Skip to content

novu

v@novu/[email protected] Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Alerting & Incidents
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

agents communication email inbox infrastructure nodejs
+9 more
notification-center notifications novu push-notifications react reactjs sms transactional typescript

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release resolves high‑severity liquidjs and nodemailer vulnerabilities and introduces several breaking API changes.

Why it matters: High‑severity (severity 80) security fixes for root dependencies demand immediate patching; the ctx.update → replyHandle.edit breaking change requires code updates before upgrade.

Summary

AI summary

Updates 🚀 Features, 🩹 Fixes, and ctx.action.sourceMessageId across a mixed release.

Changes in this release

Security Critical

Resolve high liquidjs vulnerability

Resolve high liquidjs vulnerability

Source: llm_adapter@2026-06-10

Confidence: high

 —
Security High

Resolve high/moderate liquidjs and nodemailer vulnerabilities

Resolve high/moderate liquidjs and nodemailer vulnerabilities

Source: llm_adapter@2026-06-10

Confidence: high

 —
Security High

Resolve moderate lodash, ajv, and express vulnerabilities

Resolve moderate lodash, ajv, and express vulnerabilities

Source: llm_adapter@2026-06-10

Confidence: high

 —
Breaking High

Replace ctx.update with replyHandle.edit in api and framework

Replace ctx.update with replyHandle.edit in api and framework

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Add WhatsApp support for agent conversations in api, shared, and framework

Add WhatsApp support for agent conversations in api, shared, and framework

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Allow passing a custom logger to the client in framework

Allow passing a custom logger to the client in framework

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Expose email raw payload and resolved routing in agent context across api-service and framework

Expose email raw payload and resolved routing in agent context across api-service and framework

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Implement Slack quick‑setup endpoint and related UI components in api

Implement Slack quick‑setup endpoint and related UI components in api

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Properly parse signed bridge request timestamp to enable replay protection

Properly parse signed bridge request timestamp to enable replay protection

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Preserve JSON‑stringified control values containing quotes

Preserve JSON‑stringified control values containing quotes

Source: llm_adapter@2026-06-10

Confidence: high

 —
Full changelog

🚀 Features

  • framework: allow passing a custom logger to the client fixes NV-7963 (#11440)
  • api-service, framework: expose email raw payload and resolved routing in agent context (fixes NV-7951) (#11422)
  • api-service: agent card+files delivery and portless agent fixes fixes NV-7721 (#11186)
  • api-service, dashboard: new telegram provider agents (#11112)
  • shared: add ctx.metadata.delete(), clear(), get(), and current fixes NV-7501 (#10971)
  • framework: improve agent framework DX and starter template fixes NV-7451 (#11003)
  • api: implement Slack quick setup endpoint and related UI components (#10967)
  • js: add discriminated AgentContext types per handler fixes NV-7509 (#10974)
  • framework: expose sourceMessageId on action events (ctx.action.sourceMessageId) fixes NV-7500 (#10973)
  • framework: promise reply syntax — return value as reply fixes NV-7384 (#10887)
  • framework: add ctx.addReaction() to the agent SDK fixes NV-7411 (#10882)
  • api-service: implement ctx.trigger() workflow execution fixes NV-7388 (#10815)
  • api-service,dashboard,dal,shared: implement domain management (#10793)
  • dashboard,api: onboarding workflow suggestions fixes NV-7394 (#10805)
  • novu: print next-steps guide after init scaffolding (#10776)
  • api,framework: replace ctx.update with replyHandle.edit (#10773)
  • api,shared,framework: add WhatsApp support for agent conversations fixes NV-7374 (#10751)
  • dashboard,novu: pin CLI framework version and use rc tag for pre-release (#10747)
  • api-service: per-agent bridge URL with dev/production toggle fixes NV-7373 (#10740)
  • api-service,framework: agent onReaction event fixes NV-7370 (#10733)
  • api-service,framework: add rich content support and onAction handler for agent cards fixes NV-7363 (#10727)
  • framework: add agent support to @novu/framework SDK fixes NV-7358 (#10710)
  • api-service: integrate system environment variables fixes NV-7312 (#10521)
  • api-service,dashboard,novu,framework: extend step resolver support to delay, digest, and throttle step types fixes NV-7268 (#10507)
  • api-service: add env parameter to framework resources fixes NV-7281 (#10489)
  • api-service: implement environment variables management fixes NV-7234 (#10328)
  • framework: export param types fixes NV-7261 (#10407)
  • novu,framework: align step resolver handlers with framework steps fixes NV-7235 (#10286)
  • api-service,dashboard,novu: extend step resolver to all steps fixes NV-7187 (#10271)
  • api-service: implement HTTP destination step type fixes NV-7189 (#10183)
  • api-service,dashboard,framework: align step resolver scaffolding with framework fixes NV-7116 (#10136)
  • api-service: monthly usage digest email fixes NV-6933 (#10042)
  • api-service, worker, dashboard: custom sender name in email step on new dashboard fixes NV-6950 (#9962)

🩹 Fixes

  • api: bump chat SDK to 4.30.0 and enable WhatsApp typing fixes NV-7977 (#11473)
  • shared: Properly parse signed bridge request timestamp to enable replay protection fixes NV-7568 (#11120)
  • shared: preserve JSON-stringified control values containing quotes fixes NV-7638 (#11095)
  • framework: remove duplicate message from AgentMessageContext fixes NV-7544 (#11010)
  • api-service,dashboard,shared: support agent file delivery fixes NV-7457 (#10945)
  • framework: clean up AgentDeliveryError message to avoid logging raw response bodies (#10907)
  • root: resolve high liquidjs and moderate postcss vulnerabilities (#10874)
  • framework: unify text and markdown making markdown the default fixes NV-7392 (#10880)
  • api-service: surface provider delivery errors in agents flow fixes NV-7410 (#10877)
  • root: resolve high/moderate liquidjs and nodemailer vulnerabilities (#10625)
  • framework: Add error handling to mockSchema call (#10512)
  • application-generic,framework,dashboard: disable AJV strict mode for user schemas and remove noisy console.error (#10426)
  • root: resolve moderate lodash, ajv, and express vulnerabilities (#10360)
  • root: resolve high liquidjs vulnerability (#10263)
  • worker: Normalize malformed closing tags (#10251)

Security Fixes

  • Resolve high liquidjs vulnerabilities
  • Resolve moderate lodash, ajv, express vulnerabilities
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track novu

Get notified when new releases ship.

Sign up free

About novu

The open-source notification infrastructure. In-app Inbox component, E-mail, SMS, Push and Slack Integrations.

All releases →

Related context

Beta — feedback welcome: [email protected]