Ralph Slooten 6f1f4f34c9 Security: Prevent Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data [CVE-2026-22689](https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm)

2026-01-10 15:42:14 +13:00

..

apiv1

Chore: Add type assertion for value in imaging assignment

2025-11-09 11:33:51 +13:00

handlers

Security: Restrict screenshot proxy to only support asset links contained in messages [CVE-2026-21859](https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr)

2026-01-06 15:33:50 +13:00

ui

Chore: Refactor API Swagger definitions and remove unused structs

2025-06-22 15:25:22 +12:00

ui-src

Delay bootstrap-tags init until after render

2026-01-08 16:23:24 +13:00

webhook

Chore: Refactor error handling and resource management across multiple files (golangci-lint)

2025-06-22 15:25:21 +12:00

websockets

Security: Prevent Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data [CVE-2026-22689](https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm)

2026-01-10 15:42:14 +13:00

embed.go

Fix: Include font/woff content type to embedded controller

2025-02-13 22:16:46 +13:00

server_test.go

Chore: Refactor API Swagger definitions and remove unused structs

2025-06-22 15:25:22 +12:00

server.go

Fix: Prevent potential information disclosure via indirect expvar library (Prometheus)

2025-10-08 17:32:05 +13:00