v1.10.0

This release is mostly security updates for everyone on the self-hosted image, plus a fix for self-hosted storage: the MinIO image our Docker Compose setup used no longer exists.

⚠️ Self-hosters: read before upgrading

If you use our Docker Compose file, download the new docker/prod/compose.yml. The minio/minio image it used has been removed from Docker Hub, and MinIO's community edition is no longer maintained or patched. The old compose file fails on any server that doesn't already have that image cached. Compose now runs RustFS instead (#484).

• Your existing .env keeps working. If RUSTFS_ACCESS_KEY / RUSTFS_SECRET_KEY aren't set, your MINIO_ROOT_USER / MINIO_ROOT_PASSWORD are used. We recommend setting the new names.
• Nothing is deleted. RustFS uses a new rustfs volume, and your old usesend-prod_storage volume is left alone. The old compose file never connected the app to MinIO, so for most installs it's empty. If you wired uploads to MinIO yourself, the self-hosting guide has a tested command to copy your files across.
• Image uploads in the email editor now work with Compose. They're optional. To turn them on, put a reverse proxy in front of the RustFS API (port 9002, bound to 127.0.0.1) and set S3_COMPATIBLE_API_URL and S3_COMPATIBLE_PUBLIC_URL. Uploaded objects are publicly readable so images load in inboxes. Nothing else in the bucket is public.

Other changes you might notice:

• Node 24. The image is now built on node:24-alpine3.24 (Node 24.22.1). The previous image shipped Node 22.16.0, which is affected by the October 2026 Node.js security release (#484).
• Failed migrations stop the container. If the database migration fails at startup, the container now exits instead of serving requests against an outdated schema (#462).
• Stricter from parsing. A from value with more than one address, group syntax, or more than one @ is now rejected with 400 From email is invalid (#477).
• Malformed API keys now get 403 instead of 500 (#468).

Security

• Next.js 15.5.18 → 15.5.28, including the October 14 security release (image optimizer RCE, Server Actions DoS). Auth.js: next-auth 4.24.15, @auth/core 0.41.3 (#465, #470).
• Node.js 24.22.1 in the Docker image (#484).
• Sender-domain check hardened. The domain check now reads from with the same parser that builds the message, so the address that's checked and the address that's sent can't differ (#477).
• nodemailer 8 → 10.2.1 and mailparser 3.12.4 in the app and the SMTP proxy (#470).
• hono 4.13 for the public API, React 19.1.10, turbo 2.11 (#484).
• Vitest 4, plus overrides for vulnerable transitive packages (#470). pnpm audit across the monorepo goes from 4 critical / 45 high to 0 critical / 2 high. The two left need major upgrades (zod 4, deepmerge-ts 8 inside Prisma).
• Unmaintained MinIO replaced by RustFS, with the storage ports bound to loopback (#461, #484).

Fixes

• The SMTP proxy is declared as its own workspace package, and frozen installs work on pnpm 9 (#450, #451).
• No error log for the expected "domain not found" case when creating or updating API keys (#484).
• The login email field no longer switches between uncontrolled and controlled (#484).

Python SDK

usesend 0.2.11 is on PyPI. It requires patched urllib3 (≥ 2.8.0) and certifi (≥ 2026.10.19) (#481).

Thanks

• @rubixvi did the MinIO → RustFS work and many of the dependency updates in #475, which landed as #484.
• @jiaweing contributed the Node base image, Next.js 15.5.28 and sharp changes from #474, which landed in #470, and reported the vulnerable self-hosted image in #473.

What's Changed

• fix: support pnpm 9 frozen installs by @KMKoushik in #450
• fix: declare SMTP workspace package by @KMKoushik in #451
• Set up Polylane by @polylane in #460
• fix(docker): stop the container when the startup migration fails by @polylane in #462
• fix: patch critical Next.js and Auth.js advisories by @KMKoushik in #465
• fix(api): reject malformed API keys with 403 instead of 500 by @polylane in #468
• fix(docker): require MinIO credentials and bind its ports to loopback by @polylane in #461
• fix(email): parse the from address with the same parser that builds the message by @KMKoushik in #477
• fix(deps): Next.js 15.5.28, Node 22.23 base image and high advisories within their majors by @KMKoushik in #470
• fix(python-sdk): release 0.2.11 with patched urllib3 and certifi by @KMKoushik in #481
• chore: drop the prescriptive repo rules for agents by @KMKoushik in #483
• fix(self-host): replace the unmaintained MinIO with RustFS, plus hono, React and Node 24 updates by @KMKoushik and @rubixvi in #484

Full Changelog: v1.9.8...v1.10.0