Build(deps): Bump actions/cache from 5.0.5 to 6.1.0

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](27d5ce7f10...55cc834586)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/FUNDING.yml

@@ -1,3 +1,4 @@
 # These are supported funding model platforms
 
 github: [axllent]
+thanks_dev: u/gh/axllent

.github/SECURITY.md

@@ -2,10 +2,12 @@
 
 Your efforts to responsibly disclose your findings are appreciated.
 
-** **Please do _not_ report security vulnerabilities through public GitHub issues.** **
+**Please do not report security vulnerabilities through public GitHub issues.**
 
-If you believe you have found a **security vulnerability**, then please report it to security@axllent.org so 
-your findings can be investigated, and if confirmed, fixed and released in a timely manner.
+If you believe you have found a security vulnerability, you can report it using one of the following methods:
+
+1. **GitHub Security Advisory (Recommended):** Use the "Report a vulnerability" button in the [Security tab](../../security/advisories/new) of this repository.
+2. **Email:** Send your findings to security@axllent.org
 
 Your report should include:
 
@@ -14,6 +16,6 @@ Your report should include:
 - Reproduction steps (if applicable)
 - Any other details you think are likely to be important
 
-You should receive an initial acknowledgement within 24 hours in most cases, and will kept updated throughout the process. 
+You should receive an initial acknowledgement within 24 hours in most cases, and will be kept updated throughout the process.
 
 With your consent, your contributions will be publicly acknowledged.

.github/cliff.toml

@@ -28,6 +28,7 @@ trim = true
 # HTML comments added for grouping order, stripped on generation
 commit_parsers = [
   {body = ".*security", group = "<!-- 1 -->Security"},
+  {message = "(?i)^security", group = "<!-- 1 -->Security"},
   {message = "(?i)^feat", group = "<!-- 2 -->Feature"},
   {message = "(?i)^chore", group = "<!-- 3 -->Chore"},
   {message = "(?i)^libs", group = "<!-- 3 -->Chore"},

.github/dependabot.yml

@@ -8,16 +8,16 @@ updates:
   - package-ecosystem: "gomod"
     directory: "/" # Location of package manifests
     schedule:
-      interval: "monthly"
+      interval: "biannually"
   - package-ecosystem: "github-actions"
     directory: "/" # Location of package manifests
     schedule:
-      interval: "monthly"
+      interval: "biannually"
   - package-ecosystem: "docker"
     directory: "/" # Location of package manifests
     schedule:
-      interval: "monthly"
+      interval: "biannually"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "monthly"
+      interval: "biannually"

.github/workflows/build-docker-edge.yml

@@ -8,37 +8,57 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+          fetch-depth: 0 # required for github-action-get-previous-tag
+          persist-credentials: false
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
     - name: Log into Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
         password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
     - name: Log into GitHub Container Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         registry: ghcr.io
         username: ${{ github.repository_owner }}
         password: ${{ github.token }}
 
-    - uses: benjlevesque/short-sha@v3.0
+    - name: Get previous git tag
+      uses: WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de # v2.0.0
+      id: previous-tag
+
+    - name: Get short SHA
+      uses: benjlevesque/short-sha@dbe07338b37c456ce06d23409b35a56a7815eef4 # v4.0
       id: short-sha
 
+    - name: Calculate next patch version
+      id: next-version
+      run: |
+        TAG="${STEPS_PREVIOUS_TAG_OUTPUTS_TAG}"
+        VERSION="${TAG#v}"
+        BASE="${VERSION%.*}"
+        PATCH="${VERSION##*.}"
+        echo "version=v${BASE}.$((PATCH + 1))-${STEPS_SHORT_SHA_OUTPUTS_SHA}" >> "$GITHUB_OUTPUT"
+      env:
+        STEPS_PREVIOUS_TAG_OUTPUTS_TAG: ${{ steps.previous-tag.outputs.tag }}
+        STEPS_SHORT_SHA_OUTPUTS_SHA: ${{ steps.short-sha.outputs.sha }}
+
     - name: Build and push
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       with:
         context: .
         platforms: linux/386,linux/amd64,linux/arm64
         build-args: |
-          "VERSION=edge-${{ steps.short-sha.outputs.sha }}"
+          "VERSION=${{ steps.next-version.outputs.version }}"
         push: true
         tags: |
           axllent/mailpit:edge

.github/workflows/build-docker.yml

@@ -8,22 +8,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+        persist-credentials: false
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
     - name: Log into Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
         password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
     - name: Log into GitHub Container Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         registry: ghcr.io
         username: ${{ github.repository_owner }}
@@ -31,13 +33,13 @@ jobs:
 
     - name: Parse semver
       id: semver_parser 
-      uses: booxmedialtd/ws-action-parse-semver@v1.4.7
+      uses: booxmedialtd/ws-action-parse-semver@7784200024d6b3fc01253e617ec0168daf603de3 # v1.4.7
       with:
         input_string: '${{ github.ref_name }}'
         version_extractor_regex: 'v(.*)$'
 
     - name: Build and push
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       with:
         context: .
         platforms: linux/386,linux/amd64,linux/arm64

.github/workflows/build-release.yml

@@ -21,19 +21,20 @@ jobs:
           - goarch: arm
             goos: windows
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+        persist-credentials: false
 
     # build the assets
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: 22
-        cache: 'npm'
-    - run: echo "Building assets for ${{ github.ref_name }}"
-    - run: npm install
+    - run: echo "Building assets for ${GITHUB_REF_NAME}"
+    - run: npm ci
     - run: npm run package
 
     # build the binaries
-    - uses: wangyoucao577/go-release-action@v1
+    - uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.55
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         goos: ${{ matrix.goos }}

.github/workflows/close-stale-issues.yml

@@ -10,12 +10,13 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v9.1.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           days-before-issue-stale: 7
           days-before-issue-close: 3
           exempt-issue-labels: "enhancement,bug,awaiting feedback"
           stale-issue-label: "stale"
+          close-issue-reason: "completed"
           stale-issue-message: "This issue has been marked as stale because it has been open for 7 days with no activity."
           close-issue-message: "This issue was closed because there has been no activity since being marked as stale."
           days-before-pr-stale: -1

.github/workflows/codeql-analysis.yml

@@ -38,11 +38,13 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +58,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +71,4 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/tests-rqlite.yml

@@ -17,13 +17,15 @@ jobs:
           # the HTTP address the rqlite node should advertise
           HTTP_ADV_ADDR: "localhost:4001"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: 'stable'
           cache-dependency-path: "**/*.sum"
-      - run: go test -p 1 ./internal/storage ./server ./internal/smtpd ./internal/pop3 ./internal/tools ./internal/html2text ./internal/htmlcheck ./internal/linkcheck -v
+      - run: go test -p 1 ./internal/storage ./server ./internal/smtpd ./internal/pop3 ./internal/tools ./internal/html2text ./internal/htmlcheck ./internal/linkcheck ./internal/healthcheck -v
         env:
           # set Mailpit to use the rqlite service container
           MP_DATABASE: "http://localhost:4001"

.github/workflows/tests.yml

@@ -12,13 +12,15 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: ${{ matrix.go-version }}
         cache: false
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+        persist-credentials: false
     - name: Set up Go environment
-      uses: actions/cache@v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           ~/.cache/go-build
@@ -31,20 +33,19 @@ jobs:
       # https://olegk.dev/github-actions-and-go
       run: gofmt -s -w . && git diff --exit-code
     - name: Run Go tests
-      run: go test -p 1 ./internal/storage ./server ./internal/smtpd ./internal/pop3 ./internal/tools ./internal/html2text ./internal/htmlcheck ./internal/linkcheck -v
+      run: go test -p 1 ./internal/storage ./server ./internal/smtpd ./internal/pop3 ./internal/tools ./internal/html2text ./internal/htmlcheck ./internal/linkcheck ./internal/shortuuid ./internal/healthcheck -v
     - name: Run Go benchmarking
       run: go test -p 1 ./internal/storage ./internal/html2text -bench=.
     
     # build the assets
     - name: Set up node environment
       if: startsWith(matrix.os, 'ubuntu') == true
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: 22
-        cache: 'npm'
     - name: Install JavaScript dependencies
       if: startsWith(matrix.os, 'ubuntu') == true
-      run: npm install
+      run: npm ci
     - name: Run JavaScript linting
       if: startsWith(matrix.os, 'ubuntu') == true
       run: npm run lint
@@ -52,9 +53,10 @@ jobs:
       if: startsWith(matrix.os, 'ubuntu') == true
       run: npm run package
 
-    # validate the swagger file
-    - name: Validate OpenAPI definition
-      if: startsWith(matrix.os, 'ubuntu') == true
-      uses: swaggerexpert/swagger-editor-validate@v1
-      with:
-        definition-file: server/ui/api/v1/swagger.json
+    # # validate the swagger file
+    # - name: Validate OpenAPI definition
+    #   if: startsWith(matrix.os, 'ubuntu') == true
+    #   uses: swaggerexpert/swagger-editor-validate@v1
+    #   with:
+    #     definition-file: server/ui/api/v1/swagger.json
+    #     default-timeout: 20000

.vscode/settings.json

@@ -26,6 +26,7 @@
         "Mechs",
         "navhtml",
         "neostandard",
+        "nolint",
         "popperjs",
         "readyz",
         "RSET",

CHANGELOG.md

@@ -2,6 +2,441 @@
 
 Notable changes to Mailpit will be documented in this file.
 
+## [v1.30.3]
+
+### Feature
+- Add link check rate limiting and caching mechanism
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Correctly parse after/before datetimes with timestamp in search query ([#704](https://github.com/axllent/mailpit/issues/704))
+- Update Swagger response definitions for MessageHeadersResponse ([#703](https://github.com/axllent/mailpit/issues/703))
+- Refactor Web UI configuration definitions in Swagger documentation
+- Handle MaxBytesError in SendMessageHandler and return JSON error response
+
+
+## [v1.30.2]
+
+### Security
+- Fix incomplete SSRF protection in IsInternalIP() detection for IPv6 transition mechanisms (GHSA-w4mc-hhc6-xp28)
+
+### Feature
+- Add wait support to readyz ([#697](https://github.com/axllent/mailpit/issues/697))
+
+### Chore
+- Compress websocket messages once per broadcast to improve performance ([#695](https://github.com/axllent/mailpit/issues/695))
+- Toggle websocket compression using HTTP compression setting
+- Update Github Actions  dependencies
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Adjust header setting order in error response functions ([#699](https://github.com/axllent/mailpit/issues/699))
+
+### Test
+- Add readyz tests
+
+
+## [v1.30.1]
+
+### Security
+- Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r)
+- Pin Github Actions workflow versions using full commit SHA
+- Do not use npm cache to prevent cache poisoning
+- Disable GitHub Actions credential persistence for checkout steps
+
+### Chore
+- Enhance schema application logging ([#688](https://github.com/axllent/mailpit/issues/688))
+- Change log level to Info for database vacuuming message ([#688](https://github.com/axllent/mailpit/issues/688))
+- Update Github Action workflows
+- Update Go dependencies
+- Update node dependencies
+- Update caniemail test database
+
+
+## [v1.30.0]
+
+### Security
+- Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes (GHSA-fpxj-m5q8-fphw)
+- Include CGNAT (Carrier-Grade NAT) in internal IP checks (GHSA-j3fj-qppj-fmmc)
+- Block internal IP access by default in HTML check (GHSA-j3fj-qppj-fmmc)
+- Fix for path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs (GHSA-qx5x-85p8-vg4j)
+- Fix concurrent map read & write in proxy CSS rewriter (GHSA-w4vj-r5pg-3722)
+
+### Feature
+- New loading indicator, reduce flash during message transitions ([#682](https://github.com/axllent/mailpit/issues/682))
+
+### Chore
+- Remove gorilla/mux dependency and replace with stdlib routing
+- Remove logrus dependency and implement slog-based logging
+- Remove go-telnet dependency and implement TCP/Unix socket handling for SMTP
+- Replace lithammer/shortuuid with custom shortuuid implementation and update tests
+- Improve iframe height adjustment with optional chaining
+- Bump axios version to v1.16.0
+- Refactor Prometheus metrics implementation and remove unused dependencies
+- Refactor MarkRead and MarkUnread functions to only broadcast changes of modified messages
+- Optimize tag retrieval by batching message IDs in List and Search functions
+- Enhance SetMessageTags function to improve tag handling and batch deletions
+- Optimize MarkRead and MarkUnread functions to reduce database calls and improve performance
+- Refactor pruneMessages function to eliminate duplicate ID checks using a map
+- Refactor addMessageTag function to remove mutex and ensure safe concurrent inserts
+- Refactor Hub to use atomic clientCount for safe concurrent client tracking
+- Ensure websocket connection is closed on client unregistration
+- Simplify writePump by using WriteMessage and remove unnecessary newline handling
+- Add message dump max-message-size flag and refactor message handling
+- Add message ingest max-message-size flag and refactor message handling
+- Update Go dependencies
+- Update node dependencies
+- Update caniemail test database
+
+### Fix
+- Validate SMTP XCLIENT args before processing
+
+### Build
+- Update CI actions to use `npm ci`
+- Tag Docker edge build with next patch versions
+
+
+## [v1.29.7]
+
+### Chore
+- Bump vue-router from 4.6.4 to 5.0.4
+- Bump axios version to 1.15.0
+- Update Go dependencies
+- Update node dependencies
+
+
+## [v1.29.6]
+
+### Chore
+- Bump docker/login-action from 3 to 4 ([#670](https://github.com/axllent/mailpit/issues/670))
+- Bump actions/stale from 10.1.1 to 10.2.0 ([#669](https://github.com/axllent/mailpit/issues/669))
+- Bump docker/setup-buildx-action from 3 to 4 ([#668](https://github.com/axllent/mailpit/issues/668))
+- Bump docker/setup-qemu-action from 3 to 4 ([#666](https://github.com/axllent/mailpit/issues/666))
+- Bump docker/build-push-action from 6 to 7 ([#665](https://github.com/axllent/mailpit/issues/665))
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Version check logic in version command and self updater ([#673](https://github.com/axllent/mailpit/issues/673))
+
+
+## [v1.29.5]
+
+### Security
+- Add sandbox attribute to message iframe for extra later of security (already protected via CSP headers)
+
+### Feature
+- Add option to disable auto-VACUUMing of the SQLite database ([#661](https://github.com/axllent/mailpit/issues/661))
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+
+
+## [v1.29.4]
+
+### Feature
+- Add filter functionality to message headers tab
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Refactor webhook delay & rate limit logic to ignore endpoint response times & prevent hardcoded 1000 message limit when set to 0 ([#656](https://github.com/axllent/mailpit/issues/656))
+
+
+## [v1.29.3]
+
+### Security
+- Enhance CORS origin handling to respect host:port distinctions
+- Limit proxy requests to 50MB to prevent OOM attacks
+- Enhance HTML sanitization in message view
+- Enhance HTML sanitization in screenshot generation
+- Escape ContentID in HTML replacement to prevent regex injection
+
+### Chore
+- Use last release + git hash in Docker edge versions
+- Bump minimatch from 10.2.2 to 10.2.4
+- Refactor code with go fix
+- Switch to math/rand/v2
+- Refactor API send authentication logic
+- Refactor events websocket middleware
+- Set timeout for HTTP client in webhook Send function
+- Use local hostname for EHLO/HELO in SMTP communication
+- Simplify HTML decoding function in screenshot generation using DOMParser
+- Set margin & padding to HTML screenshot to prevent transparent top/left border
+- Replace localStorage retrieval with a dedicated function for default release addresses
+- Limit subject length to 100 characters in browser notifications
+- Improve transaction handling in pruneMessages and fix loop continuation in InitDB
+- Update Content-Disposition header to use inline display and escape filename
+- Refactor timezone handling in searchQueryBuilder
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Update SQL query to use tenant when using is:tagged filter
+
+
+## [v1.29.2]
+
+### Security
+- Prevent Server-Side Request Forgery (SSRF) via Link Check API ([GHSA-mpf7-p9x7-96r3](https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3))
+
+### Chore
+- Upgrade eslint JavaScript linting
+- Update Go dependencies
+- Update node dependencies
+- Update caniemail test database
+
+### Fix
+- Update install instructions when setting INSTALL_PATH
+- Include 8BITMIME in SMTPD EHLO response ([#648](https://github.com/axllent/mailpit/issues/648))
+
+
+## [v1.29.1]
+
+### Chore
+- Add CORS error logging and update error messages for failed CORS requests
+- Bump axios from 1.13.4 to 1.13.5
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Enable "Mark all read" button (Inbox) when new message is received
+
+
+## [v1.29.0]
+
+### Feature
+- Include message attachment checksums (MD5, SHA1 & SHA254) in API message summary
+- Option to display/hide attachment information in message view in web UI including checksums, content type & disposition
+
+### Chore
+- Add support for multi-origin CORS settings and apply to events websocket ([#630](https://github.com/axllent/mailpit/issues/630))
+- Add support for webhook delay ([#627](https://github.com/axllent/mailpit/issues/627))
+- Update Go dependencies
+- Update node dependencies
+
+### Test
+- Add CORS tests
+- Add message summary attachment checksum tests
+
+
+## [v1.28.4]
+
+### Chore
+- Increase allowed SMTP email address length to 1024 chars & return clearer SMTP responses for failures ([#620](https://github.com/axllent/mailpit/issues/620))
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Ensure SMTP HELO/EHLO command is issued before MAIL FROM as per RFC 5321 ([#621](https://github.com/axllent/mailpit/issues/621))
+- Prevent nested MAIL command during an active SMTP transaction ([#623](https://github.com/axllent/mailpit/issues/623))
+- Avoid error on image type assertion in thumbnail generation
+
+
+## [v1.28.3]
+
+### Security
+- Ensure SMTP TO & FROM addresses are RFC 5322 compliant and prevent header injection ([GHSA-54wq-72mp-cq7c](https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c))
+- Prevent Server-Side Request Forgery (SSRF) via HTML Check API ([GHSA-6jxm-fv7w-rw5j](https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j))
+
+### Chore
+- Fix formatting and update reporting instructions in SECURITY.md ([#614](https://github.com/axllent/mailpit/issues/614))
+- Allow `@` character in message tags & set max length to 100 characters per tag
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Correctly render default addresses in release modal after settings change ([#594](https://github.com/axllent/mailpit/issues/594))
+- Correctly detect macOS group in install.sh ([#619](https://github.com/axllent/mailpit/issues/619))
+- Auto-tagging using SMTP username using plain auth ([#617](https://github.com/axllent/mailpit/issues/617))
+- Validate maximum lengths of email addresses - RFC5321 (section 4.5.3.1)
+
+### Test
+- Update tag tests with length limits and `@` character
+- Add SMTP tests for address compliancy (RFC 5322) and header injection
+- Add maximum email length validation tests - RFC5321 (section 4.5.3.1)
+
+
+## [v1.28.2]
+
+### Security
+- Prevent Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data [CVE-2026-22689](https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm)
+
+### Feature
+- Allow default mail addresses to be set when releasing message ([#594](https://github.com/axllent/mailpit/issues/594))
+
+### Chore
+- Remove webkit warnings about missing template / render functions
+- Avoid empty URL query parameter when returning to inbox from message view
+
+
+## [v1.28.1]
+
+### Security
+- Restrict screenshot proxy to only support asset links contained in messages [CVE-2026-21859](https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr)
+
+### Chore
+- Bump actions/checkout from 5 to 6 ([#610](https://github.com/axllent/mailpit/issues/610))
+- Bump actions/cache from 4 to 5 ([#607](https://github.com/axllent/mailpit/issues/607))
+- Bump actions/stale from 10.0.0 to 10.1.1 ([#604](https://github.com/axllent/mailpit/issues/604))
+- Bump actions/setup-node from 5 to 6 ([#598](https://github.com/axllent/mailpit/issues/598))
+- Bump esbuild from 0.25.12 to 0.27.2 ([#611](https://github.com/axllent/mailpit/issues/611))
+- Update Go dependencies
+- Update node dependencies
+
+### Test
+- Add inline message tests
+- Increase swagger test timeout
+
+
+## [v1.28.0]
+
+### Feature
+- Optionally propagate SMTP errors ([#588](https://github.com/axllent/mailpit/issues/588))
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+- Update caniemail test database
+
+
+## [v1.27.11]
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+- Add type assertion for value in imaging assignment
+
+
+## [v1.27.10]
+
+### Security
+- Prevent potential information disclosure via indirect expvar library (Prometheus)
+
+### Chore
+- Add tooltip to messages nav dropdown
+- Update GitHub Actions
+- Add tooltip to messages nav dropdown
+- Update GitHub Actions
+- Update Go dependencies
+- Update node dependencies
+
+
+## [v1.27.9]
+
+### Chore
+- UI tweaks to pagination layout for clearer navigation ([#568](https://github.com/axllent/mailpit/issues/568))
+- Add margin to icons in release and delete buttons for consistent spacing
+- Update navbar theme to use data-bs-theme attribute for consistency
+- Update Go dependencies
+- Update node dependencies
+
+
+## [v1.27.8]
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+- Update caniemail test database
+
+
+## [v1.27.7]
+
+### Fix
+- Move HELO/EHLO hostname setting to the correct position in SMTP client creation ([#558](https://github.com/axllent/mailpit/issues/558))
+
+
+## [v1.27.6]
+
+### Feature
+- Add optional --no-release-check to version subcommand ([#557](https://github.com/axllent/mailpit/issues/557))
+
+### Chore
+- Set HELO/EHLO hostname when connecting to external SMTP server ([#556](https://github.com/axllent/mailpit/issues/556))
+- Update Go dependencies
+- Update node dependencies
+
+
+## [v1.27.5]
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+- Update caniemail test database
+
+### Fix
+- Support optional UIDL argument in POP3 server ([#552](https://github.com/axllent/mailpit/issues/552))
+
+
+## [v1.27.4]
+
+### Feature
+- Allow rejected SMTP recipients to be silently dropped ([#549](https://github.com/axllent/mailpit/issues/549))
+
+### Chore
+- Update Go dependencies
+- Update node dependencies
+- Update caniemail test database
+
+
+## [v1.27.3]
+
+### Fix
+- Fix sendmail when using an  `--smtp-addr <ip>:<port>` ([#542](https://github.com/axllent/mailpit/issues/542))
+
+
+## [v1.27.2]
+
+### Security
+- Prevent integer overflow conversion to uint64
+- Add ReadHeaderTimeout to Prometheus metrics server
+
+### Feature
+- Add ability to generate self-signed (snakeoil) certificates for UI, SMTP and POP3 ([#539](https://github.com/axllent/mailpit/issues/539))
+
+### Chore
+- Allow sendmail to send to untrusted TLS server
+- Update eslint config, remove neostandard
+- Refactor JS functions and remove unused parameters
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Use MaxMessages to determine pruning ([#536](https://github.com/axllent/mailpit/issues/536))
+- Support angle brackets for text/plain URLs with spaces ([#535](https://github.com/axllent/mailpit/issues/535))
+- Do not check latest release for Prometheus statistics ([#522](https://github.com/axllent/mailpit/issues/522))
+
+
+## [v1.27.1]
+
+### Chore
+- Allow unknown href link protocols in HTML view such as myapp:// ([#532](https://github.com/axllent/mailpit/issues/532))
+- Update Go dependencies
+- Update node dependencies
+
+
+## [v1.27.0]
+
+### Chore
+- Remove unused functionality/deadcode (golangci-lint)
+- Refactor error handling and resource management across multiple files (golangci-lint)
+- Refactor API Swagger definitions and remove unused structs
+- Bump minimum Go version to v1.24.3 for jhillyerd/enmime/v2
+- Switch version checks & self-updater to use ghru/v2
+- Update Go dependencies
+- Update node dependencies
+
+### Fix
+- Align websocket new message values with global Message Summary (no null values) ([#526](https://github.com/axllent/mailpit/issues/526))
+
+
 ## [v1.26.2]
 
 ### Feature
@@ -1607,6 +2042,9 @@ Notable changes to Mailpit will be documented in this file.
 
 ## [1.1.4]
 
+### Security
+- Add restrictive HTTP Content-Security-Policy
+
 ### Feature
 - Add --quiet flag to display only errors
 
@@ -1615,9 +2053,6 @@ Notable changes to Mailpit will be documented in this file.
 - Add favicon unread message counter
 - Minor UI color change & unread count position adjustment
 
-### Security
-- Add restrictive HTTP Content-Security-Policy
-
 
 ## [1.1.3]
 
@@ -1704,14 +2139,14 @@ Notable changes to Mailpit will be documented in this file.
 
 ## [0.1.2]
 
-### Feature
-- Optional browser notifications (HTTPS only)
-
 ### Security
 - Use strconv.Atoi() for safe string to int conversions
 - Sanitize mailbox names
 - Don't allow tar files containing a ".."
 
+### Feature
+- Optional browser notifications (HTTPS only)
+
 
 ## [0.1.1]
 

CONTRIBUTING.md

@@ -1,16 +1,10 @@
-# Contributing guide
-
-Thank you for your interest in contributing to Mailpit, your help is greatly appreciated! Please follow the guidelines below to ensure a smooth contribution process.
-
-
-## Code of conduct
-
-Please be respectful and considerate in all interactions. Mailpit is open source and free of charge, however is the result of thousands of hours of work.
+# Contributing to Mailpit
 
+Thank you for your interest in contributing to Mailpit! 
 
 ## Reporting issues and feature requests
 
-If you find a bug or have a feature request, please [open an issue](https://github.com/axllent/mailpit/issues) and provide as much detail as possible. Pleas do not report security issues here (see below).
+If you find a bug or have a feature request, please [open an issue](https://github.com/axllent/mailpit/issues) and provide as much detail as possible. Please **do not** report security issues here (see below).
 
 
 ## Reporting security issues
@@ -18,44 +12,11 @@ If you find a bug or have a feature request, please [open an issue](https://gith
 Please do not report security issues publicly in GitHub. Refer to [SECURITY document](https://github.com/axllent/mailpit/blob/develop/.github/SECURITY.md) for instructions and contact information.
 
 
+## Contributing code
 
-## How to contribute (pull request)
+Please ensure your code is clean and well-commented, and [passes linting](https://mailpit.axllent.org/docs/development/code-linting/) before submitting a Pull Request. Contributions should enhance the functionality or usability of Mailpit, focusing on quality over quantity.
 
-1. **Fork the repository**  
-   Click the "Fork" button at the top right of this repository to create your own copy.
+Note that while assistance from AI tools is perfectly acceptable, **"[vibe coded](https://en.wikipedia.org/wiki/Vibe_coding)" pull requests will most likely not be accepted.**
+We value the unique insights and creativity that individual contributors bring to the project.
 
-2. **Clone your fork**  
-   ```bash
-   git clone https://github.com/your-username/mailpit.git
-   cd mailpit
-   ```
-
-3. **Create a branch**  
-   Use a descriptive branch name:
-   ```bash
-   git checkout -b feature/your-feature-name
-   ```
-
-4. **Make your changes**  
-   Write clear, concise code and include comments where necessary.
-
-5. **Test your changes**  
-   Run all tests to ensure nothing is broken. This is a mandatory step as pull requests cannot be merged unless they pass the automated testing.
-
-6. **Ensure your changes pass linting**  
-   Ensure your changes pass the [code linting](https://mailpit.axllent.org/docs/development/code-linting/) requirements. This is a mandatory step as pull requests cannot be merged unless they pass the automated linting tests.
-
-7. **Commit and push**  
-   Write a clear commit message:
-   ```bash
-   git add .
-   git commit -m "Describe your changes"
-   git push origin feature/your-feature-name
-   ```
-
-8. **Open a pull request**  
-   Go to your fork on GitHub and open a pull request against the `develop` branch. Fill out the PR template and describe your changes.
-
----
-
-Thank you for helping make this project awesome!
+Thank you for your understanding and for contributing to Mailpit!

Dockerfile

@@ -7,7 +7,7 @@ COPY . /app
 WORKDIR /app
 
 RUN  apk upgrade && apk add git npm && \
-npm install && npm run package && \
+npm ci && npm run package && \
 CGO_ENABLED=0 go build -ldflags "-s -w -X github.com/axllent/mailpit/config.Version=${VERSION}" -o /mailpit
 
 FROM alpine:latest

README.md

@@ -4,7 +4,7 @@
 
 <div align="center">
     <a href="https://github.com/axllent/mailpit/actions/workflows/tests.yml"><img src="https://github.com/axllent/mailpit/actions/workflows/tests.yml/badge.svg" alt="CI Tests status"></a>
-    <a href="https://github.com/axllent/mailpit/actions/workflows/release-build.yml"><img src="https://github.com/axllent/mailpit/actions/workflows/release-build.yml/badge.svg" alt="CI build status"></a>
+    <a href="https://github.com/axllent/mailpit/actions/workflows/build-release.yml"><img src="https://github.com/axllent/mailpit/actions/workflows/build-release.yml/badge.svg" alt="CI build status"></a>
     <a href="https://github.com/axllent/mailpit/actions/workflows/build-docker.yml"><img src="https://github.com/axllent/mailpit/actions/workflows/build-docker.yml/badge.svg" alt="CI Docker build status"></a>
     <a href="https://github.com/axllent/mailpit/actions/workflows/codeql-analysis.yml"><img src="https://github.com/axllent/mailpit/actions/workflows/codeql-analysis.yml/badge.svg" alt="Code quality"></a>
     <a href="https://goreportcard.com/report/github.com/axllent/mailpit"><img src="https://goreportcard.com/badge/github.com/axllent/mailpit" alt="Go Report Card"></a>
@@ -47,8 +47,8 @@ including image thumbnails), including optional [HTTPS](https://mailpit.axllent.
 - [Message tagging](https://mailpit.axllent.org/docs/usage/tagging/) including manual tagging or automated tagging using filtering and "plus addressing"
 - [SMTP relaying](https://mailpit.axllent.org/docs/configuration/smtp-relay/) (message release) - relay messages via a different SMTP server including an optional allowlist of accepted recipients
 - [SMTP forwarding](https://mailpit.axllent.org/docs/configuration/smtp-forward/) - automatically forward messages via a different SMTP server to predefined email addresses
-- Fast message [storing & processing](https://mailpit.axllent.org/docs/configuration/email-storage/) - ingesting 100-200 emails per second over SMTP depending on CPU, network speed & email size,
-easily handling tens of thousands of emails, with automatic email pruning (by default keeping the most recent 500 emails)
+- Fast message [storing & processing](https://mailpit.axllent.org/docs/configuration/email-storage/) - ingesting 200-300 emails per second over SMTP depending on CPU, network speed & email size,
+easily handling tens of thousands of emails, with automatic email pruning by volume or message age (by default keeping the most recent 500 emails)
 - [Chaos](https://mailpit.axllent.org/docs/integration/chaos/) feature to enable configurable SMTP errors to test application resilience
 - `List-Unsubscribe` syntax validation
 - Optional [webhook](https://mailpit.axllent.org/docs/integration/webhook/) for received messages
@@ -79,7 +79,7 @@ sudo sh < <(curl -sL https://raw.githubusercontent.com/axllent/mailpit/develop/i
 You can also change the install path to something else by setting the `INSTALL_PATH` environment, for example:
 
 ```shell
-INSTALL_PATH=/usr/bin sudo sh < <(curl -sL https://raw.githubusercontent.com/axllent/mailpit/develop/install.sh)
+sudo INSTALL_PATH=/usr/bin sh < <(curl -sL https://raw.githubusercontent.com/axllent/mailpit/develop/install.sh)
 ```
 
 
@@ -115,3 +115,10 @@ Please refer to [the documentation](https://mailpit.axllent.org/docs/install/tes
 Mailpit's SMTP server (default on port 1025), so you will likely need to configure your sending application to deliver mail via that port. 
 A common MTA (Mail Transfer Agent) that delivers system emails to an SMTP server is `sendmail`, used by many applications, including PHP. 
 Mailpit can also act as substitute for sendmail. For instructions on how to set this up, please refer to the [sendmail documentation](https://mailpit.axllent.org/docs/install/sendmail/).
+
+---
+
+<p align="center">
+  For team features, multiple inboxes, and a hosted setup, try
+  <a href="https://mailtrap.io/?ref=mailpit">Mailtrap</a>, our friendly companion.
+</p>

cmd/dump.go

@@ -9,7 +9,7 @@ import (
 
 // dumpCmd represents the dump command
 var dumpCmd = &cobra.Command{
-	Use:   "dump <database> <output-dir>",
+	Use:   "dump <output-dir>",
 	Short: "Dump all messages from a database to a directory",
 	Long: `Dump all messages stored in Mailpit into a local directory as individual files.
 
@@ -17,7 +17,7 @@ The database can either be the database file (eg: --database /var/lib/mailpit/ma
 URL of a running Mailpit instance (eg: --http http://127.0.0.1/). If dumping over HTTP, the URL
 should be the base URL of your running Mailpit instance, not the link to the API itself.`,
 	Args: cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
+	Run: func(_ *cobra.Command, args []string) {
 		if err := dump.Sync(args[0]); err != nil {
 			logger.Log().Fatal(err)
 		}
@@ -30,7 +30,8 @@ func init() {
 	dumpCmd.Flags().SortFlags = false
 
 	dumpCmd.Flags().StringVar(&config.Database, "database", config.Database, "Dump messages directly from a database file")
-	dumpCmd.Flags().StringVar(&config.TenantID, "tenant-id", config.TenantID, "Database tenant ID to isolate data (optional)")
 	dumpCmd.Flags().StringVar(&dump.URL, "http", dump.URL, "Dump messages via HTTP API (base URL of running Mailpit instance)")
+	dumpCmd.Flags().IntVar(&config.MaxMessageSize, "max-message-size", config.MaxMessageSize, "Maximum message size in MB (0 = unlimited)")
+	dumpCmd.Flags().StringVar(&config.TenantID, "tenant-id", config.TenantID, "Database tenant ID to isolate data (optional)")
 	dumpCmd.Flags().BoolVarP(&logger.VerboseLogging, "verbose", "v", logger.VerboseLogging, "Verbose logging")
 }

cmd/ingest.go

@@ -7,9 +7,9 @@ import (
 	"net/mail"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
+	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
 	sendmail "github.com/axllent/mailpit/sendmail/cmd"
 	"github.com/spf13/cobra"
@@ -30,10 +30,11 @@ Mailpit server. Each email must be a separate file (eg: Maildir format, not mbox
 The --recent flag will only consider files with a modification date within the last X days.`,
 	// Hidden: true,
 	Args: cobra.MinimumNArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
+	Run: func(_ *cobra.Command, args []string) {
 		var count int
 		var total int
 		var per100start = time.Now()
+		limit := int64(config.MaxMessageSize) * 1024 * 1024
 
 		for _, a := range args {
 			err := filepath.Walk(a,
@@ -42,7 +43,7 @@ The --recent flag will only consider files with a modification date within the l
 						logger.Log().Error(err)
 						return nil
 					}
-					if !isFile(path) {
+					if !info.Mode().IsRegular() {
 						return nil
 					}
 
@@ -50,18 +51,31 @@ The --recent flag will only consider files with a modification date within the l
 						return nil
 					}
 
+					if config.MaxMessageSize > 0 && info.Size() > limit {
+						logger.Log().Warnf("%s exceeds %d MiB size cap, skipping", path, config.MaxMessageSize)
+						return nil
+					}
+
 					f, err := os.Open(filepath.Clean(path))
 					if err != nil {
 						logger.Log().Errorf("%s: %s", path, err.Error())
 						return nil
 					}
-					defer f.Close() // #nosec
+					defer func() { _ = f.Close() }()
 
-					body, err := io.ReadAll(f)
+					var reader io.Reader = f
+					if config.MaxMessageSize > 0 {
+						reader = io.LimitReader(f, limit+1)
+					}
+					body, err := io.ReadAll(reader)
 					if err != nil {
 						logger.Log().Errorf("%s: %s", path, err.Error())
 						return nil
 					}
+					if config.MaxMessageSize > 0 && int64(len(body)) > limit {
+						logger.Log().Warnf("%s exceeds %d MiB size cap, skipping", path, config.MaxMessageSize)
+						return nil
+					}
 
 					msg, err := mail.ReadMessage(bytes.NewReader(body))
 					if err != nil {
@@ -87,22 +101,33 @@ The --recent flag will only consider files with a modification date within the l
 						}
 					}
 
-					if sendmail.FromAddr == "" {
-						if fromAddresses, err := msg.Header.AddressList("From"); err == nil {
-							sendmail.FromAddr = fromAddresses[0].Address
-						}
+					// Parse the message's From: header once for this iteration.
+					// Do NOT mutate the package-level sendmail.FromAddr — that
+					// is the CLI default and would leak across messages.
+					var msgFrom string
+					if fromAddresses, err := msg.Header.AddressList("From"); err == nil && len(fromAddresses) > 0 {
+						msgFrom = fromAddresses[0].Address
 					}
 
 					if len(recipients) == 0 {
-						// Bcc
-						recipients = []string{sendmail.FromAddr}
+						// Bcc — fall back to the message's own From, or the
+						// CLI-configured default if the message has none.
+						fallback := msgFrom
+						if fallback == "" {
+							fallback = sendmail.FromAddr
+						}
+						recipients = []string{fallback}
 					}
 
-					returnPath := strings.Trim(msg.Header.Get("Return-Path"), "<>")
+					// Return-Path per RFC 5321 is "<addr>" (or "<>" for null).
+					// Use mail.ParseAddress so we only strip the wrapping
+					// angle brackets, not stray "<"/">" inside the value.
+					var returnPath string
+					if rp, err := mail.ParseAddress(msg.Header.Get("Return-Path")); err == nil {
+						returnPath = rp.Address
+					}
 					if returnPath == "" {
-						if fromAddresses, err := msg.Header.AddressList("From"); err == nil {
-							returnPath = fromAddresses[0].Address
-						}
+						returnPath = msgFrom
 					}
 
 					err = sendmail.Send(sendmail.SMTPAddr, returnPath, recipients, body)
@@ -134,16 +159,7 @@ func init() {
 
 	ingestCmd.Flags().StringVarP(&sendmail.SMTPAddr, "smtp-addr", "S", sendmail.SMTPAddr, "SMTP server address")
 	ingestCmd.Flags().IntVarP(&ingestRecent, "recent", "r", 0, "Only ingest messages from the last X days (default all)")
-}
-
-// IsFile returns if a path is a file
-func isFile(path string) bool {
-	info, err := os.Stat(path)
-	if os.IsNotExist(err) || !info.Mode().IsRegular() {
-		return false
-	}
-
-	return true
+	ingestCmd.Flags().IntVar(&config.MaxMessageSize, "max-message-size", config.MaxMessageSize, "Maximum message size in MB (0 = unlimited)")
 }
 
 // Format a an integer 10000 => 10,000

cmd/readyz.go

@@ -1,20 +1,19 @@
 package cmd
 
 import (
-	"crypto/tls"
 	"fmt"
-	"net/http"
 	"os"
-	"path"
-	"strings"
 	"time"
 
 	"github.com/axllent/mailpit/config"
+	"github.com/axllent/mailpit/internal/healthcheck"
 	"github.com/spf13/cobra"
 )
 
 var (
-	useHTTPS bool
+	useHTTPS      bool
+	readyzWait    bool
+	readyzTimeout time.Duration
 )
 
 // readyzCmd represents the healthcheck command
@@ -22,32 +21,25 @@ var readyzCmd = &cobra.Command{
 	Use:   "readyz",
 	Short: "Run a healthcheck to test if Mailpit is running",
 	Long: `This command connects to the /readyz endpoint of a running Mailpit server
-and exits with a status of 0 if the connection is successful, else with a 
+and exits with a status of 0 if the connection is successful, else with a
 status 1 if unhealthy.
 
