@react-email/ui ships vulnerable versions of Next.js, PostCSS and Sharp

[sss-Mihail-sss]

What versions are you using? (if relevant)

@react-email/ui@6.9.1, react-email@6.9.1

Describe the Bug

Running npm audit reports multiple high-severity vulnerabilities introduced by @react-email/ui.

The package currently installs vulnerable versions of:

• next
• postcss
• sharp

These advisories are reported even in a fresh installation and cannot be resolved because npm reports "No fix available" for the current dependency tree.

This causes CI pipelines using npm audit (or Dependabot/security policies) to fail.

What is affected (leave empty if unsure)

@react-email/components package

Link to the code that reproduces this issue

Fresh project created with:

npx create-email@latest
npm install
npm audit

No additional code is required to reproduce.

To Reproduce

1. Create a new project:

   npx create-email@latest

2. Install dependencies:

   npm install

3. Run:

   npm audit

4. Observe multiple high-severity vulnerabilities coming from:

   • next
   • postcss
   • sharp

The vulnerabilities originate from @react-email/ui.

Expected Behavior

Installing a fresh React Email project should not introduce known high-severity vulnerabilities through its direct dependencies.

If these dependencies are required, they should be updated to patched versions as soon as they become available, or replaced where possible.

What's your node version? (if relevant)

v24.16.0