69 changes from 10 contributors (4 new contributors). 64 files were affected.

What's Changed

New features

• feat(frontend/backend): reat/web based configurations by @Shadow243 in #2100
• feat(frontend): add amp4email handling by @josaphatim in #2117

Bug fixes

• fix(module/smtp): add the missing blank line and closing boundary when sending html message by @camilevahviraki in #2119
• fix(module/saved_searches): load a saved advanced search on direct page load by @exSnake in #2127
• fix(module/nux): accept upper-case booleans in the CSV account import by @exSnake in #2129
• fix(backend): server config corruption when DEFAULT_SETTING_NO_PASSWORD_SAVE is enabled by @chiliec in #2124
• fix(other): php deprecation when the cookie domain is resolved without X-Forwarded-Host by @IrAlfred in #2139
• fix(module/imap): don't show the attachment icon for the $HasNoAttachment keyword by @Masad791 in #2135
• fix(other): preserve profile selection and attachments on send failure by @IrAlfred in #1832
• fix(other): restrict base, object, frame, and form targets in CSP by @IrAlfred in #2138
• fix(other): allow the HTTP test site in Chrome 157 by @IrAlfred in #2142
• fix(module/brute_force): tighten login attempt handling by @IrAlfred in #2140
• fix(module/2fa): halt the request from the second-factor check by @IrAlfred in #2141

Documentation

• docs(other): improve README structure and content by @kambereBr in #2116

Maintenance & Infrastructure

• fix(release): point docker compose to latest Cypht release 2.13.0 by @IrAlfred in #2125
• fix(release): update version reference to 2.13.1 for upcoming release by @IrAlfred in #2143
• fix(release): update version reference to 2.14.0 for upcoming release by @IrAlfred in #2146
• fix(release): merge all master commits to 2.x for new release 2.14.0 by @IrAlfred in #2147

Dependancy Updates

• build(deps): bump certifi from 2024.7.4 to 2026.10.19 in /tests/selenium by @dependabot[bot] in #2131
• build(deps): bump symfony/yaml from 6.4.40 to 6.4.45 by @dependabot[bot] in #2137

Tests & Quality Assurance

• ci(workflow): add PHP 8.3, 8.4 and 8.5 to test matrix by @penniger in #1975

New Contributors

• @exSnake made their first contribution in #2127
• @chiliec made their first contribution in #2124
• @penniger made their first contribution in #1975
• @Masad791 made their first contribution in #2135

Full Changelog: v2.13.0...v2.14.0

Security fixes only

• fix(module/brute_force): tighten login attempt handling by @IrAlfred in #2140
• fix(module/2fa): halt the request from the second-factor check by @IrAlfred in #2141

We greatly appreciate Wenhao Wu (Southeast University) and S31ZUR3 for identifying and reporting the security concerns addressed in this release. Thank you for your collaboration and commitment!

Full Changelog: v2.13.0...v2.13.1

136 changes from 13 contributors (5 new contributors). 95 files were affected.

What's Changed

New features

• feat(backend): add configurable socket timeout for IMAP connections by @Shadow243 in #2097
• feat(backend): add TLS options for MySQL/MariaDB connections by @iiroak in #2103
• feat(other): log extra information for failed authentication by @IrAlfred in #2113

Bug fixes

• fix(backend): check select_mailbox() result in get_mailbox_page() by @HomoMachinaNeuralis in #2061
• fix(module/smtp): prevent path traversal in chunked attachment upload by @IrAlfred in #2059
• fix(module/tags): scope tag removal and lookup to the message's server and folder by @kirinriki7777-sys in #2068
• fix(module/contacts): escape From header values in add-contact popup by @IrAlfred in #2072
• fix(module/core): stop deserializing logout back_query by @IrAlfred in #2073
• fix(frontend): restore missing icon on the admin Accounts menu item by @IrAlfred in #2082
• fix(backend): guard undefined $latestVersion in upgrade checker by @IrAlfred in #2081
• fix(module/account): restyle accounts page and confirm before deleting users by @IrAlfred in #2083
• fix(module/tags): add-label dialog fails when no labels exist by @IrAlfred in #2092
• fix(backend): exclude CSS for JS libs excluded via 'JS_EXCLUDE_DEPS' config by @mercihabam in #2099
• fix(module/smtp): scope attachment chunks to the current user by @IrAlfred in #2088
• fix(frontend): add missing bootstrap icons to servers and account headers for visual consistency by @ashanzzz in #2110
• fix(backend): keep the session when the origin carries a port the target lost by @kirinriki7777-sys in #2101
• fix(module/core): render the blocked external image notice as text by @IrAlfred in #2118
• fix(module/smtp): render compose recipient bubbles as text by @IrAlfred in #2120