 If running within Docker, it should automatically detect environment
 settings to determine the HTTP bind interface & port.
 `,
-	Run: func(cmd *cobra.Command, args []string) {
-		webroot := strings.TrimRight(path.Join("/", config.Webroot, "/"), "/") + "/"
-		proto := "http"
-		if useHTTPS {
-			proto = "https"
+	Run: func(_ *cobra.Command, _ []string) {
+		uri := healthcheck.URI(config.HTTPListen, config.Webroot, useHTTPS)
+		client := healthcheck.NewClient()
+
+		var err error
+		if readyzWait {
+			err = healthcheck.Wait(client, uri, readyzTimeout)
+		} else {
+			err = healthcheck.Check(client, uri)
 		}
 
-		uri := fmt.Sprintf("%s://%s%sreadyz", proto, config.HTTPListen, webroot)
-
-		conf := &http.Transport{
-			IdleConnTimeout:       time.Second * 5,
-			ExpectContinueTimeout: time.Second * 5,
-			TLSHandshakeTimeout:   time.Second * 5,
-			// do not verify TLS in case this instance is using HTTPS
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // #nosec
-		}
-		client := &http.Client{Transport: conf}
-
-		res, err := client.Get(uri)
-		if err != nil || res.StatusCode != 200 {
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
 			os.Exit(1)
 		}
 	},
@@ -73,4 +65,6 @@ func init() {
 	readyzCmd.Flags().StringVarP(&config.HTTPListen, "listen", "l", config.HTTPListen, "Set the HTTP bind interface & port")
 	readyzCmd.Flags().StringVar(&config.Webroot, "webroot", config.Webroot, "Set the webroot for web UI & API")
 	readyzCmd.Flags().BoolVar(&useHTTPS, "https", useHTTPS, "Connect via HTTPS (ignores HTTPS validation)")
+	readyzCmd.Flags().BoolVar(&readyzWait, "wait", readyzWait, "Wait until Mailpit is ready instead of checking once")
+	readyzCmd.Flags().DurationVar(&readyzTimeout, "timeout", 30*time.Second, "Maximum time to wait when --wait is set")
 }

cmd/reindex.go

@@ -18,7 +18,7 @@ var reindexCmd = &cobra.Command{
 If you have several thousand messages in your mailbox, then it is advised to shut down
 Mailpit while you reindex as this process will likely result in database locking issues.`,
 	Args: cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
+	Run: func(_ *cobra.Command, args []string) {
 		config.Database = args[0]
 		config.MaxMessages = 0
 

cmd/root.go

@@ -67,14 +67,6 @@ func Execute() {
 	}
 }
 
-// SendmailExecute adds all child commands to the root command and sets flags appropriately.
-// This is called by main.main(). It only needs to happen once to the rootCmd.
-func SendmailExecute() {
-	args := []string{"mailpit", "sendmail"}
-
-	rootCmd.Run(sendmailCmd, args)
-}
-
 func init() {
 	// hide autocompletion
 	rootCmd.CompletionOptions.HiddenDefaultCmd = true
@@ -94,11 +86,13 @@ func init() {
 	rootCmd.Flags().StringVarP(&config.Database, "database", "d", config.Database, "Database to store persistent data")
 	rootCmd.Flags().BoolVar(&config.DisableWAL, "disable-wal", config.DisableWAL, "Disable WAL for local database (allows NFS mounted DBs)")
 	rootCmd.Flags().BoolVar(&config.DisableVersionCheck, "disable-version-check", config.DisableVersionCheck, "Disable version update checking")
+	rootCmd.Flags().BoolVar(&config.DisableAutoVACUUM, "disable-auto-vacuum", config.DisableAutoVACUUM, "Disable auto-VACUUM for the database")
 	rootCmd.Flags().IntVar(&config.Compression, "compression", config.Compression, "Compression level to store raw messages (0-3)")
 	rootCmd.Flags().StringVar(&config.Label, "label", config.Label, "Optional label identify this Mailpit instance")
 	rootCmd.Flags().StringVar(&config.TenantID, "tenant-id", config.TenantID, "Database tenant ID to isolate data")
 	rootCmd.Flags().IntVarP(&config.MaxMessages, "max", "m", config.MaxMessages, "Max number of messages to store")
 	rootCmd.Flags().StringVar(&config.MaxAge, "max-age", config.MaxAge, "Max age of messages in either (h)ours or (d)ays (eg: 3d)")
+	rootCmd.Flags().IntVar(&config.MaxMessageSize, "max-message-size", config.MaxMessageSize, "Maximum message size in MB (0 = unlimited)")
 	rootCmd.Flags().BoolVar(&config.UseMessageDates, "use-message-dates", config.UseMessageDates, "Use message dates as the received dates")
 	rootCmd.Flags().BoolVar(&config.IgnoreDuplicateIDs, "ignore-duplicate-ids", config.IgnoreDuplicateIDs, "Ignore duplicate messages (by Message-ID)")
 	rootCmd.Flags().StringVar(&logger.LogFile, "log-file", logger.LogFile, "Log output to file instead of stdout")
@@ -111,8 +105,10 @@ func init() {
 	rootCmd.Flags().StringVar(&config.UIAuthFile, "ui-auth-file", config.UIAuthFile, "A password file for web UI & API authentication")
 	rootCmd.Flags().StringVar(&config.UITLSCert, "ui-tls-cert", config.UITLSCert, "TLS certificate for web UI (HTTPS) - requires ui-tls-key")
 	rootCmd.Flags().StringVar(&config.UITLSKey, "ui-tls-key", config.UITLSKey, "TLS key for web UI (HTTPS) - requires ui-tls-cert")
-	rootCmd.Flags().StringVar(&server.AccessControlAllowOrigin, "api-cors", server.AccessControlAllowOrigin, "Set API CORS Access-Control-Allow-Origin header")
+	rootCmd.Flags().StringVar(&server.AccessControlAllowOrigin, "api-cors", server.AccessControlAllowOrigin, "Set CORS origin(s) for the API, comma-separated (eg: example.com,foo.com)")
 	rootCmd.Flags().BoolVar(&config.BlockRemoteCSSAndFonts, "block-remote-css-and-fonts", config.BlockRemoteCSSAndFonts, "Block access to remote CSS & fonts")
+	rootCmd.Flags().BoolVar(&config.AllowInternalHTTPRequests, "allow-internal-http-requests", config.AllowInternalHTTPRequests, "Allow link checker, HTML checker & screenshots to access internal IP addresses")
+	rootCmd.Flags().BoolVar(&config.DisableLinkCheckRateLimit, "disable-link-check-rate-limit", config.DisableLinkCheckRateLimit, "Disable the per-domain rate limiter and result cache used by the link checker")
 	rootCmd.Flags().StringVar(&config.EnableSpamAssassin, "enable-spamassassin", config.EnableSpamAssassin, "Enable integration with SpamAssassin")
 	rootCmd.Flags().BoolVar(&config.AllowUntrustedTLS, "allow-untrusted-tls", config.AllowUntrustedTLS, "Do not verify HTTPS certificates (link checker & screenshots)")
 	rootCmd.Flags().BoolVar(&config.DisableHTTPCompression, "disable-http-compression", config.DisableHTTPCompression, "Disable HTTP compression support (web UI & API)")
@@ -134,6 +130,7 @@ func init() {
 	rootCmd.Flags().BoolVar(&config.SMTPStrictRFCHeaders, "smtp-strict-rfc-headers", config.SMTPStrictRFCHeaders, "Return SMTP error if message headers contain <CR><CR><LF>")
 	rootCmd.Flags().IntVar(&config.SMTPMaxRecipients, "smtp-max-recipients", config.SMTPMaxRecipients, "Maximum SMTP recipients allowed")
 	rootCmd.Flags().StringVar(&config.SMTPAllowedRecipients, "smtp-allowed-recipients", config.SMTPAllowedRecipients, "Only allow SMTP recipients matching a regular expression (default allow all)")
+	rootCmd.Flags().BoolVar(&config.SMTPIgnoreRejectedRecipients, "smtp-ignore-rejected-recipients", config.SMTPIgnoreRejectedRecipients, "Ignore rejected SMTP recipients with 2xx response")
 	rootCmd.Flags().BoolVar(&smtpd.DisableReverseDNS, "smtp-disable-rdns", smtpd.DisableReverseDNS, "Disable SMTP reverse DNS lookups")
 
 	// SMTP relay
@@ -167,6 +164,7 @@ func init() {
 	// Webhook
 	rootCmd.Flags().StringVar(&config.WebhookURL, "webhook-url", config.WebhookURL, "Send a webhook request for new messages")
 	rootCmd.Flags().IntVar(&webhook.RateLimit, "webhook-limit", webhook.RateLimit, "Limit webhook requests per second")
+	rootCmd.Flags().IntVar(&webhook.Delay, "webhook-delay", webhook.Delay, "Delay in seconds before sending webhook requests (default 0)")
 
 	// DEPRECATED FLAG 2024/04/12 - but will not be removed to maintain backwards compatibility
 	rootCmd.Flags().StringVar(&config.Database, "db-file", config.Database, "Database file to store persistent data")
@@ -207,6 +205,8 @@ func initConfigFromEnv() {
 
 	config.DisableVersionCheck = getEnabledFromEnv("MP_DISABLE_VERSION_CHECK")
 
+	config.DisableAutoVACUUM = getEnabledFromEnv("MP_DISABLE_AUTO_VACUUM")
+
 	if len(os.Getenv("MP_COMPRESSION")) > 0 {
 		config.Compression, _ = strconv.Atoi(os.Getenv("MP_COMPRESSION"))
 	}
@@ -221,6 +221,9 @@ func initConfigFromEnv() {
 	if len(os.Getenv("MP_MAX_AGE")) > 0 {
 		config.MaxAge = os.Getenv("MP_MAX_AGE")
 	}
+	if len(os.Getenv("MP_MAX_MESSAGE_SIZE")) > 0 {
+		config.MaxMessageSize, _ = strconv.Atoi(os.Getenv("MP_MAX_MESSAGE_SIZE"))
+	}
 	if getEnabledFromEnv("MP_USE_MESSAGE_DATES") {
 		config.UseMessageDates = true
 	}
@@ -256,6 +259,12 @@ func initConfigFromEnv() {
 	if getEnabledFromEnv("MP_BLOCK_REMOTE_CSS_AND_FONTS") {
 		config.BlockRemoteCSSAndFonts = true
 	}
+	if getEnabledFromEnv("MP_ALLOW_INTERNAL_HTTP_REQUESTS") {
+		config.AllowInternalHTTPRequests = true
+	}
+	if getEnabledFromEnv("MP_DISABLE_LINK_CHECK_RATE_LIMIT") {
+		config.DisableLinkCheckRateLimit = true
+	}
 	if len(os.Getenv("MP_ENABLE_SPAMASSASSIN")) > 0 {
 		config.EnableSpamAssassin = os.Getenv("MP_ENABLE_SPAMASSASSIN")
 	}
@@ -309,6 +318,9 @@ func initConfigFromEnv() {
 	if len(os.Getenv("MP_SMTP_ALLOWED_RECIPIENTS")) > 0 {
 		config.SMTPAllowedRecipients = os.Getenv("MP_SMTP_ALLOWED_RECIPIENTS")
 	}
+	if getEnabledFromEnv("MP_SMTP_IGNORE_REJECTED_RECIPIENTS") {
+		config.SMTPIgnoreRejectedRecipients = true
+	}
 	if getEnabledFromEnv("MP_SMTP_DISABLE_RDNS") {
 		smtpd.DisableReverseDNS = true
 	}
@@ -336,6 +348,7 @@ func initConfigFromEnv() {
 	config.SMTPRelayConfig.AllowedRecipients = os.Getenv("MP_SMTP_RELAY_ALLOWED_RECIPIENTS")
 	config.SMTPRelayConfig.BlockedRecipients = os.Getenv("MP_SMTP_RELAY_BLOCKED_RECIPIENTS")
 	config.SMTPRelayConfig.PreserveMessageIDs = getEnabledFromEnv("MP_SMTP_RELAY_PRESERVE_MESSAGE_IDS")
+	config.SMTPRelayConfig.ForwardSMTPErrors = getEnabledFromEnv("MP_SMTP_RELAY_FWD_SMTP_ERRORS")
 
 	// SMTP forwarding
 	config.SMTPForwardConfigFile = os.Getenv("MP_SMTP_FORWARD_CONFIG")
@@ -354,6 +367,7 @@ func initConfigFromEnv() {
 	config.SMTPForwardConfig.ReturnPath = os.Getenv("MP_SMTP_FORWARD_RETURN_PATH")
 	config.SMTPForwardConfig.OverrideFrom = os.Getenv("MP_SMTP_FORWARD_OVERRIDE_FROM")
 	config.SMTPForwardConfig.To = os.Getenv("MP_SMTP_FORWARD_TO")
+	config.SMTPForwardConfig.ForwardSMTPErrors = getEnabledFromEnv("MP_SMTP_FORWARD_FWD_SMTP_ERRORS")
 
 	// Chaos
 	chaos.Enabled = getEnabledFromEnv("MP_ENABLE_CHAOS")
@@ -389,6 +403,9 @@ func initConfigFromEnv() {
 	if len(os.Getenv("MP_WEBHOOK_LIMIT")) > 0 {
 		webhook.RateLimit, _ = strconv.Atoi(os.Getenv("MP_WEBHOOK_LIMIT"))
 	}
+	if len(os.Getenv("MP_WEBHOOK_DELAY")) > 0 {
+		webhook.Delay, _ = strconv.Atoi(os.Getenv("MP_WEBHOOK_DELAY"))
+	}
 
 	// Demo mode
 	config.DemoMode = getEnabledFromEnv("MP_DEMO_MODE")

cmd/version.go

@@ -6,7 +6,6 @@ import (
 	"runtime"
 
 	"github.com/axllent/mailpit/config"
-	"github.com/axllent/mailpit/internal/updater"
 	"github.com/spf13/cobra"
 )
 
@@ -15,29 +14,44 @@ var versionCmd = &cobra.Command{
 	Use:   "version",
 	Short: "Display the current version & update information",
 	Long:  `Display the current version & update information (if available).`,
-	RunE: func(cmd *cobra.Command, args []string) error {
-
-		updater.AllowPrereleases = true
-
+	Run: func(cmd *cobra.Command, _ []string) {
 		update, _ := cmd.Flags().GetBool("update")
+		noReleaseCheck, _ := cmd.Flags().GetBool("no-release-check")
 
 		if update {
-			return updateApp()
+			// Update the application
+			rel, err := config.GHRUConfig.SelfUpdate()
+			if err != nil {
+				fmt.Printf("Error updating: %s\n", err)
+				os.Exit(1)
+			}
+
+			fmt.Printf("Updated %s to version %s\n", os.Args[0], rel.Tag)
+			os.Exit(0)
 		}
 
 		fmt.Printf("%s %s compiled with %s on %s/%s\n",
 			os.Args[0], config.Version, runtime.Version(), runtime.GOOS, runtime.GOARCH)
 
-		latest, _, _, err := updater.GithubLatest(config.Repo, config.RepoBinaryName)
-		if err == nil && updater.GreaterThan(latest, config.Version) {
+		if !noReleaseCheck {
+			release, err := config.GHRUConfig.Latest()
+			if err != nil {
+				fmt.Printf("Error checking for latest release: %s\n", err)
+				os.Exit(1)
+			}
+
+			// The latest version is not a newer version
+			if !release.IsNewerThan(config.Version) {
+				os.Exit(0)
+			}
+
+			// A newer release is available
 			fmt.Printf(
 				"\nUpdate available: %s\nRun `%s version -u` to update (requires read/write access to install directory).\n",
-				latest,
+				release.Tag,
 				os.Args[0],
 			)
 		}
-
-		return nil
 	},
 }
 
@@ -46,14 +60,6 @@ func init() {
 
 	versionCmd.Flags().
 		BoolP("update", "u", false, "update to latest version")
-}
-
-func updateApp() error {
-	rel, err := updater.GithubUpdate(config.Repo, config.RepoBinaryName, config.Version)
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("Updated %s to version %s\n", os.Args[0], rel)
-	return nil
+	versionCmd.Flags().
+		Bool("no-release-check", false, "do not check online for the latest release version")
 }

config/config.go

@@ -11,14 +11,28 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/axllent/ghru/v2"
 	"github.com/axllent/mailpit/internal/auth"
 	"github.com/axllent/mailpit/internal/logger"
 	"github.com/axllent/mailpit/internal/smtpd/chaos"
+	"github.com/axllent/mailpit/internal/snakeoil"
 	"github.com/axllent/mailpit/internal/spamassassin"
 	"github.com/axllent/mailpit/internal/tools"
 )
 
 var (
+	// Version is the Mailpit version, updated with every release
+	Version = "dev"
+
+	// GHRUConfig is the configuration for the GitHub Release Updater
+	// used to check for updates and self-update
+	GHRUConfig = ghru.Config{
+		Repo:           "axllent/mailpit",
+		ArchiveName:    "mailpit-{{.OS}}-{{.Arch}}",
+		BinaryName:     "mailpit",
+		CurrentVersion: Version,
+	}
+
 	// SMTPListen to listen on <interface>:<port>
 	SMTPListen = "[::]:1025"
 
@@ -32,6 +46,10 @@ var (
 	// @see https://sqlite.org/wal.html
 	DisableWAL bool
 
+	// DisableAutoVACUUM will disable the auto-VACUUM of the local SQLite database when messages
+	// are deleted and a preconfigured threshold is reached.
+	DisableAutoVACUUM bool
+
 	// Compression is the compression level used to store raw messages in the database:
 	// 0 = off, 1 = fastest (default), 2 = standard, 3 = best compression
 	Compression = 1
@@ -107,17 +125,31 @@ var (
 	// however some servers accept more.
 	SMTPMaxRecipients = 100
 
+	// MaxMessageSize is the maximum size of an inbound message, in megabytes (MiB).
+	// Applies to both SMTP DATA payloads and the HTTP /api/v1/send body.
+	// 0 disables the limit (not recommended on network-reachable listeners).
+	MaxMessageSize = 50
+
 	// IgnoreDuplicateIDs will skip messages with the same ID
 	IgnoreDuplicateIDs bool
 
 	// BlockRemoteCSSAndFonts used to disable remote CSS & fonts
 	BlockRemoteCSSAndFonts = false
 
+	// AllowInternalHTTPRequests will allow HTTP requests to internal IP addresses (e.g., loopback, private, link-local, or multicast) when set to true.
+	// This policy applies to both link checking and screenshot generation (proxy) features and is disabled by default for security reasons.
+	AllowInternalHTTPRequests = false
+
+	// DisableLinkCheckRateLimit disables the per-domain rate limiter, concurrency
+	// cap, and result cache used by the link checker. Off by default; set when
+	// running in a trusted environment where the limiter's pacing is unwanted.
+	DisableLinkCheckRateLimit = false
+
 	// CLITagsArg is used to map the CLI args
 	CLITagsArg string
 
 	// ValidTagRegexp represents a valid tag
-	ValidTagRegexp = regexp.MustCompile(`^([a-zA-Z0-9\-\ \_\.]){1,}$`)
+	ValidTagRegexp = regexp.MustCompile(`^([a-zA-Z0-9\-\ \_\.@]){1,100}$`)
 
 	// TagsConfig is a yaml file to pre-load tags
 	TagsConfig string
@@ -167,6 +199,9 @@ var (
 	// SMTPAllowedRecipientsRegexp is the compiled version of SMTPAllowedRecipients
 	SMTPAllowedRecipientsRegexp *regexp.Regexp
 
+	// SMTPIgnoreRejectedRecipients if true, will accept emails to rejected recipients with 2xx response but silently drop them
+	SMTPIgnoreRejectedRecipients bool
+
 	// POP3Listen address - if set then Mailpit will start the POP3 server and listen on this address
 	POP3Listen = "[::]:1110"
 
@@ -198,15 +233,6 @@ var (
 	// Empty = disabled, true= use existing web server, address = separate server
 	PrometheusListen string
 
-	// Version is the default application version, updated on release
-	Version = "dev"
-
-	// Repo on Github for updater
-	Repo = "axllent/mailpit"
-
-	// RepoBinaryName on Github for updater
-	RepoBinaryName = "mailpit"
-
 	// ChaosTriggers are parsed and set in the chaos module
 	ChaosTriggers string
 
@@ -244,6 +270,7 @@ type SMTPRelayConfigStruct struct {
 	BlockedRecipients       string         `yaml:"blocked-recipients"` // regex, if set prevents relating to these addresses
 	BlockedRecipientsRegexp *regexp.Regexp // compiled regexp using BlockedRecipients
 	PreserveMessageIDs      bool           `yaml:"preserve-message-ids"` // preserve the original Message-ID when relaying
+	ForwardSMTPErrors       bool           `yaml:"forward-smtp-errors"`  // whether to log smtp-errors or forward them to upstream-client
 
 	// DEPRECATED 2024/03/12
 	RecipientAllowlist string `yaml:"recipient-allowlist"`
@@ -251,18 +278,19 @@ type SMTPRelayConfigStruct struct {
 
 // SMTPForwardConfigStruct struct for parsing yaml & storing variables
 type SMTPForwardConfigStruct struct {
-	To            string `yaml:"to"`             // comma-separated list of email addresses
-	Host          string `yaml:"host"`           // SMTP host
-	Port          int    `yaml:"port"`           // SMTP port
-	STARTTLS      bool   `yaml:"starttls"`       // whether to use STARTTLS
-	TLS           bool   `yaml:"tls"`            // whether to use TLS
-	AllowInsecure bool   `yaml:"allow-insecure"` // allow insecure authentication, ignore TLS validation
-	Auth          string `yaml:"auth"`           // none, plain, login, cram-md5
-	Username      string `yaml:"username"`       // plain & cram-md5
-	Password      string `yaml:"password"`       // plain
-	Secret        string `yaml:"secret"`         // cram-md5
-	ReturnPath    string `yaml:"return-path"`    // allow overriding the bounce address
-	OverrideFrom  string `yaml:"override-from"`  // allow overriding of the from address
+	To                string `yaml:"to"`                  // comma-separated list of email addresses
+	Host              string `yaml:"host"`                // SMTP host
+	Port              int    `yaml:"port"`                // SMTP port
+	STARTTLS          bool   `yaml:"starttls"`            // whether to use STARTTLS
+	TLS               bool   `yaml:"tls"`                 // whether to use TLS
+	AllowInsecure     bool   `yaml:"allow-insecure"`      // allow insecure authentication, ignore TLS validation
+	Auth              string `yaml:"auth"`                // none, plain, login, cram-md5
+	Username          string `yaml:"username"`            // plain & cram-md5
+	Password          string `yaml:"password"`            // plain
+	Secret            string `yaml:"secret"`              // cram-md5
+	ReturnPath        string `yaml:"return-path"`         // allow overriding the bounce address
+	OverrideFrom      string `yaml:"override-from"`       // allow overriding of the from address
+	ForwardSMTPErrors bool   `yaml:"forward-smtp-errors"` // whether to log smtp-errors or forward them to upstream-client
 }
 
 // VerifyConfig wil do some basic checking
@@ -275,7 +303,8 @@ func VerifyConfig() error {
 	// The default Content Security Policy is updates on every application page load to replace script-src 'self'
 	// with a random nonce ID to prevent XSS. This applies to the Mailpit app & API.
 	// See server.middleWareFunc()
-	ContentSecurityPolicy = fmt.Sprintf("default-src 'self'; script-src 'self'; style-src %s 'unsafe-inline'; frame-src 'self'; img-src * data: blob:; font-src %s data:; media-src 'self'; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'self';",
+	ContentSecurityPolicy = fmt.Sprintf(
+		"default-src 'self'; script-src 'self'; style-src %s 'unsafe-inline'; frame-src 'self'; img-src * data: blob:; font-src %s data:; media-src 'self'; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'self';",
 		cssFontRestriction, cssFontRestriction,
 	)
 
@@ -306,6 +335,10 @@ func VerifyConfig() error {
 		return errors.New("[ui] HTTP bind should be in the format of <ip>:<port>")
 	}
 
+	if MaxMessageSize == 0 {
+		logger.Log().Warnf("[smtpd] no message limit set, this is not recommended for network-reachable listeners")
+	}
+
 	// Web UI & API
 	if UIAuthFile != "" {
 		UIAuthFile = filepath.Clean(UIAuthFile)
@@ -329,8 +362,19 @@ func VerifyConfig() error {
 	}
 
 	if UITLSCert != "" {
-		UITLSCert = filepath.Clean(UITLSCert)
-		UITLSKey = filepath.Clean(UITLSKey)
+		if strings.HasPrefix(UITLSCert, "sans:") {
+			// generate a self-signed certificate
+			UITLSCert = snakeoil.Public(UITLSCert)
+		} else {
+			UITLSCert = filepath.Clean(UITLSCert)
+		}
+
+		if strings.HasPrefix(UITLSKey, "sans:") {
+			// generate a self-signed key
+			UITLSKey = snakeoil.Private(UITLSKey)
+		} else {
+			UITLSKey = filepath.Clean(UITLSKey)
+		}
 
 		if !isFile(UITLSCert) {
 			return fmt.Errorf("[ui] TLS certificate not found or readable: %s", UITLSCert)
@@ -389,8 +433,19 @@ func VerifyConfig() error {
 	}
 
 	if SMTPTLSCert != "" {
-		SMTPTLSCert = filepath.Clean(SMTPTLSCert)
-		SMTPTLSKey = filepath.Clean(SMTPTLSKey)
+		if strings.HasPrefix(SMTPTLSCert, "sans:") {
+			// generate a self-signed certificate
+			SMTPTLSCert = snakeoil.Public(SMTPTLSCert)
+		} else {
+			SMTPTLSCert = filepath.Clean(SMTPTLSCert)
+		}
+
+		if strings.HasPrefix(SMTPTLSKey, "sans:") {
+			// generate a self-signed key
+			SMTPTLSKey = snakeoil.Private(SMTPTLSKey)
+		} else {
+			SMTPTLSKey = filepath.Clean(SMTPTLSKey)
+		}
 
 		if !isFile(SMTPTLSCert) {
 			return fmt.Errorf("[smtp] TLS certificate not found or readable: %s", SMTPTLSCert)
@@ -458,8 +513,18 @@ func VerifyConfig() error {
 
 	// POP3 server
 	if POP3TLSCert != "" {
-		POP3TLSCert = filepath.Clean(POP3TLSCert)
-		POP3TLSKey = filepath.Clean(POP3TLSKey)
+		if strings.HasPrefix(POP3TLSCert, "sans:") {
+			// generate a self-signed certificate
+			POP3TLSCert = snakeoil.Public(POP3TLSCert)
+		} else {
+			POP3TLSCert = filepath.Clean(POP3TLSCert)
+		}
+		if strings.HasPrefix(POP3TLSKey, "sans:") {
+			// generate a self-signed key
+			POP3TLSKey = snakeoil.Private(POP3TLSKey)
+		} else {
+			POP3TLSKey = filepath.Clean(POP3TLSKey)
+		}
 
 		if !isFile(POP3TLSCert) {
 			return fmt.Errorf("[pop3] TLS certificate not found or readable: %s", POP3TLSCert)
@@ -544,6 +609,14 @@ func VerifyConfig() error {
 		logger.Log().Infof("[smtp] only allowing recipients matching regexp: %s", SMTPAllowedRecipients)
 	}
 
+	if SMTPIgnoreRejectedRecipients {
+		if SMTPAllowedRecipientsRegexp == nil {
+			logger.Log().Warn("[smtp] ignoring rejected recipients has no effect without setting smtp-allowed-recipients")
+		} else {
+			logger.Log().Info("[smtp] ignoring rejected recipients")
+		}
+	}
+
 	if err := parseRelayConfig(SMTPRelayConfigFile); err != nil {
 		return err
 	}
@@ -567,8 +640,10 @@ func VerifyConfig() error {
 			}
 
 			SMTPRelayMatchingRegexp = re
-			logger.Log().Infof("[relay] auto-relaying new messages to recipients matching \"%s\" via %s:%d",
-				SMTPRelayMatching, SMTPRelayConfig.Host, SMTPRelayConfig.Port)
+			logger.Log().Infof(
+				"[relay] auto-relaying new messages to recipients matching \"%s\" via %s:%d",
+				SMTPRelayMatching, SMTPRelayConfig.Host, SMTPRelayConfig.Port,
+			)
 		}
 	}
 

config/tags.go

@@ -94,9 +94,9 @@ func parseTagsDisable(s string) error {
 		return nil
 	}
 
-	parts := strings.Split(strings.ToLower(s), ",")
+	parts := strings.SplitSeq(strings.ToLower(s), ",")
 
-	for _, p := range parts {
+	for p := range parts {
 		switch strings.TrimSpace(p) {
 		case "x-tags", "xtags":
 			TagsDisableXTags = true

config/utils.go

@@ -13,7 +13,7 @@ import (
 // IsFile returns whether a file exists and is readable
 func isFile(path string) bool {
 	f, err := os.Open(filepath.Clean(path))
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	return err == nil
 }
 

config/validators.go

@@ -26,8 +26,8 @@ func parseMaxAge() error {
 		return fmt.Errorf("max-age must be either <int>h for hours or <int>d for days: %s", MaxAge)
 	}
 
-	if strings.HasSuffix(MaxAge, "h") {
-		hours, err := strconv.Atoi(strings.TrimSuffix(MaxAge, "h"))
+	if before, ok := strings.CutSuffix(MaxAge, "h"); ok {
+		hours, err := strconv.Atoi(before)
 		if err != nil {
 			return err
 		}
@@ -221,8 +221,8 @@ func validateForwardConfig() error {
 	}
 
 	to := []string{}
-	addresses := strings.Split(SMTPForwardConfig.To, ",")
-	for _, a := range addresses {
+	addresses := strings.SplitSeq(SMTPForwardConfig.To, ",")
+	for a := range addresses {
 		a = strings.TrimSpace(a)
 		m, err := mail.ParseAddress(a)
 		if err != nil {
@@ -263,8 +263,8 @@ func parseChaosTriggers() error {
 
 	re := regexp.MustCompile(`^([a-zA-Z0-0]+):(\d\d\d):(\d+(\.\d)?)$`)
 
-	parts := strings.Split(ChaosTriggers, ",")
-	for _, p := range parts {
+	parts := strings.SplitSeq(ChaosTriggers, ",")
+	for p := range parts {
 		p = strings.TrimSpace(p)
 		if !re.MatchString(p) {
 			return fmt.Errorf("invalid argument: %s", p)

eslint.config.js

@@ -1,34 +1,76 @@
 import eslintConfigPrettier from "eslint-config-prettier/flat";
-import neostandard, { resolveIgnoresFromGitignore } from "neostandard";
+import globals from "globals";
+import { includeIgnoreFile } from "@eslint/compat";
+import js from "@eslint/js";
 import vue from "eslint-plugin-vue";
+import { fileURLToPath } from "node:url";
+
+const gitignorePath = fileURLToPath(new URL(".gitignore", import.meta.url));
 
 export default [
-	/* Baseline JS rules, provided by Neostandard */
-	...neostandard({
-		/* Allows references to browser APIs like `document` */
-		env: ["browser"],
+	/* Use .gitignore to prevent linting of irrelevant files */
+	includeIgnoreFile(gitignorePath, ".gitignore"),
 
-		/* We rely on .gitignore to avoid running against dist / dependency files */
-		ignores: resolveIgnoresFromGitignore(),
-
-		/* Disables a range of style-related rules, as we use Prettier for that */
-		noStyle: true,
-
-		/* Ensures we only lint JS and Vue files */
+	/* ESLint's recommended rules */
+	{
 		files: ["**/*.js", "**/*.vue"],
-	}),
+		languageOptions: { globals: { ...globals.browser, ...globals.node } },
+		rules: js.configs.recommended.rules,
+	},
 
 	/* Vue-specific rules */
 	...vue.configs["flat/recommended"],
 
-	/* Prettier is responsible for formatting, so this disables any conflicting rules */
+	/* Prettier is responsible for formatting, so we disable conflicting rules */
 	eslintConfigPrettier,
 
 	/* Our custom rules */
 	{
 		rules: {
-			/* We prefer arrow functions for tidiness and consistency */
+			/* Always use arrow functions for tidiness and consistency */
 			"prefer-arrow-callback": "error",
+
+			/* Always use camelCase for variable names */
+			camelcase: [
+				"error",
+				{
+					ignoreDestructuring: false,
+					ignoreGlobals: true,
+					ignoreImports: false,
+					properties: "never",
+				},
+			],
+
+			/* The default case in switch statements must always be last */
+			"default-case-last": "error",
+
+			/* Always use dot notation where possible (e.g. `obj.val` over `obj['val']`) */
+			"dot-notation": "error",
+
+			/* Always use `===` and `!==` for comparisons unless unambiguous */
+			eqeqeq: ["error", "smart"],
+
+			/* Never use `eval()` as it violates our CSP and can lead to security issues */
+			"no-eval": "error",
+			"no-implied-eval": "error",
+
+			/* Prevents accidental use of template literals in plain strings, e.g. "my ${var}" */
+			"no-template-curly-in-string": "error",
+
+			/* Avoid unnecessary ternary operators */
+			"no-unneeded-ternary": "error",
+
+			/* Avoid unused expressions that have no purpose */
+			"no-unused-expressions": "error",
+
+			/* Always use `const` or `let` to make scope behaviour clear */
+			"no-var": "error",
+
+			/* Always use shorthand syntax for objects where possible, e.g. { a, b() { } } */
+			"object-shorthand": "error",
+
+			/* Always use `const` for variables that are never reassigned */
+			"prefer-const": "error",
 		},
 	},
 ];

go.mod

@@ -1,72 +1,66 @@
 module github.com/axllent/mailpit
 
-go 1.23.0
-
-toolchain go1.23.2
-
-// https://github.com/jaytaylor/html2text/issues/67
-replace github.com/olekukonko/tablewriter => github.com/olekukonko/tablewriter v0.0.5
+go 1.25.0
 
 require (
-	github.com/PuerkitoBio/goquery v1.10.3
+	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de
-	github.com/axllent/semver v0.0.1
-	github.com/goccy/go-yaml v1.18.0
-	github.com/gomarkdown/markdown v0.0.0-20250311123330-531bef5e742b
-	github.com/gorilla/mux v1.8.1
+	github.com/axllent/ghru/v2 v2.2.3
+	github.com/axllent/semver v1.0.0
+	github.com/goccy/go-yaml v1.19.2
+	github.com/gomarkdown/markdown v0.0.0-20260614204949-e08cff860f76
+	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/jhillyerd/enmime/v2 v2.1.0
-	github.com/klauspost/compress v1.18.0
-	github.com/kovidgoyal/imaging v1.6.4
+	github.com/jhillyerd/enmime/v2 v2.4.1
+	github.com/klauspost/compress v1.18.6
+	github.com/kovidgoyal/imaging v1.8.22
 	github.com/leporo/sqlf v1.4.0
-	github.com/lithammer/shortuuid/v4 v4.2.0
-	github.com/mneis/go-telnet v0.0.0-20221017141824-6f643e477c62
-	github.com/prometheus/client_golang v1.22.0
-	github.com/rqlite/gorqlite v0.0.0-20250609141355-ac86a4a1c9a8
-	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
-	github.com/tg123/go-htpasswd v1.2.4
-	github.com/vanng822/go-premailer v1.25.0
-	golang.org/x/crypto v0.39.0
-	golang.org/x/net v0.41.0
-	golang.org/x/text v0.26.0
-	golang.org/x/time v0.12.0
-	modernc.org/sqlite v1.38.0
+	github.com/pkg/errors v0.9.1
+	github.com/rqlite/gorqlite v0.0.0-20260504155303-50d445fd0ab9
+	github.com/spf13/cobra v1.10.2
+	github.com/spf13/pflag v1.0.10
+	github.com/tg123/go-htpasswd v1.2.5
+	github.com/vanng822/go-premailer v1.34.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/net v0.56.0
+	golang.org/x/text v0.38.0
+	golang.org/x/time v0.15.0
+	modernc.org/sqlite v1.53.0
 )
 
 require (
 	github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5 // indirect
-	github.com/andybalholm/cascadia v1.3.3 // indirect
-	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
+	github.com/inbucket/html2text v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
-	github.com/olekukonko/tablewriter v1.0.7 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.64.0 // indirect
-	github.com/prometheus/procfs v0.16.1 // indirect
-	github.com/reiver/go-oi v1.0.0 // indirect
+	github.com/kovidgoyal/go-parallel v1.1.1 // indirect
+	github.com/kovidgoyal/go-shm v1.0.0 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mattn/go-runewidth v0.0.24 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
+	github.com/olekukonko/errors v1.3.0 // indirect
+	github.com/olekukonko/ll v0.1.8 // indirect
+	github.com/olekukonko/tablewriter v1.1.4 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/vanng822/css v1.0.1 // indirect
-	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
-	golang.org/x/image v0.28.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
-	modernc.org/libc v1.66.0 // indirect
+	golang.org/x/image v0.43.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	modernc.org/libc v1.73.5 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 )

go.sum

@@ -1,34 +1,41 @@
 github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5 h1:IEjq88XO4PuBDcvmjQJcQGg+w+UaafSy8G5Kcb5tBhI=
 github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5/go.mod h1:exZ0C/1emQJAw5tHOaUDyY1ycttqBAPcxuzf7QbY6ec=
-github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
-github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
-github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
-github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
+github.com/PuerkitoBio/goquery v1.12.0 h1:pAcL4g3WRXekcB9AU/y1mbKez2dbY2AajVhtkO8RIBo=
+github.com/PuerkitoBio/goquery v1.12.0/go.mod h1:802ej+gV2y7bbIhOIoPY5sT183ZW0YFofScC4q/hIpQ=
+github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
+github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de h1:FxWPpzIjnTlhPwqqXc4/vE0f7GvRjuAsbW+HOIe8KnA=
 github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de/go.mod h1:DCaWoUhZrYW9p1lxo/cm8EmUOOzAPSEZNGF2DK1dJgw=
-github.com/axllent/semver v0.0.1 h1:QqF+KSGxgj8QZzSXAvKFqjGWE5792ksOnQhludToK8E=
-github.com/axllent/semver v0.0.1/go.mod h1:2xSPzvG8n9mRfdtxSvWvfTfQGWfHsMsHO1iZnKATMSc=
-github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/axllent/ghru/v2 v2.2.3 h1:nLzbq7jLiYQMxYPU4uBdgKL4jzAaMkBfAif3igpGaaE=
+github.com/axllent/ghru/v2 v2.2.3/go.mod h1:tyH60pqmLCDHd3UMOZyiedrYMFVLwBQqPQ5y8WLvDzA=
+github.com/axllent/semver v1.0.0 h1:FDekA0alnMed5bWVWjUwBS+6QouZZkmPXsGVmOfjWOg=
+github.com/axllent/semver v1.0.0/go.mod h1:ySHHYLyFX3vKAALmaO8TOOJkzGRsUNmzFiIWwPm8li8=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a/go.mod h1:2GxOXOlEPAMFPfp014mK1SWq8G8BN8o7/dfYqJrVGn8=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
+github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f h1:3BSP1Tbs2djlpprl7wCLuiqMaUh5SJkkzI2gDs+FgLs=
 github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f/go.mod h1:Pcatq5tYkCW2Q6yrR2VRHlbHpZ/R4/7qyL1TCF7vl14=
-github.com/gomarkdown/markdown v0.0.0-20250311123330-531bef5e742b h1:EY/KpStFl60qA17CptGXhwfZ+k1sFNJIUNR8DdbcuUk=
-github.com/gomarkdown/markdown v0.0.0-20250311123330-531bef5e742b/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/gomarkdown/markdown v0.0.0-20260614204949-e08cff860f76 h1:Ltt9ldIaSYEsjA7sPY2c8r9dOmnKM1vlzhh3dxlhBHM=
+github.com/gomarkdown/markdown v0.0.0-20260614204949-e08cff860f76/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
@@ -37,72 +44,63 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
-github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
-github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/inbucket/html2text v1.0.0 h1:N5kza++4uBBDJ2Z3KUnTRyPNoBcW+YfOgNiNmNB+sgs=
+github.com/inbucket/html2text v1.0.0/go.mod h1:5TrhXQKGU+LXurODaSm55Y9eXoPBRnYiOz4x2XfUoJU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056 h1:iCHtR9CQyktQ5+f3dMVZfwD2KWJUgm7M0gdL9NGr8KA=
-github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056/go.mod h1:CVKlgaMiht+LXvHG173ujK6JUhZXKb2u/BQtjPDIvyk=
-github.com/jhillyerd/enmime/v2 v2.1.0 h1:c8Qwi5Xq5EdtMN6byQWoZ/8I2RMTo6OJ7Xay+s1oPO0=
-github.com/jhillyerd/enmime/v2 v2.1.0/go.mod h1:EJ74dcRbBcqHSP2TBu08XRoy6y3Yx0cevwb1YkGMEmQ=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/kovidgoyal/imaging v1.6.4 h1:K0idhRPXnRrJBKnBYcTfI1HTWSNDeAn7hYDvf9I0dCk=
-github.com/kovidgoyal/imaging v1.6.4/go.mod h1:bEIgsaZmXlvFfkv/CUxr9rJook6AQkJnpB5EPosRfRY=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/jhillyerd/enmime/v2 v2.4.1 h1:VkBX8GJJ/wbQofWsKP3egRqgXcwmxlY94YUmXTj08kE=
+github.com/jhillyerd/enmime/v2 v2.4.1/go.mod h1:TLpvqImPiumRecsJK5TYseRw2bPg3g0EtWc+SfU7cMs=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/kovidgoyal/go-parallel v1.1.1 h1:1OzpNjtrUkBPq3UaqrnvOoB2F9RttSt811uiUXyI7ok=
+github.com/kovidgoyal/go-parallel v1.1.1/go.mod h1:BJNIbe6+hxyFWv7n6oEDPj3PA5qSw5OCtf0hcVxWJiw=
+github.com/kovidgoyal/go-shm v1.0.0 h1:HJEel9D1F9YhULvClEHJLawoRSj/1u/EDV7MJbBPgQo=
+github.com/kovidgoyal/go-shm v1.0.0/go.mod h1:Yzb80Xf9L3kaoB2RGok9hHwMIt7Oif61kT6t3+VnZds=
+github.com/kovidgoyal/imaging v1.8.22 h1:CtpoRXQpS79xxJsKu8+LUJJE/0i4FLquJZy0QH+QNlM=
+github.com/kovidgoyal/imaging v1.8.22/go.mod h1:y8wo4JTv4D+skbtQf6fHg8nA1qtagvCcn8J2Nu5k2Jg=
 github.com/leporo/sqlf v1.4.0 h1:SyWnX/8GSGOzVmanG0Ub1c04mR9nNl6Tq3IeFKX2/4c=
 github.com/leporo/sqlf v1.4.0/go.mod h1:pgN9yKsAnQ+2ewhbZogr98RcasUjPsHF3oXwPPhHvBw=
-github.com/lithammer/shortuuid/v4 v4.2.0 h1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=
-github.com/lithammer/shortuuid/v4 v4.2.0/go.mod h1:D5noHZ2oFw/YaKCfGy0YxyE7M0wMbezmMjPdhyEFe6Y=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.10/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
+github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
 github.com/mattn/go-sqlite3 v1.14.16/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
-github.com/mneis/go-telnet v0.0.0-20221017141824-6f643e477c62 h1:XMG5DklHoioVYysfYglOB7vRBg/LOUJZy2mq2QyedLg=
-github.com/mneis/go-telnet v0.0.0-20221017141824-6f643e477c62/go.mod h1:niAM5cni0I/47IFA995xQfeK58Mkbb7FHJjacY4OGQg=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
-github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
+github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
+github.com/olekukonko/errors v1.3.0 h1:teJvgLGUEqMzBUms+Dj3/3szNqCG/Jdw9iDbum8fR6U=
+github.com/olekukonko/errors v1.3.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
+github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8=
+github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw=
+github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
+github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.64.0 h1:pdZeA+g617P7oGv1CzdTzyeShxAGrTBsolKNOLQPGO4=
-github.com/prometheus/common v0.64.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
-github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
-github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
-github.com/reiver/go-oi v1.0.0 h1:nvECWD7LF+vOs8leNGV/ww+F2iZKf3EYjYZ527turzM=
-github.com/reiver/go-oi v1.0.0/go.mod h1:RrDBct90BAhoDTxB1fenZwfykqeGvhI6LsNfStJoEkI=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
-github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rqlite/gorqlite v0.0.0-20250609141355-ac86a4a1c9a8 h1:BoxiqWvhprOB2isgM59s8wkgKwAoyQH66Twfmof41oE=
-github.com/rqlite/gorqlite v0.0.0-20250609141355-ac86a4a1c9a8/go.mod h1:xF/KoXmrRyahPfo5L7Szb5cAAUl53dMWBh9cMruGEZg=
+github.com/rqlite/gorqlite v0.0.0-20260504155303-50d445fd0ab9 h1:TS0KUGThBdgr2QURBtaUdNdcRJuwZ1O7/FnhrTDRp0c=
+github.com/rqlite/gorqlite v0.0.0-20260504155303-50d445fd0ab9/go.mod h1:xF/KoXmrRyahPfo5L7Szb5cAAUl53dMWBh9cMruGEZg=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd h1:CmH9+J6ZSsIjUK3dcGsnCnO41eRBOnY12zwkn5qVwgc=
+github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/scylladb/termtables v0.0.0-20191203121021-c4c0b6d42ff4/go.mod h1:C1a7PQSMz9NShzorzCiG2fk9+xuCgLkPeCvMHYR2OWg=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf h1:pvbZ0lM0XWPBqUKqFU8cmavspvIl9nulOYwdy6IFRRo=
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf/go.mod h1:RJID2RhlZKId02nZ62WenDCkgHFerpIOmW0iT7GKmXM=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -112,130 +110,63 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/tg123/go-htpasswd v1.2.4 h1:HgH8KKCjdmo7jjXWN9k1nefPBd7Be3tFCTjc2jPraPU=
-github.com/tg123/go-htpasswd v1.2.4/go.mod h1:EKThQok9xHkun6NBMynNv6Jmu24A33XdZzzl4Q7H1+0=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tg123/go-htpasswd v1.2.5 h1:h+QdWCAp/FebK6fqjsqg9RGYcgEMcaiKNDV+Mg6uk3E=
+github.com/tg123/go-htpasswd v1.2.5/go.mod h1:grOqB+sLpkA5ousKWPDRS2colmiBSGxlpuXrm8HxtXs=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/vanng822/css v1.0.1 h1:10yiXc4e8NI8ldU6mSrWmSWMuyWgPr9DZ63RSlsgDw8=
 github.com/vanng822/css v1.0.1/go.mod h1:tcnB1voG49QhCrwq1W0w5hhGasvOg+VQp9i9H1rCM1w=
-github.com/vanng822/go-premailer v1.25.0 h1:hGHKfroCXrCDTyGVR8o4HCON5/HWvc7C1uocS+VnaZs=
-github.com/vanng822/go-premailer v1.25.0/go.mod h1:8WJKIPZtegxqSOA8+eDFx7QNesKmMYfGEIodLTJqrtM=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
-golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
-golang.org/x/image v0.28.0 h1:gdem5JW1OLS4FbkWgLO+7ZeFzYtL3xClb97GaUzYMFE=
-golang.org/x/image v0.28.0/go.mod h1:GUJYXtnGKEUgggyzh+Vxt+AviiCcyiwpsl8iQ8MvwGY=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
-golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
-golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
-golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+github.com/vanng822/go-premailer v1.34.0 h1:CW7RUnjCfXrkuCbgC2wi/Cub7IwKslJWD/OkIBlcQUk=
+github.com/vanng822/go-premailer v1.34.0/go.mod h1:LGYI7ym6FQ7KcHN16LiQRF+tlan7qwhP1KEhpTINFpo=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
+golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.26.1 h1:+X5NtzVBn0KgsBCBe+xkDC7twLb/jNVj9FPgiwSQO3s=
-modernc.org/cc/v4 v4.26.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
-modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
-modernc.org/fileutil v1.3.3 h1:3qaU+7f7xxTUmvU1pJTZiDLAIoJVdUSSauJNHg9yXoA=
-modernc.org/fileutil v1.3.3/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
+modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.5 h1:hcwnthv2/LBl+mRLOYwnQA/LuW44Oln1NQlWppNaS1Q=
+modernc.org/ccgo/v4 v4.34.5/go.mod h1:aow0HNkO30OSA/2NrtDXkis92ff8ZFiDOmDOPhqhF8U=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/goabi0 v0.0.3 h1:y81b9r3asCh6Xtse6Nz85aYGB0cG3M3U6222yap1KWI=
-modernc.org/goabi0 v0.0.3/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.66.0 h1:eoFuDb1ozurUY5WSWlgvxHp0FuL+AncMwNjFqGYMJPQ=
-modernc.org/libc v1.66.0/go.mod h1:AiZxInURfEJx516LqEaFcrC+X38rt9G7+8ojIXQKHbo=
+modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
+modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.73.5 h1:G34rN/cRqL+zOUnrbz9uPq/+OxJ8/vzQ2CQwTJ42Wmw=
+modernc.org/libc v1.73.5/go.mod h1:+Aoyx4M0etg6GikzCrip1VtvAtUlMlo2Aq+GHwQSqOA=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
 modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.38.0 h1:+4OrfPQ8pxHKuWG4md1JpR/EYAh3Md7TdejuuzE7EUI=
-modernc.org/sqlite v1.38.0/go.mod h1:1Bj+yES4SVvBZ4cBOpVZ6QgesMCKpJZDq0nxYzOpmNE=
+modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
+modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

install.sh

@@ -2,10 +2,39 @@
 
 # This script will install the latest release of Mailpit.
 
+show_help() {
+    cat <<EOF
+Mailpit install script
+
+Usage:
+  $(basename "$0") [OPTIONS]
+
+Options:
+  -h, --help                            Show this help and exit
+  --install-path <path>                 Install location (default: /usr/local/bin)
+  --auth, --auth-token, 
+    --github-token, --token <token>     GitHub token for API authentication
+
+Environment:
+  INSTALL_PATH                          Default install path override
+  GITHUB_TOKEN                          GitHub API token
+EOF
+}
+
+# Show help if requested
+for arg in "$@"; do
+    case "$arg" in
+    -h|--help)
+        show_help
+        exit 0
+        ;;
+    esac
+done
+
 # Check dependencies is installed
 for cmd in curl tar; do
     if ! command -v "$cmd" >/dev/null 2>&1; then
-        echo "Then $cmd command is required but not installed."
+        echo "The $cmd command is required but not installed."
         echo "Please install $cmd and try again."
         exit 1
     fi
@@ -15,9 +44,9 @@ done
 OS=
 case "$(uname -s)" in
 Linux) OS="linux" ;;
-Darwin) OS="Darwin" ;;
+Darwin) OS="darwin" ;;
 *)
-    echo "OS not supported."
+    echo "Unsupported operating system: $(uname -s)"
     exit 2
     ;;
 esac
@@ -35,7 +64,7 @@ aarch64 | arm64)
     OS_ARCH="arm64"
     ;;
 *)
-    echo "OS architecture not supported."
+    echo "Unsupported architecture: $(uname -m)"
     exit 2
     ;;
 esac
@@ -47,7 +76,7 @@ TIMEOUT=90
 # Try the GITHUB_TOKEN environment variable is set globally.
 GITHUB_API_TOKEN="${GITHUB_TOKEN:-}"
 
-# Update the default values if the user has set.
+# Override defaults with any user-supplied arguments.
 while [ $# -gt 0 ]; do
     case $1 in
     --install-path)
@@ -66,6 +95,10 @@ while [ $# -gt 0 ]; do
         gh*)
             GITHUB_API_TOKEN="$1"
             ;;
+        *)
+            echo "ERROR: Invalid GitHub token. Token must start with \"gh\"."
+            exit 1
+            ;;
         esac
         ;;
     *) ;;
@@ -89,7 +122,7 @@ fi
 
