v1.20.0

This release introduces a new side navigation message listing when viewing messages, allowing you to see other messages in the mailbox or current search and easily navigate between them without needing to co back to the inbox first.

As part of this feature, messages status changes (read/unread/deleted/tags) are now also synchronised to all connected browsers (provided you have websockets working).

Another new feature is the option to auto-delete messages based on age (--max-age / MP_MAX_AGE). This can be used together with, or in addition to, the existing --max / MP_MAX_MESSAGES option. See documentation.

Feature

• UI: List messages in side nav when viewing message for easy navigation (#336)
• Add option to control message retention by age (#338)

Chore

• Update caniemail database
• Update Go dependencies
• Update node dependencies
• Make internal tagging methods private

Fix

• Prevent potential JavaScript errors caused by race condition
• Better regexp to detect tags in search
• Prevent Vue race condition to initialize dayjs relativeTime plugin
• API: Return text/plain header for message delete request

v1.19.3

This release includes an important security fix, so upgrading is strongly recommended.

A vulnerability was discovered which allowed a bad actor with SMTP access to Mailpit to bypass the Content Security Policy headers using a series of crafted HTML messages which could result in a stored XSS attack via the web UI. A special thanks to @bmodotdev for responsibly disclosing the vulnerability, proving information and an draft fix. Additional preventative measures have also been added (see below).

• The CSP headers have been hardened and require a valid nonce ID to run. This will make it impossible to inject any other local JavaScript files (remote & inline JavaScript was already blocked).
• All message HTML is now sanitized via DOMPurify before rendering in the preview. This will remove all unsupported elements such as<script> & <iframe> (which aren't allowed to run anyway), and make the HTML even safer. There has had significant testing to try ensure regular message previews do not break as a result, but should you experience issues then please report these via the issue tracker.

Changelog

Fix

• Security: Prevent bypass of Contend Security Policy using stored XSS, and sanitize preview HTML data (DOMPurify)

Chore

• Update Go dependencies
• Display nicer <noscript> message when JavaScript is disabled

v1.19.2

Fix

• Update Inbox "Delete All" count when new messages are detected (#334)

Chore

• Update Go dependencies

v1.19.1

Feature

• Add optional relay recipient blocklist (#333)

Chore

• Update Go dependencies
• Equal column widths in About modal
• Bump esbuild to version 0.23.0
• Bump docker/build-push-action from 5 to 6 (#327)

v1.19.0

Feature

• Add ability to rename and delete tags globally
• Add option to disable auto-tagging for plus-addresses & X-Tags (#323)

Chore

• Update node dependencies
• Update Go dependencies

v1.18.7

Feature

• Add optional label to identify Mailpit instance (#316)

Chore

• Refactor JavaScript, use arrow functions instead of "self" aliasing
• Handle websocket errors caused by persistent connection failures (#319)

Testing

• Add POP3 integration tests

v1.18.6

Chore

• Delete multiple POP3 messages in single action
• Handle POP3 RSET command
• Update caniemail database
• Update node dependencies
• Update Go dependencies

Fix

• POP3 end of file reached error (#315)
• POP3 size output to show compatible sizes (#312)

v1.18.5

Feature

• Add pagination & limits to URL parameters (#303)

Chore

• Update node dependencies
• Update Go dependencies

v1.18.4

This is a maintenance release to update some Go & JavaScript dependencies (no notable changes), as well as clone new Docker images to ghcr.io. Docker Hub remains the official Docker repository.

Chore

• Update node dependencies
• Update Go dependencies
• Clone new Docker images to ghcr.io (#302)

v1.18.3

Feature

• iCalendar (ICS) viewer (#298) - clicking on an *.ics attachment will now open a basic summary view.

Fix

• Add dot stuffing for POP3 (#300)

Chore

• Update Go dependencies
• Update node dependencies