This release keeps dependencies and maintenance posture current for teams operating this tool.
✓ No known CVEs patched in this version
Topics
+2 more
ReleasePort's take
Light signalRelease 28.4.1 updates several runtime and development dependencies to patch minor issues.
Why it matters: Updates include shivammathur/setup-php, vite, vue-router, zizmor-action, @nextcloud/vue, typos, and @types/node; operators should review compatibility for affected build surfaces.
Summary
AI summaryUpdates 📦 Dependency Updates, deps, and deps-dev across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Dependency | Medium |
Dependency updated: shivammathur/setup-php from 2.37.0 to 2.37.1. Dependency updated: shivammathur/setup-php from 2.37.0 to 2.37.1. Source: llm_adapter@2026-05-22 Confidence: high |
— |
| Dependency | Medium |
Dependency updated: vite group across 1 directory with 2 updates. Dependency updated: vite group across 1 directory with 2 updates. Source: llm_adapter@2026-05-22 Confidence: high |
— |
| Dependency | Medium |
Dependency updated: vue-router from 5.0.6 to 5.0.7 in the vue group across 1 directory. Dependency updated: vue-router from 5.0.6 to 5.0.7 in the vue group across 1 directory. Source: llm_adapter@2026-05-22 Confidence: high |
— |
| Dependency | Medium |
Dependency updated: zizmorcore/zizmor-action from 0.5.3 to 0.5.5. Dependency updated: zizmorcore/zizmor-action from 0.5.3 to 0.5.5. Source: llm_adapter@2026-05-22 Confidence: high |
— |
| Dependency | Medium |
Dependency updated: @nextcloud/vue from 9.7.0 to 9.8.0. Dependency updated: @nextcloud/vue from 9.7.0 to 9.8.0. Source: llm_adapter@2026-05-22 Confidence: high |
— |
| Dependency | Medium |
Dependency updated: crate-ci/typos from 1.46.0 to 1.46.1. Dependency updated: crate-ci/typos from 1.46.0 to 1.46.1. Source: llm_adapter@2026-05-22 Confidence: high |
— |
| Dependency | Medium |
Dependency updated: @types/node from 25.6.0 to 25.8.0 in the types group across 1 directory. Dependency updated: @types/node from 25.6.0 to 25.8.0 in the types group across 1 directory. Source: llm_adapter@2026-05-22 Confidence: high |
— |
Full changelog
No major changes, basically a re-release of 28.4.0
What's Changed
📦 Dependency Updates
- build(deps): Bump shivammathur/setup-php from 2.37.0 to 2.37.1 by @dependabot[bot] in https://github.com/nextcloud/news/pull/3749
- build(deps-dev): Bump the vite group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/nextcloud/news/pull/3744
- build(deps): Bump vue-router from 5.0.6 to 5.0.7 in the vue group across 1 directory by @dependabot[bot] in https://github.com/nextcloud/news/pull/3746
- build(deps): Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 by @dependabot[bot] in https://github.com/nextcloud/news/pull/3750
- build(deps): Bump @nextcloud/vue from 9.7.0 to 9.8.0 by @dependabot[bot] in https://github.com/nextcloud/news/pull/3741
- build(deps): Bump crate-ci/typos from 1.46.0 to 1.46.1 by @dependabot[bot] in https://github.com/nextcloud/news/pull/3739
- build(deps-dev): Bump @types/node from 25.6.0 to 25.8.0 in the types group across 1 directory by @dependabot[bot] in https://github.com/nextcloud/news/pull/3740
Full Changelog: https://github.com/nextcloud/news/compare/28.4.0...28.4.1
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v28.4.0 NcCheckBoxRadioSwitch component requires value property as string
Beta — feedback welcome: [email protected]