 VERSION=""
 if [ $EXIT_CODE -eq 0 ]; then
-    # Extracts the latest version using jq, awk, or sed.
+    # Parse the GitHub API JSON response and extract the tag_name field to get the latest version.
     if command -v jq >/dev/null 2>&1; then
         # Use jq -n because the output is not a valid JSON in sh.
         VERSION=$(jq -n "$CURL_OUTPUT" | jq -r '.tag_name')
@@ -106,12 +139,19 @@ fi
 case "$VERSION" in
 v[0-9][0-9\.]*) ;;
 *)
-    echo "There was an error trying to check what is the latest version of Mailpit."
+    echo "Unable to determine the latest version of Mailpit."
     echo "Please try again later."
+    if [ -z "$GITHUB_API_TOKEN" ]; then
+        echo "Tip: Set GITHUB_TOKEN to authenticate and avoid GitHub API rate limiting."
+    fi
     exit $EXIT_CODE
     ;;
 esac
 
+TEMP_DIR=""
+cleanup() { [ -n "$TEMP_DIR" ] && rm -rf "$TEMP_DIR"; }
+trap cleanup EXIT
+
 TEMP_DIR="$(mktemp -qd)"
 EXIT_CODE=$?
 # Ensure the temporary directory exists and is a directory.
@@ -169,7 +209,7 @@ if [ $EXIT_CODE -eq 0 ]; then
         cp mailpit "$INSTALL_BIN_PATH"
         EXIT_CODE=$?
         if [ $EXIT_CODE -ne 0 ]; then
-            echo "ERROR: Copying mailpit to \"${INSTALL_PATH}\" directory."
+            echo "ERROR: Cannot copy mailpit to \"$INSTALL_BIN_PATH\"."
         fi
     fi
 
@@ -198,17 +238,15 @@ if [ $EXIT_CODE -eq 0 ]; then
         fi
     fi
 else
-    echo "ERROR: Changing to temporary directory."
+    echo "ERROR: Could not change to temporary directory."
     exit $EXIT_CODE
 fi
 
-# Cleanup the temporary directory.
-rm -rf "$TEMP_DIR"
 # Check the EXIT_CODE variable, and print the success or error message.
 if [ $EXIT_CODE -ne 0 ]; then
     echo "There was an error installing Mailpit."
     exit $EXIT_CODE
 fi
 
-echo "Installed successfully to \"$INSTALL_BIN_PATH\"."
+echo "Mailpit ${VERSION} installed successfully to \"$INSTALL_BIN_PATH\"."
 exit 0

internal/dump/dump.go

@@ -7,9 +7,11 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"path"
+	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
@@ -18,9 +20,24 @@ import (
 	"github.com/axllent/mailpit/server/apiv1"
 )
 
+// httpClient bounds each remote request so a slow or hostile --http endpoint
+// cannot hang the dump indefinitely.
+var httpClient = &http.Client{Timeout: time.Minute}
+
+// maxSummarySize caps the bytes read from the remote messages-summary endpoint
+// to prevent a hostile server from exhausting memory via an unbounded response.
+const maxSummarySize = 20 * 1024 * 1024 // 20 MiB
+
+// pageSize is the per-request limit when paging through the remote messages
+// summary endpoint.
+const pageSize = 10000
+
 var (
 	linkRe = regexp.MustCompile(`(?i)^https?:\/\/`)
 
+	// idRe matches a valid Mailpit message ID (alphanumeric or dash, 8–60 chars).
+	idRe = regexp.MustCompile(`^[a-zA-Z0-9-]{8,60}$`)
+
 	outDir string
 
 	// Base URL of mailpit instance
@@ -29,24 +46,26 @@ var (
 	// URL is the base URL of a remove Mailpit instance
 	URL string
 
-	summary = []storage.MessageSummary{}
+	dumpIDs = make(map[string]struct {
+		Timestamp time.Time
+	})
 )
 
 // Sync will sync all messages from the specified database or API to the specified output directory
 func Sync(d string) error {
 
-	outDir = path.Clean(d)
+	outDir = filepath.Clean(d)
 
 	if URL != "" {
 		if !linkRe.MatchString(URL) {
-			return errors.New("Invalid URL")
+			return errors.New("invalid URL")
 		}
 
 		base = strings.TrimRight(URL, "/") + "/"
 	}
 
 	if base == "" && config.Database == "" {
-		return errors.New("No database or API URL specified")
+		return errors.New("no database or API URL specified")
 	}
 
 	if !tools.IsDir(outDir) {
@@ -71,53 +90,117 @@ func loadIDs() error {
 	if base != "" {
 		// remote
 		logger.Log().Debugf("Fetching messages summary from %s", base)
-		res, err := http.Get(base + "api/v1/messages?limit=0")
 
-		if err != nil {
-			return err
+		start := 0
+		var total uint64
+		for {
+			data, err := fetchSummaryPage(start)
+			if err != nil {
+				return err
+			}
+
+			if start == 0 {
+				total = data.Total
+			}
+
+			for _, m := range data.Messages {
+				dumpIDs[m.ID] = struct {
+					Timestamp time.Time
+				}{Timestamp: m.Created}
+			}
+
+			logger.Log().Debugf("Fetched messages summary page start=%d size=%d (%d/%d)", start, len(data.Messages), len(dumpIDs), total)
+
+			// stop on empty page to guard against stale/inconsistent Total
+			if len(data.Messages) == 0 {
+				break
+			}
+
+			if uint64(len(dumpIDs)) >= total {
+				break
+			}
+
+			start += pageSize
 		}
 
-		body, err := io.ReadAll(res.Body)
-
-		if err != nil {
-			return err
-		}
-
-		var data apiv1.MessagesSummary
-		if err := json.Unmarshal(body, &data); err != nil {
-			return err
-		}
-
-		summary = data.Messages
-
 	} else {
 		// make sure the database isn't pruned while open
 		config.MaxMessages = 0
 
-		var err error
 		// local database
-		if err = storage.InitDB(); err != nil {
+		if err := storage.InitDB(); err != nil {
 			return err
 		}
 
 		logger.Log().Debugf("Fetching messages summary from %s", config.Database)
 
-		summary, err = storage.List(0, 0, 0)
-		if err != nil {
-			return err
+		start := 0
+		for {
+			page, err := storage.List(start, 0, pageSize)
+			if err != nil {
+				return err
+			}
+
+			for _, m := range page {
+				dumpIDs[m.ID] = struct {
+					Timestamp time.Time
+				}{Timestamp: m.Created}
+			}
+
+			if len(page) < pageSize {
+				break
+			}
+
+			start += pageSize
 		}
 	}
 
-	if len(summary) == 0 {
-		return errors.New("No messages found")
+	if len(dumpIDs) == 0 {
+		return errors.New("no messages found")
 	}
 
 	return nil
 }
 
+// fetchSummaryPage fetches a single page of the remote messages summary,
+// starting at the given offset.
+func fetchSummaryPage(start int) (*apiv1.MessagesSummary, error) {
+	url := base + "api/v1/messages?limit=" + strconv.Itoa(pageSize) + "&start=" + strconv.Itoa(start)
+	res, err := httpClient.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		return nil, errors.New("error fetching messages summary: HTTP " + res.Status)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(res.Body, maxSummarySize+1))
+	if err != nil {
+		return nil, err
+	}
+
+	if int64(len(body)) > maxSummarySize {
+		return nil, errors.New("messages summary exceeds size cap")
+	}
+
+	var data apiv1.MessagesSummary
+	if err := json.Unmarshal(body, &data); err != nil {
+		return nil, err
+	}
+
+	return &data, nil
+}
+
 func saveMessages() error {
-	for _, m := range summary {
-		out := path.Join(outDir, m.ID+".eml")
+	for id, m := range dumpIDs {
+		if !idRe.MatchString(id) {
+			logger.Log().Errorf("skipping message with invalid ID: %q", id)
+			continue
+		}
+
+		out := filepath.Join(outDir, id+".eml")
 
 		// skip if message exists
 		if tools.IsFile(out) {
@@ -126,37 +209,66 @@ func saveMessages() error {
 
 		var b []byte
 
+		limit := int64(config.MaxMessageSize) * 1024 * 1024
+
 		if base != "" {
-			res, err := http.Get(base + "api/v1/message/" + m.ID + "/raw")
+			res, err := httpClient.Get(base + "api/v1/message/" + id + "/raw")
 
 			if err != nil {
-				logger.Log().Errorf("error fetching message %s: %s", m.ID, err.Error())
+				logger.Log().Errorf("error fetching message %s: %s", id, err.Error())
 				continue
 			}
 
-			b, err = io.ReadAll(res.Body)
-
-			if err != nil {
-				logger.Log().Errorf("error fetching message %s: %s", m.ID, err.Error())
+			if res.StatusCode != http.StatusOK {
+				res.Body.Close()
+				logger.Log().Errorf("error fetching message %s: HTTP %d", id, res.StatusCode)
 				continue
 			}
+
+			if config.MaxMessageSize > 0 {
+				b, err = io.ReadAll(io.LimitReader(res.Body, limit+1))
+				res.Body.Close()
+
+				if err != nil {
+					logger.Log().Errorf("error fetching message %s: %s", id, err.Error())
+					continue
+				}
+
+				if int64(len(b)) > limit {
+					logger.Log().Warnf("message %s exceeds %d MiB size cap, skipping", id, config.MaxMessageSize)
+					continue
+				}
+			} else {
+				b, err = io.ReadAll(res.Body)
+				res.Body.Close()
+
+				if err != nil {
+					logger.Log().Errorf("error fetching message %s: %s", id, err.Error())
+					continue
+				}
+			}
 		} else {
 			var err error
-			b, err = storage.GetMessageRaw(m.ID)
+			b, err = storage.GetMessageRaw(id)
 			if err != nil {
-				logger.Log().Errorf("error fetching message %s: %s", m.ID, err.Error())
+				logger.Log().Errorf("error fetching message %s: %s", id, err.Error())
+				continue
+			}
+
+			if config.MaxMessageSize > 0 && int64(len(b)) > limit {
+				logger.Log().Warnf("message %s exceeds %d MiB size cap, skipping", id, config.MaxMessageSize)
 				continue
 			}
 		}
 
 		if err := os.WriteFile(out, b, 0644); /* #nosec */ err != nil {
-			logger.Log().Errorf("error writing message %s: %s", m.ID, err.Error())
+			logger.Log().Errorf("error writing message %s: %s", id, err.Error())
 			continue
 		}
 
-		_ = os.Chtimes(out, m.Created, m.Created)
+		_ = os.Chtimes(out, m.Timestamp, m.Timestamp)
 
-		logger.Log().Debugf("Saved message %s to %s", m.ID, out)
+		logger.Log().Debugf("Saved message %s to %s", id, out)
 	}
 
 	return nil

internal/healthcheck/healthcheck.go

@@ -0,0 +1,70 @@
+// Package healthcheck probes a running Mailpit instance's /readyz endpoint.
+package healthcheck
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net/http"
+	"path"
+	"strings"
+	"time"
+)
+
+// PollInterval is the delay between polls in Wait. Exported as a variable so
+// tests can shorten it.
+var PollInterval = time.Second
+
+// URI builds the readyz URL from a listen address, webroot, and TLS flag.
+func URI(listen, webroot string, https bool) string {
+	proto := "http"
+	if https {
+		proto = "https"
+	}
+	root := strings.TrimRight(path.Join("/", webroot, "/"), "/") + "/"
+	return fmt.Sprintf("%s://%s%sreadyz", proto, listen, root)
+}
+
+// NewClient returns an HTTP client suitable for probing a Mailpit readyz
+// endpoint. TLS verification is disabled because probes typically connect via
+// IP, which won't match the server certificate.
+func NewClient() *http.Client {
+	return &http.Client{Transport: &http.Transport{
+		IdleConnTimeout:       time.Second * 5,
+		ExpectContinueTimeout: time.Second * 5,
+		TLSHandshakeTimeout:   time.Second * 5,
+		TLSClientConfig:       &tls.Config{InsecureSkipVerify: true}, // #nosec
+	}}
+}
+
+// Check makes a single readiness probe. Returns nil if the server responds
+// with 200 OK.
+func Check(client *http.Client, uri string) error {
+	res, err := client.Get(uri)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = res.Body.Close() }()
+
+	if res.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected status: %s", res.Status)
+	}
+
+	return nil
+}
+
+// Wait polls uri until Check succeeds or timeout elapses.
+func Wait(client *http.Client, uri string, timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+
+	for {
+		if err := Check(client, uri); err == nil {
+			return nil
+		}
+
+		if time.Now().After(deadline) {
+			return fmt.Errorf("timed out after %s waiting for Mailpit to become ready", timeout)
+		}
+
+		time.Sleep(PollInterval)
+	}
+}

internal/healthcheck/healthcheck_test.go

@@ -0,0 +1,88 @@
+package healthcheck
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestCheck(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	t.Cleanup(srv.Close)
+
+	if err := Check(srv.Client(), srv.URL); err != nil {
+		t.Fatalf("Check() error = %v", err)
+	}
+}
+
+func TestWaitRetriesUntilSuccess(t *testing.T) {
+	oldPoll := PollInterval
+	PollInterval = time.Millisecond
+	t.Cleanup(func() { PollInterval = oldPoll })
+
+	var calls int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		calls++
+		if calls == 1 {
+			w.WriteHeader(http.StatusServiceUnavailable)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	t.Cleanup(srv.Close)
+
+	if err := Wait(srv.Client(), srv.URL, 100*time.Millisecond); err != nil {
+		t.Fatalf("Wait() error = %v", err)
+	}
+
+	if calls < 2 {
+		t.Fatalf("Wait() calls = %d, want at least 2", calls)
+	}
+}
+
+func TestWaitTimesOut(t *testing.T) {
+	oldPoll := PollInterval
+	PollInterval = time.Millisecond
+	t.Cleanup(func() { PollInterval = oldPoll })
+
+	var calls int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		calls++
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	t.Cleanup(srv.Close)
+
+	if err := Wait(srv.Client(), srv.URL, 5*time.Millisecond); err == nil {
+		t.Fatal("Wait() error = nil, want timeout")
+	}
+
+	if calls == 0 {
+		t.Fatal("Wait() did not call the endpoint")
+	}
+}
+
+func TestURI(t *testing.T) {
+	tests := []struct {
+		name    string
+		listen  string
+		webroot string
+		https   bool
+		want    string
+	}{
+		{"plain", "127.0.0.1:8025", "", false, "http://127.0.0.1:8025/readyz"},
+		{"https", "127.0.0.1:8025", "", true, "https://127.0.0.1:8025/readyz"},
+		{"webroot", "127.0.0.1:8025", "/mailpit", false, "http://127.0.0.1:8025/mailpit/readyz"},
+		{"webroot trailing slash", "127.0.0.1:8025", "/mailpit/", false, "http://127.0.0.1:8025/mailpit/readyz"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := URI(tc.listen, tc.webroot, tc.https); got != tc.want {
+				t.Errorf("URI() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}

internal/html2text/html2text.go

@@ -3,7 +3,7 @@ package html2text
 
 import (
 	"bytes"
-	"log"
+	"fmt"
 	"regexp"
 	"strings"
 	"unicode"
@@ -30,18 +30,18 @@ func init() {
 }
 
 // Strip will convert a HTML string to plain text
-func Strip(h string, includeLinks bool) string {
+func Strip(h string, includeLinks bool) (string, error) {
 	h = spaceRe.ReplaceAllString(h, "</$1> <")
 	h = brRe.ReplaceAllString(h, " ")
 	h = imgRe.ReplaceAllString(h, " <$1")
 	var buffer bytes.Buffer
 	doc, err := html.Parse(strings.NewReader(h))
 	if err != nil {
-		log.Fatal(err)
+		return "", fmt.Errorf("html2text: parsing HTML: %w", err)
 	}
 
 	extract(doc, &buffer, includeLinks)
-	return clean(buffer.String())
+	return clean(buffer.String()), nil
 }
 
 func extract(node *html.Node, buff *bytes.Buffer, includeLinks bool) {
@@ -52,7 +52,8 @@ func extract(node *html.Node, buff *bytes.Buffer, includeLinks bool) {
 		}
 	}
 	for c := node.FirstChild; c != nil; c = c.NextSibling {
-		if _, skip := skip[c.Data]; !skip {
+		if _, shouldSkip := skip[c.Data]; !shouldSkip {
+			extract(c, buff, includeLinks)
 			if includeLinks && c.Data == "a" {
 				for _, a := range c.Attr {
 					if a.Key == "href" && strings.HasPrefix(strings.ToLower(a.Val), "http") {
@@ -60,7 +61,6 @@ func extract(node *html.Node, buff *bytes.Buffer, includeLinks bool) {
 					}
 				}
 			}
-			extract(c, buff, includeLinks)
 		}
 	}
 }

internal/html2text/html2text_test.go

@@ -20,7 +20,7 @@ func TestPlain(t *testing.T) {
 	tests[`<h1>Heading</h3><p>   <a href="https://github.com">linked text.`] = "Heading linked text."
 
 	for str, expected := range tests {
-		res := Strip(str, false)
+		res, _ := Strip(str, false)
 		if res != expected {
 			t.Log("error:", res, "!=", expected)
 			t.Fail()
@@ -42,12 +42,12 @@ func TestWithLinks(t *testing.T) {
 	tests["<h1>Heading</h1><p>Paragraph</p>"] = "Heading Paragraph"
 	tests[`<h1>Heading</h1>
 		<p>Paragraph</p>`] = "Heading Paragraph"
-	tests[`<h1>Heading</h1><p>   <a href="https://github.com">linked text</a></p>`] = "Heading https://github.com linked text"
+	tests[`<h1>Heading</h1><p>   <a href="https://github.com">linked text</a></p>`] = "Heading linked text https://github.com"
 	// broken html
-	tests[`<h1>Heading</h3><p>   <a href="https://github.com">linked text.`] = "Heading https://github.com linked text."
+	tests[`<h1>Heading</h3><p>   <a href="https://github.com">linked text.`] = "Heading linked text. https://github.com"
 
 	for str, expected := range tests {
-		res := Strip(str, true)
+		res, _ := Strip(str, true)
 		if res != expected {
 			t.Log("error:", res, "!=", expected)
 			t.Fail()

internal/htmlcheck/caniemail.go

@@ -42,19 +42,19 @@ type CanIEmail struct {
 
 // JSONResult struct for CanIEmail Data
 type JSONResult struct {
-	Slug           string                 `json:"slug"`
-	Title          string                 `json:"title"`
-	Description    string                 `json:"description"`
-	URL            string                 `json:"url"`
-	Category       string                 `json:"category"`
-	Tags           []string               `json:"tags"`
-	Keywords       string                 `json:"keywords"`
-	LastTestDate   string                 `json:"last_test_date"`
-	TestURL        string                 `json:"test_url"`
-	TestResultsURL string                 `json:"test_results_url"`
-	Stats          map[string]interface{} `json:"stats"`
-	Notes          string                 `json:"notes"`
-	NotesByNumber  map[string]string      `json:"notes_by_num"`
+	Slug           string            `json:"slug"`
+	Title          string            `json:"title"`
+	Description    string            `json:"description"`
+	URL            string            `json:"url"`
+	Category       string            `json:"category"`
+	Tags           []string          `json:"tags"`
+	Keywords       string            `json:"keywords"`
+	LastTestDate   string            `json:"last_test_date"`
+	TestURL        string            `json:"test_url"`
+	TestResultsURL string            `json:"test_results_url"`
+	Stats          map[string]any    `json:"stats"`
+	Notes          string            `json:"notes"`
+	NotesByNumber  map[string]string `json:"notes_by_num"`
 }
 
 // Load the JSON data

internal/htmlcheck/css.go

@@ -1,8 +1,11 @@
 package htmlcheck
 
 import (
+	"context"
+	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
@@ -141,19 +144,20 @@ func inlineRemoteCSS(h string) (string, error) {
 		attributes := link.Attr
 		for _, a := range attributes {
 			if a.Key == "href" {
-				if !isURL(a.Val) {
-					// skip invalid URL
-					continue
-				}
-
 				if config.BlockRemoteCSSAndFonts {
 					logger.Log().Debugf("[html-check] skip testing remote CSS content: %s (--block-remote-css-and-fonts)", a.Val)
 					return h, nil
 				}
 
-				resp, err := downloadToBytes(a.Val)
+				if !isValidURL(a.Val) {
+					// skip invalid URL
+					logger.Log().Warnf("[html-check] ignoring unsupported stylesheet URL: %s", a.Val)
+					continue
+				}
+
+				resp, err := downloadCSSToBytes(a.Val)
 				if err != nil {
-					logger.Log().Warnf("[html-check] failed to download %s", a.Val)
+					logger.Log().Warnf("[html-check] %s", err.Error())
 					continue
 				}
 
@@ -182,25 +186,41 @@ func inlineRemoteCSS(h string) (string, error) {
 	return newDoc, nil
 }
 
-// DownloadToBytes returns a []byte slice from a URL
-func downloadToBytes(url string) ([]byte, error) {
-	client := http.Client{
-		Timeout: 5 * time.Second,
-	}
-
-	// Get the link response data
-	resp, err := client.Get(url)
+// DownloadCSSToBytes returns a []byte slice from a URL.
+// It requires the HTTP response code to be 200 and the content-type to be text/css.
+// It will download a maximum of 5MB.
+func downloadCSSToBytes(url string) ([]byte, error) {
+	client := safeHTTPClient()
+	req, err := http.NewRequestWithContext(context.TODO(), http.MethodGet, url, nil)
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+
+	req.Header.Set("User-Agent", "Mailpit HTML Checker/"+config.Version)
+
+	// Get the link response data
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != 200 {
-		err := fmt.Errorf("Error downloading %s", url)
+		err := fmt.Errorf("error downloading %s", url)
 		return nil, err
 	}
 
-	body, err := io.ReadAll(resp.Body)
+	ct := strings.ToLower(resp.Header.Get("content-type"))
+	if !strings.Contains(ct, "text/css") {
+		err := fmt.Errorf("invalid CSS content-type from %s: \"%s\" (expected \"text/css\")", url, ct)
+		return nil, err
+	}
+
+	// set a limit on the number of bytes to read - max 5MB
+	limit := int64(5242880)
+	limitedReader := &io.LimitedReader{R: resp.Body, N: limit}
+
+	body, err := io.ReadAll(limitedReader)
 	if err != nil {
 		return nil, err
 	}
@@ -208,10 +228,12 @@ func downloadToBytes(url string) ([]byte, error) {
 	return body, nil
 }
 
-// Test if str is a URL
-func isURL(str string) bool {
+// Test if the string is a supported URL.
+// The URL must have the "http" or "https" scheme, and must not contain any login info (http://user:pass@<host>).
+func isValidURL(str string) bool {
 	u, err := url.Parse(str)
-	return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != ""
+
+	return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Hostname() != "" && u.User.String() == ""
 }
 
 // Test the HTML for inline CSS styles and styling attributes
@@ -249,3 +271,64 @@ func testInlineStyles(doc *goquery.Document) map[string]int {
 
 	return matches
 }
+
+func safeHTTPClient() *http.Client {
+	dialer := &net.Dialer{
+		Timeout:   5 * time.Second,
+		KeepAlive: 30 * time.Second,
+	}
+
+	tr := &http.Transport{
+		Proxy:                 nil, // avoid env proxy surprises unless you explicitly want it
+		DialContext:           safeDialContext(dialer),
+		TLSHandshakeTimeout:   5 * time.Second,
+		ResponseHeaderTimeout: 10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		IdleConnTimeout:       30 * time.Second,
+		MaxIdleConns:          50,
+	}
+
+	client := &http.Client{
+		Transport: tr,
+		Timeout:   15 * time.Second,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			// re-validate every redirect hop.
+			if len(via) >= 3 {
+				return errors.New("too many redirects")
+			}
+			if !isValidURL(req.URL.String()) {
+				return errors.New("invalid redirect URL")
+			}
+
+			return nil
+		},
+	}
+
+	return client
+}
+
+// safeDialContext is the same pattern as linkcheck/status.go::safeDialContext
+// — copy the function (or factor a shared helper into internal/tools/net.go).
+func safeDialContext(dialer *net.Dialer) func(ctx context.Context, network, address string) (net.Conn, error) {
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		host, port, err := net.SplitHostPort(address)
+		if err != nil {
+			return nil, err
+		}
+
+		ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+		if err != nil {
+			return nil, err
+		}
+
+		if !config.AllowInternalHTTPRequests {
+			for _, ip := range ips {
+				if tools.IsInternalIP(ip.IP) {
+					return nil, fmt.Errorf("blocked request to %s (%s): private/reserved address", host, ip)
+				}
+			}
+		}
+
+		return dialer.DialContext(ctx, network, net.JoinHostPort(ips[0].IP.String(), port))
+	}
+}

internal/htmlcheck/inline_test.go

@@ -72,7 +72,7 @@ func TestInlineStyleDetection(t *testing.T) {
 	}
 }
 
-func assertEqual(t *testing.T, a interface{}, b interface{}, message string) {
+func assertEqual(t *testing.T, a any, b any, message string) {
 	if a == b {
 		return
 	}

internal/htmlcheck/main.go

@@ -141,30 +141,31 @@ func (c CanIEmail) getTest(k string) (Warning, error) {
 			continue
 		}
 
-		for platform, clients := range stats.(map[string]interface{}) {
+		for platform, clients := range stats.(map[string]any) {
 			if len(LimitPlatforms) != 0 && !tools.InArray(platform, LimitPlatforms) {
 				continue
 			}
-			for version, support := range clients.(map[string]interface{}) {
+			for version, support := range clients.(map[string]any) {
 				s := Result{}
 				s.Name = fmt.Sprintf("%s %s (%s)", c.NiceNames.Family[family], c.NiceNames.Platform[platform], version)
 				s.Family = family
 				s.Platform = platform
 				s.Version = version
 
-				if support == "y" {
+				switch support {
+				case "y":
 					y++
 					s.Support = "yes"
-				} else if support == "n" {
+				case "n":
 					n++
 					s.Support = "no"
-				} else {
+				default:
 					p++
 					s.Support = "partial"
 
-					noteIDS := noteMatch.FindStringSubmatch(fmt.Sprintf("%s", support))
+					noteIDs := noteMatch.FindStringSubmatch(fmt.Sprintf("%s", support))
 
-					for _, id := range noteIDS {
+					for _, id := range noteIDs {
 						s.NoteNumber = id
 					}
 				}

internal/htmlcheck/platforms.go

@@ -1,7 +1,7 @@
 package htmlcheck
 
 import (
-	"sort"
+	"slices"
 
 	"github.com/axllent/mailpit/internal/tools"
 )
@@ -18,7 +18,7 @@ func Platforms() (map[string][]string, error) {
 	for _, t := range cie.Data {
 		for family, stats := range t.Stats {
 			niceFamily := cie.NiceNames.Family[family]
-			for platform := range stats.(map[string]interface{}) {
+			for platform := range stats.(map[string]any) {
 				c, found := data[platform]
 				if !found {
 					data[platform] = []string{}
@@ -32,9 +32,7 @@ func Platforms() (map[string][]string, error) {
 	}
 
 	for group, clients := range data {
-		sort.Slice(clients, func(i, j int) bool {
-			return clients[i] < clients[j]
-		})
+		slices.Sort(clients)
 		data[group] = clients
 	}
 

internal/linkcheck/linkcheck_test.go

@@ -1,7 +1,9 @@
 package linkcheck
 
 import (
+	"fmt"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/axllent/mailpit/internal/storage"
@@ -31,7 +33,14 @@ var (
 	</html>`
 
 	expectedHTMLLinks = []string{
-		"http://example.com", "https://example.com", "HTTPS://EXAMPLE.COM", "http://localhost", "https://localhost", "https://127.0.0.1", "http://link with spaces", "http://example.com/?blaah=yes&test=true",
+		"http://example.com",
+		"https://example.com",
+		"HTTPS://EXAMPLE.COM",
+		"http://localhost",
+		"https://localhost",
+		"https://127.0.0.1",
+		"http://link with spaces",
+		"http://example.com/?blaah=yes&test=true",
 		"http://remote-host/style.css",  // css
 		"https://example.com/image.jpg", // images
 	}
@@ -41,10 +50,18 @@ var (
 		[http://localhost]
 		www.google.com < ignored
 		|||http://example.com/?some=query-string|||
+		// RFC2396 appendix E states angle brackets are recommended for text/plain emails to
+		// recognize potential spaces in between the URL
+		<https://example.com/ link with spaces>
 	`
 
 	expectedTextLinks = []string{
-		"http://example.com", "https://example.com", "HTTPS://EXAMPLE.COM", "http://localhost", "http://example.com/?some=query-string",
+		"http://example.com",
+		"https://example.com",
+		"HTTPS://EXAMPLE.COM",
+		"http://localhost",
+		"http://example.com/?some=query-string",
+		"https://example.com/ link with spaces",
 	}
 )
 
@@ -57,15 +74,47 @@ func TestLinkDetection(t *testing.T) {
 	m.Text = testTextLinks
 	m.HTML = testHTML
 
-	textLinks := extractTextLinks(&m)
+	textC := &linkCollector{seen: make(map[string]bool)}
+	extractTextLinks(&m, textC)
 
-	if !reflect.DeepEqual(textLinks, expectedTextLinks) {
+	if !reflect.DeepEqual(textC.links, expectedTextLinks) {
 		t.Fatalf("Failed to detect text links correctly")
 	}
 
-	htmlLinks := extractHTMLLinks(&m)
+	htmlC := &linkCollector{seen: make(map[string]bool)}
+	extractHTMLLinks(&m, htmlC)
 
-	if !reflect.DeepEqual(htmlLinks, expectedHTMLLinks) {
+	if !reflect.DeepEqual(htmlC.links, expectedHTMLLinks) {
 		t.Fatalf("Failed to detect HTML links correctly")
 	}
 }
+
+func TestLinkLimit(t *testing.T) {
+	var html strings.Builder
+	html.WriteString("<html><body>")
+	for i := range maxUniqueLinks + 50 {
+		fmt.Fprintf(&html, `<a href="http://example.com/%d">link</a>`, i)
+	}
+	html.WriteString("</body></html>")
+
+	var text strings.Builder
+	for i := range 100 {
+		fmt.Fprintf(&text, " http://text-example.com/%d ", i)
+	}
+
+	m := storage.Message{HTML: html.String(), Text: text.String()}
+
+	c := &linkCollector{seen: make(map[string]bool)}
+	extractHTMLLinks(&m, c)
+	extractTextLinks(&m, c)
+
+	if len(c.links) != maxUniqueLinks {
+		t.Fatalf("expected %d links, got %d", maxUniqueLinks, len(c.links))
+	}
+
+	for _, l := range c.links {
+		if strings.HasPrefix(l, "http://text-example.com/") {
+			t.Fatalf("text extractor should not have run once HTML filled the collector, got %q", l)
+		}
+	}
+}

internal/linkcheck/main.go

@@ -2,6 +2,7 @@
 package linkcheck
 
 import (
+	"context"
 	"regexp"
 	"strings"
 
@@ -12,13 +13,17 @@ import (
 
 var linkRe = regexp.MustCompile(`(?im)\b(http|https):\/\/([\-\w@:%_\+'!.~#?,&\/\/=;]+)`)
 
+// maxUniqueLinks caps how many unique links will be tested per message.
+const maxUniqueLinks = 100
+
 // RunTests will run all tests on an HTML string
-func RunTests(msg *storage.Message, followRedirects bool) (Response, error) {
+func RunTests(ctx context.Context, msg *storage.Message, followRedirects bool) (Response, error) {
 	s := Response{}
 
-	allLinks := extractHTMLLinks(msg)
-	allLinks = strUnique(append(allLinks, extractTextLinks(msg)...))
-	s.Links = getHTTPStatuses(allLinks, followRedirects)
+	c := &linkCollector{seen: make(map[string]bool)}
+	extractHTMLLinks(msg, c)
+	extractTextLinks(msg, c)
+	s.Links = getHTTPStatuses(ctx, c.links, followRedirects)
 
 	for _, l := range s.Links {
 		if l.StatusCode >= 400 || l.StatusCode == 0 {
@@ -29,62 +34,91 @@ func RunTests(msg *storage.Message, followRedirects bool) (Response, error) {
 	return s, nil
 }
 
-func extractTextLinks(msg *storage.Message) []string {
-	links := []string{}
-
-	links = append(links, linkRe.FindAllString(msg.Text, -1)...)
-
-	return links
+// linkCollector accumulates unique links up to maxUniqueLinks.
+type linkCollector struct {
+	seen  map[string]bool
+	links []string
 }
 
-func extractHTMLLinks(msg *storage.Message) []string {
-	links := []string{}
+// full reports whether the collector has reached maxUniqueLinks.
+func (c *linkCollector) full() bool {
+	return len(c.links) >= maxUniqueLinks
+}
+
+// add appends link if new and within capacity, returning false when the
+// collector is full and the caller should stop producing more links.
+func (c *linkCollector) add(link string) bool {
+	if c.full() {
+		return false
+	}
+	if !c.seen[link] {
+		c.seen[link] = true
+		c.links = append(c.links, link)
+	}
+	return !c.full()
+}
+
+func extractTextLinks(msg *storage.Message, c *linkCollector) {
+	if c.full() {
+		return
+	}
+
+	testLinkRe := regexp.MustCompile(`(?im)([^<]\b)((http|https):\/\/([\-\w@:%_\+'!.~#?,&\/\/=;]+))`)
+	// RFC2396 appendix E states angle brackets are recommended for text/plain emails to
+	// recognize potential spaces in between the URL
+	// @see https://www.rfc-editor.org/rfc/rfc2396#appendix-E
+	bracketLinkRe := regexp.MustCompile(`(?im)<((http|https):\/\/([\-\w@:%_\+'!.~#?,&\/\/=;][^>]+))>`)
+
+	// Cap the regex match count to bound work on very large bodies; the
+	// 3x multiplier leaves headroom for duplicates the collector will drop.
+	matchLimit := maxUniqueLinks * 3
+
+	matches := testLinkRe.FindAllStringSubmatch(msg.Text, matchLimit)
+	for _, match := range matches {
+		if len(match) > 0 {
+			if !c.add(match[2]) {
+				return
+			}
+		}
+	}
+
+	angleMatches := bracketLinkRe.FindAllStringSubmatch(msg.Text, matchLimit)
+	for _, match := range angleMatches {
+		if len(match) > 0 {
+			link := strings.ReplaceAll(match[1], "\n", "")
+			if !c.add(link) {
+				return
+			}
+		}
+	}
+}
+
+func extractHTMLLinks(msg *storage.Message, c *linkCollector) {
+	if c.full() {
+		return
+	}
 
 	reader := strings.NewReader(msg.HTML)
 
 	// Load the HTML document
 	doc, err := goquery.NewDocumentFromReader(reader)
 	if err != nil {
-		return links
+		return
 	}
 
-	aLinks := doc.Find("a[href]").Nodes
-	for _, link := range aLinks {
-		l, err := tools.GetHTMLAttributeVal(link, "href")
-		if err == nil && linkRe.MatchString(l) {
-			links = append(links, l)
+	for _, sel := range []struct{ selector, attr string }{
+		{"a[href]", "href"},
+		{`link[rel="stylesheet"]`, "href"},
+		{"img[src]", "src"},
+	} {
+		for _, node := range doc.Find(sel.selector).Nodes {
+			l, err := tools.GetHTMLAttributeVal(node, sel.attr)
+			if err != nil || !linkRe.MatchString(l) {
+				continue
+			}
+			if !c.add(l) {
+				return
+			}
 		}
 	}
-
-	cssLinks := doc.Find("link[rel=\"stylesheet\"]").Nodes
-	for _, link := range cssLinks {
-		l, err := tools.GetHTMLAttributeVal(link, "href")
-		if err == nil && linkRe.MatchString(l) {
-			links = append(links, l)
-		}
-	}
-
-	imgLinks := doc.Find("img[src]").Nodes
-	for _, link := range imgLinks {
-		l, err := tools.GetHTMLAttributeVal(link, "src")
-		if err == nil && linkRe.MatchString(l) {
-			links = append(links, l)
-		}
-	}
-
-	return links
-}
-
-// strUnique return a slice of unique strings from a slice
-func strUnique(strSlice []string) []string {
-	keys := make(map[string]bool)
-	list := []string{}
-	for _, entry := range strSlice {
-		if _, value := keys[entry]; !value {
-			keys[entry] = true
-			list = append(list, entry)
-		}
-	}
-
-	return list
 }

internal/linkcheck/status.go

@@ -1,83 +1,105 @@
 package linkcheck
 
 import (
+	"context"
 	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
 	"net/http"
 	"regexp"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
+	"github.com/axllent/mailpit/internal/tools"
 )
 
-func getHTTPStatuses(links []string, followRedirects bool) []Link {
-	// allow 5 threads
-	threads := make(chan int, 5)
-
-	results := make(map[string]Link, len(links))
-	resultsMutex := sync.RWMutex{}
-
-	output := []Link{}
-
+func getHTTPStatuses(ctx context.Context, links []string, followRedirects bool) []Link {
+	results := make([]Link, len(links))
 	var wg sync.WaitGroup
+	var warnedDomains sync.Map
+
+	for i, l := range links {
+		if cached, ok := cachedLink(l); ok {
+			results[i] = cached
+			continue
+		}
 
-	for _, l := range links {
 		wg.Add(1)
-		go func(link string, w *sync.WaitGroup) {
-			threads <- 1 // will block if MAX threads
-			defer w.Done()
+		go func(idx int, link string) {
+			defer wg.Done()
 
-			code, err := doHead(link, followRedirects)
-			l := Link{}
-			l.URL = link
+			domain := registeredDomain(link)
+			release, err := acquireDomainSlot(ctx, domain, &warnedDomains)
+			if err != nil {
+				results[idx] = Link{URL: link, StatusCode: 0, Status: httpErrorSummary(err)}
+				return
+			}
+			defer release()
+
+			code, err := doHead(ctx, link, followRedirects)
+			l := Link{URL: link}
 			if err != nil {
 				l.StatusCode = 0
 				l.Status = httpErrorSummary(err)
+				if strings.Contains(l.Status, "private/reserved address") {
+					l.Status = "Blocked private/reserved address"
+					l.StatusCode = 451
+				}
 			} else {
 				l.StatusCode = code
 				l.Status = http.StatusText(code)
 			}
-			resultsMutex.Lock()
-			results[link] = l
-			resultsMutex.Unlock()
-
-			<-threads // remove from threads
-		}(l, &wg)
+			results[idx] = l
+			storeLink(link, l)
+		}(i, l)
 	}
 
 	wg.Wait()
-
-	for _, l := range results {
-		output = append(output, l)
-	}
-
-	return output
+	return results
 }
 
 // Do a HEAD request to return HTTP status code
-func doHead(link string, followRedirects bool) (int, error) {
+func doHead(ctx context.Context, link string, followRedirects bool) (int, error) {
+	if !tools.IsValidLinkURL(link) {
+		return 0, fmt.Errorf("invalid URL: %s", link)
+	}
 
-	timeout := time.Duration(10 * time.Second)
+	dialer := &net.Dialer{
+		Timeout:   10 * time.Second,
+		KeepAlive: 30 * time.Second,
+	}
 
-	tr := &http.Transport{}
+	tr := &http.Transport{
+		DialContext: safeDialContext(dialer),
+	}
 
 	if config.AllowUntrustedTLS {
+		// user has explicitly allowed untrusted TLS, so we will not verify it for link checks
 		tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec
 	}
 
 	client := http.Client{
-		Timeout:   timeout,
+		Timeout:   10 * time.Second,
 		Transport: tr,
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if followRedirects {
-				return nil
+			if len(via) >= 3 {
+				return errors.New("too many redirects")
 			}
-			return http.ErrUseLastResponse
+			if !followRedirects {
+				return http.ErrUseLastResponse
+			}
+			if !tools.IsValidLinkURL(req.URL.String()) {
+				return fmt.Errorf("blocked redirect to invalid URL: %s", req.URL)
+			}
+			return nil
 		},
 	}
 
-	req, err := http.NewRequest("HEAD", link, nil)
+	req, err := http.NewRequestWithContext(ctx, "HEAD", link, nil)
 	if err != nil {
 		logger.Log().Errorf("[link-check] %s", err.Error())
 		return 0, err
@@ -92,7 +114,6 @@ func doHead(link string, followRedirects bool) (int, error) {
 		}
 
 		return 0, err
-
 	}
 
 	return res.StatusCode, nil
@@ -107,8 +128,33 @@ func httpErrorSummary(err error) string {
 	if !re.MatchString(e) {
 		return e
 	}
-
 	parts := re.FindAllStringSubmatch(e, -1)
 
 	return parts[0][len(parts[0])-1]
 }
+
+// SafeDialContext is a custom dialer that checks if the resolved IP addresses are internal before allowing the connection.
+func safeDialContext(dialer *net.Dialer) func(ctx context.Context, network, address string) (net.Conn, error) {
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		host, port, err := net.SplitHostPort(address)
+		if err != nil {
+			return nil, err
+		}
+
+		ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+		if err != nil {
+			return nil, err
+		}
+
+		if !config.AllowInternalHTTPRequests {
+			for _, ip := range ips {
+				if tools.IsInternalIP(ip.IP) {
+					logger.Log().Warnf("[link-check] Blocked HEAD request to private/reserved address: %s (%s)", host, ip)
+					return nil, fmt.Errorf("blocked request to %s (%s): private/reserved address", host, ip)
+				}
+			}
+		}
+
+		return dialer.DialContext(ctx, network, net.JoinHostPort(ips[0].IP.String(), port))
+	}
+}

internal/linkcheck/throttle.go

@@ -0,0 +1,219 @@
+package linkcheck
+
+import (
+	"container/list"
+	"context"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/axllent/mailpit/config"
+	"github.com/axllent/mailpit/internal/logger"
+	"golang.org/x/net/publicsuffix"
+	"golang.org/x/time/rate"
+)
+
+// Per-domain rate-limiter parameters. The bucket starts full so a single
+// fresh check of a 100-link newsletter completes without waiting; refill
+// caps sustained traffic to any one registered domain at 1 req/s across
+// all concurrent API calls.
+const (
+	perDomainBurst       = 100
+	perDomainRefill      = rate.Limit(1)
+	perDomainConcurrency = 2
+
+	// limiterRegistryCap bounds memory regardless of attacker effort.
+	// Eviction prefers buckets at full capacity (safe to drop).
+	limiterRegistryCap = 10000
+
+	// resultCacheTTL deduplicates repeated checks of the same URL so a
+	// user retesting the same email doesn't drain the rate limiter twice
+	// and an attacker can't multiply outbound load by looping the API.
+	resultCacheTTL = 60 * time.Second
+)
+
+type domainState struct {
+	limiter *rate.Limiter
+	sem     chan struct{}
+	lruElem *list.Element
+}
+
+type registry struct {
+	mu      sync.Mutex
+	entries map[string]*domainState
+	lru     *list.List // front = most recently used
+}
+
+func newRegistry() *registry {
+	return &registry{
+		entries: make(map[string]*domainState),
+		lru:     list.New(),
+	}
+}
+
+// get returns the state for a registered domain, creating it on demand.
+// When the registry is at capacity, prefers to evict entries whose bucket
+// is at full capacity (no security cost — recreating yields identical state).
+func (r *registry) get(domain string) *domainState {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if st, ok := r.entries[domain]; ok {
+		r.lru.MoveToFront(st.lruElem)
+		return st
+	}
+
+	if len(r.entries) >= limiterRegistryCap {
+		r.evictLocked()
+	}
+
+	st := &domainState{
+		limiter: rate.NewLimiter(perDomainRefill, perDomainBurst),
+		sem:     make(chan struct{}, perDomainConcurrency),
+	}
+	st.lruElem = r.lru.PushFront(domainKey{domain: domain, state: st})
+	r.entries[domain] = st
+
+	return st
+}
+
+type domainKey struct {
+	domain string
+	state  *domainState
+}
+
+// evictLocked drops one entry. Caller must hold r.mu.
+// Walks the LRU from the back looking for a full bucket; if none, drops the LRU.
+func (r *registry) evictLocked() {
+	for e := r.lru.Back(); e != nil; e = e.Prev() {
+		k := e.Value.(domainKey)
+		if k.state.limiter.Tokens() >= float64(perDomainBurst) {
+			r.lru.Remove(e)
+			delete(r.entries, k.domain)
+			return
+		}
+	}
+
+	e := r.lru.Back()
+	if e == nil {
+		return
+	}
+
+	k := e.Value.(domainKey)
+	r.lru.Remove(e)
+	delete(r.entries, k.domain)
+}
+
+type cachedResult struct {
+	link    Link
+	expires time.Time
+}
+
+type resultCache struct {
+	mu      sync.Mutex
+	entries map[string]cachedResult
+}
+
+func newResultCache() *resultCache {
+	return &resultCache{entries: make(map[string]cachedResult)}
+}
+
+func (c *resultCache) get(u string) (Link, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	e, ok := c.entries[u]
+	if !ok {
+		return Link{}, false
+	}
+	if time.Now().After(e.expires) {
+		delete(c.entries, u)
+		return Link{}, false
+	}
+
+	return e.link, true
+}
+
+func (c *resultCache) put(u string, l Link) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.entries[u] = cachedResult{link: l, expires: time.Now().Add(resultCacheTTL)}
+	// Opportunistic sweep: when the cache grows past a threshold,
+	// drop expired entries. Avoids unbounded growth without a goroutine.
+	if len(c.entries) > 2*limiterRegistryCap {
+		now := time.Now()
+		for k, v := range c.entries {
+			if now.After(v.expires) {
+				delete(c.entries, k)
+			}
+		}
+	}
+}
+
+var (
+	domainRegistry = newRegistry()
+	linkCache      = newResultCache()
+)
+
+// registeredDomain returns the eTLD+1 for a URL's host, or the lowercased
+// host if no registered domain can be determined (e.g. IP literals).
+// Subdomains share the same key so wildcard-DNS bypass is closed.
+func registeredDomain(rawurl string) string {
+	u, err := url.Parse(rawurl)
+	if err != nil {
+		return ""
+	}
+	host := strings.ToLower(u.Hostname())
+	if host == "" {
+		return ""
+	}
+	d, err := publicsuffix.EffectiveTLDPlusOne(host)
+	if err != nil {
+		return host
+	}
+
+	return d
+}
+
+// acquireDomainSlot blocks until both a rate-limit token and a per-domain
+// concurrency slot are available, or ctx is cancelled. Returns a release
+// function that must be called when the request completes.
+func acquireDomainSlot(ctx context.Context, domain string, warned *sync.Map) (release func(), err error) {
+	if config.DisableLinkCheckRateLimit {
+		return func() {}, nil
+	}
+	st := domainRegistry.get(domain)
+	if st.limiter.Tokens() < 1 {
+		if _, alreadyWarned := warned.LoadOrStore(domain, struct{}{}); !alreadyWarned {
+			logger.Log().Warnf("[link-check] rate limiting active for %s - use --disable-link-check-rate-limit to disable", domain)
+		}
+	}
+	if err := st.limiter.Wait(ctx); err != nil {
+		return nil, err
+	}
+	select {
+	case st.sem <- struct{}{}:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+
+	return func() { <-st.sem }, nil
+}
+
+// cachedLink returns a previously-checked result if still fresh.
+func cachedLink(u string) (Link, bool) {
+	if config.DisableLinkCheckRateLimit {
+		return Link{}, false
+	}
+	return linkCache.get(u)
+}
+
+// storeLink caches a result so repeat checks of the same URL skip the
+// rate limiter and the outbound HEAD.
+func storeLink(u string, l Link) {
+	if config.DisableLinkCheckRateLimit {
+		return
+	}
+
+	linkCache.put(u, l)
+}

internal/logger/logger.go

@@ -1,84 +1,177 @@
 // Package logger handles the logging
+// Mailpit now uses slog for logging, but this package provides a logrus-compatible API and formatting to avoid changing all existing log calls
+// and provide backwards compatibility with logrus formatting and features like log levels and file output.
 package logger
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"regexp"
-
-	"github.com/sirupsen/logrus"
+	"sync"
 )
 
