Version 10.14.0 release notes

This release is all about reliability. Custom scripts no longer run through a shell, the dashboard and panel do less work, and a large batch of fixes makes sure your edits, settings, and content end up where you expect them.

Highlights

• Custom scripts receive their arguments without going through a shell, which fixes a command injection vulnerability. On Windows, this comes with a few breaking changes.
• The dashboard, panel, and preview only refresh when a relevant setting changes, and the media dashboard scans your files once instead of twice.
• Edits in the panel are no longer lost or reverted when updates overlap or when you switch files while typing.
• The extension no longer rewrites your content types, pageFolders, or the formatting of frontmatter.json when it updates a setting.

⚠️ Breaking changes on Windows

Issue #1067 fixes an OS command injection in custom scripts (GHSA-w6cx-493p-x4jx). Front matter values, file names, titles, script answers, and Copilot responses were added to a command string, so a crafted value could break out of its quotes and run commands on your machine.

Custom scripts, placeholder scripts, and media scripts now receive these values as separate arguments that are never interpreted by a shell. Your scripts get the same arguments as before, but on Windows you need to check the following:

• .cmd and .bat commands like npx, npm, yarn, or pnpm can no longer be used as the command. Use node (or another executable) and point the script to the JavaScript file instead.
• Environment variables in the command, like %USERPROFILE%, are no longer resolved. Use the full path instead.
• PowerShell scripts receive the front matter JSON as is, no longer wrapped in single quotes.

{
  "title": "Generate social image",
  "script": "./.frontmatter/config/custom/scripts/social-image.ts",
  "command": "npx tsx"
}

{
  "title": "Generate social image",
  "script": "./.frontmatter/config/custom/scripts/social-image.ts",
  "command": "node --import tsx"
}

On macOS and Linux, nothing changes for your configuration.

Thanks to Dostxodjayev Abdullox for reporting the vulnerability.

Info

Check the custom actions documentation for more information.

A faster dashboard and panel

Pull request #1068 removes a lot of unnecessary work:

• The dashboard, panel, and preview only refresh when a Front Matter, git.path, or Markdown editor setting changes, instead of on every VS Code setting change.
• Changes to images and other non-content files in your content folders no longer trigger a full re-parse of all your pages.
• Refreshing the media dashboard, uploading, or pasting media scans the media files once instead of twice, and images and videos are loaded lazily.
• Sites with many pages load faster in the dashboard, as cached pages are looked up by their path.
• The extension bundle is smaller and activates faster, as the unused GitHub credentials code (@octokit/rest) is removed.

Your edits stay where you put them

Pull request #1074 reworks how the panel handles updates. When updates overlapped, an older value could come back and overwrite what you had typed since. This affected wysiwyg, slug, number, choice, datetime, and relationship fields, block fields, and the last characters you typed before switching files. All of these now keep your changes.

The panel also writes to the right file. Before, front matter could end up in the focused file (for example, a .ts file) instead of the file the panel shows.

The markdown wysiwyg field no longer rewrites its value when you open a file, and with #1077, editing it keeps the list bullets, emphasis markers, and line endings the value already uses. A - bullet stays a - bullet, _italic_ stays _italic_, and snake_case no longer turns into snake\_case.

Your settings stay untouched

Pull requests #1069 and #1071 fix several cases where the extension changed more of your configuration than it should:

• “Create template from current file” and project initialization no longer replace your content types or overwrite the framework, static folder, and preview host settings.
• Comments and formatting in frontmatter.json are kept when the extension updates a setting.
• Registering or unregistering a content folder no longer rewrites your pageFolders setting, and settings from .frontmatter/config files are no longer copied into frontmatter.json.
• Cancelling the remap command no longer deletes the tag or category from all your content.

Related issues/enhancements

⚠️ Breaking changes

• Custom scripts, placeholder scripts, and media scripts no longer pass front matter values, file paths, titles, answers, or Copilot responses through a shell. They are passed as separate arguments, which prevents command injection. Scripts receive the same arguments, with these differences on Windows:
  • .cmd and .bat commands like npx, npm, yarn, or pnpm are no longer supported as the command. Use node (or another executable) and point the script to the JavaScript file instead
  • Environment variables in the command like %USERPROFILE% are no longer resolved. Use the full path instead
  • PowerShell scripts receive the front matter JSON as is, no longer wrapped in single quotes

