v0.166.0 v0.0.19
medium risk
weave-os/routerSep 9, 2026 → Sep 10, 20261 day between releases
What's New
Newer release adds plugin sandbox CSPRNG and SSRF-safe fetch, while older release added template context arguments.
Breaking Changes
- Plugin SDK changes require manifest configurations to include `contentAccess`
New Features
- Plugin sandbox now uses a CSPRNG
- Plugin SDK can ingest managed media from plugins
- Runnable server artifacts added
Improvements
- SSRF-safe fetch guard for storage uploads
- Path containment logic fixed using relative() instead of string prefix
Bug Fixes
- Import content now honours alt text and script order
- Re-imports now keep content compound button wrappers
- Plugin manifest now correctly carries contentAccess
Upgrade Notes
Plugin developers should update manifest configurations to include `contentAccess` if using the new SDK features.