+// Logger wraps slog.Logger providing a logrus-compatible API
+type Logger struct {
+	sl *slog.Logger
+}
+
 var (
-	log *logrus.Logger
+	log *Logger
 	// VerboseLogging for verbose logging
 	VerboseLogging bool
 	// QuietLogging shows only errors
 	QuietLogging bool
-	// NoLogging shows only fatal errors
+	// NoLogging disables all logging (tests)
 	NoLogging bool
 	// LogFile sets a log file
 	LogFile string
 )
 
-// Log returns the logger instance
-func Log() *logrus.Logger {
+// Log returns the logger instance, initialising it on first call. The level and
+// output destination are determined once from VerboseLogging, QuietLogging,
+// NoLogging, and LogFile at the time of first use.
+func Log() *Logger {
 	if log == nil {
-		log = logrus.New()
-		log.SetLevel(logrus.InfoLevel)
-		if VerboseLogging {
-			// verbose logging (debug)
-			log.SetLevel(logrus.DebugLevel)
-		} else if QuietLogging {
-			// show errors only
-			log.SetLevel(logrus.ErrorLevel)
-		} else if NoLogging {
-			// disable all logging (tests)
-			log.SetLevel(logrus.PanicLevel)
+		level := slog.LevelInfo
+		switch {
+		case VerboseLogging:
+			level = slog.LevelDebug
+		case QuietLogging:
+			level = slog.LevelError
+		case NoLogging:
+			level = slog.Level(100) // above all real levels — silences all output
 		}
 
+		out := os.Stdout
 		if LogFile != "" {
 			file, err := os.OpenFile(filepath.Clean(LogFile), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0664) // #nosec
 			if err == nil {
-				log.Out = file
+				out = file
 			} else {
-				log.Out = os.Stdout
-				log.Warn("Failed to log to file, using default stderr")
+				fmt.Fprintln(os.Stderr, "failed to log to file, using default stdout")
 			}
-		} else {
-			log.Out = os.Stdout
 		}
 
-		log.SetFormatter(&logrus.TextFormatter{
-			FullTimestamp:   true,
-			TimestampFormat: "2006/01/02 15:04:05",
-		})
+		log = &Logger{
+			sl: slog.New(&logrusHandler{
+				out:   out,
+				level: level,
+				color: isTerminal(out),
+			}),
+		}
 	}
 
 	return log
 }
 
-// PrettyPrint for debugging
-func PrettyPrint(i interface{}) {
+// logrusHandler is a slog.Handler that formats output to match logrus TextFormatter.
+// TTY output:  INFO[2006/01/02 15:04:05] message
+// File output: time="2006/01/02 15:04:05" level=info msg="message"
+type logrusHandler struct {
+	mu    sync.Mutex
+	out   *os.File
+	level slog.Level
+	color bool
+}
+
+// Enabled reports whether the handler will emit a record at the given level.
+func (h *logrusHandler) Enabled(_ context.Context, level slog.Level) bool {
+	return level >= h.level
+}
+
+// Handle formats and writes a log record. TTY output is coloured; file output
+// uses the logrus key=value text format.
+func (h *logrusHandler) Handle(_ context.Context, r slog.Record) error {
+	label, name, code := logrusLevel(r.Level)
+	ts := r.Time.Format("2006/01/02 15:04:05")
+
+	var line string
+	if h.color {
+		line = fmt.Sprintf("\x1b[%dm%s\x1b[0m[%s] %s\n", code, label, ts, r.Message)
+	} else {
+		line = fmt.Sprintf("time=%q level=%s msg=%q\n", ts, name, r.Message)
+	}
+
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	_, err := fmt.Fprint(h.out, line)
+	return err
+}
+
+// WithAttrs returns the handler unchanged; structured attributes are not used.
+func (h *logrusHandler) WithAttrs(_ []slog.Attr) slog.Handler { return h }
+
+// WithGroup returns the handler unchanged; groups are not used.
+func (h *logrusHandler) WithGroup(_ string) slog.Handler { return h }
+
+// logrusLevel maps slog levels to the 4-char TTY label, lowercase file label, and ANSI colour code.
+func logrusLevel(level slog.Level) (string, string, int) {
+	switch {
+	case level < slog.LevelInfo:
+		return "DEBU", "debug", 37 // gray
+	case level < slog.LevelWarn:
+		return "INFO", "info", 36 // cyan
+	case level < slog.LevelError:
+		return "WARN", "warning", 33 // yellow
+	default:
+		return "ERRO", "error", 31 // red
+	}
+}
+
+// isTerminal reports whether f is connected to a terminal.
+func isTerminal(f *os.File) bool {
+	info, err := f.Stat()
+	return err == nil && info.Mode()&os.ModeCharDevice != 0
+}
+
+// Info logs a message at INFO level.
+func (l *Logger) Info(args ...any) { l.sl.Info(fmt.Sprint(args...)) }
+
+// Infof logs a formatted message at INFO level.
+func (l *Logger) Infof(format string, args ...any) { l.sl.Info(fmt.Sprintf(format, args...)) }
+
+// Debug logs a message at DEBUG level.
+func (l *Logger) Debug(args ...any) { l.sl.Debug(fmt.Sprint(args...)) }
+
+// Debugf logs a formatted message at DEBUG level.
+func (l *Logger) Debugf(format string, args ...any) { l.sl.Debug(fmt.Sprintf(format, args...)) }
+
+// Warn logs a message at WARN level.
+func (l *Logger) Warn(args ...any) { l.sl.Warn(fmt.Sprint(args...)) }
+
+// Warnf logs a formatted message at WARN level.
+func (l *Logger) Warnf(format string, args ...any) { l.sl.Warn(fmt.Sprintf(format, args...)) }
+
+// Error logs a message at ERROR level.
+func (l *Logger) Error(args ...any) { l.sl.Error(fmt.Sprint(args...)) }
+
+// Errorf logs a formatted message at ERROR level.
+func (l *Logger) Errorf(format string, args ...any) { l.sl.Error(fmt.Sprintf(format, args...)) }
+
+// Printf logs a formatted message at INFO level.
+func (l *Logger) Printf(format string, args ...any) { l.sl.Info(fmt.Sprintf(format, args...)) }
+
+// Fatal logs a message at ERROR level then exits with status 1.
+func (l *Logger) Fatal(args ...any) { l.sl.Error(fmt.Sprint(args...)); os.Exit(1) }
+
+// Fatalf logs a formatted message at ERROR level then exits with status 1.
+func (l *Logger) Fatalf(format string, args ...any) {
+	l.sl.Error(fmt.Sprintf(format, args...))
+	os.Exit(1)
+}
+
+// PrettyPrint prints any value as indented JSON to stdout, for debugging.
+func PrettyPrint(i any) {
 	s, _ := json.MarshalIndent(i, "", "\t")
 	fmt.Println(string(s))
 }
 
-// CleanIP returns a human-readable IP for the logging interface
-// when starting services. It translates [::]:<port> to "0.0.0.0:<port>"
-func CleanIP(s string) string {
-	re := regexp.MustCompile(`^\[\:\:\]\:\d+`)
-	if re.MatchString(s) {
-		return "0.0.0.0:" + s[5:]
-	}
-
-	return s
-}
-
-// CleanHTTPIP returns a human-readable IP for the logging interface
-// when starting services. It translates [::]:<port> to "localhost:<port>"
+// CleanHTTPIP returns a human-readable address for log output.
+// It translates [::]:<port> to localhost:<port>.
 func CleanHTTPIP(s string) string {
 	re := regexp.MustCompile(`^\[\:\:\]\:\d+`)
 	if re.MatchString(s) {

internal/pop3/functions.go

@@ -18,7 +18,7 @@ func authUser(username, password string) bool {
 
 // Send a response with debug logging
 func sendResponse(c net.Conn, m string) {
-	fmt.Fprintf(c, "%s\r\n", m)
+	_, _ = fmt.Fprintf(c, "%s\r\n", m)
 	logger.Log().Debugf("[pop3] response: %s", m)
 
 	if strings.HasPrefix(m, "-ERR ") {
@@ -29,7 +29,7 @@ func sendResponse(c net.Conn, m string) {
 
 // Send a response without debug logging (for data)
 func sendData(c net.Conn, m string) {
-	fmt.Fprintf(c, "%s\r\n", m)
+	_, _ = fmt.Fprintf(c, "%s\r\n", m)
 }
 
 // Get the latest 100 messages

internal/pop3/pop3_test.go

@@ -29,22 +29,21 @@ func TestPOP3(t *testing.T) {
 
 	// connect with bad password
 	t.Log("Testing invalid login")
-	c, err := connectBadAuth()
-	if err == nil {
+	if _, err := connectBadAuth(); err == nil {
 		t.Error("invalid login gained access")
 		return
 	}
 
 	t.Log("Testing valid login")
-	c, err = connectAuth()
+	c, err := connectAuth()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
 	count, size, err := c.Stat()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -53,7 +52,7 @@ func TestPOP3(t *testing.T) {
 
 	// quit else we get old data
 	if err := c.Quit(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -63,13 +62,13 @@ func TestPOP3(t *testing.T) {
 
 	c, err = connectAuth()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
 	count, _, err = c.Stat()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -80,23 +79,60 @@ func TestPOP3(t *testing.T) {
 	for i := 1; i <= 20; i++ {
 		_, err := c.Retr(i)
 		if err != nil {
-			t.Errorf(err.Error())
+			t.Error(err.Error())
 			return
 		}
 	}
 
+	t.Log("Checking UIDL with multiple arguments")
+
+	_, err = c.Cmd("UIDL", false, 1, 2, 3)
+	if err == nil {
+		t.Error("UIDL with multiple arguments should return an error")
+		return
+	}
+
+	t.Log("Checking UIDL without a message id")
+
+	messageIDs, err := c.Uidl(0)
+	if err != nil {
+		t.Error(err.Error())
+		return
+	}
+
+	if len(messageIDs) != 50 {
+		assertEqual(t, len(messageIDs), 50, "incorrect UIDL message count")
+	}
+
+	t.Log("Checking UIDL with a message ID")
+
+	messageIDs, err = c.Uidl(50)
+	if err != nil {
+		t.Error(err.Error())
+		return
+	}
+
+	assertEqual(t, len(messageIDs), 1, "incorrect UIDL message count")
+
+	t.Log("Checking UIDL with an invalid message ID")
+
+	if _, err := c.Uidl(51); err == nil {
+		t.Errorf("UIDL 51 should return an error")
+		return
+	}
+
 	t.Log("Deleting 25 messages")
 
 	for i := 1; i <= 25; i++ {
 		if err := c.Dele(i); err != nil {
-			t.Errorf(err.Error())
+			t.Error(err.Error())
 			return
 		}
 	}
 
 	// messages get deleted after a QUIT
 	if err := c.Quit(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -105,7 +141,7 @@ func TestPOP3(t *testing.T) {
 
 	c, err = connectAuth()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -113,7 +149,7 @@ func TestPOP3(t *testing.T) {
 
 	count, _, err = c.Stat()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -121,13 +157,13 @@ func TestPOP3(t *testing.T) {
 
 	// messages get deleted after a QUIT
 	if err := c.Quit(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
 	c, err = connectAuth()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -135,7 +171,7 @@ func TestPOP3(t *testing.T) {
 
 	for i := 1; i <= 25; i++ {
 		if err := c.Dele(i); err != nil {
-			t.Errorf(err.Error())
+			t.Error(err.Error())
 			return
 		}
 	}
@@ -143,31 +179,31 @@ func TestPOP3(t *testing.T) {
 	t.Log("Undeleting messages")
 
 	if err := c.Rset(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
 	if err := c.Quit(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
 	c, err = connectAuth()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
 	count, _, err = c.Stat()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
 	assertEqual(t, count, 25, "incorrect message count")
 
 	if err := c.Quit(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 }
@@ -190,7 +226,7 @@ func TestAuthentication(t *testing.T) {
 	// non-authenticated connection
 	c, err := connect()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -207,7 +243,7 @@ func TestAuthentication(t *testing.T) {
 	}
 
 	if err := c.Quit(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -216,7 +252,7 @@ func TestAuthentication(t *testing.T) {
 	// authenticated connection
 	c, err = connectAuth()
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 
@@ -233,13 +269,15 @@ func TestAuthentication(t *testing.T) {
 	}
 
 	if err := c.Quit(); err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 		return
 	}
 }
 
 func setup() {
-	auth.SetPOP3Auth("username:password")
+	if err := auth.SetPOP3Auth("username:password"); err != nil {
+		panic(err)
+	}
 	logger.NoLogging = true
 	config.MaxMessages = 0
 	config.Database = os.Getenv("MP_DATABASE")
@@ -324,11 +362,11 @@ func randRange(min, max int) int {
 }
 
 func insertEmailData(t *testing.T) {
-	for i := 0; i < 50; i++ {
+	for i := range 50 {
 		msg := enmime.Builder().
 			From(fmt.Sprintf("From %d", i), fmt.Sprintf("from-%d@example.com", i)).
 			Subject(fmt.Sprintf("Subject line %d end", i)).
-			Text([]byte(fmt.Sprintf("This is the email body %d <jdsauk;dwqmdqw;>.", i))).
+			Text(fmt.Appendf(nil, "This is the email body %d <jdsauk;dwqmdqw;>.", i)).
 			To(fmt.Sprintf("To %d", i), fmt.Sprintf("to-%d@example.com", i))
 
 		env, err := msg.Build()
@@ -359,7 +397,7 @@ func insertEmailData(t *testing.T) {
 	}
 }
 
-func assertEqual(t *testing.T, a interface{}, b interface{}, message string) {
+func assertEqual(t *testing.T, a any, b any, message string) {
 	if a == b {
 		return
 	}

internal/pop3/server.go

@@ -215,7 +215,7 @@ func handleTransactionCommand(conn net.Conn, cmd string, args []string, messages
 		for _, m := range messages {
 			totalSize += m.Size
 		}
-		sendResponse(conn, fmt.Sprintf("+OK %d %d", len(messages), int64(totalSize)))
+		sendResponse(conn, fmt.Sprintf("+OK %d %d", len(messages), totalSize))
 	case "LIST":
 		totalSize := uint64(0)
 		for _, m := range messages {
@@ -229,21 +229,41 @@ func handleTransactionCommand(conn net.Conn, cmd string, args []string, messages
 				sendResponse(conn, "-ERR no such message")
 				return
 			}
-			sendResponse(conn, fmt.Sprintf("+OK %d %d", nr, int64(messages[nr-1].Size)))
+			sendResponse(conn, fmt.Sprintf("+OK %d %d", nr, messages[nr-1].Size))
 		} else {
-			sendResponse(conn, fmt.Sprintf("+OK %d messages (%d octets)", len(messages), int64(totalSize)))
+			sendResponse(conn, fmt.Sprintf("+OK %d messages (%d octets)", len(messages), totalSize))
 
 			for row, m := range messages {
-				sendResponse(conn, fmt.Sprintf("%d %d", row+1, int64(m.Size))) // Convert Size to int64 when printing
+				sendResponse(conn, fmt.Sprintf("%d %d", row+1, m.Size))
 			}
 			sendResponse(conn, ".")
 		}
 	case "UIDL":
-		sendResponse(conn, "+OK unique-id listing follows")
-		for row, m := range messages {
-			sendResponse(conn, fmt.Sprintf("%d %s", row+1, m.ID))
+		if len(args) > 1 {
+			sendResponse(conn, "-ERR UIDL takes at most one argument")
+		} else if len(args) == 1 {
+			nr, err := strconv.Atoi(args[0])
+			if err != nil {
+				sendResponse(conn, "-ERR no such message")
+				return
+			}
+
+			if nr < 1 || nr > len(messages) {
+				sendResponse(conn, "-ERR no such message")
+				return
+			}
+
+			m := messages[nr-1]
+
+			sendResponse(conn, fmt.Sprintf("+OK %d %s", nr, m.ID))
+		} else {
+			sendResponse(conn, "+OK unique-id listing follows")
+			for row, m := range messages {
+				sendResponse(conn, fmt.Sprintf("%d %s", row+1, m.ID))
+			}
+			sendResponse(conn, ".")
 		}
-		sendResponse(conn, ".")
+
 	case "RETR":
 		if len(args) != 1 {
 			sendResponse(conn, "-ERR no such message")
@@ -271,7 +291,7 @@ func handleTransactionCommand(conn net.Conn, cmd string, args []string, messages
 		// begins with the termination octet, the line is "byte-stuffed" by
 		// pre-pending the termination octet to that line of the response.
 		// @see: https://www.ietf.org/rfc/rfc1939.txt
-		sendData(conn, strings.Replace(string(raw), "\n.", "\n..", -1))
+		sendData(conn, strings.ReplaceAll(string(raw), "\n.", "\n.."))
 		sendResponse(conn, ".")
 	case "TOP":
 		arg, err := getSafeArg(args, 0)

internal/pop3client/client.go

@@ -138,7 +138,7 @@ func (c *Conn) Send(b string) error {
 // in case of single line responses, or a help message followed by multiple lines of actual response
 // data in case of multiline responses.
 // See https://www.shellhacks.com/retrieve-email-pop3-server-command-line/ for examples.
-func (c *Conn) Cmd(cmd string, isMulti bool, args ...interface{}) (*bytes.Buffer, error) {
+func (c *Conn) Cmd(cmd string, isMulti bool, args ...any) (*bytes.Buffer, error) {
 	var cmdLine string
 
 	// Repeat a %v to format each arg.
@@ -422,7 +422,7 @@ func (c *Conn) Noop() error {
 // Message deletions (DELE command) are only executed by the server on a graceful
 // quit and close.
 func (c *Conn) Quit() error {
-	defer c.conn.Close()
+	defer func() { _ = c.conn.Close() }()
 
 	if _, err := c.Cmd("QUIT", false); err != nil {
 		return err
@@ -441,12 +441,12 @@ func parseResp(b []byte) ([]byte, error) {
 
 	if bytes.Equal(b, respOK) {
 		return nil, nil
-	} else if bytes.HasPrefix(b, respOKInfo) {
-		return bytes.TrimPrefix(b, respOKInfo), nil
+	} else if after, ok := bytes.CutPrefix(b, respOKInfo); ok {
+		return after, nil
 	} else if bytes.Equal(b, respErr) {
 		return nil, errors.New("unknown error (no info specified in response)")
-	} else if bytes.HasPrefix(b, respErrInfo) {
-		return nil, errors.New(string(bytes.TrimPrefix(b, respErrInfo)))
+	} else if after, ok := bytes.CutPrefix(b, respErrInfo); ok {
+		return nil, errors.New(string(after))
 	}
 
 	return nil, fmt.Errorf("unknown response: %s. Neither -ERR, nor +OK", string(b))

internal/prometheus/metrics.go

@@ -2,153 +2,184 @@
 package prometheus
 
 import (
+	"fmt"
+	"io"
 	"net/http"
+	"sort"
+	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
 	"github.com/axllent/mailpit/internal/stats"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
 )
 
-var (
-	// Registry is the Prometheus registry for Mailpit metrics
-	Registry = prometheus.NewRegistry()
-
-	// Metrics
-	totalMessages    prometheus.Gauge
-	unreadMessages   prometheus.Gauge
-	databaseSize     prometheus.Gauge
-	messagesDeleted  prometheus.Counter
-	smtpAccepted     prometheus.Counter
-	smtpRejected     prometheus.Counter
-	smtpIgnored      prometheus.Counter
-	smtpAcceptedSize prometheus.Counter
-	uptime           prometheus.Gauge
-	memoryUsage      prometheus.Gauge
-	tagCounters      *prometheus.GaugeVec
-)
-
-// InitMetrics initializes all Prometheus metrics
-func InitMetrics() {
-	// Create metrics
-	totalMessages = prometheus.NewGauge(prometheus.GaugeOpts{
-		Name: "mailpit_messages",
-		Help: "Total number of messages in the database",
-	})
-
-	unreadMessages = prometheus.NewGauge(prometheus.GaugeOpts{
-		Name: "mailpit_messages_unread",
-		Help: "Number of unread messages in the database",
-	})
-
-	databaseSize = prometheus.NewGauge(prometheus.GaugeOpts{
-		Name: "mailpit_database_size_bytes",
-		Help: "Size of the database in bytes",
-	})
-
-	messagesDeleted = prometheus.NewCounter(prometheus.CounterOpts{
-		Name: "mailpit_messages_deleted_total",
-		Help: "Total number of messages deleted",
-	})
-
-	smtpAccepted = prometheus.NewCounter(prometheus.CounterOpts{
-		Name: "mailpit_smtp_accepted_total",
-		Help: "Total number of SMTP messages accepted",
-	})
-
-	smtpRejected = prometheus.NewCounter(prometheus.CounterOpts{
-		Name: "mailpit_smtp_rejected_total",
-		Help: "Total number of SMTP messages rejected",
-	})
-
-	smtpIgnored = prometheus.NewCounter(prometheus.CounterOpts{
-		Name: "mailpit_smtp_ignored_total",
-		Help: "Total number of SMTP messages ignored (duplicates)",
-	})
-
-	smtpAcceptedSize = prometheus.NewCounter(prometheus.CounterOpts{
-		Name: "mailpit_smtp_accepted_size_bytes_total",
-		Help: "Total size of accepted SMTP messages in bytes",
-	})
-
-	uptime = prometheus.NewGauge(prometheus.GaugeOpts{
-		Name: "mailpit_uptime_seconds",
-		Help: "Uptime of Mailpit in seconds",
-	})
-
-	memoryUsage = prometheus.NewGauge(prometheus.GaugeOpts{
-		Name: "mailpit_memory_usage_bytes",
-		Help: "Memory usage in bytes",
-	})
-
-	tagCounters = prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: "mailpit_tag_messages",
-			Help: "Number of messages per tag",
-		},
-		[]string{"tag"},
-	)
-
-	// Register metrics
-	Registry.MustRegister(totalMessages)
-	Registry.MustRegister(unreadMessages)
-	Registry.MustRegister(databaseSize)
-	Registry.MustRegister(messagesDeleted)
-	Registry.MustRegister(smtpAccepted)
-	Registry.MustRegister(smtpRejected)
-	Registry.MustRegister(smtpIgnored)
-	Registry.MustRegister(smtpAcceptedSize)
-	Registry.MustRegister(uptime)
-	Registry.MustRegister(memoryUsage)
-	Registry.MustRegister(tagCounters)
+type gauge struct {
+	mu  sync.RWMutex
+	val float64
 }
 
-// UpdateMetrics updates all metrics with current values
-func UpdateMetrics() {
-	info := stats.Load()
+func (g *gauge) Set(v float64) {
+	g.mu.Lock()
+	g.val = v
+	g.mu.Unlock()
+}
+
+func (g *gauge) get() float64 {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+	return g.val
+}
+
+type gaugeVec struct {
+	mu    sync.RWMutex
+	label string
+	vals  map[string]float64
+}
+
+func newGaugeVec(label string) *gaugeVec {
+	return &gaugeVec{label: label, vals: make(map[string]float64)}
+}
+
+func (v *gaugeVec) Set(labelVal string, val float64) {
+	v.mu.Lock()
+	v.vals[labelVal] = val
+	v.mu.Unlock()
+}
+
+func (v *gaugeVec) Reset() {
+	v.mu.Lock()
+	v.vals = make(map[string]float64)
+	v.mu.Unlock()
+}
+
+type entry struct {
+	name string
+	help string
+	typ  string
+	g    *gauge
+	vec  *gaugeVec
+}
+
+var (
+	regMu    sync.RWMutex
+	registry []entry
+
+	totalMessages    = &gauge{}
+	unreadMessages   = &gauge{}
+	databaseSize     = &gauge{}
+	messagesDeleted  = &gauge{}
+	smtpAccepted     = &gauge{}
+	smtpRejected     = &gauge{}
+	smtpIgnored      = &gauge{}
+	smtpAcceptedSize = &gauge{}
+	uptime           = &gauge{}
+	memoryUsage      = &gauge{}
+	tagCounters      = newGaugeVec("tag")
+)
+
+func register(name, help, typ string, g *gauge, vec *gaugeVec) {
+	regMu.Lock()
+	registry = append(registry, entry{name: name, help: help, typ: typ, g: g, vec: vec})
+	regMu.Unlock()
+}
+
+func initMetrics() {
+	register("mailpit_database_size_bytes", "Size of the database in bytes", "gauge", databaseSize, nil)
+	register("mailpit_memory_usage_bytes", "Memory usage in bytes", "gauge", memoryUsage, nil)
+	register("mailpit_messages", "Total number of messages in the database", "gauge", totalMessages, nil)
+	register("mailpit_messages_deleted_total", "Total number of messages deleted", "counter", messagesDeleted, nil)
+	register("mailpit_messages_unread", "Number of unread messages in the database", "gauge", unreadMessages, nil)
+	register("mailpit_smtp_accepted_size_bytes_total", "Total size of accepted SMTP messages in bytes", "counter", smtpAcceptedSize, nil)
+	register("mailpit_smtp_accepted_total", "Total number of SMTP messages accepted", "counter", smtpAccepted, nil)
+	register("mailpit_smtp_ignored_total", "Total number of SMTP messages ignored (duplicates)", "counter", smtpIgnored, nil)
+	register("mailpit_smtp_rejected_total", "Total number of SMTP messages rejected", "counter", smtpRejected, nil)
+	register("mailpit_tag_messages", "Number of messages per tag", "gauge", nil, tagCounters)
+	register("mailpit_uptime_seconds", "Uptime of Mailpit in seconds", "gauge", uptime, nil)
+}
+
+func updateMetrics() {
+	info := stats.Load(false)
 
 	totalMessages.Set(float64(info.Messages))
 	unreadMessages.Set(float64(info.Unread))
 	databaseSize.Set(float64(info.DatabaseSize))
-	messagesDeleted.Add(float64(info.RuntimeStats.MessagesDeleted))
-	smtpAccepted.Add(float64(info.RuntimeStats.SMTPAccepted))
-	smtpRejected.Add(float64(info.RuntimeStats.SMTPRejected))
-	smtpIgnored.Add(float64(info.RuntimeStats.SMTPIgnored))
-	smtpAcceptedSize.Add(float64(info.RuntimeStats.SMTPAcceptedSize))
+	messagesDeleted.Set(float64(info.RuntimeStats.MessagesDeleted))
+	smtpAccepted.Set(float64(info.RuntimeStats.SMTPAccepted))
+	smtpRejected.Set(float64(info.RuntimeStats.SMTPRejected))
+	smtpIgnored.Set(float64(info.RuntimeStats.SMTPIgnored))
+	smtpAcceptedSize.Set(float64(info.RuntimeStats.SMTPAcceptedSize))
 	uptime.Set(float64(info.RuntimeStats.Uptime))
 	memoryUsage.Set(float64(info.RuntimeStats.Memory))
 
-	// Reset tag counters
 	tagCounters.Reset()
-
-	// Update tag counters
 	for tag, count := range info.Tags {
-		tagCounters.WithLabelValues(tag).Set(float64(count))
+		tagCounters.Set(tag, float64(count))
 	}
 }
 
-// Returns the Prometheus handler & disables double compression in middleware
+func writeMetrics(w io.Writer) {
+	regMu.RLock()
+	entries := make([]entry, len(registry))
+	copy(entries, registry)
+	regMu.RUnlock()
+
+	sort.Slice(entries, func(i, j int) bool {
+		return entries[i].name < entries[j].name
+	})
+
+	for _, e := range entries {
+		fmt.Fprintf(w, "# HELP %s %s\n# TYPE %s %s\n", e.name, e.help, e.name, e.typ)
+		if e.g != nil {
+			fmt.Fprintf(w, "%s %s\n", e.name, formatFloat(e.g.get()))
+		} else {
+			e.vec.mu.RLock()
+			keys := make([]string, 0, len(e.vec.vals))
+			snapshot := make(map[string]float64, len(e.vec.vals))
+			for k, v := range e.vec.vals {
+				keys = append(keys, k)
+				snapshot[k] = v
+			}
+			e.vec.mu.RUnlock()
+			sort.Strings(keys)
+			for _, k := range keys {
+				fmt.Fprintf(w, "%s{%s=\"%s\"} %s\n", e.name, e.vec.label, escapeLabelValue(k), formatFloat(snapshot[k]))
+			}
+		}
+	}
+}
+
+func escapeLabelValue(s string) string {
+	s = strings.ReplaceAll(s, `\`, `\\`)
+	s = strings.ReplaceAll(s, "\n", `\n`)
+	s = strings.ReplaceAll(s, `"`, `\"`)
+	return s
+}
+
+func formatFloat(v float64) string {
+	return strconv.FormatFloat(v, 'g', -1, 64)
+}
+
+// GetHandler returns the Prometheus metrics HTTP handler
 func GetHandler() http.Handler {
-	return promhttp.HandlerFor(Registry, promhttp.HandlerOpts{
-		DisableCompression: true,
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
+		writeMetrics(w)
 	})
 }
 
 // StartUpdater starts the periodic metrics update routine
 func StartUpdater() {
-	InitMetrics()
-	UpdateMetrics()
+	initMetrics()
+	updateMetrics()
 
-	// Start periodic updates
 	go func() {
 		ticker := time.NewTicker(15 * time.Second)
 		defer ticker.Stop()
-
 		for range ticker.C {
-			UpdateMetrics()
+			updateMetrics()
 		}
 	}()
 }
@@ -159,17 +190,15 @@ func StartSeparateServer() {
 
 	logger.Log().Infof("[prometheus] metrics server listening on %s", config.PrometheusListen)
 
-	// Create a dedicated mux for the metrics server
 	mux := http.NewServeMux()
-	mux.Handle("/metrics", promhttp.HandlerFor(Registry, promhttp.HandlerOpts{}))
+	mux.Handle("/metrics", GetHandler())
 
-	// Create a dedicated server instance
 	server := &http.Server{
-		Addr:    config.PrometheusListen,
-		Handler: mux,
+		Addr:              config.PrometheusListen,
+		Handler:           mux,
+		ReadHeaderTimeout: 5 * time.Second,
 	}
 
-	// Start HTTP server
 	if err := server.ListenAndServe(); err != nil {
 		logger.Log().Errorf("[prometheus] metrics server error: %s", err.Error())
 	}
@@ -178,11 +207,10 @@ func StartSeparateServer() {
 // GetMode returns the Prometheus run mode
 func GetMode() string {
 	mode := strings.ToLower(strings.TrimSpace(config.PrometheusListen))
-
-	switch {
-	case mode == "false", mode == "":
+	switch mode {
+	case "false", "":
 		return "disabled"
-	case mode == "true":
+	case "true":
 		return "integrated"
 	default:
 		return "separate"

internal/shortuuid/shortuuid.go

@@ -0,0 +1,53 @@
+// Package shortuuid provides a simple way to generate short, unique, alphanumeric identifiers.
+// The generated IDs are 22 characters long and consist of uppercase letters, lowercase letters, and digits.
+package shortuuid
+
+import (
+	"encoding/binary"
+	"math/bits"
+
+	"github.com/google/uuid"
+)
+
+const (
+	alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+	length   = 22
+	nDigits  = 10
+	divisor  = 839299365868340224 // 62^10, max power of 62 that fits in uint64
+)
+
+// New returns a 22-character alphanumeric unique identifier.
+func New() string {
+	id := uuid.New()
+	num := [2]uint64{
+		binary.BigEndian.Uint64(id[8:]),
+		binary.BigEndian.Uint64(id[:8]),
+	}
+
+	buf := make([]byte, length)
+	var r uint64
+	i := length - 1
+	for num[1] > 0 || num[0] > 0 {
+		num, r = quoRem64(num, divisor)
+		for j := 0; j < nDigits && i >= 0; j++ {
+			buf[i] = alphabet[r%62]
+			r /= 62
+			i--
+		}
+	}
+	for ; i >= 0; i-- {
+		buf[i] = alphabet[0]
+	}
+
+	return string(buf)
+}
+
+// quoRem64 divides a 128-bit number (represented as [lo, hi] uint64) by v,
+// returning the quotient and remainder.
+func quoRem64(u [2]uint64, v uint64) ([2]uint64, uint64) {
+	var q [2]uint64
+	var r uint64
+	q[1], r = bits.Div64(0, u[1], v)
+	q[0], r = bits.Div64(r, u[0], v)
+	return q, r
+}

internal/shortuuid/shortuuid_test.go

@@ -0,0 +1,52 @@
+package shortuuid
+
+import (
+	"regexp"
+	"testing"
+)
+
+// alphanumeric matches IDs that contain only digits and ASCII letters.
+var alphanumeric = regexp.MustCompile(`^[0-9A-Za-z]+$`)
+
+// TestLength verifies that every generated ID is exactly 22 characters long,
+// including when the UUID encodes to a value with leading zero-padding.
+func TestLength(t *testing.T) {
+	for range 100 {
+		id := New()
+		if len(id) != length {
+			t.Errorf("expected length %d, got %d: %q", length, len(id), id)
+		}
+	}
+}
+
+// TestAlphanumeric verifies that no ID contains hyphens, underscores, or any
+// other non-alphanumeric character that would be unsafe in a URL path segment.
+func TestAlphanumeric(t *testing.T) {
+	for range 100 {
+		id := New()
+		if !alphanumeric.MatchString(id) {
+			t.Errorf("non-alphanumeric characters in ID: %q", id)
+		}
+	}
+}
+
+// TestUnique verifies that IDs are unique across a large sample. Collisions are
+// cryptographically implausible given the 122-bit UUID entropy, so any hit here
+// indicates a bug in the encoding (e.g. truncation, constant output).
+func TestUnique(t *testing.T) {
+	seen := make(map[string]struct{}, 1000000)
+	for range 1000000 {
+		id := New()
+		if _, exists := seen[id]; exists {
+			t.Fatalf("duplicate ID generated: %q", id)
+		}
+		seen[id] = struct{}{}
+	}
+}
+
+// BenchmarkNew measures the cost of generating a single ID, including UUID generation.
+func BenchmarkNew(b *testing.B) {
+	for b.Loop() {
+		_ = New()
+	}
+}

internal/smtpd/chaos/chaos.go

@@ -25,7 +25,8 @@ var (
 )
 
 // Triggers for the Chaos configuration
-// swagger:model Triggers
+//
+// swagger:model ChaosTriggers
 type Triggers struct {
 	// Sender trigger to fail on From, Sender
 	Sender Trigger
@@ -36,7 +37,8 @@ type Triggers struct {
 }
 
 // Trigger for Chaos
-// swagger:model Trigger
+//
+// swagger:model ChaosTrigger
 type Trigger struct {
 	// SMTP error code to return. The value must range from 400 to 599.
 	// required: true

internal/smtpd/forward.go

@@ -4,25 +4,31 @@ import (
 	"crypto/tls"
 	"fmt"
 	"net/smtp"
+	"os"
 	"strings"
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
 	"github.com/axllent/mailpit/internal/tools"
+	"github.com/pkg/errors"
 )
 
 // Wrapper to forward messages if configured
-func autoForwardMessage(from string, data *[]byte) {
+func autoForwardMessage(from string, data *[]byte) error {
 	if config.SMTPForwardConfig.Host == "" {
-		return
+		return nil
 	}
 
 	if err := forward(from, *data); err != nil {
-		logger.Log().Errorf("[forward] error: %s", err.Error())
-	} else {
-		logger.Log().Debugf("[forward] message from %s to %s via %s:%d",
-			from, config.SMTPForwardConfig.To, config.SMTPForwardConfig.Host, config.SMTPForwardConfig.Port)
+		return fmt.Errorf("[forward] error: %w", err)
 	}
+
+	logger.Log().Debugf(
+		"[forward] message from %s to %s via %s:%d",
+		from, config.SMTPForwardConfig.To, config.SMTPForwardConfig.Host, config.SMTPForwardConfig.Port,
+	)
+
+	return nil
 }
 
 func createForwardingSMTPClient(config config.SMTPForwardConfigStruct, addr string) (*smtp.Client, error) {
@@ -37,7 +43,7 @@ func createForwardingSMTPClient(config config.SMTPForwardConfigStruct, addr stri
 
 		client, err := smtp.NewClient(conn, tlsConf.ServerName)
 		if err != nil {
-			conn.Close()
+			_ = conn.Close()
 			return nil, fmt.Errorf("SMTP client error: %v", err)
 		}
 
@@ -50,12 +56,20 @@ func createForwardingSMTPClient(config config.SMTPForwardConfigStruct, addr stri
 		return nil, fmt.Errorf("error connecting to %s: %v", addr, err)
 	}
 
+	// Set the hostname for HELO/EHLO
+	if hostname, err := os.Hostname(); err == nil {
+		if err := client.Hello(hostname); err != nil {
+			_ = client.Close()
+			return nil, fmt.Errorf("error saying HELO/EHLO to %s: %v", addr, err)
+		}
+	}
+
 	if config.STARTTLS {
 		tlsConf := &tls.Config{ServerName: config.Host} // #nosec
 		tlsConf.InsecureSkipVerify = config.AllowInsecure
 
 		if err = client.StartTLS(tlsConf); err != nil {
-			client.Close()
+			_ = client.Close()
 			return nil, fmt.Errorf("error creating StartTLS config: %v", err)
 		}
 	}
@@ -72,7 +86,7 @@ func forward(from string, msg []byte) error {
 	if err != nil {
 		return err
 	}
-	defer c.Close()
+	defer func() { _ = c.Close() }()
 
 	auth := forwardAuthFromConfig()
 
@@ -95,11 +109,14 @@ func forward(from string, msg []byte) error {
 		return fmt.Errorf("error response to MAIL command: %s", err.Error())
 	}
 
-	to := strings.Split(config.SMTPForwardConfig.To, ",")
+	to := strings.SplitSeq(config.SMTPForwardConfig.To, ",")
 
-	for _, addr := range to {
+	for addr := range to {
 		if err = c.Rcpt(addr); err != nil {
 			logger.Log().Warnf("error response to RCPT command for %s: %s", addr, err.Error())
+			if config.SMTPForwardConfig.ForwardSMTPErrors {
+				return errors.WithMessagef(err, "error response to RCPT command for %s", addr)
+			}
 		}
 	}
 

internal/smtpd/main.go

@@ -12,11 +12,12 @@ import (
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/auth"
 	"github.com/axllent/mailpit/internal/logger"
+	"github.com/axllent/mailpit/internal/shortuuid"
 	"github.com/axllent/mailpit/internal/stats"
 	"github.com/axllent/mailpit/internal/storage"
 	"github.com/axllent/mailpit/internal/tools"
 	"github.com/axllent/mailpit/server/websockets"
-	"github.com/lithammer/shortuuid/v4"
+	"github.com/pkg/errors"
 )
 
 var (
@@ -73,10 +74,36 @@ func SaveToDatabase(origin net.Addr, from string, to []string, data []byte, smtp
 	}
 
 	// if enabled, this may conditionally relay the email through to the preconfigured smtp server
-	autoRelayMessage(from, to, &data)
+	if relayErr := autoRelayMessage(from, to, &data); relayErr != nil {
+		logger.Log().Error(relayErr.Error())
+
+		if config.SMTPRelayConfig.ForwardSMTPErrors {
+			for {
+				unwrappedErr := errors.Unwrap(relayErr)
+				if unwrappedErr == nil {
+					break
+				}
+				relayErr = unwrappedErr
+			}
+			return "", relayErr
+		}
+	}
 
 	// if enabled, this will forward a copy to preconfigured addresses
-	autoForwardMessage(from, &data)
+	if forwardErr := autoForwardMessage(from, &data); forwardErr != nil {
+		logger.Log().Error(forwardErr.Error())
+
+		if config.SMTPForwardConfig.ForwardSMTPErrors {
+			for {
+				unwrappedErr := errors.Unwrap(forwardErr)
+				if unwrappedErr == nil {
+					break
+				}
+				forwardErr = unwrappedErr
+			}
+			return "", forwardErr
+		}
+	}
 
 	// build array of all addresses in the header to compare to the []to array
 	emails, hasBccHeader := scanAddressesInHeader(msg.Header)
@@ -194,15 +221,16 @@ func listenAndServe(addr string, handler MsgIDHandler, authHandler AuthHandler)
 
 	Debug = true // to enable Mailpit logging
 	srv := &Server{
-		Addr:              addr,
-		MsgIDHandler:      handler,
-		HandlerRcpt:       handlerRcpt,
-		AppName:           "Mailpit",
-		Hostname:          "",
-		AuthHandler:       nil,
-		AuthRequired:      false,
-		MaxRecipients:     config.SMTPMaxRecipients,
-		DisableReverseDNS: DisableReverseDNS,
+		Addr:                     addr,
+		MsgIDHandler:             handler,
+		HandlerRcpt:              handlerRcpt,
+		AppName:                  "Mailpit",
+		Hostname:                 "",
+		AuthHandler:              nil,
+		AuthRequired:             false,
+		MaxRecipients:            config.SMTPMaxRecipients,
+		IgnoreRejectedRecipients: config.SMTPIgnoreRejectedRecipients,
+		DisableReverseDNS:        DisableReverseDNS,
 		LogRead: func(remoteIP, verb, line string) {
 			logger.Log().Debugf("[smtpd] %s (%s) %s", verbLogTranslator(verb), remoteIP, line)
 		},
@@ -219,20 +247,36 @@ func listenAndServe(addr string, handler MsgIDHandler, authHandler AuthHandler)
 		},
 	}
 
+	if config.MaxMessageSize > 0 {
+		srv.MaxSize = config.MaxMessageSize * 1024 * 1024
+	}
+
 	if config.Label != "" {
 		srv.AppName = fmt.Sprintf("Mailpit (%s)", config.Label)
 	}
 
 	if config.SMTPAuthAllowInsecure {
-		srv.AuthMechs = map[string]bool{"CRAM-MD5": false, "PLAIN": true, "LOGIN": true}
+		srv.AuthMechs = map[string]bool{
+			"CRAM-MD5": false,
+			"PLAIN":    true,
+			"LOGIN":    true,
+		}
 	}
 
 	if auth.SMTPCredentials != nil {
-		srv.AuthMechs = map[string]bool{"CRAM-MD5": false, "PLAIN": true, "LOGIN": true}
+		srv.AuthMechs = map[string]bool{
+			"CRAM-MD5": false,
+			"PLAIN":    true,
+			"LOGIN":    true,
+		}
 		srv.AuthHandler = authHandler
 		srv.AuthRequired = true
 	} else if config.SMTPAuthAcceptAny {
-		srv.AuthMechs = map[string]bool{"CRAM-MD5": false, "PLAIN": true, "LOGIN": true}
+		srv.AuthMechs = map[string]bool{
+			"CRAM-MD5": false,
+			"PLAIN":    true,
+			"LOGIN":    true,
+		}
 		srv.AuthHandler = authHandlerAny
 	}
 

internal/smtpd/relay.go

@@ -2,18 +2,19 @@ package smtpd
 
 import (
 	"crypto/tls"
-	"errors"
 	"fmt"
 	"net/smtp"
+	"os"
 	"strings"
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
 	"github.com/axllent/mailpit/internal/tools"
+	"github.com/pkg/errors"
 )
 
