Releases 0.18.7 → 0.18.10 finally ship — CI was silently failing for 4 days on a deps audit
Awkward operational story worth being honest about: the four versions shipped today (0.18.7 Stripo native integration, 0.18.8 Braze fix, 0.18.9 Stripo audit/fix tools, 0.18.10 MCP server lifecycle fix) were all committed and pushed to GitHub, but none of them actually reached the .mcpb download because the CI build job had been failing since 27 April on a transitive-dependency audit gate. Discovered the failure when the website kept showing v0.18.5 despite 4 successful-looking pushes. 0.18.11 fixes the underlying CI break by bumping mjml to v5 (which removes the dead html-minifier dependency), and bundles every feature from those four prior versions into one deploy that actually lands.
What shipped
•CI's `npm audit --omit=dev --audit-level=high` was failing on 32 high + 1 critical vulnerabilities, all traceable to one dependency tree: html-minifier (unmaintained, REDoS regex DoS bug) → mjml-core → every mjml-* sub-package → mjml. The audit had been failing since the 28 April release was attempted.
•Fix: bumped mjml from ^4.18.0 to ^5.1.0 (which uses a different minifier and drops html-minifier entirely) plus npm audit fix for the lodash + protobufjs + ip-address vulns. Verified non-breaking: all 78 tests pass, including the full email-pipeline suite that uses mjml.
•All features from the four undeployed releases now ship in this build: the Stripo native API integration (orbit_setup_stripo / orbit_sync_stripo_modules / orbit_list_stripo_modules / orbit_document_stripo_design_system / orbit_compose_stripo_email), the orbit_audit_stripo_modules + orbit_fix_stripo_module pair for catching and correcting saved-module structural issues, the orbit_braze_performance fix for scheduled-blast canvases, and the MCP server lifecycle handlers that stop zombie processes accumulating after Claude Desktop quits.
•Lesson tucked away in our internal runbook: the website's LATEST_MCPB_VERSION constant auto-syncs from the live S3 manifest every 15 minutes, but if CI never uploads to S3 the website silently stays on the previous version. A 'CI passed but version sync didn't tick' alarm would have caught this on day one rather than day four. Future improvement.