emdash

v@emdash-cms/[email protected] Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 5h Productivity & Wikis

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

astro cms emdash typescript

Summary

AI summary

Fixes crash caused by CJS semver dependency in @emdash-cms/registry-client on Cloudflare Workers.

Type	Severity	Summary	CVE
Bugfix	Medium	Fixes "require is not defined" crash on EmDash API routes under astro dev on Cloudflare Workers. Fixes "require is not defined" crash on EmDash API routes under astro dev on Cloudflare Workers. Source: llm_adapter@2026-06-03 Confidence: high	—

Full changelog

#1319 69bdc97 Thanks @ascorbic! - Fix require is not defined crash on every EmDash API route under astro dev on Cloudflare Workers (#1292).

@emdash-cms/registry-client listed semver (CommonJS) in dependencies, which the build externalizes -- so consumers loaded a nested CJS copy. Vite's SSR module runner (workerd) evaluates modules with no require binding, so semver's internal require() threw and took down any route whose import graph reached registry-client (schema, plugins, env compatibility checks). semver is now bundled into the ESM output, so nothing CommonJS reaches the worker.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track emdash

Get notified when new releases ship.

About emdash

[email protected] Schema migration adds `locale` and `translation_group` columns to `_emdash_bylines`.
[email protected] Byline hydration now strictly per-locale, suppressing cross‑locale fallback.
v@emdash-cms/[email protected] Changes `_emdash_content_bylines.byline_id` to store translation_group instead of row id, enforcing strict per-locale credit hydration.
v@emdash-cms/[email protected] Registry install handler fails closed on non-conforming aggregator release records.
v@emdash-cms/[email protected] Menu and menu-item API responses now camelCase, breaking clients expecting snake_case keys.