 // Wrapper to auto relay messages if configured
-func autoRelayMessage(from string, to []string, data *[]byte) {
+func autoRelayMessage(from string, to []string, data *[]byte) error {
 	if config.SMTPRelayConfig.BlockedRecipientsRegexp != nil {
 		filteredTo := []string{}
 		for _, address := range to {
@@ -28,16 +29,18 @@ func autoRelayMessage(from string, to []string, data *[]byte) {
 	}
 
 	if len(to) == 0 {
-		return
+		return nil
 	}
 
 	if config.SMTPRelayAll {
 		if err := Relay(from, to, *data); err != nil {
-			logger.Log().Errorf("[relay] error: %s", err.Error())
-		} else {
-			logger.Log().Debugf("[relay] sent message to %s from %s via %s:%d",
-				strings.Join(to, ", "), from, config.SMTPRelayConfig.Host, config.SMTPRelayConfig.Port)
+			return errors.WithMessage(err, "[relay] error")
 		}
+
+		logger.Log().Debugf(
+			"[relay] sent message to %s from %s via %s:%d",
+			strings.Join(to, ", "), from, config.SMTPRelayConfig.Host, config.SMTPRelayConfig.Port,
+		)
 	} else if config.SMTPRelayMatchingRegexp != nil {
 		filtered := []string{}
 		for _, t := range to {
@@ -47,16 +50,20 @@ func autoRelayMessage(from string, to []string, data *[]byte) {
 		}
 
 		if len(filtered) == 0 {
-			return
+			return nil
 		}
 
 		if err := Relay(from, filtered, *data); err != nil {
-			logger.Log().Errorf("[relay] error: %s", err.Error())
-		} else {
-			logger.Log().Debugf("[relay] auto-relay message to %s from %s via %s:%d",
-				strings.Join(filtered, ", "), from, config.SMTPRelayConfig.Host, config.SMTPRelayConfig.Port)
+			return errors.WithMessage(err, "[relay] error")
 		}
+
+		logger.Log().Debugf(
+			"[relay] auto-relay message to %s from %s via %s:%d",
+			strings.Join(filtered, ", "), from, config.SMTPRelayConfig.Host, config.SMTPRelayConfig.Port,
+		)
 	}
+
+	return nil
 }
 
 func createRelaySMTPClient(config config.SMTPRelayConfigStruct, addr string) (*smtp.Client, error) {
@@ -71,7 +78,7 @@ func createRelaySMTPClient(config config.SMTPRelayConfigStruct, addr string) (*s
 
 		client, err := smtp.NewClient(conn, tlsConf.ServerName)
 		if err != nil {
-			conn.Close()
+			_ = conn.Close()
 			return nil, fmt.Errorf("SMTP client error: %v", err)
 		}
 
@@ -84,12 +91,19 @@ func createRelaySMTPClient(config config.SMTPRelayConfigStruct, addr string) (*s
 		return nil, fmt.Errorf("error connecting to %s: %v", addr, err)
 	}
 
+	// Set the hostname for HELO/EHLO
+	if hostname, err := os.Hostname(); err == nil {
+		if err := client.Hello(hostname); err != nil {
+			return nil, fmt.Errorf("error saying HELO/EHLO to %s: %v", addr, err)
+		}
+	}
+
 	if config.STARTTLS {
 		tlsConf := &tls.Config{ServerName: config.Host} // #nosec
 		tlsConf.InsecureSkipVerify = config.AllowInsecure
 
 		if err = client.StartTLS(tlsConf); err != nil {
-			client.Close()
+			_ = client.Close()
 			return nil, fmt.Errorf("error creating StartTLS config: %v", err)
 		}
 	}
@@ -106,7 +120,7 @@ func Relay(from string, to []string, msg []byte) error {
 	if err != nil {
 		return err
 	}
-	defer c.Close()
+	defer func() { _ = c.Close() }()
 
 	auth := relayAuthFromConfig()
 
@@ -126,26 +140,29 @@ func Relay(from string, to []string, msg []byte) error {
 	}
 
 	if err = c.Mail(from); err != nil {
-		return fmt.Errorf("error response to MAIL command: %s", err.Error())
+		return errors.WithMessage(err, "error sending MAIL command")
 	}
 
 	for _, addr := range to {
 		if err = c.Rcpt(addr); err != nil {
 			logger.Log().Warnf("error response to RCPT command for %s: %s", addr, err.Error())
+			if config.SMTPRelayConfig.ForwardSMTPErrors {
+				return errors.WithMessagef(err, "error response to RCPT command for %s", addr)
+			}
 		}
 	}
 
 	w, err := c.Data()
 	if err != nil {
-		return fmt.Errorf("error response to DATA command: %s", err.Error())
+		return errors.WithMessage(err, "error response to DATA command")
 	}
 
 	if _, err := w.Write(msg); err != nil {
-		return fmt.Errorf("error sending message: %s", err.Error())
+		return errors.WithMessage(err, "error sending message")
 	}
 
 	if err := w.Close(); err != nil {
-		return fmt.Errorf("error closing connection: %s", err.Error())
+		return errors.WithMessage(err, "error closing connection")
 	}
 
 	return c.Quit()
@@ -178,7 +195,10 @@ type loginAuth struct {
 
 // LoginAuth authentication
 func LoginAuth(username, password string) smtp.Auth {
-	return &loginAuth{username, password}
+	return &loginAuth{
+		username,
+		password,
+	}
 }
 
 func (a *loginAuth) Start(_ *smtp.ServerInfo) (string, []byte, error) {
@@ -193,7 +213,7 @@ func (a *loginAuth) Next(fromServer []byte, more bool) ([]byte, error) {
 		case "Password:":
 			return []byte(a.password), nil
 		default:
-			return nil, errors.New("Unknown fromServer")
+			return nil, errors.New("unknown fromServer")
 		}
 	}
 

internal/smtpd/smtpd.go

@@ -15,6 +15,7 @@ import (
 	"io/fs"
 	"log"
 	"net"
+	"net/mail"
 	"os"
 	"regexp"
 	"strconv"
@@ -92,26 +93,27 @@ type LogFunc func(remoteIP, verb, line string)
 
 // Server is an SMTP server.
 type Server struct {
-	Addr              string // TCP address to listen on, defaults to ":25" (all addresses, port 25) if empty
-	AppName           string
-	AuthHandler       AuthHandler
-	AuthMechs         map[string]bool // Override list of allowed authentication mechanisms. Currently supported: LOGIN, PLAIN, CRAM-MD5. Enabling LOGIN and PLAIN will reduce RFC 4954 compliance.
-	AuthRequired      bool            // Require authentication for every command except AUTH, EHLO, HELO, NOOP, RSET or QUIT as per RFC 4954. Ignored if AuthHandler is not configured.
-	DisableReverseDNS bool            // Disable reverse DNS lookups, enforces "unknown" hostname
-	Handler           Handler
-	HandlerRcpt       HandlerRcpt
-	Hostname          string
-	LogRead           LogFunc
-	LogWrite          LogFunc
-	MaxSize           int // Maximum message size allowed, in bytes
-	MaxRecipients     int // Maximum number of recipients, defaults to 100.
-	MsgIDHandler      MsgIDHandler
-	Timeout           time.Duration
-	TLSConfig         *tls.Config
-	TLSListener       bool        // Listen for incoming TLS connections only (not recommended as it may reduce compatibility). Ignored if TLS is not configured.
-	TLSRequired       bool        // Require TLS for every command except NOOP, EHLO, STARTTLS, or QUIT as per RFC 3207. Ignored if TLS is not configured.
-	Protocol          string      // Default tcp, supports unix
-	SocketPerm        fs.FileMode // if using Unix socket, socket permissions
+	Addr                     string // TCP address to listen on, defaults to ":25" (all addresses, port 25) if empty
+	AppName                  string
+	AuthHandler              AuthHandler
+	AuthMechs                map[string]bool // Override list of allowed authentication mechanisms. Currently supported: LOGIN, PLAIN, CRAM-MD5. Enabling LOGIN and PLAIN will reduce RFC 4954 compliance.
+	AuthRequired             bool            // Require authentication for every command except AUTH, EHLO, HELO, NOOP, RSET or QUIT as per RFC 4954. Ignored if AuthHandler is not configured.
+	DisableReverseDNS        bool            // Disable reverse DNS lookups, enforces "unknown" hostname
+	Handler                  Handler
+	HandlerRcpt              HandlerRcpt
+	Hostname                 string
+	LogRead                  LogFunc
+	LogWrite                 LogFunc
+	MaxSize                  int // Maximum message size allowed, in bytes
+	MaxRecipients            int // Maximum number of recipients, defaults to 100.
+	MsgIDHandler             MsgIDHandler
+	IgnoreRejectedRecipients bool // Accept emails to rejected recipients with 2xx response but silently drop them
+	Timeout                  time.Duration
+	TLSConfig                *tls.Config
+	TLSListener              bool        // Listen for incoming TLS connections only (not recommended as it may reduce compatibility). Ignored if TLS is not configured.
+	TLSRequired              bool        // Require TLS for every command except NOOP, EHLO, STARTTLS, or QUIT as per RFC 3207. Ignored if TLS is not configured.
+	Protocol                 string      // Default tcp, supports unix
+	SocketPerm               fs.FileMode // if using Unix socket, socket permissions
 
 	inShutdown   int32 // server was closed or shutdown
 	openSessions int32 // count of open sessions
@@ -217,7 +219,7 @@ func (srv *Server) Serve(ln net.Listener) error {
 		return ErrServerClosed
 	}
 
-	defer ln.Close()
+	defer func() { _ = ln.Close() }()
 
 	for {
 		// if we are shutting down, don't accept new connections
@@ -229,7 +231,7 @@ func (srv *Server) Serve(ln net.Listener) error {
 
 		conn, err := ln.Accept()
 		if err != nil {
-			if netErr, ok := err.(net.Error); ok && netErr.Temporary() {
+			if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
 				continue
 			}
 			return err
@@ -335,7 +337,7 @@ func (srv *Server) Shutdown(ctx context.Context) error {
 	timer := time.NewTimer(100 * time.Millisecond)
 	defer timer.Stop()
 
-	for i := 0; i < 300; i++ {
+	for range 300 {
 		// wait for open sessions to close
 		if atomic.LoadInt32(&srv.openSessions) == 0 {
 			break
@@ -356,11 +358,15 @@ func (srv *Server) Shutdown(ctx context.Context) error {
 // Function called to handle connection requests.
 func (s *session) serve() {
 	defer atomic.AddInt32(&s.srv.openSessions, -1)
-	defer s.conn.Close()
+	// pass the connection into the defer function to ensure it is closed,
+	// otherwise results in a 5s timeout for each connection
+	defer func(c net.Conn) { _ = c.Close() }(s.conn)
 
+	var gotEHLO bool
 	var from string
-	var gotFrom bool
+	var gotFROM bool
 	var to []string
+	var hasRejectedRecipients bool
 	var buffer bytes.Buffer
 
 	// RFC 5321 specifies support for minimum of 100 recipients is required.
@@ -392,18 +398,22 @@ loop:
 			s.writef("250 %s greets %s", s.srv.Hostname, s.remoteName)
 
 			// RFC 2821 section 4.1.4 specifies that EHLO has the same effect as RSET, so reset for HELO too.
+			gotEHLO = true
 			from = ""
-			gotFrom = false
+			gotFROM = false
 			to = nil
+			hasRejectedRecipients = false
 			buffer.Reset()
 		case "EHLO":
 			s.remoteName = args
 			s.writef("%s", s.makeEHLOResponse())
 
 			// RFC 2821 section 4.1.4 specifies that EHLO has the same effect as RSET.
+			gotEHLO = true
 			from = ""
-			gotFrom = false
+			gotFROM = false
 			to = nil
+			hasRejectedRecipients = false
 			buffer.Reset()
 		case "MAIL":
 			if s.srv.TLSConfig != nil && s.srv.TLSRequired && !s.tls {
@@ -414,10 +424,22 @@ loop:
 				s.writef("530 5.7.0 Authentication required")
 				break
 			}
+			if !gotEHLO {
+				s.writef("503 5.5.1 Bad sequence of commands (HELO/EHLO required before MAIL)")
+				break
+			}
+			if to != nil {
+				s.writef("503 5.5.1 Bad sequence of commands (RSET/HELO/EHLO required before MAIL)")
+				break
+			}
 
-			match := mailFromRE.FindStringSubmatch(args)
+			match, err := extractAndValidateAddress(mailFromRE, args)
 			if match == nil {
-				s.writef("501 5.5.4 Syntax error in parameters or arguments (invalid FROM parameter)")
+				if err != nil {
+					s.writef("%s", err.Error())
+				} else {
+					s.writef("501 5.5.4 Syntax error in parameters or arguments (invalid FROM parameter)")
+				}
 			} else {
 				// Mailpit Chaos
 				if fail, code := chaos.Config.Sender.Trigger(); fail {
@@ -431,7 +453,7 @@ loop:
 					if sizeMatch == nil {
 						// ignore other parameter
 						from = match[1]
-						gotFrom = true
+						gotFROM = true
 						s.writef("250 2.1.0 Ok")
 					} else {
 						// Enforce the maximum message size if one is set.
@@ -443,18 +465,19 @@ loop:
 							s.writef("%s", err.Error())
 						} else { // SIZE ok
 							from = match[1]
-							gotFrom = true
+							gotFROM = true
 							s.writef("250 2.1.0 Ok")
 						}
 					}
 				} else { // No parameters after FROM
 					from = match[1]
-					gotFrom = true
+					gotFROM = true
 					s.writef("250 2.1.0 Ok")
 				}
 			}
 
 			to = nil
+			hasRejectedRecipients = false
 			buffer.Reset()
 		case "RCPT":
 			if s.srv.TLSConfig != nil && s.srv.TLSRequired && !s.tls {
@@ -465,14 +488,18 @@ loop:
 				s.writef("530 5.7.0 Authentication required")
 				break
 			}
-			if !gotFrom {
+			if !gotFROM {
 				s.writef("503 5.5.1 Bad sequence of commands (MAIL required before RCPT)")
 				break
 			}
 
-			match := rcptToRE.FindStringSubmatch(args)
+			match, err := extractAndValidateAddress(rcptToRE, args)
 			if match == nil {
-				s.writef("501 5.5.4 Syntax error in parameters or arguments (invalid TO parameter)")
+				if err != nil {
+					s.writef("%s", err.Error())
+				} else {
+					s.writef("501 5.5.4 Syntax error in parameters or arguments (invalid TO parameter)")
+				}
 			} else {
 				// Mailpit Chaos
 				if fail, code := chaos.Config.Recipient.Trigger(); fail {
@@ -490,6 +517,9 @@ loop:
 					if accept {
 						to = append(to, match[1])
 						s.writef("250 2.1.5 Ok")
+					} else if s.srv.IgnoreRejectedRecipients {
+						hasRejectedRecipients = true
+						s.writef("250 2.1.5 Ok")
 					} else {
 						s.writef("550 5.1.0 Requested action not taken: mailbox unavailable")
 					}
@@ -504,7 +534,8 @@ loop:
 				s.writef("530 5.7.0 Authentication required")
 				break
 			}
-			if !gotFrom || len(to) == 0 {
+			hasRecipients := len(to) > 0 || hasRejectedRecipients
+			if !gotFROM || !hasRecipients {
 				s.writef("503 5.5.1 Bad sequence of commands (MAIL & RCPT required before DATA)")
 				break
 			}
@@ -517,9 +548,9 @@ loop:
 			// On other errors, allow the client to try again.
 			data, err := s.readData()
 			if err != nil {
-				switch err.(type) {
+				switch err := err.(type) {
 				case net.Error:
-					if err.(net.Error).Timeout() {
+					if err.Timeout() {
 						s.writef("421 4.4.2 %s %s ESMTP Service closing transmission channel after timeout exceeded", s.srv.Hostname, s.srv.AppName)
 					}
 					break loop
@@ -534,11 +565,13 @@ loop:
 
 			// Create Received header & write message body into buffer.
 			buffer.Reset()
-			buffer.Write(s.makeHeaders(to))
+			if len(to) > 0 {
+				buffer.Write(s.makeHeaders(to))
+			}
 			buffer.Write(data)
 
-			// Pass mail on to handler.
-			if s.srv.Handler != nil {
+			// Pass mail on to handler only if there are valid recipients.
+			if len(to) > 0 && s.srv.Handler != nil {
 				err := s.srv.Handler(s.conn.RemoteAddr(), from, to, buffer.Bytes())
 				if err != nil {
 					checkErrFormat := regexp.MustCompile(`^([2-5][0-9]{2})[\s\-](.+)$`)
@@ -550,7 +583,7 @@ loop:
 					break
 				}
 				s.writef("250 2.0.0 Ok: queued")
-			} else if s.srv.MsgIDHandler != nil {
+			} else if len(to) > 0 && s.srv.MsgIDHandler != nil {
 				msgID, err := s.srv.MsgIDHandler(s.conn.RemoteAddr(), from, to, buffer.Bytes(), s.username)
 				if err != nil {
 					checkErrFormat := regexp.MustCompile(`^([2-5][0-9]{2})[\s\-](.+)$`)
@@ -568,13 +601,21 @@ loop:
 					s.writef("250 2.0.0 Ok: queued")
 				}
 			} else {
+				if hasRejectedRecipients && Debug {
+					if s.srv.LogWrite != nil {
+						s.srv.LogWrite(s.remoteIP, "DEBUG", "Message from sender silently dropped (rejected recipients)")
+					} else {
+						log.Printf("%s DEBUG Message from sender silently dropped (rejected recipients)", s.remoteIP)
+					}
+				}
 				s.writef("250 2.0.0 Ok: queued")
 			}
 
 			// Reset for next mail.
 			from = ""
-			gotFrom = false
+			gotFROM = false
 			to = nil
+			hasRejectedRecipients = false
 			buffer.Reset()
 		case "QUIT":
 			s.writef("221 2.0.0 %s %s ESMTP Service closing transmission channel", s.srv.Hostname, s.srv.AppName)
@@ -586,17 +627,21 @@ loop:
 			}
 			s.writef("250 2.0.0 Ok")
 			from = ""
-			gotFrom = false
+			gotFROM = false
 			to = nil
+			hasRejectedRecipients = false
 			buffer.Reset()
 		case "NOOP":
 			s.writef("250 2.0.0 Ok")
 		case "XCLIENT":
 			s.xClient = args
 			if s.xClientTrust {
-				xCArgs := strings.Split(args, " ")
-				for _, xCArg := range xCArgs {
+				xCArgs := strings.SplitSeq(args, " ")
+				for xCArg := range xCArgs {
 					xCParse := strings.Split(strings.TrimSpace(xCArg), "=")
+					if len(xCParse) != 2 {
+						continue
+					}
 					if strings.ToUpper(xCParse[0]) == "ADDR" && (net.ParseIP(xCParse[1]) != nil) {
 						s.xClientADDR = xCParse[1]
 					}
@@ -662,8 +707,9 @@ loop:
 			// RFC 3207 specifies that the server must discard any prior knowledge obtained from the client.
 			s.remoteName = ""
 			from = ""
-			gotFrom = false
+			gotFROM = false
 			to = nil
+			hasRejectedRecipients = false
 			buffer.Reset()
 		case "AUTH":
 			if s.srv.TLSConfig != nil && s.srv.TLSRequired && !s.tls {
@@ -683,7 +729,7 @@ loop:
 			}
 
 			// RFC 4954 specifies that AUTH is not permitted during mail transactions.
-			if gotFrom || len(to) > 0 {
+			if gotFROM || len(to) > 0 {
 				s.writef("503 5.5.1 Bad sequence of commands (AUTH not permitted during mail transaction)")
 				break
 			}
@@ -743,13 +789,13 @@ loop:
 }
 
 // Wrapper function for writing a complete line to the socket.
-func (s *session) writef(format string, args ...interface{}) {
+func (s *session) writef(format string, args ...any) {
 	if s.srv.Timeout > 0 {
 		_ = s.conn.SetWriteDeadline(time.Now().Add(s.srv.Timeout))
 	}
 
 	line := fmt.Sprintf(format, args...)
-	fmt.Fprintf(s.bw, "%s\r\n", line)
+	_, _ = fmt.Fprintf(s.bw, "%s\r\n", line)
 	_ = s.bw.Flush()
 
 	if Debug {
@@ -788,9 +834,9 @@ func (s *session) readLine() (string, error) {
 
 // Parse a line read from the socket.
 func (s *session) parseLine(line string) (verb string, args string) {
-	if idx := strings.Index(line, " "); idx != -1 {
-		verb = strings.ToUpper(line[:idx])
-		args = strings.TrimSpace(line[idx+1:])
+	if before, after, ok := strings.Cut(line, " "); ok {
+		verb = strings.ToUpper(before)
+		args = strings.TrimSpace(after)
 	} else {
 		verb = strings.ToUpper(line)
 		args = ""
@@ -836,10 +882,14 @@ func (s *session) readData() ([]byte, error) {
 // TODO: Work out what to do with multiple to addresses.
 func (s *session) makeHeaders(to []string) []byte {
 	var buffer bytes.Buffer
+	if len(to) == 0 {
+		return buffer.Bytes()
+	}
+
 	now := time.Now().Format("Mon, 2 Jan 2006 15:04:05 -0700 (MST)")
-	buffer.WriteString(fmt.Sprintf("Received: from %s (%s [%s])\r\n", s.remoteName, s.remoteHost, s.remoteIP))
-	buffer.WriteString(fmt.Sprintf("        by %s (%s) with SMTP\r\n", s.srv.Hostname, s.srv.AppName))
-	buffer.WriteString(fmt.Sprintf("        for <%s>; %s\r\n", to[0], now))
+	fmt.Fprintf(&buffer, "Received: from %s (%s [%s])\r\n", s.remoteName, s.remoteHost, s.remoteIP)
+	fmt.Fprintf(&buffer, "        by %s (%s) with SMTP\r\n", s.srv.Hostname, s.srv.AppName)
+	fmt.Fprintf(&buffer, "        for <%s>; %s\r\n", to[0], now)
 	return buffer.Bytes()
 }
 
@@ -885,6 +935,10 @@ func (s *session) makeEHLOResponse() (response string) {
 	}
 
 	response += "250-ENHANCEDSTATUSCODES\r\n"
+	// RFC 6531 specifies that the presence of SMTPUTF8 should include 8BITMIME
+	// "Servers offering this extension MUST provide support for, and announce, the 8BITMIME extension"
+	// https://www.rfc-editor.org/rfc/rfc6531#section-3.1:
+	response += "250-8BITMIME\r\n"
 	response += "250 SMTPUTF8" // last entry must use a space instead of a dash
 	return
 }
@@ -952,6 +1006,12 @@ func (s *session) handleAuthPlain(arg string) (bool, error) {
 
 	// Validate credentials.
 	authenticated, err := s.srv.AuthHandler(s.conn.RemoteAddr(), "PLAIN", parts[1], parts[2], nil)
+	if authenticated {
+		uname := string(parts[1])
+		s.username = &uname
+	} else {
+		s.username = nil
+	}
 
 	return authenticated, err
 }
@@ -985,3 +1045,35 @@ func (s *session) handleAuthCramMD5() (bool, error) {
 
 	return authenticated, err
 }
+
+// Extract and validate email address from a regex match.
+// This ensures that only RFC 5322 compliant email addresses are accepted (if set).
+func extractAndValidateAddress(re *regexp.Regexp, args string) ([]string, error) {
+	match := re.FindStringSubmatch(args)
+	if match == nil {
+		return nil, nil
+	}
+
+	if strings.Contains(match[1], " ") {
+		return nil, errors.New("553 5.1.3 The address is not a valid RFC 5321 address")
+	}
+
+	// first argument will be the email address, validate it if not empty
+	if match[1] != "" {
+		a, err := mail.ParseAddress(match[1])
+		if err != nil {
+			return nil, errors.New("553 5.1.3 The address is not a valid RFC 5321 address")
+		}
+
+		// https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3.1
+		// RFC states that the local part of an email address SHOULD not exceed 64 characters
+		// and the domain part SHOULD not exceed 255 characters, however as per https://github.com/axllent/mailpit/issues/620
+		// it appears that investigated mail servers do not actually implement this limit, but rather enforce
+		// a much larger limit (ie: 1024 characters).
+		if len(a.Address) > 1024 {
+			return nil, errors.New("500 The address is too long")
+		}
+	}
+
+	return match, nil
+}

internal/smtpd/smtpd_test.go

@@ -12,7 +12,6 @@ import (
 	"fmt"
 	"io"
 	"net"
-	"os"
 	"reflect"
 	"regexp"
 	"strings"
@@ -40,7 +39,7 @@ func newConn(t *testing.T, server *Server) net.Conn {
 
 // Send a command and verify the 3 digit code from the response.
 func cmdCode(t *testing.T, conn net.Conn, cmd string, code string) string {
-	fmt.Fprintf(conn, "%s\r\n", cmd)
+	_, _ = fmt.Fprintf(conn, "%s\r\n", cmd)
 	resp, err := bufio.NewReader(conn).ReadString('\n')
 	if err != nil {
 		t.Fatalf("Failed to read response from test server: %v", err)
@@ -72,7 +71,9 @@ func TestSimpleCommands(t *testing.T) {
 		conn := newConn(t, &Server{})
 		cmdCode(t, conn, tt.cmd, tt.code)
 		cmdCode(t, conn, "QUIT", "221")
-		conn.Close()
+		if err := conn.Close(); err != nil {
+			t.Errorf("Failed to close connection after command %s: %v", tt.cmd, err)
+		}
 	}
 }
 
@@ -90,7 +91,7 @@ func TestCmdHELO(t *testing.T) {
 	cmdCode(t, conn, "DATA", "503")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdEHLO(t *testing.T) {
@@ -103,11 +104,59 @@ func TestCmdEHLO(t *testing.T) {
 	// See RFC 2821 section 4.1.4 for more detail.
 	cmdCode(t, conn, "MAIL FROM:<sender@example.com>", "250")
 	cmdCode(t, conn, "RCPT TO:<recipient@example.com>", "250")
+
+	// test invalid addresses & header injection
+	cmdCode(t, conn, "RCPT TO: <recipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipientreciprecipientrecipientrecipientreciptrecipientrecipientrecipient@exampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexample.com>", "500") // too long
+	cmdCode(t, conn, "RCPT TO:<recipientexample.com>", "553")
+	cmdCode(t, conn, "RCPT TO: <recipient@test@example.com>", "553")
+	cmdCode(t, conn, "RCPT TO: <recipient@@example.com>", "553")
+	cmdCode(t, conn, "RCPT TO: <recipientexample.com>", "553")
+	cmdCode(t, conn, "RCPT TO:  <recipientexample.com>", "501")
+	cmdCode(t, conn, "RCPT TO:<recipient\rexample.com>", "553")
+	cmdCode(t, conn, "RCPT TO: <recipient\rexample.com>", "553")
+	cmdCode(t, conn, "RCPT TO:  <recipient\rexample.com>", "501")
+	cmdCode(t, conn, "RCPT TO: <>", "501") // empty address not allowed here
+
 	cmdCode(t, conn, "EHLO host.example.com", "250")
 	cmdCode(t, conn, "DATA", "503")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
+}
+
+func TestCmdMAILBeforeEHLO(t *testing.T) {
+	conn := newConn(t, &Server{})
+	// RFC 5321 §4.1.4 — Order of Commands states (emphasis added):
+	// “The SMTP client MUST issue HELO or EHLO before any other SMTP commands.”
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com>", "503")
+
+	cmdCode(t, conn, "QUIT", "221")
+	_ = conn.Close()
+}
+
+func TestCmdMAILAfterRCPT(t *testing.T) {
+	conn := newConn(t, &Server{})
+
+	// Send EHLO, expect greeting
+	cmdCode(t, conn, "EHLO host.example.com", "250")
+
+	// Send MAIL FROM
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com>", "250")
+
+	// Send RCPT TO
+	cmdCode(t, conn, "RCPT TO:<recipient@example.com>", "250")
+
+	// MAIL FROM must not come after RCPT TO in the same transaction
+	cmdCode(t, conn, "MAIL FROM:<sender2@example.com>", "503")
+
+	// RSET to clear the transaction
+	cmdCode(t, conn, "RSET", "250")
+
+	// Now the MAIL FROM should be accepted
+	cmdCode(t, conn, "MAIL FROM:<sender2@example.com>", "250")
+
+	cmdCode(t, conn, "QUIT", "221")
+	_ = conn.Close()
 }
 
 func TestCmdRSET(t *testing.T) {
@@ -121,7 +170,7 @@ func TestCmdRSET(t *testing.T) {
 	cmdCode(t, conn, "DATA", "503")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdMAIL(t *testing.T) {
@@ -130,7 +179,7 @@ func TestCmdMAIL(t *testing.T) {
 
 	// MAIL with no FROM arg should return 501 syntax error
 	cmdCode(t, conn, "MAIL", "501")
-	// MAIL with empty FROM arg should return 501 syntax error
+	// // MAIL with empty FROM arg should return 501 syntax error
 	cmdCode(t, conn, "MAIL FROM:", "501")
 	cmdCode(t, conn, "MAIL FROM: ", "501")
 	cmdCode(t, conn, "MAIL FROM:  ", "501")
@@ -144,6 +193,20 @@ func TestCmdMAIL(t *testing.T) {
 	// MAIL with seemingly valid but noncompliant FROM arg (double space after the colon) should return 501 syntax error
 	cmdCode(t, conn, "MAIL FROM:  <sender@example.com>", "501")
 
+	// test invalid addresses & header injection
+	cmdCode(t, conn, "MAIL FROM: <sendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersendersender@exampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexample.com>", "500") // too long
+	cmdCode(t, conn, "MAIL FROM:<sender\rexample.com>", "553")
+	cmdCode(t, conn, "MAIL FROM: <sender\rexample.com>", "553")
+	cmdCode(t, conn, "MAIL FROM:  <sender\rexample.com>", "501")
+	cmdCode(t, conn, "MAIL FROM:<senderexample.com>", "553")
+	cmdCode(t, conn, "MAIL FROM: <sender@@example.com>", "553")
+	cmdCode(t, conn, "MAIL FROM: <sender@test@example.com>", "553")
+	cmdCode(t, conn, "MAIL FROM: <senderexample.com>", "553")
+	cmdCode(t, conn, "MAIL FROM:  <senderexample.com>", "501")
+	cmdCode(t, conn, "MAIL FROM: < sender@example.com >", "553")
+	cmdCode(t, conn, "MAIL FROM: < sender@example.com>", "553")
+	cmdCode(t, conn, "MAIL FROM: <sender@example.com >", "553")
+
 	// MAIL with valid SIZE parameter should return 250 Ok
 	cmdCode(t, conn, "MAIL FROM:<sender@example.com> SIZE=1000", "250")
 
@@ -152,17 +215,17 @@ func TestCmdMAIL(t *testing.T) {
 	cmdCode(t, conn, "MAIL FROM:<sender@example.com> SIZE= ", "501")
 	cmdCode(t, conn, "MAIL FROM:<sender@example.com> SIZE=foo", "501")
 
-	// MAIL with options should be ignored except for SIZE
-	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME", "250")           // ignored
-	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME,SIZE=1000", "250") // size detected
-	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME,SIZE=foo", "501")  // ignored
+	// MAIL with BODY parameter should be accepted (8BITMIME support)
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME", "250")
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME,SIZE=1000", "250")
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME,SIZE=foo", "501") // SIZE validation error
 
 	// TODO: MAIL with valid AUTH parameter should return 250 Ok
 
 	// TODO: MAIL with invalid AUTH parameter must return 501 syntax error
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdMAILMaxSize(t *testing.T) {
@@ -192,7 +255,7 @@ func TestCmdMAILMaxSize(t *testing.T) {
 
 	// Clients should send either RSET or QUIT after receiving 552 (RFC 1870 section 6.2).
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdRCPT(t *testing.T) {
@@ -211,6 +274,7 @@ func TestCmdRCPT(t *testing.T) {
 	cmdCode(t, conn, "RCPT TO:", "501")
 	cmdCode(t, conn, "RCPT TO: ", "501")
 	cmdCode(t, conn, "RCPT TO:  ", "501")
+	cmdCode(t, conn, "RCPT TO:<@route.example user@example.com>", "553")
 
 	// RCPT with valid TO arg should return 250 Ok
 	cmdCode(t, conn, "RCPT TO:<recipient@example.com>", "250")
@@ -239,7 +303,7 @@ func TestCmdRCPT(t *testing.T) {
 	cmdCode(t, conn, "RCPT TO:  <recipient@example.com>", "501")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdMaxRecipients(t *testing.T) {
@@ -256,7 +320,7 @@ func TestCmdMaxRecipients(t *testing.T) {
 	cmdCode(t, conn, "RCPT TO: <recipient5@example.com>", "452")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdDATA(t *testing.T) {
@@ -286,7 +350,7 @@ func TestCmdDATA(t *testing.T) {
 	cmdCode(t, conn, "Test message.\r\n.", "250")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdDATAWithMaxSize(t *testing.T) {
@@ -323,7 +387,7 @@ func TestCmdDATAWithMaxSize(t *testing.T) {
 
 	// Clients should send either RSET or QUIT after receiving 552 (RFC 1870 section 6.2).
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 type mockHandler struct {
@@ -347,7 +411,7 @@ func TestCmdDATAWithHandler(t *testing.T) {
 	cmdCode(t, conn, "DATA", "354")
 	cmdCode(t, conn, "Test message.\r\n.", "250")
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 
 	if m.handlerCalled != 1 {
 		t.Errorf("MailHandler called %d times, want one call", m.handlerCalled)
@@ -364,7 +428,7 @@ func TestCmdDATAWithHandlerError(t *testing.T) {
 	cmdCode(t, conn, "DATA", "354")
 	cmdCode(t, conn, "Test message.\r\n.", "451")
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 
 	if m.handlerCalled != 1 {
 		t.Errorf("MailHandler called %d times, want one call", m.handlerCalled)
@@ -382,7 +446,7 @@ func TestCmdSTARTTLS(t *testing.T) {
 	cmdCode(t, conn, "STARTTLS FOO", "501")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdSTARTTLSFailure(t *testing.T) {
@@ -411,7 +475,7 @@ func TestCmdSTARTTLSFailure(t *testing.T) {
 	}
 
 	cmdCode(t, conn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 // Utility function to make a valid TLS certificate for use by the server.
@@ -497,7 +561,7 @@ func TestCmdSTARTTLSSuccess(t *testing.T) {
 	cmdCode(t, tlsConn, "STARTTLS", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 func TestCmdSTARTTLSRequired(t *testing.T) {
@@ -548,7 +612,7 @@ func TestCmdSTARTTLSRequired(t *testing.T) {
 	}
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 func TestMakeHeaders(t *testing.T) {
@@ -715,8 +779,8 @@ func parseExtensions(t *testing.T, greeting string) map[string]string {
 
 			// Add line as extension.
 			line = strings.TrimSpace(line[4:]) // Strip code prefix and trailing \r\n
-			if idx := strings.Index(line, " "); idx != -1 {
-				extensions[line[:idx]] = line[idx+1:]
+			if before, after, ok := strings.Cut(line, " "); ok {
+				extensions[before] = after
 			} else {
 				extensions[line] = ""
 			}
@@ -798,8 +862,8 @@ func TestMakeEHLOResponse(t *testing.T) {
 		t.Errorf("AUTH does not appear in the extension list when an AuthHandler is specified")
 	}
 
-	reLogin := regexp.MustCompile("\\bLOGIN\\b")
-	rePlain := regexp.MustCompile("\\bPLAIN\\b")
+	reLogin := regexp.MustCompile(`\bLOGIN\b`)
+	rePlain := regexp.MustCompile(`\bPLAIN\b`)
 
 	// RFC 4954 specifies that, without TLS in use, plaintext authentication mechanisms must not be advertised.
 	s.tls = false
@@ -820,88 +884,187 @@ func TestMakeEHLOResponse(t *testing.T) {
 	if !rePlain.MatchString(extensions["AUTH"]) {
 		t.Errorf("AUTH mechanism PLAIN does not appear in the extension list when an AuthHandler is specified and TLS is in use")
 	}
+
+	// 8BITMIME should always be advertised
+	s.srv = &Server{}
+	s.tls = false
+	extensions = parseExtensions(t, s.makeEHLOResponse())
+	if _, ok := extensions["8BITMIME"]; !ok {
+		t.Errorf("8BITMIME does not appear in the extension list")
+	}
+
+	// SMTPUTF8 should always be advertised
+	if _, ok := extensions["SMTPUTF8"]; !ok {
+		t.Errorf("SMTPUTF8 does not appear in the extension list")
+	}
+
+	// ENHANCEDSTATUSCODES should always be advertised
+	if _, ok := extensions["ENHANCEDSTATUSCODES"]; !ok {
+		t.Errorf("ENHANCEDSTATUSCODES does not appear in the extension list")
+	}
 }
 
-func createTmpFile(content string) (file *os.File, err error) {
-	file, err = os.CreateTemp("", "")
-	if err != nil {
-		return
+// Test 8BITMIME BODY parameter parsing in MAIL FROM command
+func TestCmd8BITMIME(t *testing.T) {
+	srv := &Server{}
+	conn := newConn(t, srv)
+	cmdCode(t, conn, "EHLO host.example.com", "250")
+
+	// Create a session to check internal state
+	clientConn, serverConn := net.Pipe()
+	session := srv.newSession(serverConn)
+	go session.serve()
+
+	// Read and discard banner
+	_, _ = bufio.NewReader(clientConn).ReadString('\n')
+
+	// Send EHLO
+	_, _ = fmt.Fprintf(clientConn, "EHLO test.example.com\r\n")
+	reader := bufio.NewReader(clientConn)
+	for {
+		line, _ := reader.ReadString('\n')
+		if strings.HasPrefix(line, "250 ") {
+			break
+		}
 	}
-	_, err = file.Write([]byte(content))
-	if err != nil {
-		return
+
+	// Test BODY=8BITMIME parameter
+	_, _ = fmt.Fprintf(clientConn, "MAIL FROM:<sender@example.com> BODY=8BITMIME\r\n")
+	resp, _ := reader.ReadString('\n')
+	if !strings.HasPrefix(resp, "250") {
+		t.Errorf("MAIL FROM with BODY=8BITMIME failed: %s", resp)
 	}
-	err = file.Close()
-	return
+
+	// Verify bodyEncoding was set (we can't directly access it, but we can test the behavior)
+	// Reset and test BODY=7BIT
+	_, _ = fmt.Fprintf(clientConn, "RSET\r\n")
+	_, _ = reader.ReadString('\n')
+
+	_, _ = fmt.Fprintf(clientConn, "MAIL FROM:<sender@example.com> BODY=7BIT\r\n")
+	resp, _ = reader.ReadString('\n')
+	if !strings.HasPrefix(resp, "250") {
+		t.Errorf("MAIL FROM with BODY=7BIT failed: %s", resp)
+	}
+
+	// Test BODY parameter with SIZE parameter
+	_, _ = fmt.Fprintf(clientConn, "RSET\r\n")
+	_, _ = reader.ReadString('\n')
+
+	_, _ = fmt.Fprintf(clientConn, "MAIL FROM:<sender@example.com> SIZE=1000 BODY=8BITMIME\r\n")
+	resp, _ = reader.ReadString('\n')
+	if !strings.HasPrefix(resp, "250") {
+		t.Errorf("MAIL FROM with SIZE and BODY parameters failed: %s", resp)
+	}
+
+	// Test case insensitivity
+	_, _ = fmt.Fprintf(clientConn, "RSET\r\n")
+	_, _ = reader.ReadString('\n')
+
+	_, _ = fmt.Fprintf(clientConn, "MAIL FROM:<sender@example.com> body=8bitmime\r\n")
+	resp, _ = reader.ReadString('\n')
+	if !strings.HasPrefix(resp, "250") {
+		t.Errorf("MAIL FROM with lowercase body parameter failed: %s", resp)
+	}
+
+	// Clean up
+	_, _ = fmt.Fprintf(clientConn, "QUIT\r\n")
+	_, _ = reader.ReadString('\n')
+	_ = clientConn.Close()
+
+	// Also test via the original connection
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME", "250")
+	cmdCode(t, conn, "RCPT TO:<recipient@example.com>", "250")
+
+	cmdCode(t, conn, "RSET", "250")
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=7BIT", "250")
+
+	cmdCode(t, conn, "RSET", "250")
+	cmdCode(t, conn, "MAIL FROM:<sender@example.com> BODY=8BITMIME SIZE=5000", "250")
+
+	cmdCode(t, conn, "QUIT", "221")
+	_ = conn.Close()
 }
 
-func createTLSFiles() (
-	certFile *os.File,
-	keyFile *os.File,
-	passphrase string,
-	err error,
-) {
-	const certPEM = `-----BEGIN CERTIFICATE-----
-MIIDRzCCAi+gAwIBAgIJAKtg4oViVwv4MA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNV
-BAMMCWxvY2FsaG9zdDAgFw0xODA0MjAxMzMxNTBaGA8yMDg2MDUwODEzMzE1MFow
-FDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA8h7vl0gUquis5jRtcnETyD+8WITZO0s53aIzp0Y+9HXiHW6FGJjbOZjM
-IvozNVni+83QWKumRTgeSzIIW2j4V8iFMSNrvWmhmCKloesXS1aY6H979e01Ve8J
-WAJFRe6vZJd6gC6Z/P+ELU3ie4Vtr1GYfkV7nZ6VFp5/V/5nxGFag5TUlpP5hcoS
-9r2kvXofosVwe3x3udT8SEbv5eBD4bKeVyJs/RLbxSuiU1358Y1cDdVuHjcvfm3c
-ajhheQ4vX9WXsk7LGGhnf1SrrPN/y+IDTXfvoHn+nJh4vMAB4yzQdE1V1N1AB8RA
-0yBVJ6dwxRrSg4BFrNWhj3gfsvrA7wIDAQABo4GZMIGWMB0GA1UdDgQWBBQ4/ncp
-befFuKH1hoYkPqLwuRrPRjAfBgNVHSMEGDAWgBQ4/ncpbefFuKH1hoYkPqLwuRrP
-RjAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIGQDALBgNVHQ8EBAMCBaAwEwYD
-VR0lBAwwCgYIKwYBBQUHAwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3
-DQEBCwUAA4IBAQBJBetEXiEIzKAEpXGX87j6aUON51Fdf6BiLMCghuGKyhnaOG32
-4KJhtvVoS3ZUKPylh9c2VdItYlhWp76zd7YKk+3xUOixWeTMQHIvCvRGTyFibOPT
-mApwp2pEnJCe4vjUrBaRhiyI+xnB70cWVF2qeernlLUeJA1mfYyQLz+v06ebDWOL
-c/hPVQFB94lEdiyjGO7RZfIe8KwcK48g7iv0LQU4+c9MoWM2ZsVM1AL2tHzokSeA
-u64gDTW4K0Tzx1ab7KmOFXYUjbz/xWuReMt33EwDXAErKCjbVt2T55Qx8UoKzSh1
-tY0KDHdnYOzgsm2HIj2xcJqbeylYQvckNnoC
------END CERTIFICATE-----`
+// func createTmpFile(content string) (file *os.File, err error) {
+// 	file, err = os.CreateTemp("", "")
+// 	if err != nil {
+// 		return
+// 	}
+// 	_, err = file.Write([]byte(content))
+// 	if err != nil {
+// 		return
+// 	}
+// 	err = file.Close()
+// 	return
+// }
 
-	const keyPEM = `-----BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-256-CBC,C16BF8745B2CDB53AC2B1D7609893AA0
+// func createTLSFiles() (
+// 	certFile *os.File,
+// 	keyFile *os.File,
+// 	passphrase string,
+// 	err error,
+// ) {
+// 	const certPEM = `-----BEGIN CERTIFICATE-----
+// MIIDRzCCAi+gAwIBAgIJAKtg4oViVwv4MA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNV
+// BAMMCWxvY2FsaG9zdDAgFw0xODA0MjAxMzMxNTBaGA8yMDg2MDUwODEzMzE1MFow
+// FDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+// CgKCAQEA8h7vl0gUquis5jRtcnETyD+8WITZO0s53aIzp0Y+9HXiHW6FGJjbOZjM
+// IvozNVni+83QWKumRTgeSzIIW2j4V8iFMSNrvWmhmCKloesXS1aY6H979e01Ve8J
+// WAJFRe6vZJd6gC6Z/P+ELU3ie4Vtr1GYfkV7nZ6VFp5/V/5nxGFag5TUlpP5hcoS
+// 9r2kvXofosVwe3x3udT8SEbv5eBD4bKeVyJs/RLbxSuiU1358Y1cDdVuHjcvfm3c
+// ajhheQ4vX9WXsk7LGGhnf1SrrPN/y+IDTXfvoHn+nJh4vMAB4yzQdE1V1N1AB8RA
+// 0yBVJ6dwxRrSg4BFrNWhj3gfsvrA7wIDAQABo4GZMIGWMB0GA1UdDgQWBBQ4/ncp
+// befFuKH1hoYkPqLwuRrPRjAfBgNVHSMEGDAWgBQ4/ncpbefFuKH1hoYkPqLwuRrP
+// RjAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIGQDALBgNVHQ8EBAMCBaAwEwYD
+// VR0lBAwwCgYIKwYBBQUHAwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3
+// DQEBCwUAA4IBAQBJBetEXiEIzKAEpXGX87j6aUON51Fdf6BiLMCghuGKyhnaOG32
+// 4KJhtvVoS3ZUKPylh9c2VdItYlhWp76zd7YKk+3xUOixWeTMQHIvCvRGTyFibOPT
+// mApwp2pEnJCe4vjUrBaRhiyI+xnB70cWVF2qeernlLUeJA1mfYyQLz+v06ebDWOL
+// c/hPVQFB94lEdiyjGO7RZfIe8KwcK48g7iv0LQU4+c9MoWM2ZsVM1AL2tHzokSeA
+// u64gDTW4K0Tzx1ab7KmOFXYUjbz/xWuReMt33EwDXAErKCjbVt2T55Qx8UoKzSh1
+// tY0KDHdnYOzgsm2HIj2xcJqbeylYQvckNnoC
+// -----END CERTIFICATE-----`
 
