This release includes a security fix, so upgrading is strongly recommended.

A vulnerability was fixed which allowed animated image attachments (APNG, GIF, WebP) to bypass the thumbnail pixel budget, potentially causing multi-gigabyte memory allocation when the thumbnail was rendered.

Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security.

Security

• Bound thumbnail decode to single frame (GHSA-2vgv-6hcp-mf43)

Feature

• Add major version tag for Docker images in workflow (#734)

Chore

• Improve message rendering performance with envelope caching • Update Go dependencies • Update node dependencies • Update caniemail test database

Fix

• Re-quote local-parts in API JSON responses (#732)