v27.0

Notifuse/notifusev27.0Feb 8, 2026by pierre-b

AI Summary

Major release introducing Broadcast Data Feeds for dynamic content injection from external APIs, with global and per-recipient feed options. Includes critical migration fixes and SMTP authentication improvements.

Key Highlights

Broadcast Data Feeds - external data integration for broadcasts
Global Feed: fetch data once before broadcast, available via {{ global_feed.* }}
Per-Recipient Feed: personalized data per recipient via {{ recipient_feed.* }}
Custom HTTP headers support for API authentication
SSRF protection with URL validation (blocks localhost/private IPs)
Fixed startup crash when upgrading from v26
Fixed SMTP M365 OAuth2 to use sender email instead of fixed auth email
File Manager: sanitize filenames by replacing spaces with dashes
Broadcasts: fixed custom endpoint URL propagation to tracking URLs
Contacts bulk import now processes in batches of 500

New Features

Broadcast Data Feeds with global and per-recipient options

Full Release Notes

# v27.0

## New Features

- **Broadcast Data Feeds**: Added external data feed integration for broadcasts, allowing dynamic content injection from external APIs
  - **Global Feed**: Fetch data once before broadcast starts, available to all recipients via `{{ global_feed.* }}` template variable
  - **Per-Recipient Feed**: Fetch personalized data for each recipient via `{{ recipient_feed.* }}` template variable
  - Custom HTTP headers support for API authentication
  - Automatic retry with circuit breaker protection
  - SSRF protection with URL validation (blocks localhost and private IPs)
  - Real-time feed testing from the broadcast editor

## Database Migration

- Added `data_feed` JSONB column to `broadcasts` table (workspace migration)
- Added `recurring_interval` and `integration_id` columns to `tasks` table (system migration)

## Fixes

- **Upgrade from v26**: Fixed startup crash when upgrading from v26 due to index referencing `integration_id` column before the migration could add it
- **SMTP M365 OAuth2**: Fixed XOAUTH2 authentication to use sender email instead of fixed auth email, resolving SendAs permission errors and incorrect Sent folder placement (#250)
- **File Manager**: Sanitize uploaded filenames by replacing spaces with dashes and lowercasing extensions (#252)
- **Broadcasts**: Fixed custom endpoint URL not propagating to click tracking and open tracking URLs in sent emails (#254)
- **Email Builder**: Fixed text color/background changes not applying when re-selecting already-styled text in the rich text editor
- **Contacts**: Bulk import now processes contacts in batches of 500, fixing crashes on large imports and improving performance