-O13z7Yq7butaJmMfg9wRis9YnIDPsp4coYI6Ud+JGcP7iXoy95QMhovKWx25o1ol
-tvUTsrsG27fHGf9qG02KizApIVtO9c1e0swCWzFrKRQX0JDiZDmilb9xosBNNst1
-BOzOTRZEwFGSOCKZRBfSXyqC93TvLJ3DO9IUnKIeGt7upipvg29b/Dur/fyCy2WV
-bLHXwUTDBm7j49yfoEyGkDjoB2QO9wgcgbacbnQJQ25fTFUwZpZJEJv6o1tRhoYM
-ZMOhC9x1URmdHKN1+z2y5BrB6oNpParfeAMEvs/9FE6jJwYUR28Ql6Mhphfvr9W2
-5Gxd3J65Ao9Vi2I5j5X6aBuNjyhXN3ScLjPG4lVZm9RU/uTPEt81pig/d5nSAjvF
-Nfc08NuG3cnMyJSE/xScJ4D+GtX8U969wO4oKPCR4E/NFyXPR730ppupDFG6hzPD
-PDmiszDtU438JAZ8AuFa1LkbyFnEW6KVD4h7VRr8YDjirCqnkgjNSI6dFY0NQ8H7
-SyexB0lrceX6HZc+oNdAtkX3tYdzY3ExzUM5lSF1dkldnRbApLbqc4uuNIVXhXFM
-dJnoPdKAzM6i+2EeVUxWNdafKDxnjVSHIHzHfIFJLQ4GS5rnz9keRFdyDjQL07tT
-Lu9pPOmsadDXp7oSa81RgoCUfNZeR4jKpCk2BOft0L6ZSqwYFLcQHLIfJaGfn902
-TUOTxHt0KzEUYeYSrXC2a6cyvXAd1YI7lOgy60qG89VHyCc2v5Bs4c4FNUDC/+Dj
-4ZwogaAbSNkLaE0q3sYQRPdxSqLftyX0KitAgE7oGtdzBfe1cdBoozw3U67NEMMT
-6qvk5j7RepPRSrapHtK5pMMdg5XpKFWcOXZ26VHVrDCj4JKdjVb4iyiQi94VveV0
-w9+KcOtyrM7/jbQlCWnXpsIkP8VA/RIgh7CBn/h4oF1sO8ywP25OGQ7VWAVq1R9D
-8bl8GzIdR9PZpFyOxuIac4rPa8tkDeoXKs4cxoao7H/OZO9o9aTB7CJMTL9yv0Kb
-ntWuYxQchE6syoGsOgdGyZhaw4JeFkasDUP5beyNY+278NkzgGTOIMMTXIX46woP
-ehzHKGHXVGf7ZiSFF+zAHMXZRSwNVMkOYwlIoRg1IbvIRbAXqAR6xXQTCVzNG0SU
-cskojycBca1Cz3hDVIKYZd9beDhprVdr2a4K2nft2g2xRNjKPopsaqXx+VPibFUx
-X7542eQ3eAlhkWUuXvt0q5a9WJdjJp9ODA0/d0akF6JQlEHIAyLfoUKB1HYwgUGG
-6uRm651FDAab9U4cVC5PY1hfv/QwzpkNDkzgJAZ5SMOfZhq7IdBcqGd3lzPmq2FP
-Vy1LVZIl3eM+9uJx5TLsBHH6NhMwtNhFCNa/5ksodQYlTvR8IrrgWlYg4EL69vjS
-yt6HhhEN3lFCWvrQXQMp93UklbTlpVt6qcDXiC7HYbs3+EINargRd5Z+xL5i5vkN
-f9k7s0xqhloWNPZcyOXMrox8L81WOY+sP4mVlGcfDRLdEJ8X2ofJpOAcwYCnjsKd
-uEGsi+l2fTj/F+eZLE6sYoMprgJrbfeqtRWFguUgTn7s5hfU0tZ46al5d0vz8fWK
------END RSA PRIVATE KEY-----`
+// 	const keyPEM = `-----BEGIN RSA PRIVATE KEY-----
+// Proc-Type: 4,ENCRYPTED
+// DEK-Info: AES-256-CBC,C16BF8745B2CDB53AC2B1D7609893AA0
 
-	passphrase = "test"
+// O13z7Yq7butaJmMfg9wRis9YnIDPsp4coYI6Ud+JGcP7iXoy95QMhovKWx25o1ol
+// tvUTsrsG27fHGf9qG02KizApIVtO9c1e0swCWzFrKRQX0JDiZDmilb9xosBNNst1
+// BOzOTRZEwFGSOCKZRBfSXyqC93TvLJ3DO9IUnKIeGt7upipvg29b/Dur/fyCy2WV
+// bLHXwUTDBm7j49yfoEyGkDjoB2QO9wgcgbacbnQJQ25fTFUwZpZJEJv6o1tRhoYM
+// ZMOhC9x1URmdHKN1+z2y5BrB6oNpParfeAMEvs/9FE6jJwYUR28Ql6Mhphfvr9W2
+// 5Gxd3J65Ao9Vi2I5j5X6aBuNjyhXN3ScLjPG4lVZm9RU/uTPEt81pig/d5nSAjvF
+// Nfc08NuG3cnMyJSE/xScJ4D+GtX8U969wO4oKPCR4E/NFyXPR730ppupDFG6hzPD
+// PDmiszDtU438JAZ8AuFa1LkbyFnEW6KVD4h7VRr8YDjirCqnkgjNSI6dFY0NQ8H7
+// SyexB0lrceX6HZc+oNdAtkX3tYdzY3ExzUM5lSF1dkldnRbApLbqc4uuNIVXhXFM
+// dJnoPdKAzM6i+2EeVUxWNdafKDxnjVSHIHzHfIFJLQ4GS5rnz9keRFdyDjQL07tT
+// Lu9pPOmsadDXp7oSa81RgoCUfNZeR4jKpCk2BOft0L6ZSqwYFLcQHLIfJaGfn902
+// TUOTxHt0KzEUYeYSrXC2a6cyvXAd1YI7lOgy60qG89VHyCc2v5Bs4c4FNUDC/+Dj
+// 4ZwogaAbSNkLaE0q3sYQRPdxSqLftyX0KitAgE7oGtdzBfe1cdBoozw3U67NEMMT
+// 6qvk5j7RepPRSrapHtK5pMMdg5XpKFWcOXZ26VHVrDCj4JKdjVb4iyiQi94VveV0
+// w9+KcOtyrM7/jbQlCWnXpsIkP8VA/RIgh7CBn/h4oF1sO8ywP25OGQ7VWAVq1R9D
+// 8bl8GzIdR9PZpFyOxuIac4rPa8tkDeoXKs4cxoao7H/OZO9o9aTB7CJMTL9yv0Kb
+// ntWuYxQchE6syoGsOgdGyZhaw4JeFkasDUP5beyNY+278NkzgGTOIMMTXIX46woP
+// ehzHKGHXVGf7ZiSFF+zAHMXZRSwNVMkOYwlIoRg1IbvIRbAXqAR6xXQTCVzNG0SU
+// cskojycBca1Cz3hDVIKYZd9beDhprVdr2a4K2nft2g2xRNjKPopsaqXx+VPibFUx
+// X7542eQ3eAlhkWUuXvt0q5a9WJdjJp9ODA0/d0akF6JQlEHIAyLfoUKB1HYwgUGG
+// 6uRm651FDAab9U4cVC5PY1hfv/QwzpkNDkzgJAZ5SMOfZhq7IdBcqGd3lzPmq2FP
+// Vy1LVZIl3eM+9uJx5TLsBHH6NhMwtNhFCNa/5ksodQYlTvR8IrrgWlYg4EL69vjS
+// yt6HhhEN3lFCWvrQXQMp93UklbTlpVt6qcDXiC7HYbs3+EINargRd5Z+xL5i5vkN
+// f9k7s0xqhloWNPZcyOXMrox8L81WOY+sP4mVlGcfDRLdEJ8X2ofJpOAcwYCnjsKd
+// uEGsi+l2fTj/F+eZLE6sYoMprgJrbfeqtRWFguUgTn7s5hfU0tZ46al5d0vz8fWK
+// -----END RSA PRIVATE KEY-----`
 
-	certFile, err = createTmpFile(certPEM)
-	if err != nil {
-		return
-	}
-	keyFile, err = createTmpFile(keyPEM)
-	return
-}
+// 	passphrase = "test"
+
+// 	certFile, err = createTmpFile(certPEM)
+// 	if err != nil {
+// 		return
+// 	}
+// 	keyFile, err = createTmpFile(keyPEM)
+// 	return
+// }
 
 func TestAuthMechs(t *testing.T) {
 	s := session{}
@@ -966,7 +1129,7 @@ func TestCmdAUTH(t *testing.T) {
 	cmdCode(t, conn, "AUTH", "502")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdAUTHOptional(t *testing.T) {
@@ -1007,7 +1170,7 @@ func TestCmdAUTHOptional(t *testing.T) {
 	cmdCode(t, conn, "*", "501")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdAUTHRequired(t *testing.T) {
@@ -1056,7 +1219,7 @@ func TestCmdAUTHRequired(t *testing.T) {
 	cmdCode(t, conn, "AUTH PLAIN", "504")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdAUTHLOGIN(t *testing.T) {
@@ -1113,7 +1276,7 @@ func TestCmdAUTHLOGIN(t *testing.T) {
 	cmdCode(t, tlsConn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 func TestCmdAUTHLOGINFast(t *testing.T) {
@@ -1165,7 +1328,7 @@ func TestCmdAUTHLOGINFast(t *testing.T) {
 	cmdCode(t, tlsConn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 func TestCmdAUTHPLAIN(t *testing.T) {
@@ -1224,7 +1387,7 @@ func TestCmdAUTHPLAIN(t *testing.T) {
 	cmdCode(t, tlsConn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 func TestCmdAUTHPLAINEmpty(t *testing.T) {
@@ -1283,7 +1446,7 @@ func TestCmdAUTHPLAINEmpty(t *testing.T) {
 	cmdCode(t, tlsConn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 func TestCmdAUTHPLAINFast(t *testing.T) {
@@ -1335,7 +1498,7 @@ func TestCmdAUTHPLAINFast(t *testing.T) {
 	cmdCode(t, tlsConn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 func TestCmdAUTHPLAINFastAndEmpty(t *testing.T) {
@@ -1387,7 +1550,7 @@ func TestCmdAUTHPLAINFastAndEmpty(t *testing.T) {
 	cmdCode(t, tlsConn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 // makeCRAMMD5Response is a helper function to create the CRAM-MD5 hash.
@@ -1457,7 +1620,7 @@ func TestCmdAUTHCRAMMD5(t *testing.T) {
 	cmdCode(t, conn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, conn, "QUIT", "221")
-	conn.Close()
+	_ = conn.Close()
 }
 
 func TestCmdAUTHCRAMMD5WithTLS(t *testing.T) {
@@ -1523,7 +1686,7 @@ func TestCmdAUTHCRAMMD5WithTLS(t *testing.T) {
 	cmdCode(t, tlsConn, "AUTH CRAM-MD5", "503")
 
 	cmdCode(t, tlsConn, "QUIT", "221")
-	tlsConn.Close()
+	_ = tlsConn.Close()
 }
 
 // Benchmark the mail handling without the network stack introducing latency.
@@ -1540,17 +1703,17 @@ func BenchmarkReceive(b *testing.B) {
 
 	// Benchmark a full mail transaction.
 	for i := 0; i < b.N; i++ {
-		fmt.Fprintf(clientConn, "%s\r\n", "HELO host.example.com")
+		_, _ = fmt.Fprintf(clientConn, "%s\r\n", "HELO host.example.com")
 		_, _ = reader.ReadString('\n')
-		fmt.Fprintf(clientConn, "%s\r\n", "MAIL FROM:<sender@example.com>")
+		_, _ = fmt.Fprintf(clientConn, "%s\r\n", "MAIL FROM:<sender@example.com>")
 		_, _ = reader.ReadString('\n')
-		fmt.Fprintf(clientConn, "%s\r\n", "RCPT TO:<recipient@example.com>")
+		_, _ = fmt.Fprintf(clientConn, "%s\r\n", "RCPT TO:<recipient@example.com>")
 		_, _ = reader.ReadString('\n')
-		fmt.Fprintf(clientConn, "%s\r\n", "DATA")
+		_, _ = fmt.Fprintf(clientConn, "%s\r\n", "DATA")
 		_, _ = reader.ReadString('\n')
-		fmt.Fprintf(clientConn, "%s\r\n", "Test message.\r\n.")
+		_, _ = fmt.Fprintf(clientConn, "%s\r\n", "Test message.\r\n.")
 		_, _ = reader.ReadString('\n')
-		fmt.Fprintf(clientConn, "%s\r\n", "QUIT")
+		_, _ = fmt.Fprintf(clientConn, "%s\r\n", "QUIT")
 		_, _ = reader.ReadString('\n')
 	}
 }
@@ -1589,11 +1752,180 @@ func TestCmdShutdown(t *testing.T) {
 	cmdCode(t, conn, "QUIT", "221")
 
 	// connection should now be closed
-	fmt.Fprintf(conn, "%s\r\n", "HELO host.example.com")
+	_, _ = fmt.Fprintf(conn, "%s\r\n", "HELO host.example.com")
 	_, err := bufio.NewReader(conn).ReadString('\n')
 	if err != io.EOF {
 		t.Errorf("Expected connection to be closed\n")
 	}
 
-	conn.Close()
+	_ = conn.Close()
+}
+
+type mockDropRejectedHandler struct {
+	handlerCalled int
+	lastFrom      string
+	lastTo        []string
+	msgIDCalled   int
+	lastMsgIDFrom string
+	lastMsgIDTo   []string
+}
+
+func (m *mockDropRejectedHandler) handler(remoteAddr net.Addr, from string, to []string, data []byte) error {
+	m.handlerCalled++
+	m.lastFrom = from
+	m.lastTo = append([]string{}, to...) // copy slice
+	return nil
+}
+
+func (m *mockDropRejectedHandler) msgIDHandler(remoteAddr net.Addr, from string, to []string, data []byte, username *string) (string, error) {
+	m.msgIDCalled++
+	m.lastMsgIDFrom = from
+	m.lastMsgIDTo = append([]string{}, to...) // copy slice
+	return "test-message-id", nil
+}
+
+// Test the IgnoreRejectedRecipients option
+func TestIgnoreRejectedRecipients(t *testing.T) {
+	tests := []struct {
+		name                      string
+		IgnoreRejectedRecipients  bool
+		handlerRcpt               func(net.Addr, string, string) bool
+		rcptCommands              []struct{ addr, expectedCode string }
+		expectedHandlerCalls      int
+		expectedHandlerRecipients []string
+		useMsgIDHandler           bool
+	}{
+		{
+			name:                     "Disabled_DefaultBehavior",
+			IgnoreRejectedRecipients: false,
+			handlerRcpt: func(remoteAddr net.Addr, from string, to string) bool {
+				return !strings.HasSuffix(to, "@rejected.com")
+			},
+			rcptCommands: []struct{ addr, expectedCode string }{
+				{"valid@example.com", "250"},
+				{"invalid@rejected.com", "550"},
+			},
+			expectedHandlerCalls:      1,
+			expectedHandlerRecipients: []string{"valid@example.com"},
+		},
+		{
+			name:                     "Enabled_MixedRecipients",
+			IgnoreRejectedRecipients: true,
+			handlerRcpt: func(remoteAddr net.Addr, from string, to string) bool {
+				return !strings.HasSuffix(to, "@rejected.com")
+			},
+			rcptCommands: []struct{ addr, expectedCode string }{
+				{"valid1@example.com", "250"},
+				{"valid2@example.com", "250"},
+				{"invalid1@rejected.com", "250"}, // Now accepted but dropped
+				{"invalid2@rejected.com", "250"}, // Now accepted but dropped
+			},
+			expectedHandlerCalls:      1,
+			expectedHandlerRecipients: []string{"valid1@example.com", "valid2@example.com"},
+		},
+		{
+			name:                     "Enabled_AllRejected",
+			IgnoreRejectedRecipients: true,
+			handlerRcpt: func(remoteAddr net.Addr, from string, to string) bool {
+				return false // Reject all
+			},
+			rcptCommands: []struct{ addr, expectedCode string }{
+				{"test1@example.com", "250"}, // Accepted but dropped
+				{"test2@example.com", "250"}, // Accepted but dropped
+			},
+			expectedHandlerCalls:      0, // No handler calls since all rejected
+			expectedHandlerRecipients: nil,
+		},
+		{
+			name:                     "Enabled_OnlyValid",
+			IgnoreRejectedRecipients: true,
+			handlerRcpt: func(remoteAddr net.Addr, from string, to string) bool {
+				return strings.HasSuffix(to, "@valid.com")
+			},
+			rcptCommands: []struct{ addr, expectedCode string }{
+				{"user1@valid.com", "250"},
+				{"user2@valid.com", "250"},
+				{"user3@valid.com", "250"},
+			},
+			expectedHandlerCalls:      1,
+			expectedHandlerRecipients: []string{"user1@valid.com", "user2@valid.com", "user3@valid.com"},
+		},
+		{
+			name:                     "Enabled_WithMsgIDHandler",
+			IgnoreRejectedRecipients: true,
+			handlerRcpt: func(remoteAddr net.Addr, from string, to string) bool {
+				return !strings.HasSuffix(to, "@rejected.com")
+			},
+			rcptCommands: []struct{ addr, expectedCode string }{
+				{"valid@example.com", "250"},
+				{"invalid@rejected.com", "250"}, // Accepted but dropped
+			},
+			expectedHandlerCalls:      1,
+			expectedHandlerRecipients: []string{"valid@example.com"},
+			useMsgIDHandler:           true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mock := &mockDropRejectedHandler{}
+
+			server := &Server{
+				Hostname:                 "mail.example.com",
+				AppName:                  "TestMail",
+				MaxRecipients:            100,
+				HandlerRcpt:              tt.handlerRcpt,
+				IgnoreRejectedRecipients: tt.IgnoreRejectedRecipients,
+			}
+
+			if tt.useMsgIDHandler {
+				server.MsgIDHandler = mock.msgIDHandler
+			} else {
+				server.Handler = mock.handler
+			}
+
+			conn := newConn(t, server)
+			defer func() { _ = conn.Close() }()
+
+			cmdCode(t, conn, "HELO host.example.com", "250")
+			cmdCode(t, conn, "MAIL FROM:<sender@example.com>", "250")
+
+			// Send RCPT commands
+			for _, rcpt := range tt.rcptCommands {
+				cmdCode(t, conn, "RCPT TO:<"+rcpt.addr+">", rcpt.expectedCode)
+			}
+
+			// Send DATA
+			cmdCode(t, conn, "DATA", "354")
+			cmdCode(t, conn, "Subject: Test\r\n\r\nTest message\r\n.", "250")
+			cmdCode(t, conn, "QUIT", "221")
+
+			// Verify handler calls
+			if tt.useMsgIDHandler {
+				if mock.msgIDCalled != tt.expectedHandlerCalls {
+					t.Errorf("Expected %d MsgIDHandler calls, got %d", tt.expectedHandlerCalls, mock.msgIDCalled)
+				}
+				if tt.expectedHandlerCalls > 0 {
+					if mock.lastMsgIDFrom != "sender@example.com" {
+						t.Errorf("Expected from 'sender@example.com', got '%s'", mock.lastMsgIDFrom)
+					}
+					if !reflect.DeepEqual(mock.lastMsgIDTo, tt.expectedHandlerRecipients) {
+						t.Errorf("Expected recipients %v, got %v", tt.expectedHandlerRecipients, mock.lastMsgIDTo)
+					}
+				}
+			} else {
+				if mock.handlerCalled != tt.expectedHandlerCalls {
+					t.Errorf("Expected %d handler calls, got %d", tt.expectedHandlerCalls, mock.handlerCalled)
+				}
+				if tt.expectedHandlerCalls > 0 {
+					if mock.lastFrom != "sender@example.com" {
+						t.Errorf("Expected from 'sender@example.com', got '%s'", mock.lastFrom)
+					}
+					if !reflect.DeepEqual(mock.lastTo, tt.expectedHandlerRecipients) {
+						t.Errorf("Expected recipients %v, got %v", tt.expectedHandlerRecipients, mock.lastTo)
+					}
+				}
+			}
+		})
+	}
 }

internal/snakeoil/snakeoil.go

@@ -0,0 +1,196 @@
+// Package snakeoil provides functionality to generate a temporary self-signed certificates
+// for testing purposes. It generates a public and private key pair, stores them in the
+// OS's temporary directory, returning the paths to these files.
+package snakeoil
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/pem"
+	"errors"
+	"math/big"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/axllent/mailpit/internal/logger"
+	"github.com/axllent/mailpit/internal/tools"
+)
+
+var keys = make(map[string]KeyPair)
+
+// KeyPair holds the public and private key paths for a self-signed certificate.
+type KeyPair struct {
+	Public  string
+	Private string
+}
+
+// Certificates returns all configured self-signed certificates in use,
+// used for file deletion on exit.
+func Certificates() map[string]KeyPair {
+	return keys
+}
+
+// Public returns the path to a generated PEM-encoded RSA public key.
+func Public(str string) string {
+	domains, key, err := parse(str)
+	if err != nil {
+		logger.Log().Errorf("[tls] failed to parse domains: %v", err)
+		return ""
+	}
+
+	if pair, ok := keys[key]; ok {
+		return pair.Public
+	}
+
+	private, public, err := generate(domains)
+	if err != nil {
+		logger.Log().Errorf("[tls] failed to generate public certificate: %v", err)
+		return ""
+	}
+
+	keys[key] = KeyPair{
+		Public:  public,
+		Private: private,
+	}
+
+	return public
+}
+
+// Private returns the path to a generated PEM-encoded RSA private key.
+func Private(str string) string {
+	domains, key, err := parse(str)
+	if err != nil {
+		logger.Log().Errorf("[tls] failed to parse domains: %v", err)
+		return ""
+	}
+
+	if pair, ok := keys[key]; ok {
+		return pair.Private
+	}
+
+	private, public, err := generate(domains)
+	if err != nil {
+		logger.Log().Errorf("[tls] failed to generate public certificate: %v", err)
+		return ""
+	}
+
+	keys[key] = KeyPair{
+		Public:  public,
+		Private: private,
+	}
+
+	return private
+}
+
+// Parse takes the original string input, removes the "sans:" prefix,
+// splits the result into individual domains, and returns a slice of unique domains,
+// along with a unique key that is a comma-separated list of these domains.
+func parse(str string) ([]string, string, error) {
+	// remove "sans:" prefix
+	str = str[5:]
+	var domains []string
+	// split the string by commas and trim whitespace
+	for domain := range strings.SplitSeq(str, ",") {
+		domain = strings.ToLower(strings.TrimSpace(domain))
+		if domain != "" && !tools.InArray(domain, domains) {
+			domains = append(domains, domain)
+		}
+	}
+
+	if len(domains) == 0 {
+		return domains, "", errors.New("no valid domains provided")
+	}
+
+	// generate sha256 hash of the domains to create a unique key
+	hasher := sha256.New()
+	hasher.Write([]byte(strings.Join(domains, ",")))
+	key := base64.URLEncoding.EncodeToString(hasher.Sum(nil))
+
+	return domains, key, nil
+}
+
+// Generate a new self-signed certificate and return a public & private key paths.
+func generate(domains []string) (string, string, error) {
+	logger.Log().Infof("[tls] generating temp self-signed certificate for: %s", strings.Join(domains, ","))
+	key, err := rsa.GenerateKey(rand.Reader, 4096)
+	if err != nil {
+		return "", "", err
+	}
+
+	keyBytes := x509.MarshalPKCS1PrivateKey(key)
+	// PEM encoding of private key
+	keyPEM := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "RSA PRIVATE KEY",
+			Bytes: keyBytes,
+		},
+	)
+
+	notBefore := time.Now()
+	notAfter := notBefore.Add(365 * 24 * time.Hour)
+
+	// create certificate template
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(0),
+		Subject: pkix.Name{
+			CommonName:   domains[0],
+			Organization: []string{"Mailpit self-signed certificate"},
+		},
+		DNSNames:              domains,
+		SignatureAlgorithm:    x509.SHA256WithRSA,
+		NotBefore:             notBefore,
+		NotAfter:              notAfter,
+		BasicConstraintsValid: true,
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement | x509.KeyUsageKeyEncipherment | x509.KeyUsageDataEncipherment,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+	}
+
+	// create certificate using template
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
+	if err != nil {
+		return "", "", err
+
+	}
+
+	// PEM encoding of certificate
+	certPem := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "CERTIFICATE",
+			Bytes: derBytes,
+		},
+	)
+
+	// Store the paths to the generated keys
+	priv, err := os.CreateTemp("", ".mailpit-*-private.pem")
+	if err != nil {
+		return "", "", err
+	}
+
+	if _, err := priv.Write(keyPEM); err != nil {
+		return "", "", err
+	}
+
+	if err := priv.Close(); err != nil {
+		return "", "", err
+	}
+
+	pub, err := os.CreateTemp("", ".mailpit-*-public.pem")
+	if err != nil {
+		return "", "", err
+	}
+
+	if _, err := pub.Write(certPem); err != nil {
+		return "", "", err
+	}
+
+	if err := pub.Close(); err != nil {
+		return "", "", err
+	}
+
+	return priv.Name(), pub.Name(), nil
+}

internal/spamassassin/postmark/postmark.go

@@ -59,7 +59,7 @@ func Check(email []byte, timeout int) (Response, error) {
 		return r, err
 	}
 
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	err = json.NewDecoder(resp.Body).Decode(&r)
 

internal/spamassassin/spamassassin.go

@@ -57,13 +57,6 @@ func SetService(s string) {
 	}
 }
 
-// SetTimeout defines the timeout
-func SetTimeout(t int) {
-	if t > 0 {
-		timeout = t
-	}
-}
-
 // Ping returns whether a service is active or not
 func Ping() error {
 	if service == "postmark" {

internal/spamassassin/spamc/spamc.go

@@ -70,21 +70,22 @@ type Result struct {
 
 // dial connects to spamd through TCP or a Unix socket.
 func (c *Client) dial() (connection, error) {
-	if c.net == "tcp" {
+	switch c.net {
+	case "tcp":
 		tcpAddr, err := net.ResolveTCPAddr("tcp", c.addr)
 		if err != nil {
 			return nil, err
 		}
 		return net.DialTCP("tcp", nil, tcpAddr)
-	} else if c.net == "unix" {
+	case "unix":
 		unixAddr, err := net.ResolveUnixAddr("unix", c.addr)
 		if err != nil {
 			return nil, err
 		}
 		return net.DialUnix("unix", nil, unixAddr)
+	default:
+		return nil, fmt.Errorf("unsupported network type: %s", c.net)
 	}
-
-	panic("Client.net must be either \"tcp\" or \"unix\"")
 }
 
 // Report checks if message is spam or not, and returns score plus report
@@ -103,7 +104,7 @@ func (c *Client) report(email []byte) ([]string, error) {
 		return nil, err
 	}
 
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	if err := conn.SetDeadline(time.Now().Add(time.Duration(c.timeout) * time.Second)); err != nil {
 		return nil, err
@@ -221,7 +222,7 @@ func (c *Client) Ping() error {
 	if err != nil {
 		return err
 	}
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	if err := conn.SetDeadline(time.Now().Add(time.Duration(c.timeout) * time.Second)); err != nil {
 		return err

internal/stats/stats.go

@@ -9,7 +9,7 @@ import (
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
 	"github.com/axllent/mailpit/internal/storage"
-	"github.com/axllent/mailpit/internal/updater"
+	"github.com/axllent/mailpit/internal/tools"
 )
 
 // Stores cached version  along with its expiry time and error count.
@@ -82,7 +82,7 @@ func getBackoff(errCount int) time.Duration {
 }
 
 // Load the current statistics
-func Load() AppInformation {
+func Load(detectLatestVersion bool) AppInformation {
 	info := AppInformation{}
 	info.Version = config.Version
 
@@ -99,7 +99,7 @@ func Load() AppInformation {
 
 	if config.DisableVersionCheck {
 		info.LatestVersion = "disabled"
-	} else {
+	} else if detectLatestVersion {
 		mu.RLock()
 		cacheValid := time.Now().Before(vCache.expiry)
 		cacheValue := vCache.value
@@ -113,10 +113,10 @@ func Load() AppInformation {
 			if time.Now().Before(vCache.expiry) {
 				info.LatestVersion = vCache.value
 			} else {
-				latest, _, _, err := updater.GithubLatest(config.Repo, config.RepoBinaryName)
+				latest, err := config.GHRUConfig.Latest()
 				if err == nil {
-					vCache = versionCache{value: latest, expiry: time.Now().Add(15 * time.Minute)}
-					info.LatestVersion = latest
+					vCache = versionCache{value: latest.Tag, expiry: time.Now().Add(15 * time.Minute)}
+					info.LatestVersion = latest.Tag
 				} else {
 					logger.Log().Errorf("Failed to fetch latest version: %v", err)
 					vCache.errCount++
@@ -147,7 +147,7 @@ func Track() {
 func LogSMTPAccepted(size int) {
 	mu.Lock()
 	smtpAccepted = smtpAccepted + 1
-	smtpAcceptedSize = smtpAcceptedSize + uint64(size)
+	smtpAcceptedSize = smtpAcceptedSize + tools.SafeUint64(size)
 	mu.Unlock()
 }
 

internal/storage/cron.go

@@ -9,13 +9,20 @@ import (
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
-	"github.com/axllent/mailpit/internal/tools"
 	"github.com/axllent/mailpit/server/websockets"
 	"github.com/leporo/sqlf"
 )
 
 // Database cron runs every minute
 func dbCron() {
+	if config.DisableAutoVACUUM {
+		if sqlDriver == "rqlite" {
+			logger.Log().Warn("[db] disable-auto-vacuum has no effect as rqlite handles vacuuming automatically")
+		} else {
+			logger.Log().Infof("[db] auto-VACUUM is disabled")
+		}
+	}
+
 	for {
 		time.Sleep(60 * time.Second)
 
@@ -35,8 +42,8 @@ func dbCron() {
 					deletedPercent = float64(deletedSize * 100 / total)
 				}
 				// only vacuum the DB if at least 1% of mail storage size has been deleted
-				if deletedPercent >= 1 {
-					logger.Log().Debugf("[db] deleted messages is %f%% of total size, reclaim space", deletedPercent)
+				if !config.DisableAutoVACUUM && deletedPercent >= 1 {
+					logger.Log().Info("[db] auto-vacuuming database to reclaim space from deleted messages")
 					vacuumDb()
 				}
 			}
@@ -56,24 +63,24 @@ func pruneMessages() {
 	start := time.Now()
 
 	ids := []string{}
+	idsSeen := make(map[string]bool)
 	var prunedSize uint64
 	var size float64 // use float64 for rqlite compatibility
 
 	// prune using `--max` if set
-	if config.MaxMessages > 0 {
-		total := CountTotal()
-		if total > uint64(config.MaxAgeInHours) {
-			offset := config.MaxMessages
-			if config.DemoMode {
-				offset = 500
-			}
-			q := sqlf.Select("ID, Size").
-				From(tenant("mailbox")).
-				OrderBy("Created DESC").
-				Limit(5000).
-				Offset(offset)
+	if config.MaxMessages > 0 && CountTotal() > uint64(config.MaxMessages) {
+		offset := config.MaxMessages
+		if config.DemoMode {
+			offset = 500
+		}
+		q := sqlf.Select("ID, Size").
+			From(tenant("mailbox")).
+			OrderBy("Created DESC").
+			Limit(5000).
+			Offset(offset)
 
-			if err := q.QueryAndClose(context.TODO(), db, func(row *sql.Rows) {
+		if err := q.QueryAndClose(
+			context.TODO(), db, func(row *sql.Rows) {
 				var id string
 
 				if err := row.Scan(&id, &size); err != nil {
@@ -81,12 +88,13 @@ func pruneMessages() {
 					return
 				}
 				ids = append(ids, id)
+				idsSeen[id] = true
 				prunedSize = prunedSize + uint64(size)
 
-			}); err != nil {
-				logger.Log().Errorf("[db] %s", err.Error())
-				return
-			}
+			},
+		); err != nil {
+			logger.Log().Errorf("[db] %s", err.Error())
+			return
 		}
 	}
 
@@ -108,8 +116,9 @@ func pruneMessages() {
 				return
 			}
 
-			if !tools.InArray(id, ids) {
+			if _, exists := idsSeen[id]; !exists {
 				ids = append(ids, id)
+				idsSeen[id] = true
 				prunedSize = prunedSize + uint64(size)
 			}
 
@@ -129,7 +138,10 @@ func pruneMessages() {
 		return
 	}
 
-	args := make([]interface{}, len(ids))
+	// roll back if it fails
+	defer func() { _ = tx.Rollback() }()
+
+	args := make([]any, len(ids))
 	for i, id := range ids {
 		args[i] = id
 	}
@@ -152,13 +164,8 @@ func pruneMessages() {
 		return
 	}
 
-	err = tx.Commit()
-
-	if err != nil {
+	if err = tx.Commit(); err != nil {
 		logger.Log().Errorf("[db] %s", err.Error())
-		if err := tx.Rollback(); err != nil {
-			logger.Log().Errorf("[db] %s", err.Error())
-		}
 	}
 
 	if err := pruneUnusedTags(); err != nil {

internal/storage/database.go

@@ -27,7 +27,6 @@ import (
 
 var (
 	db           *sql.DB
-	dbFile       string
 	sqlDriver    string
 	dbLastAction time.Time
 
@@ -111,7 +110,7 @@ func InitDB() error {
 			logger.Log().Infof("[db] reconnecting in 5 seconds (attempt %d/5)", i)
 			time.Sleep(5 * time.Second)
 		} else {
-			continue
+			break
 		}
 	}
 
@@ -139,7 +138,6 @@ func InitDB() error {
 
 	LoadTagFilters()
 
-	dbFile = p
 	dbLastAction = time.Now()
 
 	sigs := make(chan os.Signal, 1)

internal/storage/functions_test.go

@@ -49,7 +49,7 @@ func setup(tenantID string) {
 	}
 }
 
-func assertEqual(t *testing.T, a interface{}, b interface{}, message string) {
+func assertEqual(t *testing.T, a any, b any, message string) {
 	if a == b {
 		return
 	}

internal/storage/messages.go

@@ -3,6 +3,9 @@ package storage
 import (
 	"bytes"
 	"context"
+	"crypto/md5"  // #nosec
+	"crypto/sha1" // #nosec
+	"crypto/sha256"
 	"database/sql"
 	"encoding/base64"
 	"encoding/hex"
@@ -16,12 +19,12 @@ import (
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
+	"github.com/axllent/mailpit/internal/shortuuid"
 	"github.com/axllent/mailpit/internal/tools"
 	"github.com/axllent/mailpit/server/webhook"
 	"github.com/axllent/mailpit/server/websockets"
 	"github.com/jhillyerd/enmime/v2"
 	"github.com/leporo/sqlf"
-	"github.com/lithammer/shortuuid/v4"
 )
 
 // Store will save an email to the database tables.
@@ -86,7 +89,7 @@ func Store(body *[]byte, username *string) (string, error) {
 	}
 
 	// roll back if it fails
-	defer tx.Rollback()
+	defer func() { _ = tx.Rollback() }()
 
 	subject := env.GetHeader("Subject")
 	size := uint64(len(*body))
@@ -108,7 +111,7 @@ func Store(body *[]byte, username *string) (string, error) {
 
 	if config.Compression > 0 {
 		// insert compressed raw message
-		compressed := dbEncoder.EncodeAll(*body, make([]byte, 0, int(size)))
+		compressed := dbEncoder.EncodeAll(*body, make([]byte, 0, size))
 
 		if sqlDriver == "rqlite" {
 			// rqlite does not support binary data in query, so we need to encode the compressed message into hexadecimal
@@ -118,8 +121,6 @@ func Store(body *[]byte, username *string) (string, error) {
 		} else {
 			_, err = tx.Exec(fmt.Sprintf(`INSERT INTO %s (ID, Email, Compressed) VALUES(?, ?, 1)`, tenant("mailbox_data")), id, compressed) // #nosec
 		}
-
-		compressed = nil
 	} else {
 		// insert uncompressed raw message
 		_, err = tx.Exec(fmt.Sprintf(`INSERT INTO %s (ID, Email, Compressed) VALUES(?, ?, 0)`, tenant("mailbox_data")), id, string(*body)) // #nosec
@@ -170,6 +171,24 @@ func Store(body *[]byte, username *string) (string, error) {
 		return "", err
 	}
 
+	// we do not want to to broadcast null values for MetaData else this does not align
+	// with the message summary documented in the API docs, so we set them to empty slices.
+	if c.From == nil {
+		c.From = &mail.Address{}
+	}
+	if c.To == nil {
+		c.To = []*mail.Address{}
+	}
+	if c.Cc == nil {
+		c.Cc = []*mail.Address{}
+	}
+	if c.Bcc == nil {
+		c.Bcc = []*mail.Address{}
+	}
+	if c.ReplyTo == nil {
+		c.ReplyTo = []*mail.Address{}
+	}
+
 	c.Created = created
 	c.ID = id
 	c.MessageID = messageID
@@ -186,7 +205,7 @@ func Store(body *[]byte, username *string) (string, error) {
 
 	BroadcastMailboxStats()
 
-	logger.Log().Debugf("[db] saved message %s (%d bytes)", id, int64(size))
+	logger.Log().Debugf("[db] saved message %s (%d bytes)", id, size)
 
 	return id, nil
 }
@@ -259,8 +278,19 @@ func List(start int, beforeTS int64, limit int) ([]MessageSummary, error) {
 	}
 
 	// set tags for listed messages only
-	for i, m := range results {
-		results[i].Tags = getMessageTags(m.ID)
+	if len(results) > 0 {
+		ids := make([]string, len(results))
+		for i, m := range results {
+			ids[i] = m.ID
+		}
+		tagMap := getTagsForIDs(ids)
+		for i, m := range results {
+			if tags, ok := tagMap[m.ID]; ok {
+				results[i].Tags = tags
+			} else {
+				results[i].Tags = []string{}
+			}
+		}
 	}
 
 	dbLastAction = time.Now()
@@ -489,6 +519,14 @@ func AttachmentSummary(a *enmime.Part) Attachment {
 	o.ContentID = a.ContentID
 	o.Size = uint64(len(a.Content))
 
+	md5Hash := md5.Sum(a.Content)   // #nosec
+	sha1Hash := sha1.Sum(a.Content) // #nosec
+	sha256Hash := sha256.Sum256(a.Content)
+
+	o.Checksums.MD5 = hex.EncodeToString(md5Hash[:])
+	o.Checksums.SHA1 = hex.EncodeToString(sha1Hash[:])
+	o.Checksums.SHA256 = hex.EncodeToString(sha256Hash[:])
+
 	return o
 }
 
@@ -521,22 +559,109 @@ func LatestID(r *http.Request) (string, error) {
 
 // MarkRead will mark a message as read
 func MarkRead(ids []string) error {
-	for _, id := range ids {
-		_, err := sqlf.Update(tenant("mailbox")).
-			Set("Read", 1).
-			Where("ID = ?", id).
-			ExecAndClose(context.Background(), db)
+	if len(ids) == 0 {
+		return nil
+	}
 
-		if err == nil {
-			logger.Log().Debugf("[db] marked message %s as read", id)
+	args := make([]any, len(ids))
+	for i, id := range ids {
+		args[i] = id
+	}
+	placeholder := `(?` + strings.Repeat(",?", len(ids)-1) + `)`
+
+	// Find which messages are actually unread (will change state)
+	toUpdate := []string{}
+	rows, err := db.Query(fmt.Sprintf(`SELECT ID FROM %s WHERE Read = 0 AND ID IN %s`, tenant("mailbox"), placeholder), args...) // #nosec
+	if err != nil {
+		return err
+	}
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			_ = rows.Close()
+			return err
 		}
+		toUpdate = append(toUpdate, id)
+	}
+	_ = rows.Close()
 
-		d := struct {
+	if len(toUpdate) == 0 {
+		return nil
+	}
+
+	updateArgs := make([]any, len(toUpdate))
+	for i, id := range toUpdate {
+		updateArgs[i] = id
+	}
+	updatePlaceholder := `(?` + strings.Repeat(",?", len(toUpdate)-1) + `)`
+
+	if _, err := db.Exec(fmt.Sprintf(`UPDATE %s SET Read = 1 WHERE ID IN %s`, tenant("mailbox"), updatePlaceholder), updateArgs...); err != nil { // #nosec
+		return err
+	}
+
+	for _, id := range toUpdate {
+		logger.Log().Debugf("[db] marked message %s as read", id)
+		websockets.Broadcast("update", struct {
 			ID   string
 			Read bool
-		}{ID: id, Read: true}
+		}{ID: id, Read: true})
+	}
 
-		websockets.Broadcast("update", d)
+	BroadcastMailboxStats()
+
+	return nil
+}
+
+// MarkUnread will mark a message as unread
+func MarkUnread(ids []string) error {
+	if len(ids) == 0 {
+		return nil
+	}
+
+	args := make([]any, len(ids))
+	for i, id := range ids {
+		args[i] = id
+	}
+	placeholder := `(?` + strings.Repeat(",?", len(ids)-1) + `)`
+
+	// Find which messages are actually read (will change state)
+	toUpdate := []string{}
+	rows, err := db.Query(fmt.Sprintf(`SELECT ID FROM %s WHERE Read = 1 AND ID IN %s`, tenant("mailbox"), placeholder), args...) // #nosec
+	if err != nil {
+		return err
+	}
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			_ = rows.Close()
+			return err
+		}
+		toUpdate = append(toUpdate, id)
+	}
+	_ = rows.Close()
+
+	if len(toUpdate) == 0 {
+		return nil
+	}
+
+	updateArgs := make([]any, len(toUpdate))
+	for i, id := range toUpdate {
+		updateArgs[i] = id
+	}
+	updatePlaceholder := `(?` + strings.Repeat(",?", len(toUpdate)-1) + `)`
+
+	if _, err := db.Exec(fmt.Sprintf(`UPDATE %s SET Read = 0 WHERE ID IN %s`, tenant("mailbox"), updatePlaceholder), updateArgs...); err != nil { // #nosec
+		return err
+	}
+
+	dbLastAction = time.Now()
+
+	for _, id := range toUpdate {
+		logger.Log().Debugf("[db] marked message %s as unread", id)
+		websockets.Broadcast("update", struct {
+			ID   string
+			Read bool
+		}{ID: id, Read: false})
 	}
 
 	BroadcastMailboxStats()
@@ -594,33 +719,6 @@ func MarkAllUnread() error {
 	return nil
 }
 
-// MarkUnread will mark a message as unread
-func MarkUnread(ids []string) error {
-	for _, id := range ids {
-		_, err := sqlf.Update(tenant("mailbox")).
-			Set("Read", 0).
-			Where("ID = ?", id).
-			ExecAndClose(context.Background(), db)
-
-		if err == nil {
-			logger.Log().Debugf("[db] marked message %s as unread", id)
-		}
-
-		dbLastAction = time.Now()
-
-		d := struct {
-			ID   string
-			Read bool
-		}{ID: id, Read: false}
-
-		websockets.Broadcast("update", d)
-	}
-
-	BroadcastMailboxStats()
-
-	return nil
-}
-
 // DeleteMessages deletes one or more messages in bulk
 func DeleteMessages(ids []string) error {
 	if len(ids) == 0 {
@@ -629,7 +727,7 @@ func DeleteMessages(ids []string) error {
 
 	start := time.Now()
 
-	args := make([]interface{}, len(ids))
+	args := make([]any, len(ids))
 	for i, id := range ids {
 		args[i] = id
 	}
@@ -639,7 +737,7 @@ func DeleteMessages(ids []string) error {
 	if err != nil {
 		return err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	toDelete := []string{}
 	var totalSize uint64
@@ -669,7 +767,7 @@ func DeleteMessages(ids []string) error {
 		return err
 	}
 
-	args = make([]interface{}, len(toDelete))
+	args = make([]any, len(toDelete))
 	for i, id := range toDelete {
 		args[i] = id
 	}
@@ -738,7 +836,7 @@ func DeleteAllMessages() error {
 	}
 
 	// roll back if it fails
-	defer tx.Rollback()
+	defer func() { _ = tx.Rollback() }()
 
 	tables := []string{"mailbox", "mailbox_data", "tags", "message_tags"}
 

internal/storage/messages_test.go

@@ -1,6 +1,7 @@
 package storage
 
 import (
+	"os"
 	"testing"
 	"time"
 
@@ -15,7 +16,7 @@ func TestTextEmailInserts(t *testing.T) {
 
 	start := time.Now()
 
-	for i := 0; i < testRuns; i++ {
+	for range testRuns {
 		if _, err := Store(&testTextEmail, nil); err != nil {
 			t.Log("error ", err)
 			t.Fail()
@@ -53,7 +54,7 @@ func TestMimeEmailInserts(t *testing.T) {
 
 		start := time.Now()
 
-		for i := 0; i < testRuns; i++ {
+		for range testRuns {
 			if _, err := Store(&testMimeEmail, nil); err != nil {
 				t.Log("error ", err)
 				t.Fail()
@@ -204,3 +205,99 @@ func BenchmarkImportMime(b *testing.B) {
 	}
 
