v32.1

crewAIInc/crewAIv32.1May 30, 2026by pierre-b

AI Summary

This release adds support for `{{ workspace.base_url }}` in email templates and addresses critical security vulnerabilities by upgrading the `liquidjs` dependency.

Key Highlights

  • Exposed `{{ workspace.base_url }}` in email templates
  • Bumped `liquidjs` to 10.27.0 to fix RCE and XSS vulnerabilities
  • Fixed Mailgun webhook registration failures on shared domains

New Features

  • Exposed `{{ workspace.base_url }}` in email templates

Full Release Notes

- **Feature**: Exposed `{{ workspace.base_url }}` in email templates — the resolved Custom Endpoint URL (or the default API endpoint), trailing slash trimmed — so templates can compose links from relative paths like `{{ workspace.base_url }}/users/verify/xxx` (#342).
- **Security**: Bumped `liquidjs` to 10.27.0 in console to clear 6 Dependabot alerts (critical RCE, ReDoS in `strip_html`, `date` filter padding DoS, `{% render %}` `ownPropertyOnly` bypass, empty `{% for %}` renderLimit bypass, and `strip_html` newline XSS); `npm audit fix` also cleared transitive `brace-expansion` and `ws` advisories.
- **Fix**: Mailgun webhook registration no longer fails with `400` on domains shared with other services — Notifuse now merges its callback URL into each event's existing URL set via `PUT` (up to Mailgun's limit of 3 per event) instead of always `POST`ing, and unregistering removes only its own URL while preserving other consumers' (#340).