CLOUDFLARE has released EmDash 1.0, a free, open-source content management system built on Astro. The company says the stable release brings together editorial, media, localisation, migration and deployment workflows, following five months of work with contributors and production users. Cloudflare also launched a decentralised plugin registry, allowing developers to publish packages while retaining control of their identity and release history.
Site owners can discover, inspect and install plugins through EmDash, while other services can index the same publications and operate their own catalogues.
The registry uses the AT Protocol and Atmosphere accounts. Plugin and release records are signed by the publisher and stored in the publisher’s account. EmDash says its catalogue can moderate displayed names, descriptions, links and images, but cannot rewrite releases or remove the underlying publication. Before installation, EmDash verifies the signed record, plugin checksum, package name, version, requested access and any required build provenance, then confirms that the downloaded bundle matches the record.
Security is also built around sandboxing. Each plugin runs in an isolated runtime with private storage and no default access to site content, media, users, secrets, environment, filesystem or network. Additional capabilities must be declared and approved by an administrator. On Cloudflare, plugins run as Dynamic Workers; on Node.js, EmDash uses the open-source workerd runtime in a separate process.
Cloudflare says the model limits plugins to specific approved functions, such as reading published articles or managing media, rather than granting unrestricted access to the CMS.