Skip to content

orangeCMS 1.1.0 — OAuth and static publication fixes

Latest
Latest

Choose a tag to compare

View all tags
@maxffarrell maxffarrell released this 07 Nov 15:55
cms-v1.1.0
d9e951d

CMS source release. Agent plugin remains at 1.3.0.

Changes since plugin-v1.3.0 (2026-10-17).

Fixed

  • OAuth consent submission: keep the consent page's referrer policy at
    same-origin, preventing browsers from sending an opaque origin that SvelteKit
    rejects as a cross-site POST when the administrator clicks Connect.
    (#6)
  • OAuth callback redirects: allow the validated client's callback origin (or
    native application scheme) in the consent page's CSP form-action. Connect and
    Cancel can now redirect to the client; a first click no longer silently consumes
    consent and leaves a second click failing as already used.
    (#8)
  • OAuth failure explanations: show the library's escaped rejection reason to
    the signed-in administrator and log rejected or failed consent requests, making
    expired, reused, browser-unbound, or otherwise invalid requests diagnosable.
    (#7)
  • Static publication: capture anonymous SvelteKit navigation data even when
    the framework marks it private, no-store. HTML validation remains strict;
    navigation responses with load errors are rejected and a failed export preserves
    the previous approved snapshot. Added unit and compiled Worker smoke coverage.
    (47c381b)

Runtime and dependencies

  • Upgrade prerequisite: Node.js 26.12.1 or newer within the 26.x line is
    now required, replacing the previous Node.js 22.17+ requirement. The repository
    pins 26.12.1 and enforces the supported range through package engines, strict
    engine checks, and a preinstall check. This change addresses CVE-2026-111497.
    Upgrade local and CI Node runtimes before installing dependencies; use pnpm
    12 or newer (the repository pins 12.4.1).
    (#3)
  • Updated Vite from 8.3.2 to 8.3.3 and refreshed the dependency lockfile.
    (#4)

Upgrade and validation

  • Update the CMS source in each installation and build/deploy through that
    installation's existing deployment flow. Publishing this release does not
    deploy consumer sites. Static snapshots still require explicit publication.
  • This release adds no database migrations. Preserve existing data, migration
    history, site configuration, and secrets when adopting the source changes.
  • Agent plugin manifests and skills remain at 1.3.0; no new plugin ZIP is
    needed for these runtime fixes.
  • The complete source CI suite passed on e5bc8155bc2b0b6efe9cf15cc2ba22e6c504b23d:
    public-source audit, unit tests, Svelte typechecking, production Worker smoke
    tests with local D1/KV, configurable-route fixtures, and plugin packaging.
    CI run.

Full source comparison

Assets 2
Loading