⚡️ Optimizations

• #1068: Only refresh the dashboard, panel, and preview when a Front Matter, git.path, or Markdown editor setting changes, instead of on every VS Code setting change
• #1068: Changes to images and other non-content files in your content folders no longer trigger a full re-parse of all pages
• #1068: Refreshing the media dashboard, uploading, or pasting media now scans the media files once instead of twice
• #1068: Faster dashboard loading for sites with many pages by looking up cached pages by path
• #1068: Smaller extension bundle and faster activation by removing the unused GitHub (@octokit/rest) credentials code
• #1068: Fewer re-renders in the dashboard and panel, including when scrolling the panel
• #1068: Images and videos in the media dashboard are now loaded lazily

🐞 Fixes

• #1069: Fix “Create template from current file” replacing your content types with the default content type and overwriting the framework, static folder, and preview host settings. Initializing a project no longer replaces existing content types either
• #1069: Fix the tag or category being deleted from all content when cancelling the remap command
• #1069: Keep the comments and formatting in frontmatter.json when the extension updates a setting
• #1067: Fix OS command injection in custom scripts via front matter values, file names, titles, script answers, and Copilot responses (GHSA-w6cx-493p-x4jx) thanks to Dostxodjayev Abdullox for reporting
• #1070: Fix content creation from a template failing on boolean, number, or empty values, and file prefixes ending in / (ex. {{year}}/)
• #1070: Fix {{filePrefix.index}} in Smart Rename and Update Slug, slug templates with multiple placeholders, and invalid dates in {{fm.x|format}} placeholders
• #1070: Fix slug generation in the panel while the page is shown in the preview
• #1070: Fix false broken links in the content health check for %20 links, mailto: and tel: links, and sites that reject HEAD requests
• #1070: Fix taxonomy rename, merge, delete, and move skipping files that get their content type from their folder
• #1070: Front matter errors found by the dashboard are now reported on the broken file instead of the open editor, and the front matter formatting no longer depends on which file was read last
• #1070: Fix media metadata being written multiple times after refreshing the media dashboard, and media script notifications that never closed
• #1071: Registering or unregistering a content folder no longer rewrites your pageFolders setting (expanded wildcards, frozen {{year}}, doubled locale paths), and now works on Windows
• #1071: Settings from .frontmatter/config files are no longer copied into frontmatter.json, and generating content types no longer writes field groups inline
• #1071: When the content types can’t be saved (split or extended config), “Generate content type” no longer assigns the unsaved content type to the page, and neither it nor “Add missing fields” reports success
• #1071: Fix files in content/blog-archive being treated as part of content/blog
• #1071: Fix “Open on website” from the dashboard, preview slugs ending in index, bold and hyperlink insertion without a selection, and creating content from a template on Windows
• #1071: Fix the last modified date not being updated after a settings change, and content validation not picking up content type changes until a restart
• #1072: Fix dashboard pages no longer updating after a page was deleted, search returning wrong or no results after deleting a page or clearing the cache, and the dashboard not loading again after a failed parse
• #1072: Fix dashboard slugs ignoring the content type slugTemplate, and content watchers not working on Windows
• #1072: Fix spinners that never stopped when a template download failed or Git is not installed
• #1073: Fix dashboard search ignoring the selected folder, tag, category, and filters, an empty page after searching from another page, and default filters not being applied
• #1073: Fix taxonomy tagging removing the tag from the wrong page, and its filter not hiding rows
• #1073: Fix data entries being saved into the wrong data file, unsaved data form edits being reset, and creating a data file overwriting an existing one
• #1073: Fix wrong media paths when the file name contains the static folder name (ex. public-logo.png)
• #1073: The media dashboard always shows the item count next to the refresh button, also in folders without media files
• #1074: Fix lost edits when panel updates overlap, and front matter being written into the focused file (ex. a .ts file) instead of the file the panel shows
• #1074: Fix lost or reverted input in wysiwyg, slug, number, choice, datetime, and relationship fields, and the last characters being lost when switching files while typing
• #1074: Opening a file with a markdown wysiwyg field no longer rewrites its front matter
• #1077: Editing a markdown wysiwyg field keeps the list bullets, emphasis and strong markers, and line endings the value already uses, instead of rewriting the whole value (ex. - bullets to *, _italic_ to *italic*, snake_case to snake\_case)
• #1074: Fix block fields losing changes or writing into the wrong record, and hidden fields with a default overwriting the stored value
• #1074: Clearing a nested field no longer removes its sibling fields, and Copilot tag suggestions no longer replace your existing tags
• #1074: Fix nested fields named title (ex. seo.meta.title) not being removed when cleared with clearEmpty
• #1074: The panel no longer shows the front matter of the previous file for a second when you switch to a file without front matter