Skip to content

chore(deps): bump mjml from 4.18.0 to 5.0.0#6745

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mjml-5.0.0
Open

chore(deps): bump mjml from 4.18.0 to 5.0.0#6745
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mjml-5.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps mjml from 4.18.0 to 5.0.0.

Release notes

Sourced from mjml's releases.

v5.0.0

Upgrade Guide

These are the changes users need to actively consider when upgrading to MJML 5.x.x from MJML 4.x (and early MJML 5 alphas):

Highlights

  • Replaced legacy html-minifier and js-beautify with htmlnano + cssnano. [breaking change]
  • Added templating syntax sanitization (runs before PostCSS and is restored afterwards)
  • Safer, stricter handling of mj-include and ignoreIncludes [breaking change]
  • Restructured outer HTML: the <body> tag is now driven by mj-body, not the global skeleton. [breaking change]
  • mjml-browser build/minification pipeline updated
  • Better attribute consistency across components (including more flexible border-radius). [breaking change]
  • Migration helper removed [breaking change]
  • Updated toolchain: Node 20/22/24 in CI. Removed Node 16/18 [breaking change]

HTML/CSS minification & formatting

What changed

  • HTML minification now uses htmlnano instead of html-minifier.
  • CSS minification now uses cssnano presets wired via mjml-core.
  • Minification options can be added via .mjmlconfig.js

Impact [potential breaking changes]

  • Generated HTML is more aggressively minified. If you rely on exact formatting (e.g. diffing raw HTML, parsing by regex, or checking snapshots), you may see changes.
  • Some obscure html-minifier specific options used in custom tooling will no longer apply; options are now expressed as htmlnano/cssnano configs.
  • Template tags may error in PostCSS (see Template syntax handling and sanitization below)
  • Fixes this issue: mjmlio/mjml#2589

What to do

  • Review any automation that assumes pretty‑printed HTML (tests, diffs, CI snapshot comparisons).
  • If you previously passed minify/beautify flags or custom minifier options, re‑map them to the new htmlnano/cssnano config.

Notes

  • cssnano uses lite preset by default. Due to this issue: mjmlio/mjml#2919. default preset can be used if your fonts don’t contain numerals

More detail: (mjmlio/mjml#2858)

Template syntax handling and sanitization (PostCSS)

What changed

  • Template syntax (e.g. {{ }}) is now sanitized before PostCSS and with syntax restored post-processing.

Impact

  • A CssSyntaxError error will occur when applying CSS minification to files with some template syntax
  • Fixes this issue: mjmlio/mjml#2858

... (truncated)

Commits
  • ddb2335 v5.0.0
  • 9aac8c6 v5.0.0-beta.2
  • 1dfbc95 v5.0.0-beta.1
  • 65e81da v5.0.0-alpha.11
  • 74f3577 Merge pull request #3045 from mjmlio/bugfix/3018-mjml5-ignoreIncludes-allowIn...
  • b8e6a60 Merge pull request #3044 from mjmlio/bugfix/attributes-adding-updating-for-co...
  • 2eb56d7 feature(includes): implemented tighter controls
  • 591fd1e bugfix(ignoreIncludes): updated test files
  • 6b22a67 feature(ignoreIncludes): added option for includePath
  • 9b7991f bugfix(border-radius): accept string input
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 29, 2026
@mozilla-blender

mozilla-blender Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

Reviewing this major version bump. Workflow run

@mozilla-blender

mozilla-blender Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

NO_VERDICT: could not evaluate this major version bump — manual review needed.

@mozilla-blender

mozilla-blender Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

mjml@4.18.0 is installed and within the vulnerable range, and mjml IS used at runtime to render emails (src/emails/renderEmail.ts). However, the vulnerable mj-include directory-traversal path is not reachable: the code calls mjml2html with ignoreIncludes: true, which disables include resolution entirely; no mj-include directives exist anywhere in the repo; and the MJML input is server-rendered output of static, developer-authored React templates, not attacker-controlled content. The only other usage is dev-only (Storybook via mjml-browser) rendering the same trusted templates. Thus the vulnerability does not impact this repo's code in practice.

This PR can be reviewed and merged as a normal dependency update.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/mjml-5.0.0 branch 2 times, most recently from ffd4c11 to ba98bb5 Compare July 13, 2026 12:11
@dependabot
chore(deps): bump mjml from 4.18.0 to 5.0.0
4442244 
Bumps [mjml](https://github.com/mjmlio/mjml/tree/HEAD/packages/mjml) from 4.18.0 to 5.0.0.
- [Release notes](https://github.com/mjmlio/mjml/releases)
- [Commits](https://github.com/mjmlio/mjml/commits/v5.0.0/packages/mjml)

---
updated-dependencies:
- dependency-name: mjml
  dependency-version: 5.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/mjml-5.0.0 branch from ba98bb5 to 4442244 Compare July 13, 2026 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants