[github-actions]

Production release verified on 10 October 2026. PR #215 is merged, and https://cockpit.start-berlin.com/newsletter serves commit f9603cb. Production pipeline passed all 479 tests, migrations, deployment promotion, commit verification and Inngest synchronization. Direct test delivery and a real one-recipient broadcast from Production reached the approved QA mailbox in Gmail's inbox; SPF, DKIM and DMARC pass. The broadcast records one delivery and zero bounces. Production upload, autosave, scheduling, cancellation and preference links were rechecked. No future QA send remains.

Cockpit gains a newsletter app for Growth: authors can compose and preview issues, upload images to Vercel Blob, send direct test emails, select existing Resend segments, schedule or cancel broadcasts, and inspect delivery analytics. Department heads, co-leads, Legal Board positions and admins also have access; inactive accounts are excluded.

Writing assistance is removed completely, including its server action, OpenAI SDK and environment variables. The Images and Writing help settings cards are removed. The redundant status strip below Email preview is removed as well. Image upload remains supported. Test emails resolve first-name placeholders with or without a fallback.

The release also carries the separate Next.js security fix: Next 16.3.8, patched Sharp/libheif, consistent preview dependencies and React Email 6.9.2. Referrals, existing Cockpit schemas, membership rules and Inngest functions are unchanged. The newsletter only adds migrations 0059 and 0060; both were generated from the schema and applied by the Staging pipeline.

Validation:

• 479 tests pass. TypeScript and the local production build pass. Changed files pass Biome; the full repository has existing warnings without lint errors.
• Cockpit-Staging exercised autosave and reload, Blob upload and public CDN access, mobile mail preview, Markdown export, contact sync and segment membership, sandbox group import and an isolated real CSV import.
• Real direct test emails and a one-recipient broadcast reached the approved QA mailbox in Gmail's inbox. SPF, DKIM and DMARC pass. The broadcast is personalized, contains HTML and plain text, includes unsubscribe headers, and records one delivery with zero bounces.
• A real scheduled broadcast was canceled through Cockpit. Resend confirms no remaining schedule. Empty-segment preflight and unauthenticated upload/presence requests are rejected.
• The final plain first-name placeholder regression email also reached Gmail's inbox on Staging commit f1cf9f6, with no remaining placeholder, the uploaded image, and passing SPF/DKIM/DMARC. The final preview cleanup is deployed and browser-verified on Staging commit 0ac1480. Email preview now leads directly into the email frame without the redundant strip.

Final Staging pipeline: Run 38057133375. Build and all 479 tests, database migration step, domain commit verification and Inngest synchronization passed. The release branch has the identical file tree as Main commit 0ac1480. Production deployment and post-release checks are complete.

Deployment configuration is scoped to start-berlin/cockpit. Staging remains live. Production's newsletter mode is prepared as live with explicit operator approval; the authorized Production deployment is complete. Other preview branches remain sandbox. The existing Production workflow builds first, requires the Production gate for migrations, then publishes the new application.

The newsletter's default segment is still empty. Growth must choose the intended audience and preserve its consent before the first regular issue. Custom tracking DNS is incomplete; tested shared Resend tracking URLs work. The patched production dependency audit has no critical findings but retains existing moderate/high findings. The full audit additionally has two dev-tool critical findings outside this fix. Outlook rendering was not tested live.

Full review and migration hashes: Pre-release review. Additive tables can remain during an application rollback. Cancel any newly scheduled live broadcasts before rolling back.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: startberlin/cockpit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: c493281c-da7f-4e03-9fc9-0165e1633703

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.6 ⏵ 16.3.8	-2	+75	+1
	@​tiptap/​pm@​3.30.5
	@​tiptap/​extension-text-align@​3.30.5
	@​tiptap/​extension-highlight@​3.30.5
	@​tiptap/​starter-kit@​3.30.5
	@​tiptap/​extension-image@​3.30.5
	@​react-email/​ui@​6.1.4 ⏵ 6.9.2				+1
	@​tiptap/​extension-link@​3.30.5
	@​tiptap/​suggestion@​3.30.5
	@​tiptap/​extension-text-style@​3.30.5
	@​tiptap/​extensions@​3.30.5
	@​tiptap/​markdown@​3.30.5
	@​tiptap/​react@​3.30.5
	@​tiptap/​core@​3.30.5
	react-email@​6.1.4 ⏵ 6.9.2
	@​vercel/​blob@​2.8.0
	resend@​6.25.0

View full report