chore(root): version packages

[resend-version-bump]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to canary, this PR will be updated.

Releases

@react-email/editor@1.4.8

Patch Changes

• f355fba: prevent prototype pollution in the email-theming plugin by building cssJS and merged theme objects from Object.create(null) so attacker-controlled __proto__, constructor, or prototype keys in panel-style input become regular own properties instead of mutating Object.prototype
  • react-email@6.3.3

@react-email/ui@6.3.3

Patch Changes

• 86745ec: reject paths that resolve outside the configured emails directory in renderEmailByPath and getEmailPathFromSlug to close a path-traversal vector in the preview server

react-email@6.3.3

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
react-email	Ready	Preview, Comment	May 25, 2026 12:45pm
react-email-demo	Ready	Preview, Comment	May 25, 2026 12:45pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mdast-util-to-string@​4.0.0
	glob@​7.2.3 ⏵ 13.0.6	-4			+35
	tsconfig-paths@​4.2.0

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@react-email/editor@3535

npm i https://pkg.pr.new/react-email@3535

npm i https://pkg.pr.new/@react-email/ui@3535

commit: 9b7825e