Mailpit 1.32.0

What's new in 1.32.0

This release includes security fixes, so upgrading is strongly recommended.
A maliciously crafted image attached to an email could make the thumbnail generator (used by the web UI and API) spin in an infinite loop. The exif reader has been replaced with a minimal in-tree EXIF orientation reader that only reads the first block and never follows pointers.

This release also strips <base> and meta refresh tags from /view/{ID}.html output, and limits concurrent HTTP, SMTP and POP3 connections to 1000 each.

Due to timing, these security fixes have released together with new UI features in this release.

Security

• Replace goexif with minimal EXIF orientation reader (GHSA-379p-g4f4-hq5h)
• Strip base and meta refresh tags from /view/{ID}.html output
• Limit concurrent SMTP, POP3 and HTTP connections to 1000 each

Feature

• Autocomplete search suggestions and history (#745)
• Open received email when clicking a browser notification (#747)

Chore

• Add composite index on message_tags (ID, TagID) to keep inserts fast as the mailbox grows (#750)
• Reject EXIF IFD0 offsets that overlap the TIFF header
• Update Go dependencies
• Update node dependencies

Fix

• Resolve data races in mailbox stats broadcast, logger init and SMTP MaxRecipients

Test

• Add JS tests for search suggestions and HTML sanitising
• Add e2e Playwright UI testing
• Add maximal APP1 and fill-byte cases for EXIF orientation reader

Full release notes »