 }
+
+func TestInlineImageContentIdHandling(t *testing.T) {
+	setup("")
+	defer Close()
+	t.Log("Testing inline content handling")
+	// Test case: Proper inline image with Content-Disposition: inline
+	inlineAttachment, err := os.ReadFile("testdata/inline-attachment.eml")
+	if err != nil {
+		t.Fatalf("Failed to read test email: %v", err)
+	}
+	storedMessage, err := Store(&inlineAttachment, nil)
+	if err != nil {
+		t.Fatal("Failed to store test case 1:", err)
+	}
+
+	msg, err := GetMessage(storedMessage)
+	if err != nil {
+		t.Fatal("Failed to retrieve test case 1:", err)
+	}
+	// Assert
+	if len(msg.Inline) != 1 {
+		t.Errorf("Test case 1: Expected 1 inline attachment, got %d", len(msg.Inline))
+	}
+	if len(msg.Attachments) != 0 {
+		t.Errorf("Test case 1: Expected 0 regular attachments, got %d", len(msg.Attachments))
+	}
+	if msg.Inline[0].ContentID != "test1@example.com" {
+		t.Errorf("Test case 1: Expected ContentID 'test1@example.com', got '%s'", msg.Inline[0].ContentID)
+	}
+}
+
+func TestRegularAttachmentHandling(t *testing.T) {
+	setup("")
+	defer Close()
+	t.Log("Testing regular attachment handling")
+	// Test case: Regular attachment without Content-ID
+	regularAttachment, err := os.ReadFile("testdata/regular-attachment.eml")
+	if err != nil {
+		t.Fatalf("Failed to read test email: %v", err)
+	}
+	storedMessage, err := Store(&regularAttachment, nil)
+	if err != nil {
+		t.Fatal("Failed to store test case 3:", err)
+	}
+	msg, err := GetMessage(storedMessage)
+	if err != nil {
+		t.Fatal("Failed to retrieve test case 3:", err)
+	}
+	// Assert
+	if len(msg.Inline) != 0 {
+		t.Errorf("Test case 3: Expected 0 inline attachments, got %d", len(msg.Inline))
+	}
+	if len(msg.Attachments) != 1 {
+		t.Errorf("Test case 3: Expected 1 regular attachment, got %d", len(msg.Attachments))
+	}
+	if msg.Attachments[0].ContentID != "" {
+		t.Errorf("Test case 3: Expected empty ContentID, got '%s'", msg.Attachments[0].ContentID)
+	}
+
+	// Checksum tests
+	assertEqual(t, msg.Attachments[0].Checksums.MD5, "b04930eb1ba0c62066adfa87e5d262c4", "Attachment MD5 checksum does not match")
+	assertEqual(t, msg.Attachments[0].Checksums.SHA1, "15605d6a2fca44e966209d1701f16ecf816df880", "Attachment SHA1 checksum does not match")
+	assertEqual(t, msg.Attachments[0].Checksums.SHA256, "92c4ccff376003381bd9054d3da7b32a3c5661905b55e3b0728c17aba6d223ec", "Attachment SHA256 checksum does not match")
+}
+
+func TestMixedAttachmentHandling(t *testing.T) {
+	setup("")
+	defer Close()
+	t.Log("Testing mixed attachment handling")
+	// Mixed scenario with both inline and regular attachment
+	mixedAttachment, err := os.ReadFile("testdata/mixed-attachment.eml")
+	if err != nil {
+		t.Fatalf("Failed to read test email: %v", err)
+	}
+	storedMessage, err := Store(&mixedAttachment, nil)
+	if err != nil {
+		t.Fatal("Failed to store test case 4:", err)
+	}
+	msg, err := GetMessage(storedMessage)
+	if err != nil {
+		t.Fatal("Failed to retrieve test case 4:", err)
+	}
+	// Assert: Should have 1 inline (with ContentID) and 1 attachment (without ContentID)
+	if len(msg.Inline) != 1 {
+		t.Errorf("Test case 4: Expected 1 inline attachment, got %d", len(msg.Inline))
+	}
+	if len(msg.Attachments) != 1 {
+		t.Errorf("Test case 4: Expected 1 regular attachment, got %d", len(msg.Attachments))
+	}
+	if msg.Inline[0].ContentID != "inline@example.com" {
+		t.Errorf("Test case 4: Expected inline ContentID 'inline@example.com', got '%s'", msg.Inline[0].ContentID)
+	}
+	if msg.Attachments[0].ContentID != "" {
+		t.Errorf("Test case 4: Expected attachment ContentID to be empty, got '%s'", msg.Attachments[0].ContentID)
+	}
+}

internal/storage/reindex.go

@@ -27,7 +27,7 @@ func ReindexAll() {
 	err := sqlf.Select("ID").To(&i).
 		From(tenant("mailbox")).
 		OrderBy("Created DESC").
-		QueryAndClose(context.TODO(), db, func(row *sql.Rows) {
+		QueryAndClose(context.TODO(), db, func(_ *sql.Rows) {
 			ids = append(ids, i)
 		})
 
@@ -114,7 +114,7 @@ func ReindexAll() {
 		}
 
 		// roll back if it fails
-		defer tx.Rollback()
+		defer func() { _ = tx.Rollback() }()
 
 		// insert mail summary data
 		for _, u := range updates {

internal/storage/schemas.go

@@ -84,7 +84,7 @@ func dbApplySchemas() error {
 			continue
 		}
 
-		schemaID := strings.TrimRight(s.Name(), ".sql")
+		schemaID := strings.TrimSuffix(s.Name(), ".sql")
 
 		if !semver.IsValid(schemaID) {
 			logger.Log().Warnf("[db] invalid schema name: %s", s.Name())
@@ -100,6 +100,13 @@ func dbApplySchemas() error {
 		return semver.Compare(scripts[j].Semver, scripts[i].Semver) == 1
 	})
 
+	// detect whether this is an existing database (has prior schema entries)
+	var existingSchemaCount int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM ` + tenant("schemas")).Scan(&existingSchemaCount); err != nil {
+		return err
+	}
+	isExistingDB := existingSchemaCount > 0
+
 	for _, s := range scripts {
 		var complete int
 		err := db.QueryRow(`SELECT EXISTS(SELECT 1 FROM `+tenant("schemas")+` WHERE Version = ?)`, s.Semver).Scan(&complete)
@@ -111,6 +118,13 @@ func dbApplySchemas() error {
 			// already completed, ignore
 			continue
 		}
+
+		if isExistingDB {
+			logger.Log().Infof("[db] applying schema updates: %s", s.Name)
+		} else {
+			logger.Log().Debugf("[db] applying schema updates: %s", s.Name)
+		}
+
 		// use path.Join for Windows compatibility, see https://github.com/golang/go/issues/44305
 		b, err := schemaScripts.ReadFile(path.Join("schemas", s.Name))
 		if err != nil {
@@ -136,8 +150,6 @@ func dbApplySchemas() error {
 		if _, err := db.Exec(`INSERT INTO `+tenant("schemas")+` (Version) VALUES (?)`, s.Semver); err != nil {
 			return err
 		}
-
-		logger.Log().Debugf("[db] applied schema: %s", s.Name)
 	}
 
 	return nil

internal/storage/search.go

@@ -80,17 +80,25 @@ func Search(search, timezone string, start int, beforeTS int64, limit int) ([]Me
 	nrResults = len(allResults)
 
 	if nrResults > start {
-		end := nrResults
-		if nrResults >= start+limit {
-			end = start + limit
-		}
+		end := min(nrResults, start+limit)
 
 		results = allResults[start:end]
 	}
 
 	// set tags for listed messages only
-	for i, m := range results {
-		results[i].Tags = getMessageTags(m.ID)
+	if len(results) > 0 {
+		ids := make([]string, len(results))
+		for i, m := range results {
+			ids[i] = m.ID
+		}
+		tagMap := getTagsForIDs(ids)
+		for i, m := range results {
+			if tags, ok := tagMap[m.ID]; ok {
+				results[i].Tags = tags
+			} else {
+				results[i].Tags = []string{}
+			}
+		}
 	}
 
 	elapsed := time.Since(tsStart)
@@ -193,10 +201,10 @@ func DeleteSearch(search, timezone string) error {
 		}
 
 		// roll back if it fails
-		defer tx.Rollback()
+		defer func() { _ = tx.Rollback() }()
 
 		for _, ids := range chunks {
-			delIDs := make([]interface{}, len(ids))
+			delIDs := make([]any, len(ids))
 			for i, id := range ids {
 				delIDs[i] = id
 			}
@@ -303,12 +311,12 @@ func searchQueryBuilder(searchString, timezone string) *sqlf.Stmt {
 	// group strings with quotes as a single argument and remove quotes
 	args := tools.ArgsParser(searchString)
 
+	loc := time.Local
 	if timezone != "" {
-		loc, err := time.LoadLocation(timezone)
-		if err != nil {
+		if l, err := time.LoadLocation(timezone); err != nil {
 			logger.Log().Warnf("ignoring invalid timezone:\"%s\"", timezone)
 		} else {
-			time.Local = loc
+			loc = l
 		}
 	}
 
@@ -440,9 +448,9 @@ func searchQueryBuilder(searchString, timezone string) *sqlf.Stmt {
 			}
 		} else if lw == "is:tagged" {
 			if exclude {
-				q.Where(`m.ID NOT IN (SELECT DISTINCT mt.ID FROM ` + tenant("message_tags") + ` mt JOIN tags t ON mt.TagID = t.ID)`)
+				q.Where(`m.ID NOT IN (SELECT DISTINCT mt.ID FROM ` + tenant("message_tags") + ` mt JOIN ` + tenant("tags") + ` t ON mt.TagID = t.ID)`)
 			} else {
-				q.Where(`m.ID IN (SELECT DISTINCT mt.ID FROM ` + tenant("message_tags") + ` mt JOIN tags t ON mt.TagID = t.ID)`)
+				q.Where(`m.ID IN (SELECT DISTINCT mt.ID FROM ` + tenant("message_tags") + ` mt JOIN ` + tenant("tags") + ` t ON mt.TagID = t.ID)`)
 			}
 		} else if lw == "has:inline" || lw == "has:inlines" {
 			if exclude {
@@ -457,9 +465,9 @@ func searchQueryBuilder(searchString, timezone string) *sqlf.Stmt {
 				q.Where("Attachments > 0")
 			}
 		} else if strings.HasPrefix(lw, "after:") {
-			w = cleanString(w[6:])
+			w = strings.ToUpper(cleanString(w[6:]))
 			if w != "" {
-				t, err := dateparse.ParseLocal(w)
+				t, err := dateparse.ParseIn(w, loc)
 				if err != nil {
 					logger.Log().Warnf("ignoring invalid after: date \"%s\"", w)
 				} else {
@@ -472,9 +480,9 @@ func searchQueryBuilder(searchString, timezone string) *sqlf.Stmt {
 				}
 			}
 		} else if strings.HasPrefix(lw, "before:") {
-			w = cleanString(w[7:])
+			w = strings.ToUpper(cleanString(w[7:]))
 			if w != "" {
-				t, err := dateparse.ParseLocal(w)
+				t, err := dateparse.ParseIn(w, loc)
 				if err != nil {
 					logger.Log().Warnf("ignoring invalid before: date \"%s\"", w)
 				} else {

internal/storage/search_test.go

@@ -3,7 +3,7 @@ package storage
 import (
 	"bytes"
 	"fmt"
-	"math/rand"
+	"math/rand/v2"
 	"testing"
 
 	"github.com/axllent/mailpit/config"
@@ -22,13 +22,13 @@ func TestSearch(t *testing.T) {
 			t.Logf("Testing search (tenant %s)", tenantID)
 		}
 
-		for i := 0; i < testRuns; i++ {
+		for i := range testRuns {
 			msg := enmime.Builder().
 				From(fmt.Sprintf("From %d", i), fmt.Sprintf("from-%d@example.com", i)).
 				CC(fmt.Sprintf("CC %d", i), fmt.Sprintf("cc-%d@example.com", i)).
 				CC(fmt.Sprintf("CC2 %d", i), fmt.Sprintf("cc2-%d@example.com", i)).
 				Subject(fmt.Sprintf("Subject line %d end", i)).
-				Text([]byte(fmt.Sprintf("This is the email body %d <jdsauk;dwqmdqw;>.", i))).
+				Text(fmt.Appendf(nil, "This is the email body %d <jdsauk;dwqmdqw;>.", i)).
 				To(fmt.Sprintf("To %d", i), fmt.Sprintf("to-%d@example.com", i)).
 				To(fmt.Sprintf("To2 %d", i), fmt.Sprintf("to2-%d@example.com", i)).
 				ReplyTo(fmt.Sprintf("Reply To %d", i), fmt.Sprintf("reply-to-%d@example.com", i))
@@ -73,7 +73,7 @@ func TestSearch(t *testing.T) {
 				fmt.Sprintf("subject:\"Subject line %d end\"", i),
 				fmt.Sprintf("\"the email body %d jdsauk dwqmdqw\"", i),
 			}
-			searchIdx := rand.Intn(len(uniqueSearches))
+			searchIdx := rand.IntN(len(uniqueSearches))
 
 			search := uniqueSearches[searchIdx]
 
@@ -116,7 +116,7 @@ func TestSearchDelete100(t *testing.T) {
 			t.Logf("Testing search delete of 100 messages (tenant %s)", tenantID)
 		}
 
-		for i := 0; i < 100; i++ {
+		for range 100 {
 			if _, err := Store(&testTextEmail, nil); err != nil {
 				t.Log("error ", err)
 				t.Fail()
@@ -157,7 +157,7 @@ func TestSearchDelete1100(t *testing.T) {
 	defer Close()
 
 	t.Log("Testing search delete of 1100 messages")
-	for i := 0; i < 1100; i++ {
+	for range 1100 {
 		if _, err := Store(&testTextEmail, nil); err != nil {
 			t.Log("error ", err)
 			t.Fail()

internal/storage/settings.go

@@ -15,7 +15,7 @@ func SettingGet(k string) string {
 		Select("Value").To(&result).
 		Where("Key = ?", k).
 		Limit(1).
-		QueryAndClose(context.TODO(), db, func(row *sql.Rows) {})
+		QueryAndClose(context.TODO(), db, func(_ *sql.Rows) {})
 	if err != nil {
 		logger.Log().Errorf("[db] %s", err.Error())
 		return ""
@@ -41,7 +41,7 @@ func getDeletedSize() uint64 {
 		Select("Value").To(&result).
 		Where("Key = ?", "DeletedSize").
 		Limit(1).
-		QueryAndClose(context.TODO(), db, func(row *sql.Rows) {})
+		QueryAndClose(context.TODO(), db, func(_ *sql.Rows) {})
 	if err != nil {
 		logger.Log().Errorf("[db] %s", err.Error())
 		return 0
@@ -55,7 +55,7 @@ func totalMessagesSize() uint64 {
 	var result sql.NullFloat64
 	err := sqlf.From(tenant("mailbox")).
 		Select("SUM(Size)").To(&result).
-		QueryAndClose(context.TODO(), db, func(row *sql.Rows) {})
+		QueryAndClose(context.TODO(), db, func(_ *sql.Rows) {})
 	if err != nil {
 		logger.Log().Errorf("[db] %s", err.Error())
 		return 0

internal/storage/structs.go

@@ -48,7 +48,7 @@ type Message struct {
 	Attachments []Attachment
 }
 
-// Attachment struct for inline and attachments
+// Attachment struct for inline images and attachments
 //
 // swagger:model Attachment
 type Attachment struct {
@@ -62,6 +62,15 @@ type Attachment struct {
 	ContentID string
 	// Size in bytes
 	Size uint64
+	// File checksums
+	Checksums struct {
+		// MD5 checksum hash of file
+		MD5 string
+		// SHA1 checksum hash of file
+		SHA1 string
+		// SHA256 checksum hash of file
+		SHA256 string
+	}
 }
 
 // MessageSummary struct for frontend messages

internal/storage/tags.go

@@ -8,7 +8,6 @@ import (
 	"regexp"
 	"sort"
 	"strings"
-	"sync"
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
@@ -19,45 +18,62 @@ import (
 
 var (
 	addressPlusRe = regexp.MustCompile(`(?U)^(.*){1,}\+(.*)@`)
-	addTagMutex   sync.RWMutex
 )
 
 // SetMessageTags will set the tags for a given database ID, removing any not in the array
 func SetMessageTags(id string, tags []string) ([]string, error) {
+	// Clean and deduplicate incoming tags (case-insensitive)
+	seen := make(map[string]struct{})
 	applyTags := []string{}
 	for _, t := range tags {
 		t = tools.CleanTag(t)
-		if t != "" && config.ValidTagRegexp.MatchString(t) && !tools.InArray(t, applyTags) {
-			applyTags = append(applyTags, t)
-		}
-	}
-
-	tagNames := []string{}
-	currentTags := getMessageTags(id)
-	origTagCount := len(currentTags)
-
-	for _, t := range applyTags {
-		if t == "" || !config.ValidTagRegexp.MatchString(t) || tools.InArray(t, currentTags) {
+		if t == "" || !config.ValidTagRegexp.MatchString(t) {
 			continue
 		}
+		lc := strings.ToLower(t)
+		if _, exists := seen[lc]; exists {
+			continue
+		}
+		seen[lc] = struct{}{}
+		applyTags = append(applyTags, t)
+	}
 
+	// Fetch existing tags once and index by lowercase name for O(1) lookup
+	currentTags := getMessageTags(id)
+	currentSet := make(map[string]struct{}, len(currentTags))
+	for _, t := range currentTags {
+		currentSet[strings.ToLower(t)] = struct{}{}
+	}
+
+	// Build apply set for O(1) lookup when computing deletions
+	applySet := make(map[string]struct{}, len(applyTags))
+	for _, t := range applyTags {
+		applySet[strings.ToLower(t)] = struct{}{}
+	}
+
+	// Add tags not already on the message
+	tagNames := []string{}
+	for _, t := range applyTags {
+		if _, exists := currentSet[strings.ToLower(t)]; exists {
+			continue
+		}
 		name, err := addMessageTag(id, t)
 		if err != nil {
 			return []string{}, err
 		}
-
 		tagNames = append(tagNames, name)
 	}
 
-	if origTagCount > 0 {
-		currentTags = getMessageTags(id)
-
-		for _, t := range currentTags {
-			if !tools.InArray(t, applyTags) {
-				if err := deleteMessageTag(id, t); err != nil {
-					return []string{}, err
-				}
-			}
+	// Delete tags removed from the message in a single batch query
+	toDelete := []string{}
+	for _, t := range currentTags {
+		if _, exists := applySet[strings.ToLower(t)]; !exists {
+			toDelete = append(toDelete, t)
+		}
+	}
+	if len(toDelete) > 0 {
+		if err := deleteMessageTags(id, toDelete); err != nil {
+			return []string{}, err
 		}
 	}
 
@@ -73,57 +89,63 @@ func SetMessageTags(id string, tags []string) ([]string, error) {
 
 // AddMessageTag adds a tag to a message
 func addMessageTag(id, name string) (string, error) {
-	// prevent two identical tags being added at the same time
-	addTagMutex.Lock()
-
-	var tagID int
-	var foundName sql.NullString
-
-	q := sqlf.From(tenant("tags")).
-		Select("ID").To(&tagID).
-		Select("Name").To(&foundName).
-		Where("Name = ?", name)
-
-	// if tag exists - add tag to message
-	if err := q.QueryRowAndClose(context.TODO(), db); err == nil {
-		addTagMutex.Unlock()
-		// check message does not already have this tag
-		var exists int
-
-		if err := sqlf.From(tenant("message_tags")).
-			Select("COUNT(ID)").To(&exists).
-			Where("ID = ?", id).
-			Where("TagID = ?", tagID).
-			QueryRowAndClose(context.Background(), db); err != nil {
-			return "", err
-		}
-		if exists > 0 {
-			// already exists
-			return foundName.String, nil
-		}
-
-		logger.Log().Debugf("[tags] adding tag \"%s\" to %s", name, id)
-
-		_, err := sqlf.InsertInto(tenant("message_tags")).
-			Set("ID", id).
-			Set("TagID", tagID).
-			ExecAndClose(context.TODO(), db)
-
-		return foundName.String, err
-	}
-
-	// new tag, add to the database
-	if _, err := sqlf.InsertInto(tenant("tags")).
-		Set("Name", name).
-		ExecAndClose(context.TODO(), db); err != nil {
-		addTagMutex.Unlock()
+	// Ensure the tag row exists; the UNIQUE index on Name makes concurrent inserts safe
+	if _, err := db.Exec(fmt.Sprintf(`INSERT OR IGNORE INTO %s (Name) VALUES (?)`, tenant("tags")), name); err != nil { // #nosec
 		return name, err
 	}
 
-	addTagMutex.Unlock()
+	var tagID int
+	var foundName string
 
-	// add tag to the message
-	return addMessageTag(id, name)
+	if err := sqlf.From(tenant("tags")).
+		Select("ID").To(&tagID).
+		Select("Name").To(&foundName).
+		Where("Name = ?", name).
+		QueryRowAndClose(context.TODO(), db); err != nil {
+		return name, err
+	}
+
+	// Check message does not already have this tag
+	var exists int
+	if err := sqlf.From(tenant("message_tags")).
+		Select("COUNT(ID)").To(&exists).
+		Where("ID = ?", id).
+		Where("TagID = ?", tagID).
+		QueryRowAndClose(context.Background(), db); err != nil {
+		return "", err
+	}
+	if exists > 0 {
+		return foundName, nil
+	}
+
+	logger.Log().Debugf("[tags] adding tag \"%s\" to %s", name, id)
+
+	_, err := sqlf.InsertInto(tenant("message_tags")).
+		Set("ID", id).
+		Set("TagID", tagID).
+		ExecAndClose(context.TODO(), db)
+
+	return foundName, err
+}
+
+// deleteMessageTags deletes multiple tags from a message in a single query
+func deleteMessageTags(id string, names []string) error {
+	args := make([]any, 1+len(names))
+	args[0] = id
+	for i, n := range names {
+		args[i+1] = n
+	}
+
+	query := fmt.Sprintf(
+		`DELETE FROM %s WHERE ID = ? AND TagID IN (SELECT ID FROM %s WHERE Name IN (?%s))`,
+		tenant("message_tags"), tenant("tags"), strings.Repeat(",?", len(names)-1),
+	) // #nosec
+
+	if _, err := db.Exec(query, args...); err != nil {
+		return err
+	}
+
+	return pruneUnusedTags()
 }
 
 // DeleteMessageTag deletes a tag from a message
@@ -138,17 +160,6 @@ func deleteMessageTag(id, name string) error {
 	return pruneUnusedTags()
 }
 
-// DeleteAllMessageTags deleted all tags from a message
-func DeleteAllMessageTags(id string) error {
-	if _, err := sqlf.DeleteFrom(tenant("message_tags")).
-		Where(tenant("message_tags.ID")+" = ?", id).
-		ExecAndClose(context.TODO(), db); err != nil {
-		return err
-	}
-
-	return pruneUnusedTags()
-}
-
 // GetAllTags returns all used tags
 func GetAllTags() []string {
 	var tags = []string{}
@@ -158,7 +169,7 @@ func GetAllTags() []string {
 		Select(`DISTINCT Name`).
 		From(tenant("tags")).To(&name).
 		OrderBy("Name").
-		QueryAndClose(context.TODO(), db, func(row *sql.Rows) {
+		QueryAndClose(context.TODO(), db, func(_ *sql.Rows) {
 			tags = append(tags, name)
 		}); err != nil {
 		logger.Log().Errorf("[db] %s", err.Error())
@@ -180,7 +191,7 @@ func GetAllTagsCount() map[string]int64 {
 		LeftJoin(tenant("message_tags"), tenant("tags.ID")+" = "+tenant("message_tags.TagID")).
 		GroupBy(tenant("message_tags.TagID")).
 		OrderBy("Name").
-		QueryAndClose(context.TODO(), db, func(row *sql.Rows) {
+		QueryAndClose(context.TODO(), db, func(_ *sql.Rows) {
 			tags[name] = int64(total)
 		}); err != nil {
 		logger.Log().Errorf("[db] %s", err.Error())
@@ -351,6 +362,43 @@ func (d Metadata) tagsFromPlusAddresses() []string {
 	return tools.SetTagCasing(tags)
 }
 
+// getTagsForIDs fetches tags for a set of message IDs in a single query,
+// returning a map of message ID to tag names.
+func getTagsForIDs(ids []string) map[string][]string {
+	result := make(map[string][]string, len(ids))
+	if len(ids) == 0 {
+		return result
+	}
+
+	args := make([]any, len(ids))
+	for i, id := range ids {
+		args[i] = id
+	}
+
+	query := fmt.Sprintf(
+		`SELECT mt.ID, t.Name FROM %s t JOIN %s mt ON t.ID = mt.TagID WHERE mt.ID IN (?%s) ORDER BY mt.ID, t.Name`,
+		tenant("Tags"), tenant("message_tags"), strings.Repeat(",?", len(ids)-1),
+	) // #nosec
+
+	rows, err := db.Query(query, args...)
+	if err != nil {
+		logger.Log().Errorf("[tags] %s", err.Error())
+		return result
+	}
+	defer func() { _ = rows.Close() }()
+
+	for rows.Next() {
+		var id, name string
+		if err := rows.Scan(&id, &name); err != nil {
+			logger.Log().Errorf("[tags] %s", err.Error())
+			return result
+		}
+		result[id] = append(result[id], name)
+	}
+
+	return result
+}
+
 // Get message tags from the database for a given database ID
 // Used when parsing a raw email.
 func getMessageTags(id string) []string {
@@ -363,7 +411,7 @@ func getMessageTags(id string) []string {
 		LeftJoin(tenant("message_tags"), tenant("Tags.ID")+"="+tenant("message_tags.TagID")).
 		Where(tenant("message_tags.ID")+` = ?`, id).
 		OrderBy("Name").
-		QueryAndClose(context.TODO(), db, func(row *sql.Rows) {
+		QueryAndClose(context.TODO(), db, func(_ *sql.Rows) {
 			tags = append(tags, name)
 		}); err != nil {
 		logger.Log().Errorf("[tags] %s", err.Error())

internal/storage/tags_test.go

@@ -1,11 +1,14 @@
 package storage
 
 import (
+	"context"
 	"fmt"
+	"slices"
 	"strings"
 	"testing"
 
 	"github.com/axllent/mailpit/config"
+	"github.com/leporo/sqlf"
 )
 
 func TestTags(t *testing.T) {
@@ -23,7 +26,7 @@ func TestTags(t *testing.T) {
 
 		ids := []string{}
 
-		for i := 0; i < 10; i++ {
+		for range 10 {
 			id, err := Store(&testMimeEmail, nil)
 			if err != nil {
 				t.Log("error ", err)
@@ -32,14 +35,14 @@ func TestTags(t *testing.T) {
 			ids = append(ids, id)
 		}
 
-		for i := 0; i < 10; i++ {
+		for i := range 10 {
 			if _, err := SetMessageTags(ids[i], []string{fmt.Sprintf("Tag-%d", i)}); err != nil {
 				t.Log("error ", err)
 				t.Fail()
 			}
 		}
 
-		for i := 0; i < 10; i++ {
+		for i := range 10 {
 			message, err := GetMessage(ids[i])
 			if err != nil {
 				t.Log("error ", err)
@@ -63,7 +66,7 @@ func TestTags(t *testing.T) {
 			t.Fail()
 		}
 		newTags := []string{}
-		for i := 0; i < 20; i++ {
+		for i := range 20 {
 			// pad number with 0 to ensure they are returned alphabetically
 			newTags = append(newTags, fmt.Sprintf("AnotherTag %02d", i))
 		}
@@ -83,7 +86,7 @@ func TestTags(t *testing.T) {
 		assertEqual(t, strings.Join(newTags[1:], "|"), strings.Join(returnedTags, "|"), "Message tags do not match after deleting 1")
 
 		// remove all tags
-		if err := DeleteAllMessageTags(id); err != nil {
+		if err := deleteAllMessageTags(id); err != nil {
 			t.Log("error ", err)
 			t.Fail()
 		}
@@ -97,7 +100,7 @@ func TestTags(t *testing.T) {
 		}
 		returnedTags = getMessageTags(id)
 		assertEqual(t, "Duplicate Tag", strings.Join(returnedTags, "|"), "Message tags should be duplicated")
-		if err := DeleteAllMessageTags(id); err != nil {
+		if err := deleteAllMessageTags(id); err != nil {
 			t.Log("error ", err)
 			t.Fail()
 		}
@@ -109,7 +112,7 @@ func TestTags(t *testing.T) {
 		}
 		returnedTags = getMessageTags(id)
 		assertEqual(t, "Dirty Tag", strings.Join(returnedTags, "|"), "Dirty message tag did not clean as expected")
-		if err := DeleteAllMessageTags(id); err != nil {
+		if err := deleteAllMessageTags(id); err != nil {
 			t.Log("error ", err)
 			t.Fail()
 		}
@@ -132,7 +135,7 @@ func TestTags(t *testing.T) {
 
 		returnedTags = getMessageTags(id)
 		assertEqual(t, "BccTag|CcTag|FromFag|ToTag|X-tag1|X-tag2", strings.Join(returnedTags, "|"), "Tags not detected correctly")
-		if err := DeleteAllMessageTags(id); err != nil {
+		if err := deleteAllMessageTags(id); err != nil {
 			t.Log("error ", err)
 			t.Fail()
 		}
@@ -157,13 +160,7 @@ func TestUsernameAutoTagging(t *testing.T) {
 		if err != nil {
 			t.Fatalf("GetMessage failed: %v", err)
 		}
-		found := false
-		for _, tag := range msg.Tags {
-			if tag == username {
-				found = true
-				break
-			}
-		}
+		found := slices.Contains(msg.Tags, username)
 		if !found {
 			t.Errorf("Expected username '%s' in tags, got %v", username, msg.Tags)
 		}
@@ -186,3 +183,14 @@ func TestUsernameAutoTagging(t *testing.T) {
 		}
 	})
 }
+
+// DeleteAllMessageTags deleted all tags from a message
+func deleteAllMessageTags(id string) error {
+	if _, err := sqlf.DeleteFrom(tenant("message_tags")).
+		Where(tenant("message_tags.ID")+" = ?", id).
+		ExecAndClose(context.TODO(), db); err != nil {
+		return err
+	}
+
+	return pruneUnusedTags()
+}

internal/storage/testdata/inline-attachment.eml

@@ -0,0 +1,20 @@
+From: sender@example.com
+To: recipient@example.com
+Subject: Test inline image proper
+MIME-Version: 1.0
+Content-Type: multipart/related; boundary="boundary123"
+
+--boundary123
+Content-Type: text/html; charset=utf-8
+
+<html><body><img src="cid:test1@example.com" alt="Test"/></body></html>
+
+--boundary123
+Content-Type: image/png; name="test1.png"
+Content-Disposition: inline; filename="test1.png"
+Content-ID: <test1@example.com>
+Content-Transfer-Encoding: base64
+
+iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==
+
+--boundary123--

internal/storage/testdata/mixed-attachment.eml

@@ -0,0 +1,27 @@
+From: sender@example.com
+To: recipient@example.com
+Subject: Test mixed attachments
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="boundary111"
+
+--boundary111
+Content-Type: text/html; charset=utf-8
+
+<html><body><img src="cid:inline@example.com" alt="Inline"/><p>Document attached</p></body></html>
+
+--boundary111
+Content-Type: image/png; name="inline.png"
+Content-Disposition: inline; filename="inline.png"
+Content-ID: <inline@example.com>
+Content-Transfer-Encoding: base64
+
+iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==
+
+--boundary111
+Content-Type: application/pdf; name="document.pdf"
+Content-Disposition: attachment; filename="document.pdf"
+Content-Transfer-Encoding: base64
+
+JVBERi0xLjQKJcOkw7zDtsOfCjIgMCBvYmoKPDwvTGVuZ3RoIDMgMCBSL0ZpbHRlci9GbGF0ZURlY29kZT4+CnN0cmVhbQo=
+
+--boundary111--

internal/storage/testdata/regular-attachment.eml

@@ -0,0 +1,19 @@
+From: sender@example.com
+To: recipient@example.com
+Subject: Test regular attachment
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="boundary789"
+
+--boundary789
+Content-Type: text/html; charset=utf-8
+
+<html><body><p>Message with regular attachment</p></body></html>
+
+--boundary789
+Content-Type: application/pdf; name="document.pdf"
+Content-Disposition: attachment; filename="document.pdf"
+Content-Transfer-Encoding: base64
+
+JVBERi0xLjQKJcOkw7zDtsOfCjIgMCBvYmoKPDwvTGVuZ3RoIDMgMCBSL0ZpbHRlci9GbGF0ZURlY29kZT4+CnN0cmVhbQo=
+
+--boundary789--

internal/storage/utils.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/axllent/mailpit/internal/html2text"
 	"github.com/axllent/mailpit/internal/logger"
+	"github.com/axllent/mailpit/internal/tools"
 	"github.com/jhillyerd/enmime/v2"
 )
 
@@ -48,23 +49,23 @@ func addressToSlice(env *enmime.Envelope, key string) []*mail.Address {
 func createSearchText(env *enmime.Envelope) string {
 	var b strings.Builder
 
-	b.WriteString(env.GetHeader("From") + " ")
-	b.WriteString(env.GetHeader("Subject") + " ")
-	b.WriteString(env.GetHeader("To") + " ")
-	b.WriteString(env.GetHeader("Cc") + " ")
-	b.WriteString(env.GetHeader("Bcc") + " ")
-	b.WriteString(env.GetHeader("Reply-To") + " ")
-	b.WriteString(env.GetHeader("Return-Path") + " ")
+	_, _ = b.WriteString(env.GetHeader("From") + " ")
+	_, _ = b.WriteString(env.GetHeader("Subject") + " ")
+	_, _ = b.WriteString(env.GetHeader("To") + " ")
+	_, _ = b.WriteString(env.GetHeader("Cc") + " ")
+	_, _ = b.WriteString(env.GetHeader("Bcc") + " ")
+	_, _ = b.WriteString(env.GetHeader("Reply-To") + " ")
+	_, _ = b.WriteString(env.GetHeader("Return-Path") + " ")
 
-	h := html2text.Strip(env.HTML, true)
+	h, _ := html2text.Strip(env.HTML, true)
 	if h != "" {
-		b.WriteString(h + " ")
+		_, _ = b.WriteString(h + " ")
 	} else {
-		b.WriteString(env.Text + " ")
+		_, _ = b.WriteString(env.Text + " ")
 	}
 	// add attachment filenames
 	for _, a := range env.Attachments {
-		b.WriteString(a.FileName + " ")
+		_, _ = b.WriteString(a.FileName + " ")
 	}
 
 	d := cleanString(b.String())
@@ -88,7 +89,7 @@ func cleanString(str string) string {
 // LogMessagesDeleted logs the number of messages deleted
 func logMessagesDeleted(n int) {
 	mu.Lock()
-	StatsDeleted = StatsDeleted + uint64(n)
+	StatsDeleted = StatsDeleted + tools.SafeUint64(n)
 	mu.Unlock()
 }
 

internal/tools/fs.go

@@ -2,20 +2,23 @@ package tools
 
 import (
 	"os"
-	"path/filepath"
 )
 
-// IsFile returns whether a file exists and is readable
+// IsFile returns whether a path exists and is a regular file.
+// Symlinks are deliberately rejected to prevent following links to
+// arbitrary files outside the intended location.
 func IsFile(path string) bool {
-	f, err := os.Open(filepath.Clean(path))
-	defer f.Close()
-	return err == nil
+	info, err := os.Lstat(path)
+	if err != nil {
+		return false
+	}
+	return info.Mode().IsRegular()
 }
 
 // IsDir returns whether a path is a directory
 func IsDir(path string) bool {
 	info, err := os.Stat(path)
-	if err != nil || os.IsNotExist(err) || !info.IsDir() {
+	if err != nil || !info.IsDir() {
 		return false
 	}
 

internal/tools/listunsubscribeparser.go

@@ -27,7 +27,7 @@ func ListUnsubscribeParser(v string) ([]string, error) {
 	comments := reComments.FindAllStringSubmatch(v, -1)
 	for _, c := range comments {
 		// strip comments
-		v = strings.Replace(v, c[0], "", -1)
+		v = strings.ReplaceAll(v, c[0], "")
 		v = strings.TrimSpace(v)
 	}
 

internal/tools/net.go

@@ -0,0 +1,115 @@
+package tools
+
+import (
+	"encoding/binary"
+	"net"
+	"net/url"
+)
+
+var (
+	// cgnatRange is the CGNAT shared address space (RFC 6598), not covered by net.IP.IsPrivate().
+	// CGNAT (Carrier-Grade NAT) is a technique used by ISPs to conserve IPv4 addresses. Instead of assigning a unique
+	// public IP to every customer, the ISP places many customers behind a shared NAT, then gives them all addresses
+	// from the reserved 100.64.0.0/10 range (RFC 6598) on their internal network.
+	cgnatRange = mustCIDR("100.64.0.0/10")
+
+	// IPv6 transition prefixes that embed an IPv4 destination. Go's net.IP.Is* family
+	// does not decode these, so an IPv6 literal of one of these forms can carry a
+	// private/link-local IPv4 destination past the stdlib checks. See golang/go#79925.
+	nat64WellKnown = mustCIDR("64:ff9b::/96")   // RFC 6052
+	nat64LocalUse  = mustCIDR("64:ff9b:1::/48") // RFC 8215
+	sixToFour      = mustCIDR("2002::/16")      // RFC 3056
+	teredo         = mustCIDR("2001::/32")      // RFC 4380
+	ipv4Compatible = mustCIDR("::/96")          // RFC 4291 §2.5.5.1
+	// IPv4-mapped IPv6 (::ffff:0:0/96, RFC 4291 §2.5.5.2) is normalised by net.IP.To4,
+	// so the stdlib Is* checks above already see the embedded IPv4 - no decode needed.
+
+	// Direct IPv6 prefixes outside the scope of Go's stdlib Is* family.
+	deprecatedSiteLocal = mustCIDR("fec0::/10")     // RFC 3879 / RFC 4291 §2.5.7 — deprecated, still routable on dual-stack hosts
+	documentationPrefix = mustCIDR("2001:db8::/32") // RFC 3849 — documentation only, must not appear in real traffic
+)
+
+// MustCIDR is a helper for use in global var initialisation.
+func mustCIDR(s string) *net.IPNet {
+	_, cidr, _ := net.ParseCIDR(s)
+
+	return cidr
+}
+
+// IsInternalIP checks if the given IP address is an internal IP address (e.g., loopback, private, link-local, or multicast).
+// IsLoopback - 127.0.0.0/8, ::1
+// IsPrivate - 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7
+// IsLinkLocalUnicast - 169.254.0.0/16, fe80::/10 (covers cloud metadata 169.254.169.254)
+// IsLinkLocalMulticast - 224.0.0.0/24, ff02::/16
+// IsUnspecified - 0.0.0.0, ::
+// IsMulticast - 224.0.0.0/4, ff00::/8
+// CGNAT - 100.64.0.0/10 (RFC 6598) (Carrier-Grade NAT)
+// IPv6 transition forms - NAT64 (RFC 6052/8215), 6to4 (RFC 3056), Teredo (RFC 4380),
+// IPv4-compatible (RFC 4291) - re-checked against their embedded IPv4.
+func IsInternalIP(ip net.IP) bool {
+	if ip.IsLoopback() ||
+		ip.IsPrivate() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsUnspecified() ||
+		ip.IsMulticast() ||
+		cgnatRange.Contains(ip) ||
+		deprecatedSiteLocal.Contains(ip) ||
+		documentationPrefix.Contains(ip) {
+		return true
+	}
+
+	if embeddedV4, ok := embeddedIPv4(ip); ok {
+		return IsInternalIP(embeddedV4)
+	}
+
+	return false
+}
+
+// embeddedIPv4 returns the IPv4 destination encoded in ip, if ip is an IPv6 form
+// documented to carry one. Without this, an IPv6 literal like 64:ff9b::a9fe:a9fe
+// (NAT64 wrapping 169.254.169.254) bypasses the stdlib Is* checks above.
+func embeddedIPv4(ip net.IP) (net.IP, bool) {
+	// Skip addresses that are already IPv4 (4-byte or IPv4-mapped IPv6) - those are
+	// covered by the stdlib Is* checks via To4 normalisation. Re-entering here would
+	// recurse infinitely, because To16 turns an IPv4 back into ::ffff:<ipv4>.
+	if ip.To4() != nil {
+		return nil, false
+	}
+
+	ip16 := ip.To16()
+	if ip16 == nil || len(ip16) != net.IPv6len {
+		return nil, false
+	}
+
+	switch {
+	case nat64WellKnown.Contains(ip16), nat64LocalUse.Contains(ip16),
+		ipv4Compatible.Contains(ip16):
+		// Last 32 bits are the embedded IPv4.
+		return net.IPv4(ip16[12], ip16[13], ip16[14], ip16[15]).To4(), true
+	case sixToFour.Contains(ip16):
+		// Bits 16..47 are the embedded IPv4.
+		return net.IPv4(ip16[2], ip16[3], ip16[4], ip16[5]).To4(), true
+	case teredo.Contains(ip16):
+		// Bits 96..127 are the embedded IPv4 XOR'd with 0xFFFFFFFF.
+		x := binary.BigEndian.Uint32(ip16[12:16]) ^ 0xFFFFFFFF
+		b := make([]byte, 4)
+		binary.BigEndian.PutUint32(b, x)
+		return net.IPv4(b[0], b[1], b[2], b[3]).To4(), true
+	case ip16[10] == 0x5e && ip16[11] == 0xfe:
+		// ISATAP (RFC 5214) - interface identifier ends with :5efe:<ipv4>. The /64
+		// prefix is not fixed (any subnet can carry ISATAP), so match structurally
+		// on bytes 10-11 and treat bytes 12-15 as the embedded IPv4. Must run after
+		// the fixed-prefix cases above (Teredo can legitimately have 5efe in bytes
+		// 10-11; its embedding takes precedence).
+		return net.IPv4(ip16[12], ip16[13], ip16[14], ip16[15]).To4(), true
+	}
+
+	return nil, false
+}
+
+// IsValidLinkURL checks if the provided string is a valid URL with http or https scheme and a non-empty hostname.
+func IsValidLinkURL(str string) bool {
+	u, err := url.Parse(str)
+	return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Hostname() != ""
+}

internal/tools/snippets.go

@@ -20,13 +20,14 @@ func CreateSnippet(text, html string) string {
 	}
 
 	if html != "" {
-		data := html2text.Strip(html, false)
+		data, err := html2text.Strip(html, false)
+		if err == nil {
+			if len(data) <= limit {
+				return data
+			}
 
-		if len(data) <= limit {
-			return data
+			return truncate(data, limit) + "..."
 		}
-
-		return truncate(data, limit) + "..."
 	}
 
 	if text != "" {

internal/tools/tags.go

@@ -10,7 +10,7 @@ import (
 
 var (
 	// Invalid tag characters regex
-	tagsInvalidChars = regexp.MustCompile(`[^a-zA-Z0-9\-\ \_\.]`)
+	tagsInvalidChars = regexp.MustCompile(`[^a-zA-Z0-9\-\ \_\.@]`)
 
 	// Regex to catch multiple spaces
 	multiSpaceRe = regexp.MustCompile(`(\s+)`)
@@ -19,14 +19,21 @@ var (
 	TagsTitleCase bool
 )
 
-// CleanTag returns a clean tag, trimming whitespace and replacing invalid characters
+// CleanTag returns a clean tag, trimming whitespace and replacing invalid characters.
+// If the tag is longer than 100 characters, it is truncated.
 func CleanTag(s string) string {
-	return strings.TrimSpace(
+	t := strings.TrimSpace(
 		multiSpaceRe.ReplaceAllString(
 			tagsInvalidChars.ReplaceAllString(s, " "),
 			" ",
 		),
 	)
+
+	if len(t) > 100 {
+		return t[:100]
+	}
+
+	return t
 }
 
 // SetTagCasing returns the slice of tags, title-casing if set

internal/tools/tools_test.go

@@ -1,10 +1,87 @@
 package tools
 
 import (
+	"net"
 	"reflect"
 	"testing"
 )
 
