Version packages

[leoisadev1]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@opencoredev/email-sdk@0.6.2

Patch Changes

• 9c8ff24: Reject SMTP envelope addresses and header names that contain control characters, whitespace, or angle brackets before connecting. This closes an SMTP command/header injection vector where a crafted recipient address or header name could smuggle extra SMTP commands or headers into the session.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
email-sdk-fumadocs	Ready	Preview, Comment	Jun 23, 2026 2:49pm

[greptile-apps]

Greptile Summary

This is a Changesets release PR bumping @opencoredev/email-sdk from 0.6.1 → 0.6.2, shipping the SMTP command/header injection guard that was authored in a prior commit. It also archives the v0.6.1 documentation and resolves the previous convex-email private/publishConfig conflict.

• SMTP injection guard (smtp.ts): assertSmtpMessage now validates all envelope addresses against SMTP_FORBIDDEN_ENVELOPE (blocks control chars, whitespace, <>, non-ASCII) and all custom header names against SMTP_HEADER_NAME before any socket connection is made; foldHeader neutralises lone CR/LF in header values.
• convex-email/package.json: \"private\": true added and the conflicting publishConfig block removed, making the package's publish intent unambiguous.
• Docs versioning: A new docsV061 collection, source loader, version entry, and client loader are added — consistent with the existing versioned-docs pattern used by v0.6.0 and earlier.

Confidence Score: 5/5

Safe to merge — the injection guard is correctly implemented for all real attack vectors (CRLF, control chars, non-ASCII in envelope addresses), the docs wiring is consistent with existing patterns, and the convex-email packaging conflict is cleanly resolved.

The core security fix (assertSmtpMessage + foldHeader) correctly blocks every practical SMTP injection path. The only finding is that SMTP_HEADER_NAME permits angle brackets in header names despite the changeset claiming otherwise — a documentation/spec discrepancy that does not enable injection and only affects malformed-but-harmless header names.

packages/email-sdk/src/smtp.ts — the SMTP_HEADER_NAME regex warrants a second look if the intent is to strictly match the changeset's stated behaviour of rejecting angle brackets in header names.

Important Files Changed

Filename	Overview
packages/email-sdk/src/smtp.ts	Security guard added via assertSmtpMessage; envelope regex correctly blocks angle brackets/CRLF/non-ASCII, but header-name regex (SMTP_HEADER_NAME) still permits < and > contrary to the changeset description.
packages/email-sdk/package.json	Version bumped from 0.6.1 → 0.6.2 as part of the Changesets release; no other changes.
packages/email-sdk/CHANGELOG.md	0.6.2 entry added documenting the SMTP injection guard patch; content matches the changeset.
packages/convex-email/package.json	Adds "private": true and removes the conflicting publishConfig block, resolving the contradiction flagged in the previous review.
apps/fumadocs/src/lib/versions.ts	New v0.6.1 versioned-docs entry inserted at the correct position (above v0.6.0), current: false, consistent with existing archived-version entries.
apps/fumadocs/src/lib/source.ts	docsV061 loader added with the same guard (throws if config is missing) used by all other versioned sources.
apps/fumadocs/source.config.ts	docsV061 collection defined pointing at content/docs-v/0.6.1 with the same postprocess settings as docsV060.
apps/fumadocs/src/routes/docs/$.tsx	docsV061 client loader registered in clientLoaders, consistent with how all prior versioned collections are wired.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["smtp().send(message)"] --> B["assertSupportedMessageFields()"]
    B --> C["assertSmtpMessage(message)"]
    C --> D{"Envelope addresses\npass SMTP_FORBIDDEN_ENVELOPE?"}
    D -- "No (contains ctrl/space/<>/non-ASCII)" --> E["throw EmailValidationError"]
    D -- "Yes" --> F{"Custom header names\npass SMTP_HEADER_NAME?"}
    F -- "No (contains ctrl/space/colon)" --> E
    F -- "Yes — note: < and > pass this regex" --> G["SmtpClient.send()"]
    G --> H["connect() → EHLO → optional STARTTLS/AUTH"]
    H --> I["MAIL FROM / RCPT TO (validated envelope)"]
    I --> J["DATA: buildMimeMessage()\nfoldHeader() applied to all values"]
    J --> K["QUIT → return result"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["smtp().send(message)"] --> B["assertSupportedMessageFields()"]
    B --> C["assertSmtpMessage(message)"]
    C --> D{"Envelope addresses\npass SMTP_FORBIDDEN_ENVELOPE?"}
    D -- "No (contains ctrl/space/<>/non-ASCII)" --> E["throw EmailValidationError"]
    D -- "Yes" --> F{"Custom header names\npass SMTP_HEADER_NAME?"}
    F -- "No (contains ctrl/space/colon)" --> E
    F -- "Yes — note: < and > pass this regex" --> G["SmtpClient.send()"]
    G --> H["connect() → EHLO → optional STARTTLS/AUTH"]
    H --> I["MAIL FROM / RCPT TO (validated envelope)"]
    I --> J["DATA: buildMimeMessage()\nfoldHeader() applied to all values"]
    J --> K["QUIT → return result"]

Loading

_{Reviews (3): Last reviewed commit: "Prepare 0.6.2 release: archive v0.6.1 do..." | Re-trigger Greptile}