- warn about deliverability before a large send
- warn about deliverability before a large send
3.124.0-beta.0 (2026-09-05)
Features
- newsletters: warn about deliverability before a large send (0536c86)
- newsletters: warn about deliverability before a large send (49197be)
Bug Fixes
- gallery: give the Grid layout a lazy-loading pre-load band (#1287) (b1e5287)
- gallery: image-loading follow-ups — pre-load band, decode release, sanitizer dedup (905fc59)
- gallery: release the canvas decode when it is drawn, not at unmount (fbe9757), closes #1287
- gallery: release the canvas-mode decode, and drop a now-duplicate sanitizer (be8d79e)
- gallery: remove the inert image-protection prop surface from AuthenticatedImage (1f316ef)
- gallery: remove the inert image-protection prop surface from AuthenticatedImage (e734e41), closes #1297
- newsletters: make the warning's duration and queue claim honest (7b4a65e)
- remove the image-fragmentation surface (ae23b1a)
- remove the image-fragmentation surface (967224c)
- security: apply image-security defaults on every creation path (ab6c33d), closes #1296
- security: apply the Image-security defaults instead of storing them (#1296) (2e9bd54)
- security: apply the Image-security defaults instead of storing them (#1296) (8ca3610)
- security: check for an escaped identifier before consuming the escape (b6dc099), closes #1264
- security: close the remaining image-security default gaps (19c518a), closes #1296
- security: close two CSS url() bypasses the sanitizer dedup exposed (1cf8274)
- security: decode settings at the API boundary and honour the transaction (0e560eb), closes #1296
- security: one settings decoder, and the last creation path (0deef25), closes #1296
- security: re-check inline CSS after template substitution (027afb6), closes #1264
- security: reject array values for every field on the event update (933f2d8), closes #1296
- security: reject array values on the event update route too (8f3436f), closes #1296
- security: strip control characters before scanning CSS for url() (99f54a3), closes #1264
- security: use CSS whitespace, not JavaScript's, in the url() reader (4196e83), closes #1264
- security: validate CSS urls last, after every pass that moves text (1151e96), closes #1264