Silex

v3.9.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 9h Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

composable design grapesjs jamstack javascript no-code

+8 more

nocode nodejs saas silex visual visual-programming webdesign website-builder

Affected surfaces

deps

Summary

AI summary

Updates Editor, Under the hood, and Desktop across a mixed release.

Full changelog

Silex v3.9.0 is live on v3.silex.me, and you can download Silex desktop below

Please find below the changes since the last release (v3.8.0)

Editor

Reworked data source panels: the filter and expression popins are readable again on light backgrounds, the Fixed/Expression toggle behaves consistently, and each state and property now sits in its own card (#1772, #1731)
::selection support in the advanced selector, so you can style selected text (#1769, closes #1680). Thanks @JE4NVRG
The resize-panel toggle restores its previous width instead of shrinking the panel (#1772)

Fixes

Temporary zip files are now deleted after download, and unsafe download paths are rejected. Publication zips used to accumulate and fill the server disk (#1725). Thanks @pupuking723
SILEX_SSL_PORT is read for the SSL port, with a fallback to SSL_PORT
Editor assets now ship with hashed filenames, so a deployment no longer leaves users on a stale cached bundle (#1787)

Desktop

Reproducible Linux builds with verified auto-update: you can rebuild the released binary yourself and check it matches, and update signatures are verified before install (#1777, #1789). Funded by NLnet through the NGI Zero Commons Fund (see what's funded)
Crash reports now carry the real version, an anonymous install id, the release channel and os/arch, which makes them actually actionable (#1768)

Under the hood

Node 24, TypeScript 6 and all dependencies updated (#1765, #1763, #1767)
Releases are driven by git tags: prerelease tags deploy to canary.silex.me, stable tags to production (#1782, #1786)
@silexlabs/silex is published to npm through an OIDC trusted publisher, without long-lived tokens (#1784)
The Dockerfile moved to the repository root and legacy deploy files were dropped

Contributors

Thanks to @pupuking723 for the download connector fix, and to @JE4NVRG for the ::selection support

Silex is an OW2 project, supported by its sponsors on Open Collective. Funded by NLnet through the NGI Zero Commons Fund (see what's funded).

The code is free software (AGPL) and built in public. Want to help? Say hi on the forum or pick a good first issue

Security Fixes

Temporary zip files are now deleted after download and unsafe paths are rejected, preventing disk‑filling accumulation (#1725)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Silex

Get notified when new releases ship.

About Silex

Silex is an online tool for visually creating static sites with dynamic data. With the free/libre spirit of internet, together.

All releases →