Accent CMS 0.27.6 — plugin runtime fixes and Sass escapes

Accent CMS 0.27.6 is available. It is a security release for the 0.27 line, and it does not contain the 0.28 development work. A licence with a 0.27 ceiling covers it.

You do not have to change your site or plugins. If your theme’s Sass uses backslash escapes outside quoted strings, compare its CSS before and after you upgrade, as described under “Sass escapes” below.

Security

The plugin runtime gets four fixes. Accent runs plugins in wasmtime, and wasmtime 48.0.8 fixes four issues in 48.0.7. Some function arguments could make the runtime panic, struct types created by the host could be confused between engines, and a memory check was skipped when one component passed a borrowed resource to another. The fourth issue lets a UDP socket send to an address it may only receive from. Accent gives plugins no network sockets, so that one can’t affect your site. Only plugins run through wasmtime, so a site without plugins is not affected by any of them.

Two more dependency advisories are closed. Release binaries list the dependencies they were built from, so a scanner such as cargo audit bin reports these advisories against 0.27.5. Neither affected Accent as it ships:

• Markdown parser. With wikilinks turned on, a few kilobytes of crafted links could make the parser exhaust memory. Accent’s Markdown parser already carried the fix, and the Markdoc engine never turns wikilinks on. Both now use the fixed release.
• Compression library. The plugin compilation cache compresses with zstd, whose fixed release closes an issue in a WebAssembly build that Accent never makes.

A scan of 0.27.6 still lists three zstd advisories. They need a reused compression context, the seekable feature or legacy frame support, and the plugin compilation cache uses none of them. They clear when wasmtime moves to a fixed zstd release.

Sass escapes

Sass escapes compile the way dart-sass compiles them. The Sass compiler now follows dart-sass 1.107.0 in how it handles backslash escapes:

• Text at statement level keeps its escapes as written. \63 olor: red and @keyframes \61 reach the CSS unchanged instead of being decoded.
• In an expression, an escape that names no valid character, such as U+0000, a surrogate or a code point past U+10FFFF, becomes the replacement character U+FFFD.
• Keywords match through escapes, so !\69 mportant now works as !important.
• A number whose unit would read back as an exponent is written with an escaped e.

Two constructs that dart-sass rejects are now errors here too: a rest parameter with the same name as another parameter, and an escaped e in a keyframe selector, such as 1\65 1%.

The bundled themes compile to the same CSS as before. If your own theme uses escaped identifiers, build the site before and after you upgrade and compare the CSS.

Install or upgrade

curl -fsSL https://accentcms.dev/install.sh | sh

Binaries for all platforms, checksums and signatures are on the GitHub release page.