@react-email/ui@6.3.1

resend/react-email@react-email/ui@6.3.1May 22, 2026by github-actions[bot]

AI Summary

This release addresses a critical security vulnerability in the directory traversal handling of a server action.

Key Highlights

Fixes a directory traversal vulnerability in `getEmailsDirectoryMetadataAction`.
Prevents arbitrary directory enumeration by reading paths from server-only environment variables.
Ignores client input for directory paths.

Full Release Notes

### Patch Changes

* 27587f1: stop accepting the emails directory path as a server-action argument

  The `getEmailsDirectoryMetadataAction` server action used to take an
  absolute filesystem path from the client and walk that directory on the
  server, which allowed any caller of the endpoint to enumerate arbitrary
  directories on the host. The action now reads the path from the server-only
  `REACT_EMAIL_INTERNAL_EMAILS_DIR_ABSOLUTE_PATH` env variable and ignores
  client input.