+func TestIsInternalIP(t *testing.T) {
+	internal := []string{
+		"127.0.0.1",       // loopback
+		"::1",             // IPv6 loopback
+		"10.0.0.1",        // private
+		"172.16.0.1",      // private
+		"192.168.1.1",     // private
+		"169.254.1.1",     // link-local unicast
+		"fe80::1",         // IPv6 link-local
+		"0.0.0.0",         // unspecified
+		"224.0.0.1",       // multicast
+		"100.64.0.1",      // CGNAT start
+		"100.127.255.255", // CGNAT end
+		// IPv6 transition forms embedding an internal IPv4 destination — golang/go#79925.
+		"64:ff9b::a9fe:a9fe",       // NAT64 well-known (RFC 6052) wrapping 169.254.169.254
+		"64:ff9b:1::a9fe:a9fe",     // NAT64 local-use (RFC 8215) wrapping 169.254.169.254
+		"2002:a9fe:a9fe::",         // 6to4 (RFC 3056) wrapping 169.254.169.254
+		"::a9fe:a9fe",              // IPv4-compatible IPv6 (RFC 4291) wrapping 169.254.169.254
+		"64:ff9b::7f00:1",          // NAT64 wrapping 127.0.0.1
+		"2002:0a00:0001::",         // 6to4 wrapping 10.0.0.1
+		"::ffff:169.254.169.254",   // IPv4-mapped (also caught by stdlib via To4)
+		"::5efe:a9fe:a9fe",         // ISATAP (RFC 5214) wrapping 169.254.169.254
+		"2001:db8::5efe:7f00:1",    // ISATAP under a documentation prefix wrapping 127.0.0.1
+		"fec0::1",                  // deprecated site-local (RFC 3879 / RFC 4291 §2.5.7)
+		"2001:db8::1",              // documentation prefix (RFC 3849)
+		"2001:db8::5efe:0808:0808", // documentation prefix (blocked regardless of embedded IPv4)
+	}
+	external := []string{
+		"8.8.8.8",
+		"1.1.1.1",
+		"100.128.0.1",          // just outside CGNAT range
+		"2001:4860:4860::8888", // Google public DNS over IPv6
+		"2002:0808:0808::",     // 6to4 wrapping 8.8.8.8 (public IPv4)
+		"64:ff9b::0808:0808",   // NAT64 wrapping 8.8.8.8 (public IPv4)
+	}
+
+	for _, s := range internal {
+		ip := net.ParseIP(s)
+		if !IsInternalIP(ip) {
+			t.Errorf("expected %s to be internal", s)
+		}
+	}
+	for _, s := range external {
+		ip := net.ParseIP(s)
+		if IsInternalIP(ip) {
+			t.Errorf("expected %s to be external", s)
+		}
+	}
+}
+
+func TestIsValidLinkURL(t *testing.T) {
+	valid := []string{
+		"http://example.com",
+		"https://example.com",
+		"https://example.com/path?q=1#anchor",
+	}
+	invalid := []string{
+		"",
+		"ftp://example.com",
+		"example.com",
+		"//example.com",
+		"https://",
+	}
+
+	for _, s := range valid {
+		if !IsValidLinkURL(s) {
+			t.Errorf("expected %q to be a valid link URL", s)
+		}
+	}
+	for _, s := range invalid {
+		if IsValidLinkURL(s) {
+			t.Errorf("expected %q to be an invalid link URL", s)
+		}
+	}
+}
+
 func TestArgsParser(t *testing.T) {
 	tests := map[string][]string{}
 	tests["this is a test"] = []string{"this", "is", "a", "test"}
@@ -33,7 +110,8 @@ func TestCleanTag(t *testing.T) {
 	tests["thiS IS a Test :-)"] = "thiS IS a Test -"
 	tests["  thiS 99     IS a Test :-)"] = "thiS 99 IS a Test -"
 	tests["this_is-a test "] = "this_is-a test"
-	tests["this_is-a&^%%(*)@ test"] = "this_is-a test"
+	tests["this_is-a&^%%(*)@ test"] = "this_is-a @ test"
+	tests["this is a long tag title with more than 100 characters, which should get automatically truncated to 100 characters"] = "this is a long tag title with more than 100 characters which should get automatically truncated to 1"
 
 	for search, expected := range tests {
 		res := CleanTag(search)

internal/tools/utils.go

@@ -36,3 +36,22 @@ func Normalize(s string) string {
 
 	return strings.TrimSpace(s)
 }
+
+// SafeUint64 converts an int or int64 to uint64, ensuring it does not exceed the maximum value for uint64.
+func SafeUint64(i any) uint64 {
+	switch v := i.(type) {
+	case int:
+		if v < 0 {
+			return 0
+		}
+		return uint64(v)
+	case int64:
+		if v < 0 {
+			return 0
+		}
+		return uint64(v)
+	default:
+		// only accepts int or int64
+		return 0
+	}
+}

internal/updater/targz.go

@@ -1,218 +0,0 @@
-package updater
-
-import (
-	"archive/tar"
-	"bufio"
-	"compress/gzip"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-)
-
-// TarGZExtract extracts a archive from the file inputFilePath.
-// It tries to create the directory structure outputFilePath contains if it doesn't exist.
-// It returns potential errors to be checked or nil if everything works.
-func TarGZExtract(inputFilePath, outputFilePath string) (err error) {
-	outputFilePath = stripTrailingSlashes(outputFilePath)
-	inputFilePath, outputFilePath, err = makeAbsolute(inputFilePath, outputFilePath)
-	if err != nil {
-		return err
-	}
-	undoDir, err := mkdirAll(outputFilePath, 0750)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err != nil {
-			undoDir()
-		}
-	}()
-
-	return extract(inputFilePath, outputFilePath)
-}
-
-// Creates all directories with os.MakedirAll and returns a function to remove the first created directory so cleanup is possible.
-func mkdirAll(dirPath string, perm os.FileMode) (func(), error) {
-	var undoDir string
-
-	for p := dirPath; ; p = filepath.Dir(p) {
-		finfo, err := os.Stat(p)
-		if err == nil {
-			if finfo.IsDir() {
-				break
-			}
-
-			finfo, err = os.Lstat(p)
-			if err != nil {
-				return nil, err
-			}
-
-			if finfo.IsDir() {
-				break
-			}
-
-			return nil, fmt.Errorf("mkdirAll (%s): %v", p, syscall.ENOTDIR)
-		}
-
-		if os.IsNotExist(err) {
-			undoDir = p
-		} else {
-			return nil, err
-		}
-	}
-
-	if undoDir == "" {
-		return func() {}, nil
-	}
-
-	if err := os.MkdirAll(dirPath, perm); err != nil {
-		return nil, err
-	}
-
-	return func() {
-		if err := os.RemoveAll(undoDir); err != nil {
-			panic(err)
-		}
-	}, nil
-}
-
-// Remove trailing slash if any.
-func stripTrailingSlashes(path string) string {
-	if len(path) > 0 && path[len(path)-1] == '/' {
-		path = path[0 : len(path)-1]
-	}
-
-	return path
-}
-
-// Make input and output paths absolute.
-func makeAbsolute(inputFilePath, outputFilePath string) (string, string, error) {
-	inputFilePath, err := filepath.Abs(inputFilePath)
-	if err == nil {
-		outputFilePath, err = filepath.Abs(outputFilePath)
-	}
-
-	return inputFilePath, outputFilePath, err
-}
-
-// Extract the file in filePath to directory.
-func extract(filePath string, directory string) error {
-	file, err := os.Open(filepath.Clean(filePath))
-	if err != nil {
-		return err
-	}
-
-	defer func() {
-		if err := file.Close(); err != nil {
-			fmt.Printf("Error closing file: %s\n", err)
-		}
-	}()
-
-	gzipReader, err := gzip.NewReader(bufio.NewReader(file))
-	if err != nil {
-		return err
-	}
-	defer gzipReader.Close()
-
-	tarReader := tar.NewReader(gzipReader)
-
-	// Post extraction directory permissions & timestamps
-	type DirInfo struct {
-		Path   string
-		Header *tar.Header
-	}
-
-	// slice to add all extracted directory info for post-processing
-	postExtraction := []DirInfo{}
-
-	for {
-		header, err := tarReader.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return err
-		}
-
-		fileInfo := header.FileInfo()
-		// paths could contain a '..', is used in a file system operations
-		if strings.Contains(fileInfo.Name(), "..") {
-			continue
-		}
-		dir := filepath.Join(directory, filepath.Dir(header.Name))
-		filename := filepath.Join(dir, fileInfo.Name())
-
-		if fileInfo.IsDir() {
-			// create the directory 755 in case writing permissions prohibit writing before files added
-			if err := os.MkdirAll(filename, 0750); err != nil {
-				return err
-			}
-
-			// set file ownership (if allowed)
-			// Chtimes() && Chmod() only set after once extraction is complete
-			_ = os.Chown(filename, header.Uid, header.Gid)
-
-			// add directory info to slice to process afterwards
-			postExtraction = append(postExtraction, DirInfo{filename, header})
-			continue
-		}
-
-		// make sure parent directory exists (may not be included in tar)
-		if !fileInfo.IsDir() && !isDir(dir) {
-			err = os.MkdirAll(dir, 0750)
-			if err != nil {
-				return err
-			}
-		}
-
-		file, err := os.Create(filepath.Clean(filename))
-		if err != nil {
-			return err
-		}
-
-		writer := bufio.NewWriter(file)
-
-		buffer := make([]byte, 4096)
-		for {
-			n, err := tarReader.Read(buffer)
-			if err != nil && err != io.EOF {
-				panic(err)
-			}
-			if n == 0 {
-				break
-			}
-
-			_, err = writer.Write(buffer[:n])
-			if err != nil {
-				return err
-			}
-		}
-
-		err = writer.Flush()
-		if err != nil {
-			return err
-		}
-
-		err = file.Close()
-		if err != nil {
-			return err
-		}
-
-		// set file permissions, timestamps & uid/gid
-		_ = os.Chmod(filename, os.FileMode(header.Mode)) // #nosec
-		_ = os.Chtimes(filename, header.AccessTime, header.ModTime)
-		_ = os.Chown(filename, header.Uid, header.Gid)
-	}
-
-	if len(postExtraction) > 0 {
-		for _, dir := range postExtraction {
-			_ = os.Chtimes(dir.Path, dir.Header.AccessTime, dir.Header.ModTime)
-			_ = os.Chmod(dir.Path, dir.Header.FileInfo().Mode().Perm())
-		}
-	}
-
-	return nil
-}

internal/updater/unzip.go

@@ -1,76 +0,0 @@
-package updater
-
-import (
-	"archive/zip"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// Unzip will decompress a zip archive, moving all files and folders
-// within the zip file (src) to an output directory (dest).
-func Unzip(src string, dest string) ([]string, error) {
-
-	var filenames []string
-
-	r, err := zip.OpenReader(src)
-	if err != nil {
-		return filenames, err
-	}
-	defer r.Close()
-
-	for _, f := range r.File {
-
-		// Store filename/path for returning and using later on
-		fpath := filepath.Join(dest, filepath.Clean(f.Name))
-
-		// Check for ZipSlip. More Info: http://bit.ly/2MsjAWE
-		if !strings.HasPrefix(fpath, filepath.Clean(dest)+string(os.PathSeparator)) {
-			return filenames, fmt.Errorf("%s: illegal file path", fpath)
-		}
-
-		filenames = append(filenames, fpath)
-
-		if f.FileInfo().IsDir() {
-			// Make Folder
-			if err := os.MkdirAll(fpath, os.ModePerm); /* #nosec */ err != nil {
-				return filenames, err
-			}
-			continue
-		}
-
-		// Make File
-		if err = os.MkdirAll(filepath.Dir(fpath), os.ModePerm); /* #nosec */ err != nil {
-			return filenames, err
-		}
-
-		outFile, err := os.OpenFile(filepath.Clean(fpath), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
-		if err != nil {
-			return filenames, err
-		}
-
-		rc, err := f.Open()
-		if err != nil {
-			return filenames, err
-		}
-
-		_, err = io.Copy(outFile, rc) // #nosec - file is streamed from zip to file
-
-		// Close the file without defer to close before next iteration of loop
-		if err := outFile.Close(); err != nil {
-			return filenames, err
-		}
-
-		if err := rc.Close(); err != nil {
-			return filenames, err
-		}
-
-		if err != nil {
-			return filenames, err
-		}
-	}
-
-	return filenames, nil
-}

internal/updater/updater.go

@@ -1,347 +0,0 @@
-// Package updater checks and downloads new versions
-package updater
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"time"
-
-	"github.com/axllent/mailpit/config"
-	"github.com/axllent/mailpit/internal/logger"
-	"github.com/axllent/semver"
-)
-
-var (
-	// AllowPrereleases defines whether pre-releases may be included
-	AllowPrereleases = false
-
-	// temporary directory
-	tempDir string
-)
-
-// Releases struct for Github releases json
-type Releases []struct {
-	Name       string `json:"name"`       // release name
-	Tag        string `json:"tag_name"`   // release tag
-	Prerelease bool   `json:"prerelease"` // Github pre-release
-	Assets     []struct {
-		BrowserDownloadURL string `json:"browser_download_url"`
-		ID                 int64  `json:"id"`
-		Name               string `json:"name"`
-		Size               int64  `json:"size"`
-	} `json:"assets"`
-}
-
-// Release struct contains the file data for downloadable release
-type Release struct {
-	Name string
-	Tag  string
-	URL  string
-	Size int64
-}
-
-// GithubLatest fetches the latest release info & returns release tag, filename & download url
-func GithubLatest(repo, name string) (string, string, string, error) {
-	releaseURL := fmt.Sprintf("https://api.github.com/repos/%s/releases", repo)
-
-	timeout := time.Duration(5 * time.Second)
-
-	client := http.Client{
-		Timeout: timeout,
-	}
-
-	req, err := http.NewRequest("GET", releaseURL, nil)
-	if err != nil {
-		return "", "", "", err
-	}
-
-	req.Header.Set("User-Agent", "Mailpit/"+config.Version)
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", "", "", err
-	}
-
-	defer resp.Body.Close()
-
-	body, err := io.ReadAll(resp.Body)
-
-	if err != nil {
-		return "", "", "", err
-	}
-
-	linkOS := runtime.GOOS
-	linkArch := runtime.GOARCH
-	linkExt := ".tar.gz"
-	if linkOS == "windows" {
-		// Windows uses .zip instead
-		linkExt = ".zip"
-	}
-
-	var allReleases = []Release{}
-
-	var releases Releases
-
-	if err := json.Unmarshal(body, &releases); err != nil {
-		return "", "", "", err
-	}
-
-	archiveName := fmt.Sprintf("%s-%s-%s%s", name, linkOS, linkArch, linkExt)
-
-	// loop through releases
-	for _, r := range releases {
-		if !semver.IsValid(r.Tag) {
-			// Invalid semversion, skip
-			continue
-		}
-
-		if !AllowPrereleases && (semver.Prerelease(r.Tag) != "" || r.Prerelease) {
-			// we don't accept AllowPrereleases, skip
-			continue
-		}
-
-		for _, a := range r.Assets {
-			if a.Name == archiveName {
-				thisRelease := Release{a.Name, r.Tag, a.BrowserDownloadURL, a.Size}
-				allReleases = append(allReleases, thisRelease)
-				break
-			}
-		}
-	}
-
-	if len(allReleases) == 0 {
-		// no releases with suitable assets found
-		return "", "", "", fmt.Errorf("No binary releases found")
-	}
-
-	var latestRelease = Release{}
-
-	for _, r := range allReleases {
-		// detect the latest release
-		if semver.Compare(r.Tag, latestRelease.Tag) == 1 {
-			latestRelease = r
-		}
-	}
-
-	return latestRelease.Tag, latestRelease.Name, latestRelease.URL, nil
-}
-
-// GreaterThan compares the current version to a different version
-// returning < 1 not upgradeable
-func GreaterThan(toVer, fromVer string) bool {
-	return semver.Compare(toVer, fromVer) == 1
-}
-
-// GithubUpdate the running binary with the latest release binary from Github
-func GithubUpdate(repo, appName, currentVersion string) (string, error) {
-	ver, filename, downloadURL, err := GithubLatest(repo, appName)
-
-	if err != nil {
-		return "", err
-	}
-
-	if ver == currentVersion {
-		return "", fmt.Errorf("No new release found")
-	}
-
-	if semver.Compare(ver, currentVersion) < 1 {
-		return "", fmt.Errorf("No newer releases found (latest %s)", ver)
-	}
-
-	tmpDir := getTempDir()
-
-	// outFile can be a tar.gz or a zip, depending on architecture
-	outFile := filepath.Join(tmpDir, filename)
-
-	if err := downloadToFile(downloadURL, outFile); err != nil {
-		return "", err
-	}
-
-	newExec := filepath.Join(tmpDir, "mailpit")
-
-	if runtime.GOOS == "windows" {
-		if _, err := Unzip(outFile, tmpDir); err != nil {
-			return "", err
-		}
-		newExec = filepath.Join(tmpDir, "mailpit.exe")
-	} else {
-		if err := TarGZExtract(outFile, tmpDir); err != nil {
-			return "", err
-		}
-	}
-
-	if runtime.GOOS != "windows" {
-		err := os.Chmod(newExec, 0755) // #nosec
-		if err != nil {
-			return "", err
-		}
-	}
-
-	// ensure the new binary is executable (mainly for inconsistent darwin builds)
-	/* #nosec G204 */
-	cmd := exec.Command(newExec, "-h")
-	if err := cmd.Run(); err != nil {
-		return "", err
-	}
-
-	// get the running binary
-	oldExec, err := os.Executable()
-	if err != nil {
-		return "", err
-	}
-
-	if err = replaceFile(oldExec, newExec); err != nil {
-		return "", err
-	}
-
-	return ver, nil
-}
-
-// DownloadToFile downloads a URL to a file
-func downloadToFile(url, fileName string) error {
-	// Get the data
-	resp, err := http.Get(url) // #nosec
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	// Create the file
-	out, err := os.Create(filepath.Clean(fileName))
-	if err != nil {
-		return err
-	}
-
-	defer func() {
-		if err := out.Close(); err != nil {
-			logger.Log().Errorf("error closing file: %s", err.Error())
-		}
-	}()
-
-	// Write the body to file
-	_, err = io.Copy(out, resp.Body)
-
-	return err
-}
-
-// ReplaceFile replaces one file with another.
-// Running files cannot be overwritten, so it has to be moved
-// and the new binary saved to the original path. This requires
-// read & write permissions to both the original file and directory.
-// Note, on Windows it is not possible to delete a running program,
-// so the old exe is renamed and moved to os.TempDir()
-func replaceFile(dst, src string) error {
-	// open the source file for reading
-	source, err := os.Open(filepath.Clean(src))
-	if err != nil {
-		return err
-	}
-
-	// destination directory eg: /usr/local/bin
-	dstDir := filepath.Dir(dst)
-	// binary filename
-	binaryFilename := filepath.Base(dst)
-	// old binary tmp name
-	dstOld := fmt.Sprintf("%s.old", binaryFilename)
-	// new binary tmp name
-	dstNew := fmt.Sprintf("%s.new", binaryFilename)
-	// absolute path of new tmp file
-	newTmpAbs := filepath.Join(dstDir, dstNew)
-	// absolute path of old tmp file
-	oldTmpAbs := filepath.Join(dstDir, dstOld)
-
-	// get src permissions
-	fi, _ := os.Stat(dst)
-	srcPerms := fi.Mode().Perm()
-
-	// create the new file
-	tmpNew, err := os.OpenFile(filepath.Clean(newTmpAbs), os.O_CREATE|os.O_RDWR, srcPerms) // #nosec
-	if err != nil {
-		return err
-	}
-
-	// copy new binary to <binary>.new
-	if _, err := io.Copy(tmpNew, source); err != nil {
-		return err
-	}
-
-	// close immediately else Windows has a fit
-	if err := tmpNew.Close(); err != nil {
-		return err
-	}
-
-	if err := source.Close(); err != nil {
-		return err
-	}
-
-	// rename the current executable to <binary>.old
-	if err := os.Rename(dst, oldTmpAbs); err != nil {
-		return err
-	}
-
-	// rename the <binary>.new to current executable
-	if err := os.Rename(newTmpAbs, dst); err != nil {
-		return err
-	}
-
-	// delete the old binary
-	if runtime.GOOS == "windows" {
-		tmpDir := os.TempDir()
-		delFile := filepath.Join(tmpDir, filepath.Base(oldTmpAbs))
-		if err := os.Rename(oldTmpAbs, delFile); err != nil {
-			return err
-		}
-	} else {
-		if err := os.Remove(oldTmpAbs); err != nil {
-			return err
-		}
-	}
-
-	// remove the src file
-	return os.Remove(src)
-}
-
-// GetTempDir will create & return a temporary directory if one has not been specified
-func getTempDir() string {
-	if tempDir == "" {
-		randBytes := make([]byte, 6)
-		if _, err := rand.Read(randBytes); err != nil {
-			panic(err)
-		}
-		tempDir = filepath.Join(os.TempDir(), "updater-"+hex.EncodeToString(randBytes))
-	}
-	if err := mkDirIfNotExists(tempDir); err != nil {
-		// need a better way to exit
-		logger.Log().Errorf("error: %s", err.Error())
-		os.Exit(2)
-	}
-
-	return tempDir
-}
-
-// MkDirIfNotExists will create a directory if it doesn't exist
-func mkDirIfNotExists(path string) error {
-	if !isDir(path) {
-		return os.MkdirAll(path, os.ModePerm) // #nosec
-	}
-
-	return nil
-}
-
-// IsDir returns if a path is a directory
-func isDir(path string) bool {
-	info, err := os.Stat(path)
-	if os.IsNotExist(err) || !info.IsDir() {
-		return false
-	}
-
-	return true
-}

package.json

@@ -12,7 +12,7 @@
     "lint-fix": "eslint --fix && prettier --write ."
   },
   "dependencies": {
-    "axios": "^1.2.1",
+    "axios": "^1.13.5",
     "bootstrap": "^5.2.0",
     "bootstrap-icons": "^1.9.1",
     "bootstrap5-tags": "^1.6.1",
@@ -27,23 +27,25 @@
     "timezones-list": "^3.0.3",
     "vue": "^3.2.13",
     "vue-css-donut-chart": "^2.0.0",
-    "vue-router": "^4.2.4"
+    "vue-router": "^5.0.4"
   },
   "devDependencies": {
+    "@eslint/compat": "^2.0.2",
+    "@eslint/js": "^10.0.1",
     "@popperjs/core": "^2.11.5",
     "@types/bootstrap": "^5.2.7",
     "@types/tinycon": "^0.6.3",
     "@vue/compiler-sfc": "^3.2.37",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.0",
     "esbuild-plugin-vue-next": "^0.1.4",
     "esbuild-sass-plugin": "^3.0.0",
-    "eslint": "^9.29.0",
+    "eslint": "^10.0.1",
     "eslint-config-prettier": "^10.1.5",
     "eslint-plugin-vue": "^10.2.0",
-    "neostandard": "^0.12.1",
+    "globals": "^17.3.0",
     "prettier": "^3.5.3"
   },
-  "prettier":{
+  "prettier": {
     "tabWidth": 4,
     "useTabs": true,
     "printWidth": 120

sendmail/cmd/cmd.go

@@ -23,10 +23,12 @@ import (
 	"path"
 	"regexp"
 	"strings"
+	"time"
+
+	"net"
 
 	"github.com/axllent/mailpit/config"
 	"github.com/axllent/mailpit/internal/logger"
-	"github.com/mneis/go-telnet"
 	flag "github.com/spf13/pflag"
 )
 
@@ -119,30 +121,49 @@ func Run() {
 	socketAddr, isSocket := socketAddress(SMTPAddr)
 
 	// handles `sendmail -bs`
-	// telnet directly to SMTP
+	// relay stdin/stdout to SMTP connection
 	if UseB && UseS {
-		var caller telnet.Caller = telnet.StandardCaller
-
+		network := "tcp"
+		addr := SMTPAddr
 		if isSocket {
-			if err := telnet.DialToAndCallUnix(socketAddr, caller); err != nil {
-				fmt.Println(err)
-				os.Exit(1)
-			}
-		} else {
-			if err := telnet.DialToAndCall(SMTPAddr, caller); err != nil {
-				fmt.Println(err)
-				os.Exit(1)
-			}
+			network = "unix"
+			addr = socketAddr
+		}
+
+		conn, err := net.Dial(network, addr)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+		defer func() { _ = conn.Close() }()
+
+		done := make(chan struct{})
+		go func() {
+			_, _ = io.Copy(os.Stdout, conn)
+			close(done)
+		}()
+		_, _ = io.Copy(conn, os.Stdin)
+		if cw, ok := conn.(interface{ CloseWrite() error }); ok {
+			_ = cw.CloseWrite()
+		}
+		select {
+		case <-done:
+		case <-time.After(30 * time.Second):
 		}
 
 		return
 	}
 
-	body, err := io.ReadAll(os.Stdin)
+	const maxMessageSize = 1000 * 1024 * 1024
+	body, err := io.ReadAll(io.LimitReader(os.Stdin, maxMessageSize+1))
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "error reading stdin")
 		os.Exit(11)
 	}
+	if len(body) > maxMessageSize {
+		fmt.Fprintf(os.Stderr, "message exceeds %d MiB size cap\n", maxMessageSize/(1024*1024))
+		os.Exit(11)
+	}
 
 	msg, err := mail.ReadMessage(bytes.NewReader(body))
 	if err != nil {

sendmail/cmd/smtp.go

@@ -2,13 +2,14 @@
 package cmd
 
 import (
+	"crypto/tls"
+	"errors"
 	"fmt"
 	"net"
 	"net/mail"
 	"net/smtp"
 	"os"
-
-	"github.com/axllent/mailpit/internal/logger"
+	"strings"
 )
 
 // Send is a wrapper for smtp.SendMail() which also supports sending via unix sockets.
@@ -26,8 +27,17 @@ func Send(addr string, from string, to []string, msg []byte) error {
 		return fmt.Errorf("no To addresses specified")
 	}
 
+	if err := validateLine(fromAddress.Address); err != nil {
+		return err
+	}
+	for _, recipient := range to {
+		if err := validateLine(recipient); err != nil {
+			return err
+		}
+	}
+
 	if !isSocket {
-		return smtp.SendMail(addr, nil, fromAddress.Address, to, msg)
+		return sendMail(addr, nil, fromAddress.Address, to, msg)
 	}
 
 	conn, err := net.Dial("unix", socketPath)
@@ -37,16 +47,15 @@ func Send(addr string, from string, to []string, msg []byte) error {
 
 	client, err := smtp.NewClient(conn, "")
 	if err != nil {
+		_ = conn.Close()
 		return err
 	}
+	defer func() { _ = client.Close() }()
 
-	// Set the sender
 	if err := client.Mail(fromAddress.Address); err != nil {
-		fmt.Fprintln(os.Stderr, "error sending mail")
-		logger.Log().Fatal(err)
+		return fmt.Errorf("error setting sender: %w", err)
 	}
 
-	// Set the recipient
 	for _, a := range to {
 		if err := client.Rcpt(a); err != nil {
 			return err
@@ -58,14 +67,81 @@ func Send(addr string, from string, to []string, msg []byte) error {
 		return err
 	}
 
-	_, err = wc.Write(msg)
+	if _, err := wc.Write(msg); err != nil {
+		return err
+	}
+	if err := wc.Close(); err != nil {
+		return err
+	}
+
+	return client.Quit()
+}
+
+func sendMail(addr string, a smtp.Auth, from string, to []string, msg []byte) error {
+	c, err := smtp.Dial(addr)
 	if err != nil {
 		return err
 	}
-	err = wc.Close()
+	defer func() { _ = c.Close() }()
+
+	// Use the local hostname for EHLO/HELO as required by RFC 5321.
+	// Fall back to "localhost" if the hostname cannot be determined.
+	localHostname, err := os.Hostname()
+	if err != nil {
+		localHostname = "localhost"
+	}
+	if err = c.Hello(localHostname); err != nil {
+		return err
+	}
+
+	if ok, _ := c.Extension("STARTTLS"); ok {
+		config := &tls.Config{ServerName: addr, InsecureSkipVerify: true} // #nosec
+		if err = c.StartTLS(config); err != nil {
+			return err
+		}
+	}
+
+	if a != nil {
+		if ok, _ := c.Extension("AUTH"); !ok {
+			return errors.New("smtp: server doesn't support AUTH")
+		}
+		if err = c.Auth(a); err != nil {
+			return err
+		}
+	}
+
+	if err = c.Mail(from); err != nil {
+		return err
+	}
+
+	for _, addr := range to {
+		if err = c.Rcpt(addr); err != nil {
+			return err
+		}
+	}
+
+	w, err := c.Data()
 	if err != nil {
 		return err
 	}
 
+	_, err = w.Write(msg)
+	if err != nil {
+		return err
+	}
+
+	err = w.Close()
+	if err != nil {
+		return err
+	}
+
+	return c.Quit()
+}
+
+// validateLine checks to see if a line has CR or LF as per RFC 5321.
+func validateLine(line string) error {
+	if strings.ContainsAny(line, "\n\r") {
+		return errors.New("smtp: A line must not contain CR or LF")
+	}
 	return nil
 }

server/apiv1/api.go

@@ -16,30 +16,28 @@ import (
 func fourOFour(w http.ResponseWriter) {
 	w.Header().Set("Referrer-Policy", "no-referrer")
 	w.Header().Set("Content-Security-Policy", config.ContentSecurityPolicy)
-	w.WriteHeader(http.StatusNotFound)
 	w.Header().Set("Content-Type", "text/plain")
-	fmt.Fprint(w, "404 page not found")
+	w.WriteHeader(http.StatusNotFound)
+	_, _ = fmt.Fprint(w, "404 page not found")
 }
 
 // HTTPError returns a basic error message (400 response)
 func httpError(w http.ResponseWriter, msg string) {
 	w.Header().Set("Referrer-Policy", "no-referrer")
 	w.Header().Set("Content-Security-Policy", config.ContentSecurityPolicy)
-	w.WriteHeader(http.StatusBadRequest)
 	w.Header().Set("Content-Type", "text/plain")
-	fmt.Fprint(w, msg)
+	w.WriteHeader(http.StatusBadRequest)
+	_, _ = fmt.Fprint(w, msg)
 }
 
 // httpJSONError returns a basic error message (400 response) in JSON format
 func httpJSONError(w http.ResponseWriter, msg string) {
 	w.Header().Set("Referrer-Policy", "no-referrer")
 	w.Header().Set("Content-Security-Policy", config.ContentSecurityPolicy)
-	w.WriteHeader(http.StatusBadRequest)
-	e := JSONErrorMessage{
-		Error: msg,
-	}
-
 	w.Header().Add("Content-Type", "application/json")
+	w.WriteHeader(http.StatusBadRequest)
+	e := struct{ Error string }{Error: msg}
+
 	if err := json.NewEncoder(w).Encode(e); err != nil {
 		httpError(w, err.Error())
 	}

server/apiv1/application.go

@@ -10,16 +10,7 @@ import (
 	"github.com/axllent/mailpit/internal/stats"
 )
 
-// Application information
-// swagger:response AppInfoResponse
-type appInfoResponse struct {
-	// Application information
-	//
-	// in: body
-	Body stats.AppInformation
-}
-
-// AppInfo returns some basic details about the running app, and latest release.
+// AppInfo returns some basic details about the running app including the latest release (unless disabled).
 func AppInfo(w http.ResponseWriter, _ *http.Request) {
 	// swagger:route GET /api/v1/info application AppInformation
 	//
@@ -37,64 +28,14 @@ func AppInfo(w http.ResponseWriter, _ *http.Request) {
 	//		400: ErrorResponse
 
 	w.Header().Add("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(stats.Load()); err != nil {
+	if err := json.NewEncoder(w).Encode(stats.Load(true)); err != nil {
 		httpError(w, err.Error())
 	}
 }
 
-// Response includes global web UI settings
-//
-// swagger:model WebUIConfiguration
-type webUIConfiguration struct {
-	// Optional label to identify this Mailpit instance
-	Label string
-	// Message Relay information
-	MessageRelay struct {
-		// Whether message relaying (release) is enabled
-		Enabled bool
-		// The configured SMTP server address
-		SMTPServer string
-		// Enforced Return-Path (if set) for relay bounces
-		ReturnPath string
-		// Only allow relaying to these recipients (regex)
-		AllowedRecipients string
-		// Block relaying to these recipients (regex)
-		BlockedRecipients string
-		// Overrides the "From" address for all relayed messages
-		OverrideFrom string
-		// Preserve the original Message-IDs when relaying messages
-		PreserveMessageIDs bool
-
-		// DEPRECATED 2024/03/12
-		// swagger:ignore
-		RecipientAllowlist string
-	}
-
-	// Whether SpamAssassin is enabled
-	SpamAssassin bool
-
-	// Whether Chaos support is enabled at runtime
-	ChaosEnabled bool
-
-	// Whether messages with duplicate IDs are ignored
-	DuplicatesIgnored bool
-
-	// Whether the delete button should be hidden
-	HideDeleteAllButton bool
-}
-
-// Web UI configuration response
-// swagger:response WebUIConfigurationResponse
-type webUIConfigurationResponse struct {
-	// Web UI configuration settings
-	//
-	// in: body
-	Body webUIConfiguration
-}
-
 // WebUIConfig returns configuration settings for the web UI.
 func WebUIConfig(w http.ResponseWriter, _ *http.Request) {
-	// swagger:route GET /api/v1/webui application WebUIConfiguration
+	// swagger:route GET /api/v1/webui application WebUIConfigurationResponse
 	//
 	// # Get web UI configuration
 	//
@@ -110,29 +51,29 @@ func WebUIConfig(w http.ResponseWriter, _ *http.Request) {
 	//	  200: WebUIConfigurationResponse
 	//	  400: ErrorResponse
 
-	conf := webUIConfiguration{}
+	conf := webUIConfigurationResponse{}
 
-	conf.Label = config.Label
-	conf.MessageRelay.Enabled = config.ReleaseEnabled
+	conf.Body.Label = config.Label
+	conf.Body.MessageRelay.Enabled = config.ReleaseEnabled
 	if config.ReleaseEnabled {
-		conf.MessageRelay.SMTPServer = fmt.Sprintf("%s:%d", config.SMTPRelayConfig.Host, config.SMTPRelayConfig.Port)
-		conf.MessageRelay.ReturnPath = config.SMTPRelayConfig.ReturnPath
-		conf.MessageRelay.AllowedRecipients = config.SMTPRelayConfig.AllowedRecipients
-		conf.MessageRelay.BlockedRecipients = config.SMTPRelayConfig.BlockedRecipients
-		conf.MessageRelay.OverrideFrom = config.SMTPRelayConfig.OverrideFrom
-		conf.MessageRelay.PreserveMessageIDs = config.SMTPRelayConfig.PreserveMessageIDs
+		conf.Body.MessageRelay.SMTPServer = fmt.Sprintf("%s:%d", config.SMTPRelayConfig.Host, config.SMTPRelayConfig.Port)
+		conf.Body.MessageRelay.ReturnPath = config.SMTPRelayConfig.ReturnPath
+		conf.Body.MessageRelay.AllowedRecipients = config.SMTPRelayConfig.AllowedRecipients
+		conf.Body.MessageRelay.BlockedRecipients = config.SMTPRelayConfig.BlockedRecipients
+		conf.Body.MessageRelay.OverrideFrom = config.SMTPRelayConfig.OverrideFrom
+		conf.Body.MessageRelay.PreserveMessageIDs = config.SMTPRelayConfig.PreserveMessageIDs
 
 		// DEPRECATED 2024/03/12
-		conf.MessageRelay.RecipientAllowlist = config.SMTPRelayConfig.AllowedRecipients
+		conf.Body.MessageRelay.RecipientAllowlist = config.SMTPRelayConfig.AllowedRecipients
 	}
 
-	conf.SpamAssassin = config.EnableSpamAssassin != ""
-	conf.ChaosEnabled = chaos.Enabled
-	conf.DuplicatesIgnored = config.IgnoreDuplicateIDs
-	conf.HideDeleteAllButton = config.HideDeleteAllButton
+	conf.Body.SpamAssassin = config.EnableSpamAssassin != ""
+	conf.Body.ChaosEnabled = chaos.Enabled
+	conf.Body.DuplicatesIgnored = config.IgnoreDuplicateIDs
+	conf.Body.HideDeleteAllButton = config.HideDeleteAllButton
 
 	w.Header().Add("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(conf); err != nil {
+	if err := json.NewEncoder(w).Encode(conf.Body); err != nil {
 		httpError(w, err.Error())
 	}
 }

server/apiv1/chaos.go

@@ -7,18 +7,6 @@ import (
 	"github.com/axllent/mailpit/internal/smtpd/chaos"
 )
 
-// ChaosTriggers are the Chaos triggers
-type ChaosTriggers chaos.Triggers
-
-// Response for the Chaos triggers configuration
-// swagger:response ChaosResponse
-type chaosResponse struct {
-	// The current Chaos triggers
-	//
-	// in: body
-	Body ChaosTriggers
-}
-
 // GetChaos returns the current Chaos triggers
 func GetChaos(w http.ResponseWriter, _ *http.Request) {
 	// swagger:route GET /api/v1/chaos testing getChaos
@@ -50,12 +38,6 @@ func GetChaos(w http.ResponseWriter, _ *http.Request) {
 	}
 }
 
-// swagger:parameters setChaosParams
-type setChaosParams struct {
-	// in: body
-	Body ChaosTriggers
-}
-
 // SetChaos sets the Chaos configuration.
 func SetChaos(w http.ResponseWriter, r *http.Request) {
 	// swagger:route PUT /api/v1/chaos testing setChaosParams

server/apiv1/message.go

@@ -6,20 +6,11 @@ import (
 	"fmt"
 	"net/http"
 	"net/mail"
+	"net/url"
 
 	"github.com/axllent/mailpit/internal/storage"
-	"github.com/gorilla/mux"
 )
 
-// swagger:parameters GetMessageParams
-type getMessageParams struct {
-	// Message database ID or "latest"
-	//
-	// in: path
-	// required: true
-	ID string
-}
-
 // GetMessage (method: GET) returns the Message as JSON
 func GetMessage(w http.ResponseWriter, r *http.Request) {
 	// swagger:route GET /api/v1/message/{ID} message GetMessageParams
@@ -40,16 +31,14 @@ func GetMessage(w http.ResponseWriter, r *http.Request) {
 	//    400: ErrorResponse
 	//    404: NotFoundResponse
 
-	vars := mux.Vars(r)
-
-	id := vars["id"]
+	id := r.PathValue("id")
 
 	if id == "latest" {
 		var err error
 		id, err = storage.LatestID(r)
 		if err != nil {
 			w.WriteHeader(404)
-			fmt.Fprint(w, err.Error())
+			_, _ = fmt.Fprint(w, err.Error())
 			return
 		}
 	}
@@ -66,19 +55,6 @@ func GetMessage(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// swagger:parameters GetHeadersParams
-type getHeadersParams struct {
-	// Message database ID or "latest"
-	//
-	// in: path
-	// required: true
-	ID string
-}
-
-// Message headers
-// swagger:model MessageHeadersResponse
-type messageHeaders map[string][]string
-
 // GetHeaders (method: GET) returns the message headers as JSON
 func GetHeaders(w http.ResponseWriter, r *http.Request) {
 	// swagger:route GET /api/v1/message/{ID}/headers message GetHeadersParams
@@ -99,16 +75,14 @@ func GetHeaders(w http.ResponseWriter, r *http.Request) {
 	//    400: ErrorResponse
 	//    404: NotFoundResponse
 
-	vars := mux.Vars(r)
-
-	id := vars["id"]
+	id := r.PathValue("id")
 
 	if id == "latest" {
 		var err error
 		id, err = storage.LatestID(r)
 		if err != nil {
 			w.WriteHeader(404)
-			fmt.Fprint(w, err.Error())
+			_, _ = fmt.Fprint(w, err.Error())
 			return
 		}
 	}
@@ -132,21 +106,6 @@ func GetHeaders(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// swagger:parameters AttachmentParams
-type attachmentParams struct {
-	// Message database ID or "latest"
-	//
-	// in: path
-	// required: true
-	ID string
-
-	// Attachment part ID
-	//
-	// in: path
-	// required: true
-	PartID string
-}
-
 // DownloadAttachment (method: GET) returns the attachment data
 func DownloadAttachment(w http.ResponseWriter, r *http.Request) {
 	// swagger:route GET /api/v1/message/{ID}/part/{PartID} message AttachmentParams
@@ -169,17 +128,15 @@ func DownloadAttachment(w http.ResponseWriter, r *http.Request) {
 	//    400: ErrorResponse
 	//    404: NotFoundResponse
 
-	vars := mux.Vars(r)
-
-	id := vars["id"]
-	partID := vars["partID"]
+	id := r.PathValue("id")
+	partID := r.PathValue("partID")
 
 	if id == "latest" {
 		var err error
 		id, err = storage.LatestID(r)
 		if err != nil {
 			w.WriteHeader(404)
-			fmt.Fprint(w, err.Error())
+			_, _ = fmt.Fprint(w, err.Error())
 			return
 		}
 	}
@@ -195,19 +152,10 @@ func DownloadAttachment(w http.ResponseWriter, r *http.Request) {
 	}
 
 	w.Header().Add("Content-Type", a.ContentType)
-	w.Header().Set("Content-Disposition", "filename=\""+fileName+"\"")
+	w.Header().Set("Content-Disposition", "inline; filename=\""+url.PathEscape(fileName)+"\"")
 	_, _ = w.Write(a.Content)
 }
 
-// swagger:parameters DownloadRawParams
-type downloadRawParams struct {
-	// Message database ID or "latest"
-	//
-	// in: path
-	// required: true
-	ID string
-}
-
 // DownloadRaw (method: GET) returns the full email source as plain text
 func DownloadRaw(w http.ResponseWriter, r *http.Request) {
 	// swagger:route GET /api/v1/message/{ID}/raw message DownloadRawParams
@@ -228,9 +176,7 @@ func DownloadRaw(w http.ResponseWriter, r *http.Request) {
 	//    400: ErrorResponse
 	//    404: NotFoundResponse
 
-	vars := mux.Vars(r)
-
-	id := vars["id"]
+	id := r.PathValue("id")
 	dl := r.FormValue("dl")
 
 	if id == "latest" {
@@ -238,7 +184,7 @@ func DownloadRaw(w http.ResponseWriter, r *http.Request) {
 		id, err = storage.LatestID(r)
 		if err != nil {
 			w.WriteHeader(404)
-			fmt.Fprint(w, err.Error())
+			_, _ = fmt.Fprint(w, err.Error())
 			return
 		}
 	}

server/apiv1/messages.go

@@ -6,37 +6,9 @@ import (
 	"strings"
 
 	"github.com/axllent/mailpit/internal/storage"
+	"github.com/axllent/mailpit/internal/tools"
 )
 
-// swagger:parameters GetMessagesParams
-type getMessagesParams struct {
-	// Pagination offset
-	//
-	// in: query
-	// name: start
-	// required: false
-	// default: 0
-	// type: integer
-	Start int `json:"start"`
-
-	// Limit number of results
-	//
-	// in: query
-	// name: limit
-	// required: false
-	// default: 50
-	// type: integer
-	Limit int `json:"limit"`
-}
-
-// Summary of messages
-// swagger:response MessagesSummaryResponse
-type messagesSummaryResponse struct {
-	// The messages summary
-	// in: body
-	Body MessagesSummary
-}
-
 // MessagesSummary is a summary of a list of messages
 type MessagesSummary struct {
 	// Total number of messages in mailbox
@@ -111,39 +83,6 @@ func GetMessages(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// swagger:parameters SetReadStatusParams
-type setReadStatusParams struct {
-	// in: body
-	Body struct {
-		// Read status
-		//
-		// required: false
-		// default: false
-		// example: true
-		Read bool
-
-		// Optional array of message database IDs
-		//
-		// required: false
-		// default: []
-		// example: ["4oRBnPtCXgAqZniRhzLNmS", "hXayS6wnCgNnt6aFTvmOF6"]
-		IDs []string
-
-		// Optional messages matching a search
-		//
-		// required: false
-		// example: tag:backups
-		Search string
-	}
-
-	// Optional [timezone identifier](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) used only for `before:` & `after:` searches (eg: "Pacific/Auckland").
-	//
-	// in: query
-	// required: false
-	// type string
-	TZ string `json:"tz"`
-}
-
 // SetReadStatus (method: PUT) will update the status to Read/Unread for all provided IDs.
 func SetReadStatus(w http.ResponseWriter, r *http.Request) {
 	// swagger:route PUT /api/v1/messages messages SetReadStatusParams
@@ -225,19 +164,6 @@ func SetReadStatus(w http.ResponseWriter, r *http.Request) {
 	_, _ = w.Write([]byte("ok"))
 }
 
-// swagger:parameters DeleteMessagesParams
-type deleteMessagesParams struct {
-	// Delete request
-	// in: body
-	Body struct {
-		// Array of message database IDs
-		//
-		// required: false
-		// example: ["4oRBnPtCXgAqZniRhzLNmS", "hXayS6wnCgNnt6aFTvmOF6"]
-		IDs []string
-	}
-}
-
 // DeleteMessages (method: DELETE) deletes all messages matching IDS.
 func DeleteMessages(w http.ResponseWriter, r *http.Request) {
 	// swagger:route DELETE /api/v1/messages messages DeleteMessagesParams
@@ -279,39 +205,6 @@ func DeleteMessages(w http.ResponseWriter, r *http.Request) {
 	_, _ = w.Write([]byte("ok"))
 }
 
-// swagger:parameters SearchParams
-type searchParams struct {
-	// Search query
-	//
-	// in: query
-	// required: true
-	// type: string
-	Query string `json:"query"`
-
-	// Pagination offset
-	//
-	// in: query
-	// required: false
-	// default: 0
-	// type integer
-	Start string `json:"start"`
-
-	// Limit results
-	//
-	// in: query
-	// required: false
-	// default: 50
-	// type integer
-	Limit string `json:"limit"`
-
-	// Optional [timezone identifier](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) used only for `before:` & `after:` searches (eg: "Pacific/Auckland").
-	//
-	// in: query
-	// required: false
-	// type string
-	TZ string `json:"tz"`
-}
-
 // Search returns the latest messages as JSON
 func Search(w http.ResponseWriter, r *http.Request) {
 	// swagger:route GET /api/v1/search messages SearchParams
@@ -349,9 +242,9 @@ func Search(w http.ResponseWriter, r *http.Request) {
 
 	res.Start = start
 	res.Messages = messages
-	res.Count = uint64(len(messages)) // legacy - now undocumented in API specs
-	res.Total = stats.Total           // total messages in mailbox
-	res.MessagesCount = uint64(results)
+	res.Count = tools.SafeUint64(len(messages)) // legacy - now undocumented in API specs
+	res.Total = stats.Total                     // total messages in mailbox
+	res.MessagesCount = tools.SafeUint64(results)
 	res.Unread = stats.Unread
 	res.Tags = stats.Tags
 
@@ -361,7 +254,7 @@ func Search(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	res.MessagesUnreadCount = uint64(unread)
+	res.MessagesUnreadCount = tools.SafeUint64(unread)
 
 	w.Header().Add("Content-Type", "application/json")
 	if err := json.NewEncoder(w).Encode(res); err != nil {
@@ -369,23 +262,6 @@ func Search(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// swagger:parameters DeleteSearchParams
-type deleteSearchParams struct {
-	// Search query
-	//
-	// in: query
-	// required: true
-	// type: string
-	Query string `json:"query"`
-
-	// [Timezone identifier](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) used only for `before:` & `after:` searches (eg: "Pacific/Auckland").
-	//
-	// in: query
-	// required: false
-	// type string
-	TZ string `json:"tz"`
-}
-
 // DeleteSearch will delete all messages matching a search
 func DeleteSearch(w http.ResponseWriter, r *http.Request) {
 	// swagger:route DELETE /api/v1/search messages DeleteSearchParams