This release includes a security fix, so upgrading is strongly recommended.
A vulnerability was fixed which allowed animated image attachments (APNG, GIF, WebP) to bypass the thumbnail pixel budget, potentially causing multi-gigabyte memory allocation when the thumbnail was rendered.
Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security.
Security
- Bound thumbnail decode to single frame (GHSA-2vgv-6hcp-mf43)
Feature
- Add major version tag for Docker images in workflow (#734)
Chore
- Improve message rendering performance with envelope caching
- Update Go dependencies
- Update node dependencies
- Update caniemail test database
Fix
- Re-quote local-parts in API JSON responses (#732)