Translation

• feat(frontend): added a Kinyarwanda Translation File (rw.php) with Accurate Kinyarwanda Translation by @HamedProDev in #2090
• chore(other): update zh-Hans Simplified Chinese translation by @PeterDaveHello in #2057
• chore(other): update and improve zh-TW translation by @PeterDaveHello in #2058

Documentation

• docs(other): add security policy for private vulnerability reports by @IrAlfred in #2087
• chore(docs): write clearer, more descriptive module READMEs by @mercihabam in #2089
• chore(docs): track policies that the source code is based on in a machine-readable format by @mercihabam in #2095

Maintenance & Infrastructure

• fix(release): point docker compose to latest Cypht release 2.12.0 by @IrAlfred in #2056
• docs(docker): switch to php 8.3 for docker version by @camilevahviraki in #2020
• fix(release): update version reference to 2.12.1 for upcoming release by @IrAlfred in #2065
• fix(release): point docker compose to latest Cypht release 2.12.1 by @IrAlfred in #2069
• fix(release): update version reference to 2.12.2 for upcoming release by @IrAlfred in #2078
• fix(release): point docker compose to latest Cypht release 2.12.2 by @IrAlfred in #2079
• fix(other): stop building linux/arm/v6 which php:8.3-fpm-bookworm does not support by @IrAlfred in #2080
• fix(release): temporary fix for php-sieve-manager github issue by @kroky in #2093
• fix(release): update version reference to 2.13.0 for upcoming release by @IrAlfred in #2121
• feat(release): merge all master commits to 2.x for new release 2.13.0 by @IrAlfred in #2123

Dependancy Updates

• build(deps): bump guzzlehttp/guzzle from 7.15.1 to 7.15.2 by @dependabot[bot] in #2060
• build(deps): bump league/commonmark from 2.8.2 to 2.9.0 by @dependabot[bot] in #2062
• build(deps): bump league/commonmark from 2.9.0 to 2.10.0 by @dependabot[bot] in #2084
• build(deps): bump league/commonmark from 2.10.0 to 2.10.2 by @dependabot[bot] in #2111
• build(deps): bump urllib3 from 2.7.0 to 2.8.0 in /tests/selenium by @dependabot[bot] in #2112
• build(deps): bump zbateson/mail-mime-parser from 3.0.5 to 3.0.6 by @dependabot[bot] in #2106

Tests & Quality Assurance and refactoring

• refactor(module/core): enable addition of custom query string to all internal URLS by @mercihabam in #2064
• refactor(frontend/backend): add single data sources to specific combined views by @josaphatim in #1998
• refactor(frontend/backend): make it possible to customize ajax request caller with custom endpoint and extra static request data by @mercihabam in #2086
• refactor(backend): resolve VENDOR_PATH dynamically based on installation layout by @mercihabam in #2070

New Contributors

• @HomoMachinaNeuralis made their first contribution in #2061
• @kirinriki7777-sys made their first contribution in #2068
• @HamedProDev made their first contribution in #2090
• @iiroak made their first contribution in #2103
• @ashanzzz made their first contribution in #2110

Full Changelog: v2.12.0...v2.13.0

Security fixes only

• fix(module/contacts): escape From header values in add-contact popup by @IrAlfred in #2072
• fix(module/core): stop deserializing logout back_query by @IrAlfred in #2073

We greatly appreciate Adam Młynarczyk for identifying and reporting the security concerns addressed in this release. Thank you for your collaboration and commitment!

Full Changelog: v2.12.1...v2.12.2

Security fixes only

• fix(module/smtp): prevent path traversal in chunked attachment upload by @IrAlfred in #2059

We greatly appreciate Haseeb for identifying and reporting the security concerns addressed in this release. Thank you for your collaboration and commitment!

