Repository navigation
build: update emails preview to react-email 6.11.0 with patched next - #4
Merged
Merged
Conversation
Что: - react-email и @react-email/ui обновлены с 6.6.4 до 6.11.0 и закреплены одной версией: CLI `email` не запускается, если они различаются. - Для next добавлен pnpm override `>=16.3.8 <17.0.0`: @react-email/ui 6.11.0 жёстко тянет next 16.3.3 с критическими и high-уязвимостями. - Добавлен react-dom (peer-зависимость react-email 6); react, react-dom и @types/react(-dom) выровнены с bun.lock (19.3.0), @react-email/components остался 1.0.12. - pnpm-lock.yaml пересобран pnpm 10.22.0 с minimum-release-age 3 дня; транзитивные brace-expansion 5.0.12, fast-uri 3.1.8 и source-map-js 1.2.2 подняты до исправленных версий. - В readme установка через pnpm: npm и yarn игнорируют pnpm-lock.yaml и override. Зачем: - Манифест и лок-файл расходились: в лок-файле не было @react-email/ui и next, specifier components отличался, а предпросмотр тянул уязвимый next. - Одинаковые @types/react и @react-email/components в bun.lock и в лок-файле пакета нужны, чтобы проверка типов @dokploy/server не видела две копии типов React. Риски: - Пакет нужен только для локального предпросмотра писем: он не входит в bun workspace и Docker-образ, рантайм сервера не меняется. Проверки: - Команды и результаты: `pnpm install --frozen-lockfile` проходит; `pnpm audit` — уязвимостей нет; `email dev` — главная страница и все 18 шаблонов отдают 200 и рендерятся без ошибок, установлен только next 16.3.8; `bun run typecheck` — 4/4 пакета без ошибок; vitest `__test__/notification` — 26/26. - Ограничения: `email build` и `email export` не запускались; `email build` ставит зависимости ui через npm внутри .react-email и не видит override. What: - Bumped react-email and @react-email/ui from 6.6.4 to 6.11.0 and pinned them to the same version: the `email` CLI refuses to start when they differ. - Added a pnpm override `>=16.3.8 <17.0.0` for next: @react-email/ui 6.11.0 pins next 16.3.3, which has critical and high advisories. - Added react-dom (a react-email 6 peer dependency); aligned react, react-dom and @types/react(-dom) with bun.lock (19.3.0); kept @react-email/components at 1.0.12. - Regenerated pnpm-lock.yaml with pnpm 10.22.0 and a 3-day minimum release age; moved transitive brace-expansion to 5.0.12, fast-uri to 3.1.8 and source-map-js to 1.2.2. - The readme now installs with pnpm: npm and yarn ignore pnpm-lock.yaml and the override. Why: - The manifest and lockfile had drifted: the lockfile had no @react-email/ui or next, the components specifier differed, and the preview pulled a vulnerable next. - bun.lock and this package's lockfile must resolve the same @types/react and @react-email/components, or the @dokploy/server typecheck sees two copies of the React types. Risks: - The package is only used to preview emails locally: it is not in the bun workspace or the Docker image, so the server runtime is unchanged. Checks: - Commands and results: `pnpm install --frozen-lockfile` passes; `pnpm audit` finds no vulnerabilities; `email dev` serves the index and all 18 templates with 200 and renders them without errors, with only next 16.3.8 installed; `bun run typecheck` passes for 4/4 packages; vitest `__test__/notification` 26/26. - Limitations: `email build` and `email export` were not run; `email build` installs ui's dependencies with npm inside .react-email and does not see the override. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR about?
Finishes the emails preview update that had been left uncommitted in a worktree:
react-emailand@react-email/ui6.11.0, pinned to the same version (theemailCLI refuses to start otherwise).nexton>=16.3.8 <17.0.0;@react-email/ui6.11.0 pins the vulnerable 16.3.3.react-domadded as the react-email 6 peer; React and its types aligned withbun.lock(19.3.0);@react-email/componentsstays 1.0.12.brace-expansion,fast-uriandsource-map-jsbumped to patched versions.The package is dev-only (not in the bun workspace or the Docker image), so the running Dokploy is unchanged.
Checks
pnpm install --frozen-lockfilepasses;pnpm audit: no known vulnerabilities.email dev: the index and all 18 templates return 200 and render without errors; only next 16.3.8 is installed.bun run typecheck: 4/4 packages pass.__test__/notification: 26/26.email buildandemail export.🤖 Generated with Claude Code