v32.1
Notifuse/notifusev32.1May 30, 2026by pierre-b
AI Summary
This release exposes the base URL in templates, applies critical security patches to liquidjs clearing 6 Dependabot alerts including RCE and ReDoS vulnerabilities, and fixes Mailgun webhook registration to work with shared domains.
Key Highlights
- New {{ workspace.base_url }} template variable exposed in email templates
- Security: Bumped liquidjs to 10.27.0 clearing critical RCE, ReDoS, and other vulnerabilities
- Fix: Mailgun webhook registration now merges callback URL via PUT instead of POST
- Clears transitive brace-expansion and ws advisories
New Features
- Exposed {{ workspace.base_url }} in email templates
- Security: Bumped liquidjs to 10.27.0 (clears 6 Dependabot alerts including critical RCE, ReDoS, date filter padding DoS, and XSS vulnerabilities)
Full Release Notes
- **Feature**: Exposed `{{ workspace.base_url }}` in email templates — the resolved Custom Endpoint URL (or the default API endpoint), trailing slash trimmed — so templates can compose links from relative paths like `{{ workspace.base_url }}/users/verify/xxx` (#342).
- **Security**: Bumped `liquidjs` to 10.27.0 in console to clear 6 Dependabot alerts (critical RCE, ReDoS in `strip_html`, `date` filter padding DoS, `{% render %}` `ownPropertyOnly` bypass, empty `{% for %}` renderLimit bypass, and `strip_html` newline XSS); `npm audit fix` also cleared transitive `brace-expansion` and `ws` advisories.
- **Fix**: Mailgun webhook registration no longer fails with `400` on domains shared with other services — Notifuse now merges its callback URL into each event's existing URL set via `PUT` (up to Mailgun's limit of 3 per event) instead of always `POST`ing, and unregistering removes only its own URL while preserving other consumers' (#340).