Skip to content

chore(deps): update dependency mjml to v5 [security]#58

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-mjml-vulnerability
Open

chore(deps): update dependency mjml to v5 [security]#58
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-mjml-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
mjml (source) ^4.13.0 → ^5.0.0 age confidence
mjml (source) 4.13.0 → 5.0.0 age confidence

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

CVE-2025-67898 / GHSA-45h5-66jx-r2wf

More information

Details

MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.

Severity

  • CVSS Score: 4.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

mjmlio/mjml (mjml)

v5.0.0

Compare Source

Upgrade Guide

These are the changes users need to actively consider when upgrading to MJML 5.x.x from MJML 4.x (and early MJML 5 alphas):

Highlights

  • Replaced legacy html-minifier and js-beautify with htmlnano + cssnano. [breaking change]
  • Added templating syntax sanitization (runs before PostCSS and is restored afterwards)
  • Safer, stricter handling of mj-include and ignoreIncludes [breaking change]
  • Restructured outer HTML: the <body> tag is now driven by mj-body, not the global skeleton. [breaking change]
  • mjml-browser build/minification pipeline updated
  • Better attribute consistency across components (including more flexible border-radius). [breaking change]
  • Migration helper removed [breaking change]
  • Updated toolchain: Node 20/22/24 in CI. Removed Node 16/18 [breaking change]

HTML/CSS minification & formatting

What changed
  • HTML minification now uses htmlnano instead of html-minifier.
  • CSS minification now uses cssnano presets wired via mjml-core.
  • Minification options can be added via .mjmlconfig.js
Impact [potential breaking changes]
  • Generated HTML is more aggressively minified. If you rely on exact formatting (e.g. diffing raw HTML, parsing by regex, or checking snapshots), you may see changes.
  • Some obscure html-minifier specific options used in custom tooling will no longer apply; options are now expressed as htmlnano/cssnano configs.
  • Template tags may error in PostCSS (see Template syntax handling and sanitization below)
  • Fixes this issue: #​2589
What to do
  • Review any automation that assumes pretty‑printed HTML (tests, diffs, CI snapshot comparisons).
  • If you previously passed minify/beautify flags or custom minifier options, re‑map them to the new htmlnano/cssnano config.
Notes
  • cssnano uses lite preset by default. Due to this issue: #​2919. default preset can be used if your fonts don’t contain numerals
More detail: (#​2858 (comment))

Template syntax handling and sanitization (PostCSS)

What changed
  • Template syntax (e.g. {{ }}) is now sanitized before PostCSS and with syntax restored post-processing.
Impact
  • A CssSyntaxError error will occur when applying CSS minification to files with some template syntax
  • Fixes this issue: #​2858 (comment)
What to do
  • If you use a templating engine on top of MJML (Handlebars, Liquid, Twig, etc.), run your existing templates and visually verify output.
  • Pay special attention to templates that put templating markers in CSS or style attributes.
More detail: (#​2858 (comment))

Includes are more locked down

What changed
  • ignoreIncludes / allowIncludes (CLI) defaults and behavior have changed to be more secure. Includes are ignored by default
  • A new includePath option is introduced to explicitly control where includes can be loaded from outside of a templates filePath
  • Support MJML, HTML and CSS includes only
Impact [potential breaking changes]
  • Includes are ignored by default, you will need to explicitly allow them
  • Projects that relied on implicit include behavior (e.g. loading templates from arbitrary paths without explicit configuration) may now fail, warn, or simply skip includes.
  • In locked‑down environments (containers, CI, hosting), path resolution for includes may change and require configuration.
  • Fixes this issue: #​2589
What to do
  • Audit usage of mj-include and any config that touches ignoreIncludes / allowIncludes.
  • Explicitly configure includePath (and related options) in your .mjmlconfig or CLI usage to match your desired include directories (see docs)
  • Expect safer, stricter defaults; don’t rely on includes working without explicit configuration.
More detail: (#​2858 (comment))

mj-body and skeleton structure

What changed
  • The <body> HTML tag is now generated under mj-body instead of a global skeleton file.
  • Added id attribute to mj-body
  • mj-body attributes have been refactored:
    • class attribute is applied to the body tag rather than the child div
    • background-color removed from body, applies to child div only
Impact [potential breaking changes]
  • If you rely on the exact skeleton (where <body> lived, what attributes were on it), this structure is now different.
  • External CSS that relies on the specific placement of the class may no longer apply
  • Fixes this issue: #​2396
What to do
  • Re‑check any tooling that injects or manipulates the outer HTML skeleton around MJML output.
  • Re‑verify any CSS relating to class or background-color attributes that were applied to mj-body
Notes

Browser bundle / build scripts

What changed
  • mjml-browser build/minification pipeline has been updated to use new minifiers
Why
  • New minifiers were not compatible
Impact
  • If you import mjml-browser directly or depended on its legacy build scripts, behavior and bundle size/shape might change.
  • Bundle size down from 1.22M to 1.04M
What to do
  • Re‑build any tools using mjml-browser and verify they still load, minify, and run as expected.

