Starstruk Logo MarkStarstruk

v29.0

Notifuse/notifusev29.0Apr 4, 2026by pierre-b

AI Summary

Version 29.0 is a significant security and naming update that renames 'SMTP Relay' to 'SMTP Bridge' throughout the application, enforces workspace team member limits via MAX_USERS environment variable, and patches a critical SSRF vulnerability in the favicon detection endpoint.

Key Highlights

  • SMTP Relay renamed to SMTP Bridge with backward compatibility for old environment variables
  • Workspace member limits now enforced via MAX_USERS env var (0 = unlimited)
  • Critical SSRF vulnerability fixed in /api/detect-favicon endpoint
  • SMTP EHLO hostname now defaults to from-email domain for better provider compatibility
  • Multiple security dependencies updated to fix prototype pollution, code injection, ReDoS, and stack overflow vulnerabilities

Breaking Changes

  • SMTP Relay renamed to SMTP Bridge (environment variables, API fields, routes, and UI labels)
  • Workspace member limits now enforced via MAX_USERS env var with checks on invite, accept invitation, and direct add

New Features

  • SSRF protection with safe HTTP client, private IP blocking, DNS rebinding protection, scheme validation, and response size limits
  • SMTP EHLO hostname defaults to from-email domain instead of SMTP host
  • Automatic database migration for SMTP settings keys via V29 migration

Full Release Notes

## [29.0] - 2026-04-04

### Breaking Changes

- **Rename**: "SMTP Relay" renamed to "SMTP Bridge" throughout the application
  - Environment variables: `SMTP_RELAY_*` renamed to `SMTP_BRIDGE_*` (old names still accepted for backward compatibility)
  - Database settings keys migrated automatically via V29 migration
  - JSON API: `smtp_relay_*` fields renamed to `smtp_bridge_*` in setup endpoints
  - Frontend routes: `/settings/smtp-relay` changed to `/settings/smtp-bridge`
  - UI labels: "SMTP Relay" changed to "SMTP Bridge"
- **Workspace**: Enforce team member limits via `MAX_USERS` env var (0 = unlimited), with checks on invite, accept invitation, and direct add — API key users are excluded from the count
- **Security**: Fixed SSRF vulnerability in `/api/detect-favicon` endpoint by adding a safe HTTP client with private IP blocking, DNS rebinding protection, scheme validation, and response size limits
- **Security**: Upgraded happy-dom to 20.8.9 in notification center and picomatch to 4.0.4 in console
- **Improvement**: SMTP EHLO hostname now defaults to the from-email domain instead of the SMTP host, improving compatibility with strict providers (#301)
- **Security**: Updated lodash/lodash-es to 4.18.x, brace-expansion to 5.0.5, and yaml to 2.8.3 to fix prototype pollution, code injection, ReDoS, and stack overflow vulnerabilities