Dernière nouveauté

v1.10.2

Same code as v1.10.1, with Docker images. The v1.10.1 image build never started because our CI runners stopped picking up jobs, so no v1.10.1 images were published. Release images are now built on GitHub-hosted runners (#492).

This is a security release. If you self-host, upgrade to this version and read the v1.10.1 notes first. They cover the settings to check after upgrading:

  • ADMIN_EMAIL (who can open the Admin page)

  • SNS_SIGNATURE_VERIFICATION (SES events are now signature-verified)

  • WEBHOOK_ALLOW_PRIVATE_URLS

  • the new docker/prod/compose.yml

What's Changed

Full Changelog: https://github.com/usesend/useSend/compare/v1.10.1...v1.10.2

Source GitHub

v1.10.1

Docker images for these fixes are published as v1.10.2. The v1.10.1 image build never ran because of a CI runner problem. The code is the same.

This is a security release. It fixes several vulnerabilities reported privately to us, and everyone running the self-hosted image should upgrade. Security advisories with full details will follow.

⚠️ Self-hosters: read before upgrading

If you use our Docker Compose file, download the new docker/prod/compose.yml. It passes the new settings below through to the container.

Admin page: only the instance admin can open it now. Before this release, every signed-in user on a self-hosted instance had full admin access (SES settings, teams, waitlist). Now only the first user who signed up is the admin. To choose someone else, set ADMIN_EMAIL to their account email (exact match). If no account has that email, the first user stays admin and a warning is logged, so you can't lock yourself out (#479).

SES events are now verified. Delivery, bounce, open and click events that arrive at /api/ses_callback must carry a valid AWS SNS signature, and subscription confirmations are only accepted from AWS SNS hosts. Forged events are rejected (#466). If your email statuses stop updating after the upgrade:

  • set SNS_SIGNATURE_VERIFICATION=log-only to accept events while logging failures, and open an issue

  • if you use an SNS emulator such as LocalStack, set AWS_SNS_ENDPOINT (and AWS_SES_ENDPOINT) together with log-only (#485)

Webhooks to internal addresses. Self-hosted instances still allow webhooks to private hosts by default (for example http://n8n:5678 on the same Docker network). If you don't trust every user who can create webhooks, set WEBHOOK_ALLOW_PRIVATE_URLS=false to only allow public URLs. Redirects from webhook endpoints are no longer followed (#467).

SMTP proxy: renewed certificates load on their own. The proxy used to keep serving its old TLS certificate after certbot renewed it, until the container restarted, so clients eventually saw "certificate verify failed". It now re-reads the certificate every 5 minutes (TLS_RELOAD_INTERVAL_MS) and swaps it in without a restart. It also logs a warning when the certificate is within 14 days of expiry (#488).

Other changes you might notice:

  • Deleting a domain revokes the API keys restricted to it. Before, those keys silently became unrestricted (#490).

  • Domain-restricted API keys can only read and manage campaigns sent from their own domain, can only send batches from their own domain, and can't create domains (403) (#490).

  • Team invites can only be seen and accepted by the email address they were sent to (#489).

Security

  • Self-hosted admin access restricted to the instance admin (#479).

  • SES callback verifies AWS SNS signatures (#466, #485).

  • Webhooks: non-public and cloud-metadata addresses are rejected on cloud and optionally on self-hosted, with the address checked at connect time (#467).

  • Templates are scoped to the sending team, and template variables are substituted literally (#478).

  • Team invites are bound to the invited email (#489).

  • Domain-restricted API keys are enforced on campaign routes, batch sends, domain creation and domain deletion (#490).

  • Next.js 15.5.28 → 15.5.29, the November 3 security release (#491).

Fixes

  • No more jsx-email "Butan" deprecation warning on every email render (#469).

Thanks

  • The security researchers who reported these issues privately. You'll be credited in the advisories.

  • @rubixvi for flagging the Next.js 15.5.29 release in #487.

What's Changed

Full Changelog: https://github.com/usesend/useSend/compare/v1.10.0...v1.10.1

Source GitHub

v1.10.0

This release is mostly security updates for everyone on the self-hosted image, plus a fix for self-hosted storage: the MinIO image our Docker Compose setup used no longer exists.

⚠️ Self-hosters: read before upgrading

If you use our Docker Compose file, download the new docker/prod/compose.yml. The minio/minio image it used has been removed from Docker Hub, and MinIO's community edition is no longer maintained or patched. The old compose file fails on any server that doesn't already have that image cached. Compose now runs RustFS instead (#484).

  • Your existing .env keeps working. If RUSTFS_ACCESS_KEY / RUSTFS_SECRET_KEY aren't set, your MINIO_ROOT_USER / MINIO_ROOT_PASSWORD are used. We recommend setting the new names.

  • Nothing is deleted. RustFS uses a new rustfs volume, and your old usesend-prod_storage volume is left alone. The old compose file never connected the app to MinIO, so for most installs it's empty. If you wired uploads to MinIO yourself, the self-hosting guide has a tested command to copy your files across.

  • Image uploads in the email editor now work with Compose. They're optional. To turn them on, put a reverse proxy in front of the RustFS API (port 9002, bound to 127.0.0.1) and set S3_COMPATIBLE_API_URL and S3_COMPATIBLE_PUBLIC_URL. Uploaded objects are publicly readable so images load in inboxes. Nothing else in the bucket is public.

Other changes you might notice:

  • Node 24. The image is now built on node:24-alpine3.24 (Node 24.22.1). The previous image shipped Node 22.16.0, which is affected by the October 2026 Node.js security release (#484).

  • Failed migrations stop the container. If the database migration fails at startup, the container now exits instead of serving requests against an outdated schema (#462).

  • Stricter from parsing. A from value with more than one address, group syntax, or more than one @ is now rejected with 400 From email is invalid (#477).

  • Malformed API keys now get 403 instead of 500 (#468).

Security

  • Next.js 15.5.18 → 15.5.28, including the October 14 security release (image optimizer RCE, Server Actions DoS). Auth.js: next-auth 4.24.15, @auth/core 0.41.3 (#465, #470).

  • Node.js 24.22.1 in the Docker image (#484).

  • Sender-domain check hardened. The domain check now reads from with the same parser that builds the message, so the address that's checked and the address that's sent can't differ (#477).

  • nodemailer 8 → 10.2.1 and mailparser 3.12.4 in the app and the SMTP proxy (#470).

  • hono 4.13 for the public API, React 19.1.10, turbo 2.11 (#484).

  • Vitest 4, plus overrides for vulnerable transitive packages (#470). pnpm audit across the monorepo goes from 4 critical / 45 high to 0 critical / 2 high. The two left need major upgrades (zod 4, deepmerge-ts 8 inside Prisma).

  • Unmaintained MinIO replaced by RustFS, with the storage ports bound to loopback (#461, #484).

Fixes

  • The SMTP proxy is declared as its own workspace package, and frozen installs work on pnpm 9 (#450, #451).

  • No error log for the expected "domain not found" case when creating or updating API keys (#484).

  • The login email field no longer switches between uncontrolled and controlled (#484).

Python SDK

usesend 0.2.11 is on PyPI. It requires patched urllib3 (≥ 2.8.0) and certifi (≥ 2026.10.19) (#481).

Thanks

  • @rubixvi did the MinIO → RustFS work and many of the dependency updates in #475, which landed as #484.

  • @jiaweing contributed the Node base image, Next.js 15.5.28 and sharp changes from #474, which landed in #470, and reported the vulnerable self-hosted image in #473.

What's Changed

Full Changelog: https://github.com/usesend/useSend/compare/v1.9.8...v1.10.0

Source GitHub

Publications précédentes

  • v1.9.8

    • fix: prevent variable popover from blocking text selection
    • fix: derive SMTP proxy Bcc recipients from the envelope

  • v1.9.7

    • fix: preserve safe headers through SMTP proxy
    • fix: restore campaign batch enqueueing

  • v1.9.6

    • fix: reject invalid SES regions
    • fix: deduplicate dashboard engagement usage

  • v1.9.5

    • Campaign previews are now isolated from the dashboard, so email styles can’t break or change the surrounding UI
    • Campaigns now continue sending when an individual recipient fails. Failed recipients appear in campaign activity with