wneessen/go-mail v0.8.2

on GitHub

Welcome to go-mail v0.8.2! 🎉

This release fixes two vulnerabilities and brings some additional bugfixes and improvements.

Notable features / improvements / fixes

Fixes for two vulnerabilities

• Unchecked out of bounds read in EML parser can cause panic (GHSA-f82v-42xw-72cj)
  Reported by @4n86rakam1 and @lml20000827
  Affected versions: >= v0.4.2
• Unfiltered List-Unsubscribe helper function can lead to CRLF header injection (GHSA-w8w6-94hg-2qpm)
  Reported by: @4n86rakam1, @NotAFlightRisk, @Hama1cco and @lml20000827
  Affected version: v0.8.1

Both vulnerabilities were reported independently in the same timeframe by different reporters and have been merged into two dedicated security advisories. Thanks to everbody who helped improving go-mail's security.

CVEs for both vulnerabilities have been requested, but so far GH has not reacted. In case CVEs are issued by GH, these will be added once received.

Version bump minimal required Go version

PR #645 bumps the minimal required Go version to 1.26.10 to mitigate CVE-2026-111943. Given the severity of the CVE, this makes sure no MitM is possible when talking to TLS secured servers.

Connection closing fixes

PRs #633, #634 and #653 fix issues in the SMTP connection opening and closing logic that could lead to potential process leaking in some edge cases. Thanks to @riabkovK, @mai7star and @bensynapse for reporting the issues and also providing the corresponding PRs.

Client connection without EHLO

PR #641 adds a new configuration flag (WithoutEhlo) that allows the client to skip the initial EHLO attempt when dialing, and only include the HELO call, for when we're certain that the server does not support EHLO (and might misbehave when receiving an unknown command). Thanks to @Neelo16 for providing the PR.

Encode non-ASCII attachment filenames as RFC 2231 extended parameters

PR #605 fixes the encoding of non-ASCII attachment and embed filenames which were written as RFC 2047 encoded-words inside the quoted parameter (which is explicitly forbidden by RFC 2047 section 5). Thanks to @binggao1230 for submitting the PR.

Fixes to formatted mail address handling

PR #657 fixes the formatted address handling in all *Format() functions. Previously addresses that were supposed to be quoted, were not quoted correctly. e. g. Robert "Bob" Tester as name would have resulted in "Robert Bob Tester". With the fix, the name is quoted correctly into "Robert \"Bob\" Tester". Thanks to @wleeaf for reporting the issue and providing a suggested fix PR, which has partly been incoorporated into #657.

Fixes to IPv6 dial address handling

PR #661 fixes the Client dial address handling, that would fail on IPv6 literal hosts. Thanks to @Narek-Khachikyan for submitting the PR.

What's Changed

• Updated Go module dependencies and Go version by @wneessen in #619
• Refactored msgwriter_test.go by @wneessen in #620
• Updated dependencies in go.mod and go.sum by @wneessen in #644
• Go version bump by @wneessen in #645
• churn(upstream): Updated EHLO parsing logic by @wneessen in #646
• Fix tests failing on specific build configurations by @Neelo16 in #639
• fix: close the dialed connection when DialToSMTPClientWithContext fails by @riabkovK in #633
• Close SMTP connections when QUIT fails by @bensynapse in #634
• Add skipEhlo flag by @Neelo16 in #641
• fix: close SMTP connection after QUIT failure by @mai7star in #653
• Encode non-ASCII attachment filenames as RFC 2231 extended parameters by @binggao1230 in #605
• bug(msgwriter_test): fix failing test by @wneessen in #655
• churn: cleanup by @wneessen in #656
• Use mail.Address in *Format address setters by @wneessen in #657
• Fix dial addresses for IPv6 SMTP hosts by @Narek-Khachikyan in #661

CI/CD maintenance changes

• Bump golang/govulncheck-action from 1.0.4 to 1.1.0 by @dependabot[bot] in #599
• Bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #600
• Bump github/codeql-action/analyze from 4.37.0 to 4.37.1 by @dependabot[bot] in #603
• Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot[bot] in #604
• Bump github/codeql-action/init from 4.37.0 to 4.37.1 by @dependabot[bot] in #602
• Bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 by @dependabot[bot] in #601
• Bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in #610
• Bump github/codeql-action/analyze from 4.37.1 to 4.37.3 by @dependabot[bot] in #609
• Bump github/codeql-action/autobuild from 4.37.1 to 4.37.3 by @dependabot[bot] in #608
• Bump github/codeql-action/init from 4.37.1 to 4.37.3 by @dependabot[bot] in #607
• Bump vmactions/freebsd-vm from 1.5.0 to 1.5.2 by @dependabot[bot] in #606
• Bump github/codeql-action/autobuild from 4.37.3 to 4.38.1 by @dependabot[bot] in #625
• Bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #624
• Bump github/codeql-action/init from 4.37.3 to 4.38.1 by @dependabot[bot] in #623
• Bump github/codeql-action/upload-sarif from 4.37.3 to 4.38.1 by @dependabot[bot] in #622
• Bump vmactions/freebsd-vm from 1.5.2 to 1.5.7 by @dependabot[bot] in #621
• Bump github/codeql-action/analyze from 4.37.3 to 4.38.2 by @dependabot[bot] in #631
• Bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 by @dependabot[bot] in #630
• Bump github/codeql-action/autobuild from 4.38.1 to 4.38.2 by @dependabot[bot] in #629
• Bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #628
• Bump step-security/harden-runner from 2.20.0 to 2.21.1 by @dependabot[bot] in #626
• Bump github/codeql-action/upload-sarif from 4.38.2 to 4.39.1 by @dependabot[bot] in #651
• Bump vmactions/freebsd-vm from 1.5.7 to 1.5.9 by @dependabot[bot] in #647
• Bump step-security/harden-runner from 2.21.1 to 2.22.2 by @dependabot[bot] in #648
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #650
• Bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #649
• Bump step-security/harden-runner from 2.22.2 to 2.22.3 by @dependabot[bot] in #654
• Bump github/codeql-action/upload-sarif from 4.39.1 to 4.39.2 by @dependabot[bot] in #659

New Contributors

• @Neelo16 made their first contribution in #639
• @riabkovK made their first contribution in #633
• @bensynapse made their first contribution in #634
• @mai7star made their first contribution in #653
• @binggao1230 made their first contribution in #605
• @wleeaf made their first contribution in #657
• @Narek-Khachikyan made their first contribution in #661

Full Changelog: v0.8.1...v0.8.2