Full Changelog: v2.12.0...v2.12.1

Changes from 1 contributor. 3 files were affected.

What's Changed

• fix(module/smtp): prevent path traversal in chunked attachment upload in 1.4.x by @IrAlfred in #2066

We greatly appreciate Haseeb for identifying and reporting the security concerns addressed in this release. Thank you for your collaboration and commitment!

Full Changelog: v1.4.8...v1.4.9

82 changes from 8 contributors (1 new contributor). 68 files were affected.

What's Changed

New features

• feat(frontend/backend): enhance Tags module with colors, refactor, and improved test coverage by @Shadow243 in #2030

Bug fixes

• fix(other): profile tests and make server_stmp_and_imap_add work correclty with a real smtp & imap server by @Shadow243 in #1553
• fix(module/imap): improve MSTNEF attachment parsing safety and temp file handling by @mercihabam in #2027
• fix(module/imap): send IMAP ID when X-CM-EXT-1 is advertised by @ThouGyeongcho in #2029
• fix(frontend): mobile css tweaks for several sections by @pom2ter in #2034
• fix(backend): remove redundant post-package-install script by @Shadow243 in #2039
• fix(frontend): invalidate message page cache after rebuild by @camilevahviraki in #2041
• fix(other): update readme inbox screenshot by @Baraka24 in #2042
• fix(other): disable reply all when only recipient is current user by @camilevahviraki in #1935
• fix(module/feeds): block SSRF to private and internal feed URLs by @IrAlfred in #2024
• fix(other): fix proxy-related login loop and cookie domain mismatch by @IrAlfred in #2045
• fix(docker): fix Docker UI when ENABLE_DEBUG is enabled by @IrAlfred in #2046

Maintenance & Infrastructure

• fix(other): point docker compose to latest Cypht release 2.11.0 by @IrAlfred in #2025
• fix(release): update version reference to 2.11.1 for upcoming release by @IrAlfred in #2035
• fix(release): point docker compose to latest Cypht release 2.11.1 by @IrAlfred in #2036
• fix(release): update version reference to 2.11.2 for upcoming release by @IrAlfred in #2047
• fix(release): point docker compose to latest Cypht release 2.11.2 by @IrAlfred in #2048
• fix(release): update version reference to 2.12.0 for upcoming release by @IrAlfred in #2053

Dependency Updates

• build(deps): bump guzzlehttp/psr7 from 2.12.1 to 2.13.0 by @dependabot[bot] in #2050
• build(deps): bump guzzlehttp/guzzle from 7.12.1 to 7.15.1 by @dependabot[bot] in #2044

Tests & Quality Assurance

• fix(unit): add 240+ tests across sievefilters, lib and core modules to improve coverage by @Shadow243 in #2026
• fix(unit): fix PHPUnit warnings and PHP 8.4 deprecations in test suite by @IrAlfred in #2031

New Contributors

• @ThouGyeongcho made their first contribution in #2029

Full Changelog: v2.11.0...v2.12.0

4 changes from 2 contributors (0 new contributor). 3 files were affected.

What's Changed

• fix(frontend): advanced search next/prev links by @josaphatim in #1950
• fix(module/feeds): block SSRF to private and internal feed URLs in 1.4.x by @IrAlfred in #2049

We greatly appreciate Sanjorn Keeratirungsan (HackerOne) for identifying and reporting the security concerns addressed in this release. Thank you for your collaboration and commitment!

Full Changelog: v1.4.7...v1.4.8

Security fixes only

• fix(module/feeds): block SSRF to private and internal feed URLs by @IrAlfred in #2024

We greatly appreciate Sanjorn Keeratirungsan (HackerOne) for identifying and reporting the security concerns addressed in this release. Thank you for your collaboration and commitment!

Full Changelog: v2.11.1...v2.11.2

Security fixes only

• fix(module/imap): improve MSTNEF attachment parsing safety and temp file handling by @mercihabam in #2027

We greatly appreciate Ki1ro for identifying and reporting the security concerns addressed in this release. Thank you for your collaboration and commitment!

Full Changelog: v2.11.0...v2.11.1