v32.1
gorhill/uBlockv32.1May 30, 2026by pierre-b
AI Summary
This release enhances email template capabilities by exposing a base URL variable, addresses security vulnerabilities by updating the Liquid.js dependency, and fixes Mailgun webhook registration failures on shared domains.
Key Highlights
- Exposed `{{ workspace.base_url }}` for relative path linking
- Security update: bumped `liquidjs` to 10.27.0
- Fixed Mailgun webhook 400 errors on domains shared with other services
- Cleared transitive advisories for `brace-expansion` and `ws`
New Features
- New `{{ workspace.base_url }}` template variable
- Security dependency updates
Full Release Notes
- **Feature**: Exposed `{{ workspace.base_url }}` in email templates — the resolved Custom Endpoint URL (or the default API endpoint), trailing slash trimmed — so templates can compose links from relative paths like `{{ workspace.base_url }}/users/verify/xxx` (#342).
- **Security**: Bumped `liquidjs` to 10.27.0 in console to clear 6 Dependabot alerts (critical RCE, ReDoS in `strip_html`, `date` filter padding DoS, `{% render %}` `ownPropertyOnly` bypass, empty `{% for %}` renderLimit bypass, and `strip_html` newline XSS); `npm audit fix` also cleared transitive `brace-expansion` and `ws` advisories.
- **Fix**: Mailgun webhook registration no longer fails with `400` on domains shared with other services — Notifuse now merges its callback URL into each event's existing URL set via `PUT` (up to Mailgun's limit of 3 per event) instead of always `POST`ing, and unregistering removes only its own URL while preserving other consumers' (#340).