SNACK: 3-line summary
- Cloudflare released EmDash 1.0 as a stable, open-source CMS.
- Its decentralized registry lets plugin authors publish signed releases under portable identities.
- Site administrators approve requested plugin access; review those requests before installing.
Cloudflare released EmDash 1.0 on September 28, pairing an Astro-based CMS with a decentralized plugin registry. For people running sites, plugins now come with specific access requests for an administrator to review rather than access to site resources by default.
Snackgirls react
AIKO: A plugin starting with no capabilities is an interesting design choice. I’d want to see which specific ability each one asks the admin to unlock.
Nea: I’m curious how a draft moves through the editor when images and localization are involved. That’s the workflow I’d want to look at first.
An editor alongside Astro development
EmDash combines Astro site development with an admin editor for content work. Cloudflare describes the free, MIT-licensed 1.0 release as stable and says its editorial, media, localization, migration and deployment workflows have been tested in production. Its own blog moved to EmDash in August, though that experience does not guarantee the same results for every site.
Plugin releases tied to their authors
The new registry uses AT Protocol: authors publish package and signed release records under portable identities. EmDash provides a default catalog, but it does not solely own those identities or release histories. Before installation, the registry checks release signatures, checksums, package names, versions, requested access and any required build provenance. Free plugins are supported now; paid-plugin support is planned.
Permissions to inspect before installation
Plugins run in an isolated runtime without default access to site content, media, users, secrets, the environment, the filesystem or the network. A plugin can request particular abilities, which a site administrator must approve. That boundary is useful to inspect, not a promise that plugins are risk-free: anyone considering EmDash can start by reading a plugin’s requested permissions and release details before enabling it.
Sources and checked date: Cloudflare · September 29, 2026