This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
ReleasePort's take
Moderate signalVersion v3.10.2 patches a critical security flaw in BaseUrlIssueBanner and adds several bug‑fixes across dev‑server, CLI, utils, sitemap, and dependencies.
Why it matters: Patches the severity 90 security issue in BaseUrlIssueBanner; fixes non‑RSA TLS cert support, host flag propagation, git author name handling, epoch timestamp sitemap entries, and upgrades markdown parsing.
Summary
AI summaryUpdates core, utils, and 2026-07-10 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fix a small security issue in BaseUrlIssueBanner. Fix a small security issue in BaseUrlIssueBanner. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Complete Spanish translations for theme-common and theme-l components. Complete Spanish translations for theme-common and theme-l components. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Dependency | Low |
Migrate to `@11ty/gray-matter` for markdown parsing. Migrate to `@11ty/gray-matter` for markdown parsing. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Bump detect-port to v2.1 and fix pnpm `trustPolicy` downgrade issue in core module. Bump detect-port to v2.1 and fix pnpm `trustPolicy` downgrade issue in core module. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Performance | Low |
Vendor `@types/gtag.js` and upgrade `@swc/html` for faster gtag.js handling. Vendor `@types/gtag.js` and upgrade `@swc/html` for faster gtag.js handling. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Fix dev server to support non‑RSA TLS certs for HTTPS. Fix dev server to support non‑RSA TLS certs for HTTPS. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fix `docusaurus serve` to pass `--host` to server.listen(). Fix `docusaurus serve` to pass `--host` to server.listen(). Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Preserve author names containing commas when parsing git logs. Preserve author names containing commas when parsing git logs. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Ensure sitemap retains lastmod for epoch (0) timestamps. Ensure sitemap retains lastmod for epoch (0) timestamps. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Low |
Do not import `@swc/html` in bundler to fix StackBlitz playground. Do not import `@swc/html` in bundler to fix StackBlitz playground. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Use locale URL in site config for core module. Use locale URL in site config for core module. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Remove redundant sidebar label titles in classic theme. Remove redundant sidebar label titles in classic theme. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Avoid transforming dotted directory links into assets in mdx-loader. Avoid transforming dotted directory links into assets in mdx-loader. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fix edge cases in `extractLeadingEmoji()` utility function. Fix edge cases in `extractLeadingEmoji()` utility function. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Use npm commands by default in init template README of create-docusaurus CLI. Use npm commands by default in init template README of create-docusaurus CLI. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Accept boolean attributes in headTags configuration validation for core module. Accept boolean attributes in headTags configuration validation for core module. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Do not drop lastmod field for epoch (0) timestamps in sitemap generator. Do not drop lastmod field for epoch (0) timestamps in sitemap generator. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
3.10.2 (2026-07-10)
Backport and cherry-pick commits from main for v3.10.2 patch release:
- fix(bundler): do not import
@swc/html, fix StackBlitz playground #12055 - fix(core): use locale url in site config #12054
- fix(theme-classic): remove redundant sidebar label titles #11966
- fix(mdx-loader): avoid transforming dotted directory links into asset… #11944
- fix(dev-server): for HTTPS, support non-RSA TLS certs #12065
- fix(utils): fix
extractLeadingEmoji()edge cases #12100 - fix(gtag.js, faster): Fix StackBlitz, vendor
@types/gtag.js, upgrade@swc/html#12080 - fix(create-docusaurus): init template README should use npm commands by default #12138
- fix(cli):
docusaurus serveshould pass--hosttoserver.listen()#12127 - fix(core): bump detect-port to v2.1, fix pnpm
trustPolicydowngrade issue #12012 - fix(i18n): complete Spanish translations for theme-common and theme-l… #12180
- chore(deps): migrate to
@11ty/gray-matter#12181 - fix(core): fix BaseUrlIssueBanner little security issue #12260
- fix(core): accept boolean attributes in headTags config validation #12238
- fix(sitemap): don't drop lastmod for an epoch (0) timestamp #12212
- fix(utils): preserve author names containing commas in git log parsing #12069
Security Fixes
- Fix BaseUrlIssueBanner little security issue in core (#12260)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]