Skip to content

Sweetpad

v0.2.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Editors & IDEs
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ios-development ios-swift vscode-extension

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release bumps esbuild to 0.28.1, eliminating the GHSA‑gv7w‑rqvm‑qjhr vulnerability.

Why it matters: Clears CVE GHSA‑gv7w‑rqvm‑qjhr (severity 90) by upgrading esbuild; upgrade required for any project using the dependency.

Summary

AI summary

Security fix clears GHSA-gv7w-rqvm-qjhr by bumping esbuild to 0.28.1.

Changes in this release

Security Critical

Clears GHSA-gv7w-rqvm-qjhr vulnerability by bumping esbuild to 0.28.1

Clears GHSA-gv7w-rqvm-qjhr vulnerability by bumping esbuild to 0.28.1

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Adds `doctor`, `derived-data`, `simulator` ops and `app open-url` CLI commands

Adds `doctor`, `derived-data`, `simulator` ops and `app open-url` CLI commands

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Introduces `sweetpad project new` command to scaffold Xcode projects

Introduces `sweetpad project new` command to scaffold Xcode projects

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Adds built‑in CLI hot reloading capability

Adds built‑in CLI hot reloading capability

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Low

Implements semantic git‑conflict merge for .pbxproj and Package.resolved files in CLI

Implements semantic git‑conflict merge for .pbxproj and Package.resolved files in CLI

Source: llm_adapter@2026-06-15

Confidence: high

 —
Dependency Medium

Drops tsx/esbuild; dev scripts now use Node's native TypeScript compiler

Drops tsx/esbuild; dev scripts now use Node's native TypeScript compiler

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Fixes DerivedData path handling for .xcodeproj/project.xcworkspace stub containers

Fixes DerivedData path handling for .xcodeproj/project.xcworkspace stub containers

Source: llm_adapter@2026-06-15

Confidence: high

 —
Refactor Medium

Moves CLI/BSP runtime state from project root to XDG state home directory

Moves CLI/BSP runtime state from project root to XDG state home directory

Source: llm_adapter@2026-06-15

Confidence: high

 —
Refactor Medium

Replaces `app run --watch` with an interactive rebuild session workflow

Replaces `app run --watch` with an interactive rebuild session workflow

Source: llm_adapter@2026-06-15

Confidence: high

 —
Full changelog

What's Changed

  • Bump esbuild to 0.28.1 to clear GHSA-gv7w-rqvm-qjhr (Dependabot #49) by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/278
  • Drop tsx/esbuild: run dev scripts on Node's native TypeScript by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/279
  • Add doctor, derived-data, simulator ops, and app open-url CLI commands by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/280
  • CLI: semantic git-conflict merge for .pbxproj and Package.resolved by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/282
  • Add sweetpad project new command to scaffold a new Xcode project by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/281
  • Move CLI/BSP runtime state out of the project root into the XDG state home by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/283
  • Replace app run --watch with an interactive rebuild session by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/284
  • Built-in CLI hot reloading by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/286
  • Fix DerivedData path for an .xcodeproj/project.xcworkspace stub container by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/287

Full Changelog: https://github.com/sweetpad-dev/sweetpad/compare/v0.2.2...v0.2.3

What's Changed

  • Bump esbuild to 0.28.1 to clear GHSA-gv7w-rqvm-qjhr (Dependabot #49) by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/278
  • Drop tsx/esbuild: run dev scripts on Node's native TypeScript by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/279
  • Add doctor, derived-data, simulator ops, and app open-url CLI commands by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/280
  • CLI: semantic git-conflict merge for .pbxproj and Package.resolved by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/282
  • Add sweetpad project new command to scaffold a new Xcode project by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/281
  • Move CLI/BSP runtime state out of the project root into the XDG state home by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/283
  • Replace app run --watch with an interactive rebuild session by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/284
  • Built-in CLI hot reloading by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/286
  • Fix DerivedData path for an .xcodeproj/project.xcworkspace stub container by @hyzyla in https://github.com/sweetpad-dev/sweetpad/pull/287

Full Changelog: https://github.com/sweetpad-dev/sweetpad/compare/v0.2.2...v0.2.3

Security Fixes

  • dep: GHSA-gv7w-rqvm-qjhr — upgraded esbuild to 0.28.1
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Sweetpad

Get notified when new releases ship.

Sign up free

About Sweetpad

All releases →

Related context

Beta — feedback welcome: [email protected]