[jannikbln]

Adds newsletter authoring and Resend delivery to Cockpit. Active Growth members can compose issues, upload images to Blob, preview email, send tests and schedule broadcasts. Department heads and co-leads across every department, the Legal Board and Cockpit admins also have access. Pages and server actions use the same permission.

The newsletter adds four tables through generated migrations 0059 and 0060. Dispatch claims prevent duplicate sends and recover interrupted work before a durable provider reference exists. Existing Cockpit apps, transactional SES mail and Inngest functions retain their current implementation. Resend runs scheduled newsletter deliveries.

A separate security commit patches Next.js to 16.3.8, removes unused @vercel/og and aligns React Email/UI to the first compatible 6.9.2 release. The Next override also patches the installed development preview runtime. Normal image optimisation and OG rendering were checked alongside harmless SVG regression cases.

Validation completed on Node 22.23.3:

• 478 tests pass across 79 suites, with no skipped tests. TypeScript, production build and clean dependency installation pass. Full lint exits successfully with existing warnings in unchanged Cockpit code.
• Generated migrations were applied to an isolated local database; db:check and real PostgreSQL dispatch-claim checks pass.
• Ten HTTP controls and a rendered newsletter in React Email preview pass. Local real test and broadcast delivery were confirmed in the approved recipient's inbox with SPF, DKIM and DMARC passing.

The existing Main pipeline will deploy Preview, apply staging migrations, assign the staging domain and sync Inngest in that order. Staging browser and actual mail checks follow this merge; the Production release remains a separate PR.

The production dependency audit has zero critical findings, down from one, and 59 remaining findings. Two critical development-tool findings in concurrently/shell-quote remain outside the Framework fix. The unsupported standalone email build generator is not used by this repository or its pipeline; the documented email:dev workflow is verified.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: startberlin/cockpit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: a9d51e9f-4e0b-4a40-9819-b645422eef65

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.6 ⏵ 16.3.8	-2	+75	+1
	@​tiptap/​pm@​3.30.5
	@​tiptap/​extension-text-align@​3.30.5
	@​tiptap/​extension-highlight@​3.30.5
	@​tiptap/​starter-kit@​3.30.5
	openai@​7.8.0
	@​tiptap/​extension-image@​3.30.5
	@​react-email/​ui@​6.1.4 ⏵ 6.9.2				+1
	@​tiptap/​extension-link@​3.30.5
	@​tiptap/​suggestion@​3.30.5
	@​tiptap/​extension-text-style@​3.30.5
	@​tiptap/​extensions@​3.30.5
	@​tiptap/​markdown@​3.30.5
	@​tiptap/​react@​3.30.5
	@​tiptap/​core@​3.30.5
	react-email@​6.1.4 ⏵ 6.9.2
	@​vercel/​blob@​2.8.0
	resend@​6.25.0

View full report