_id` to store translation_group instead of row id, enforcing strict per-locale credit hydration.
- v@emdash-cms/[email protected] Registry install handler fails closed on non-conforming aggregator release records.
- v@emdash-cms/[email protected] Menu and menu-item API responses now camelCase, breaking clients expecting snake_case keys.
Beta — feedback welcome: [email protected]