Ralph Slooten 10ad4df8cc Security: Prevent Server-Side Request Forgery (SSRF) via Link Check API ([GHSA-mpf7-p9x7-96r3](https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3)) ...

By default all internal HTTP requests are now blocked, unless mailpit is started with the `--allow-internal-http-requests` flag (env  `MP_ALLOW_INTERNAL_HTTP_REQUESTS=true`).

2026-02-24 14:22:02 +13:00

..

apiv1

Fix: Avoid error on image type assertion in thumbnail generation

2026-01-25 10:05:39 +13:00

handlers

Security: Prevent Server-Side Request Forgery (SSRF) via Link Check API ([GHSA-mpf7-p9x7-96r3](https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3))

2026-02-24 14:22:02 +13:00

ui

Feature: Include message attachment checksums (MD5, SHA1 & SHA254) in API message summary

2026-02-01 15:34:05 +13:00

ui-src

Use const instead of let

2026-02-21 22:43:51 +13:00

webhook

Chore: Add support for webhook delay (#627)

2026-02-01 15:33:54 +13:00

websockets

Fix spelling

2026-02-08 11:17:17 +13:00

cors_test.go

Test: Add CORS tests

2026-02-01 15:33:53 +13:00

cors.go

Chore: Add CORS error logging and update error messages for failed CORS requests

2026-02-08 11:19:54 +13:00

embed.go

Fix: Include font/woff content type to embedded controller

2025-02-13 22:16:46 +13:00

server_test.go

Code cleanup

2026-02-01 15:58:31 +13:00

server.go

Chore: Add CORS error logging and update error messages for failed CORS requests

2026-02-08 11:19:54 +13:00