Ralph Slooten
b99be839a0
Security: Enhance HTML sanitization in message view
2026-03-10 10:02:10 +13:00
Ralph Slooten
c1db706677
Update inline TLS verification docs for healthcheck and link checks
2026-03-09 12:44:39 +13:00
Ralph Slooten
ab3fc5ead7
Chore: Use local hostname for EHLO/HELO in SMTP communication
2026-03-09 12:38:34 +13:00
Ralph Slooten
a72d42c8d4
Chore: Set timeout for HTTP client in webhook Send function
2026-03-09 12:34:50 +13:00
Ralph Slooten
f8052e1d56
Security: Limit proxy requests to 50MB to prevent OOM attacks
2026-03-09 12:31:17 +13:00
Ralph Slooten
267bf8b639
Security: Enhance CORS origin handling to respect host:port distinctions
2026-03-09 12:30:56 +13:00
Ralph Slooten
51e327f259
Fix: Update SQL query to use tenant when using is:tagged filter
2026-03-09 11:37:40 +13:00
Ralph Slooten
bb6bdf629d
Chore: Refactor events websocket middleware
2026-03-09 11:20:45 +13:00
Ralph Slooten
a0a4ebb943
Chore: Refactor API send authentication logic
2026-03-09 11:08:19 +13:00
Ville Skyttä
ba00ea5a21
Chore: Switch to math/rand/v2
...
Insignificant as in tests only, but there's no particular reason not to.
2026-03-07 22:54:04 +13:00
Ville Skyttä
2afc52c6fe
Chore: Refactor code with go fix
...
Done with `go fix ./...` using go 1.26.0.
2026-03-03 16:03:28 +13:00
dependabot[bot]
5e9c522402
Chore: Bump minimatch from 10.2.2 to 10.2.4
...
Bumps [minimatch](https://github.com/isaacs/minimatch ) from 10.2.2 to 10.2.4.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md )
- [Commits](https://github.com/isaacs/minimatch/compare/v10.2.2...v10.2.4 )
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.2.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-02 22:46:16 +13:00
Ralph Slooten
7bb330a07a
Chore: Use last release + git hash in Docker edge versions
2026-03-02 22:38:38 +13:00
Ralph Slooten
ffb3067680
Merge tag 'v1.29.2' into develop
...
Release v1.29.2
2026-02-25 12:28:48 +13:00
Ralph Slooten
dc3e7e701f
Merge branch 'release/v1.29.2'
2026-02-25 12:28:45 +13:00
Ralph Slooten
f1d0bcda90
Release v1.29.2
2026-02-25 12:28:44 +13:00
Ralph Slooten
4f651e4f14
Chore: Update caniemail test database
2026-02-25 12:10:33 +13:00
Ralph Slooten
c3819ca26d
Chore: Update node dependencies
2026-02-25 12:09:34 +13:00
Ralph Slooten
4febeb1acd
Chore: Update Go dependencies
2026-02-25 12:07:32 +13:00
Ralph Slooten
10ad4df8cc
Security: Prevent Server-Side Request Forgery (SSRF) via Link Check API ([GHSA-mpf7-p9x7-96r3]( https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3 ))
...
By default all internal HTTP requests are now blocked, unless mailpit is started with the `--allow-internal-http-requests` flag (env `MP_ALLOW_INTERNAL_HTTP_REQUESTS=true`).
2026-02-24 14:22:02 +13:00
Ralph Slooten
632113fcc5
Fix: Include 8BITMIME in SMTPD EHLO response ( #648 )
2026-02-24 11:25:19 +13:00
Ralph Slooten
08ed46fc46
Use const instead of let
2026-02-21 22:43:51 +13:00
Ralph Slooten
6927c2b73b
Chore: Upgrade eslint JavaScript linting
2026-02-21 22:43:34 +13:00
Matthew Spahr
ac81da5ae0
Fix: Update install instructions when setting INSTALL_PATH
2026-02-17 20:51:14 +13:00
Ralph Slooten
f1d55e4e39
Release v1.29.1
2026-02-13 20:57:09 +13:00
Ralph Slooten
b622252411
Merge tag 'v1.29.1' into develop
...
Release v1.29.1
2026-02-13 20:47:03 +13:00
Ralph Slooten
5527379475
Merge branch 'release/v1.29.1'
2026-02-13 20:46:59 +13:00
Ralph Slooten
1d87f1164e
Chore: Update node dependencies
2026-02-13 20:44:34 +13:00
Ralph Slooten
b4ca68eb48
Chore: Update Go dependencies
2026-02-13 20:38:19 +13:00
dependabot[bot]
971ae95a67
Chore: Bump axios from 1.13.4 to 1.13.5
...
Bumps [axios](https://github.com/axios/axios ) from 1.13.4 to 1.13.5.
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.4...v1.13.5 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.13.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-13 18:27:21 +13:00
Ralph Slooten
c8caa29e24
Fix: Enable "Mark all read" button (Inbox) when new message is received
2026-02-09 15:38:11 +13:00
Ralph Slooten
7d314d2b50
Chore: Add CORS error logging and update error messages for failed CORS requests
2026-02-08 11:19:54 +13:00
Ralph Slooten
9d2f30787a
Fix spelling
2026-02-08 11:17:17 +13:00
Ralph Slooten
b9d071db81
Update contributing document
2026-02-05 17:05:12 +13:00
Ralph Slooten
a5ee550ba3
Rebuild changelog
2026-02-01 16:15:27 +13:00
Ralph Slooten
3e41beb214
Merge tag 'v1.29.0' into develop
...
Release v1.29.0
2026-02-01 16:12:05 +13:00
Ralph Slooten
43b8ba3dc6
Merge branch 'release/v1.29.0'
2026-02-01 16:12:00 +13:00
Ralph Slooten
d41eca3df7
Release v1.29.0
2026-02-01 16:11:59 +13:00
Ralph Slooten
e6fd638067
Detect if copy to clipboard is supported
2026-02-01 16:09:49 +13:00
Ralph Slooten
e2b1b2d0fe
Code cleanup
2026-02-01 15:58:31 +13:00
Ralph Slooten
9b4ec97483
Minor UI tweaks
2026-02-01 15:44:13 +13:00
Ralph Slooten
e735904167
Chore: Update node dependencies
2026-02-01 15:40:59 +13:00
Ralph Slooten
94113222cc
Chore: Update Go dependencies
2026-02-01 15:37:40 +13:00
Ralph Slooten
5414695508
Test: Add message summary attachment checksum tests
2026-02-01 15:34:06 +13:00
Ralph Slooten
dd74d46880
Feature: Option to display/hide attachment information in message view in web UI including checksums, content type & disposition
...
Resolves #625
2026-02-01 15:34:06 +13:00
Ralph Slooten
0bfbb4cc5f
Feature: Include message attachment checksums (MD5, SHA1 & SHA254) in API message summary
2026-02-01 15:34:05 +13:00
Ralph Slooten
38c0c4fd47
Update webhook delay flag description
2026-02-01 15:34:05 +13:00
Roman Urbanovich
9391b075d0
Chore: Add support for webhook delay ( #627 )
2026-02-01 15:33:54 +13:00
Ralph Slooten
a87b2a9455
Update API CORS flag description
2026-02-01 15:33:53 +13:00
Ralph Slooten
8d18618e4a
Test: Add CORS tests
2026-02-01 15:33:53 +13:00
