This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryAdds CLI command to edit published plugin registry records without cutting a new release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds CLI command `emdash-plugin update-package` to edit published plugin registry record without new release. Adds CLI command `emdash-plugin update-package` to edit published plugin registry record without new release. Source: llm_adapter@2026-05-28 Confidence: high |
— |
| Feature | Low |
`update-package` prints diff and exits without writing if `--yes` is not provided. `update-package` prints diff and exits without writing if `--yes` is not provided. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Feature | Low |
With `--yes`, `update-package` writes updated record using atproto's `swapRecord` precondition, handling concurrent writes as `STALE_RECORD`. With `--yes`, `update-package` writes updated record using atproto's `swapRecord` precondition, handling concurrent writes as `STALE_RECORD`. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Feature | Low |
`update-package` bumps the `lastUpdated` timestamp on successful write. `update-package` bumps the `lastUpdated` timestamp on successful write. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Feature | Low |
Optional fields follow "manifest absent = no change" policy, preserving existing published values when keys are removed. Optional fields follow "manifest absent = no change" policy, preserving existing published values when keys are removed. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Feature | Low |
Renaming a plugin via the manifest now shows a "looks like a rename" message listing the publisher's existing packages to prevent orphaned releases. Renaming a plugin via the manifest now shows a "looks like a rename" message listing the publisher's existing packages to prevent orphaned releases. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
| Refactor | Low |
Publishing client (`@emdash-cms/registry-client`) adds `swapRecord` parameter to `putRecord` and `unsafePutRecord` for optimistic-concurrency writes. Publishing client (`@emdash-cms/registry-client`) adds `swapRecord` parameter to `putRecord` and `unsafePutRecord` for optimistic-concurrency writes. Source: granite4.1:30b@2026-05-28-audit Confidence: low |
— |
Full changelog
Minor Changes
-
#1126
cf3c706Thanks @ascorbic! - Addsemdash-plugin update-package, a CLI command for editing an already-published plugin's registry record (license, authors, security contacts, name, description, keywords) without cutting a new release. Without--yesit prints a diff and exits without writing; with--yesit writes the updated record to the publisher's PDS using atproto'sswapRecordprecondition (concurrent writes surface asSTALE_RECORDinstead of silently overwriting each other) and bumpslastUpdated. Optional fields use a "manifest absent = no change" policy: removing a key from the manifest doesn't wipe the published value, matchingpublishsemantics. Renaming a plugin via the manifest now surfaces a "looks like a rename" message listing the publisher's existing packages instead of a generic not-found, so publishers don't accidentally orphan releases under the old slug.The publishing client (
@emdash-cms/registry-client) gains aswapRecordparameter onputRecordandunsafePutRecordfor callers needing optimistic-concurrency writes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About emdash
All releases →Related context
Earlier breaking changes
- [email protected] Schema migration adds `locale` and `translation_group` columns to `_emdash_bylines`.
- [email protected] Byline hydration now strictly per-locale, suppressing cross‑locale fallback.
- v@emdash-cms/[email protected] Changes `_emdash_content_bylines.byline_id` to store translation_group instead of row id, enforcing strict per-locale credit hydration.
- v@emdash-cms/[email protected] Registry install handler fails closed on non-conforming aggregator release records.
- v@emdash-cms/[email protected] Menu and menu-item API responses now camelCase, breaking clients expecting snake_case keys.
Beta — feedback welcome: [email protected]