Attributes & layout consistency

What changed
  • All border-radius attributes now accept a string, previously this was inconsistent across components. Allows more flexible input
  • Updated the inner-padding attributes of mj-hero and fixed an Outlook issue with width/padding
Impact [potential breaking changes]
  • For some components, border-radius values are less strict
  • inner-padding for mj-hero is now applied to all clients, not just Outlook
What to do
  • Visual regression‑test focusing on all instances border-radius and mj-hero's inner-padding

Migration helper removal

What changed
  • The standalone mjml-migrate tool and associated noMigrateWarn option are removed.
Impact [potential breaking changes]
  • You can no longer rely on MJML 5 to automatically migrate very old MJML syntax (3.x/early 4.x) on the fly.
What to do
  • If you still have legacy MJML, migrate those templates with MJML 4 tooling before moving the project to MJML 5, or update them manually.

Node.js version support

What changed
  • CI now runs against Node LTS 20, 22 and 24; older Node versions are effectively deprecated/unsupported.
Impact [potential breaking changes]
  • MJML 5 may not work (or will be untested) on Node 16/18 in the long term.
What to do
  • Plan to run MJML 5 on Node 20, 22 or 24 in CI and production.

Full Changelog: mjmlio/mjml@v4.18.0...v5.0.0

v4.18.0

Compare Source

What's Changed

Documentation

Full Changelog: mjmlio/mjml@v4.17.2...v4.18.0

v4.17.2

Compare Source

What's Changed

Fixes

Full Changelog: mjmlio/mjml@v4.17.1...v4.17.2

v4.17.1

Compare Source

What's Changed

Fixes

Full Changelog: mjmlio/mjml@v4.17.0...v4.17.1

v4.17.0

Compare Source

What's Changed

Features
Fixes
Documentation
Other

New Contributors

Full Changelog: mjmlio/mjml@v4.16.1...v4.17.0

v4.16.1

Compare Source

Fixes

  • Fix build issue of version 4.16.0 for mjml-browser

Full Changelog: mjmlio/mjml@v4.16.0...v4.16.1

v4.16.0

Compare Source

What's Changed

Features
Fixes
Documentation
Dependencies

New Contributors

Full Changelog: mjmlio/mjml@v4.15.3...v4.16.0

v4.15.3

Compare Source

What's Changed

Full Changelog: mjmlio/mjml@v4.15.2...v4.15.3

v4.15.2

Compare Source

Full Changelog: mjmlio/mjml@v4.15.1...v4.15.2

v4.15.1

Compare Source

v4.15.0

Compare Source

What's Changed

New Contributors

Full Changelog: mjmlio/mjml@v4.14.1...v4.15.0

v4.14.1

Compare Source

What's Changed

New Contributors

Full Changelog: mjmlio/mjml@v4.14.0...v4.14.1

v4.14.0

Compare Source

What's Changed

New
Fixes
Documentation

New Contributors

Full Changelog: mjmlio/mjml@v4.13.0...v4.14.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 7 workspace projects
.                                        |  WARN  Ignoring broken lockfile at /tmp/renovate/repos/github/ksv-vc/postbote: Lockfile /tmp/renovate/repos/github/ksv-vc/postbote/pnpm-lock.yaml not compatible with current pnpm
 WARN  GET https://registry.npmjs.org/@testing-library%2Freact error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fcolor error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fhtml-minifier error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fjest error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint%2Feslint-plugin error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint%2Fparser error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint-config-prettier error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-import error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-jsx-a11y error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-react error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-react-hooks error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/typescript error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fmjml error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Freact error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Freact-dom error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@testing-library%2Freact error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fcolor error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fhtml-minifier error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fjest error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint%2Feslint-plugin error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@typescript-eslint%2Fparser error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-config-prettier error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-import error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-jsx-a11y error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-react error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/eslint-plugin-react-hooks error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/typescript error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Fmjml error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Freact error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@types%2Freact-dom error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 ERR_PNPM_META_FETCH_FAIL  GET https://registry.npmjs.org/@testing-library%2Freact: Value of "this" must be of type URLSearchParams
 WARN  GET https://registry.npmjs.org/expect-type error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/jest error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/jest-environment-node error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/ts-jest error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.

@changeset-bot

changeset-bot Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 36896cb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/npm-mjml-vulnerability branch 4 times, most recently from 313edc6 to 5bca6c8 Compare July 17, 2026 01:01
@renovate
renovate Bot force-pushed the renovate/npm-mjml-vulnerability branch 3 times, most recently from b564073 to 21a6fc1 Compare July 24, 2026 15:05
@renovate
renovate Bot force-pushed the renovate/npm-mjml-vulnerability branch from 21a6fc1 to 36896cb Compare July 24, 2026 21:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants