🔒️(global) fix security alerts on cryptography, next and mjml - #798
Merged
Conversation
Fix CVE-2026-69247 (High) reported by trivy. cryptography is a transitive dependency pinned in uv.lock, no direct requirement to update.
Fix multiple Snyk findings on next 15.5.18, including two SSRF (CVE-2026-64649, CVE-2026-64645). Cherry-picked from renovate PR #705.
Fix the vulnerabilities of the mjml v4 dependency chain (ReDoS in minimatch and html-minifier, brace-expansion DoS among others). Cherry-picked from renovate PR #754.
mjml v5 pulls commander@15 which requires node >= 22.12, the backend image mail stage was still building with node 20.
mjml v5 ignores mj-include by default, silently dropping the whole mail head (Django load tag, title, fonts and styles) from the generated templates. Opt back in.
kernicPanel
force-pushed
the
fix/security
branch
from
August 6, 2026 12:18
819015c to
544a5ac
Compare
There was a problem hiding this comment.
Pull request overview
This PR addresses multiple security alerts across the stack by upgrading key dependencies (Python cryptography, frontend next, and mail mjml) and aligning build/runtime environments (Node.js and container base images). It also centralizes backend template-file extension handling to avoid duplicated extension lists.
Changes:
- Backend: bump
cryptographyto 50.0.0 and centralize template extension→filename mapping viacore.enums.TEMPLATE_FILES. - Frontend: bump
nextto 15.5.21 and update the frontend container base image. - Mail: upgrade
mjmlto 5.0.0, update mail build Node.js version, and adjust the MJML build command/workflow caching.
Reviewed changes
Copilot reviewed 8 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/mail/yarn.lock | Updates MJML and related Node dependencies for the mail build pipeline. |
| src/mail/package.json | Bumps mjml to v5 for mail template rendering. |
| src/mail/bin/mjml-to-html | Updates the MJML CLI invocation to work with MJML v5 include defaults. |
| src/frontend/yarn.lock | Locks updated next@15.5.21 dependency tree. |
| src/frontend/Dockerfile | Updates the frontend runtime image base to a newer Alpine variant. |
| src/frontend/apps/drive/package.json | Pins next to 15.5.21 in the Drive frontend app. |
| src/backend/uv.lock | Locks cryptography@50.0.0 for backend security fixes. |
| src/backend/core/enums.py | Introduces TEMPLATE_FILES mapping for template-backed file creation. |
| src/backend/core/api/viewsets.py | Uses TEMPLATE_FILES to resolve backend template filenames. |
| src/backend/core/api/serializers.py | Derives allowed template extensions from TEMPLATE_FILES. |
| Dockerfile | Moves the mail-builder stage to Node 22 to support MJML v5. |
| .github/workflows/build-mails.yml | Updates Node version and expands cache key inputs for mail template builds. |
Suppressed comments (1)
.github/workflows/build-mails.yml:45
- Same as above: the cache key won’t reflect changes under
src/mail/mjml/orsrc/mail/bin/unless you use file globs (e.g./**). Without this, template/script updates can be skipped because an old cache entry is considered valid.
key: mail-templates-${{ hashFiles('src/mail/mjml', 'src/mail/yarn.lock', 'src/mail/bin') }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mjml v5 pulls commander@15 which requires node >= 22.12. Include the yarn.lock and build scripts in the mail templates cache key so dependency bumps regenerate the templates.
Fix CVE-2026-67213 (infinite loop in customRandom), a transitive dependency flagged by the Snyk check on both yarn lockfiles.
The alpine 3.22 base of nginx-unprivileged carries 69 known CVEs including a critical one in openssl (CVE-2026-31789). Renovate does not manage Dockerfile images on this repo, so the bump is manual.
Snyk Code flags the f-string path built from the request extension as a path traversal. The DRF ChoiceField already restricts the value but static analysis cannot follow it. Selecting the file name from a static mapping makes the sink independent from user input, and the serializer choices now derive from that single mapping.
Close the Snyk upgrade PR #722 and refresh the html-to-text chain used to derive the plain text mail templates.
kernicPanel
force-pushed
the
fix/security
branch
from
August 6, 2026 14:19
93a18f6 to
2a5bbfc
Compare
|
lunika
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Address open security alerts: trivy findings on the backend and frontend
images, and the Snyk findings on the frontend and mail dependencies.
Proposal
Supersedes #705 and #754, closes #721 and #722.