Mailpit: ძველი ვერსიები და ყველა ვერსია

## This release includes security fixes, so upgrading is strongly recommended.
A maliciously crafted image attached to an email could make the thumbnail generator (used by the web UI and API) spin in an infinite loop. The exif reader has been replaced with a minimal in-tree EXIF orientation reader that only reads the first block and never follows pointers.

This release also strips `<base>` and meta refresh tags from `/view/{ID}.html` output, and limits concurrent HTTP, SMTP and POP3 connections to 1000 each.

Due to timing, these security fixes have released together with new UI features in this release.

### Security
• Replace goexif with minimal EXIF orientation reader ([GHSA-379p-g4f4-hq5h](https://github.com/axllent/mailpit/security/advisories/GHSA-379p-g4f4-hq5h))
• Strip base and meta refresh tags from /view/{ID}.html output
• Limit concurrent SMTP, POP3 and HTTP connections to 1000 each

### Feature
• Autocomplete search suggestions and history ([#745](https://github.com/axllent/mailpit/issues/745))
• Open received email when clicking a browser notification ([#747](https://github.com/axllent/mailpit/issues/747))

### Chore
• Add composite index on message_tags (ID, TagID) to keep inserts fast as the mailbox grows ([#750](https://github.com/axllent/mailpit/issues/750))
• Reject EXIF IFD0 offsets that overlap the TIFF header
• Update Go dependencies
• Update node dependencies

### Fix
• Resolve data races in mailbox stats broadcast, logger init and SMTP MaxRecipients

### Test
• Add JS tests for search suggestions and HTML sanitising
• Add e2e Playwright UI testing
• Add maximal APP1 and fill-byte cases for EXIF orientation reader

### Fix
• Remove expired envelope cache entries and clear them on auto-prune ([#748](https://github.com/axllent/mailpit/issues/748))

### Chore
• Add gosec #nosec annotations and set explicit Content-Type on error responses
• Update Go dependencies
• Update node dependencies

### Fix
• Escape `_` and `%` in search terms so they match literally ([#742](https://github.com/axllent/mailpit/issues/742))
• Match `&` and `\` in address searches ([#743](https://github.com/axllent/mailpit/issues/743))
• Validate AUTH parameter in MAIL FROM command ([#744](https://github.com/axllent/mailpit/issues/744))
• MAIL FROM parameters must be space-separated per RFC 5321

### Test
• Include additional tests for MAIL FROM parameters

### Fix
• Prevent duplicate messages from being added in websocket handlers ([#737](https://github.com/axllent/mailpit/issues/737))
• Set hostname for HELO/EHLO in SMTP client creation ([#738](https://github.com/axllent/mailpit/issues/738))

### Chore
• Update Go dependencies
• Update node dependencies
• Update GitHub Actions dependencies

### Chore
• Limit maximum MIME parts parsed per message to 500
• Refactor regex usage for string cleaning and normalization
• Optimize envelope parsing by using a shared parser instance
• Optimize message summary construction by eliminating JSON round-trip
• Replace bytes.ToLower with containsFold for case-insensitive tag matching
• Replace inline regex for leading whitespace with a package-level variable
• Symlink sendmail to Mailpit in Docker image ([#736](https://github.com/axllent/mailpit/issues/736))
• Update Go dependencies
• Update node dependencies
• Update GitHub Actions dependencies

## This release includes a security fix, so upgrading is strongly recommended.

A vulnerability was fixed which allowed animated image attachments (APNG, GIF, WebP) to bypass the thumbnail pixel budget, potentially causing multi-gigabyte memory allocation when the thumbnail was rendered.

Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security.

### Security
• Bound thumbnail decode to single frame ([GHSA-2vgv-6hcp-mf43](https://github.com/axllent/mailpit/security/advisories/GHSA-2vgv-6hcp-mf43))

### Feature
• Add major version tag for Docker images in workflow ([#734](https://github.com/axllent/mailpit/issues/734))

### Chore
• Improve message rendering performance with envelope caching
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

### Fix
• Re-quote local-parts in API JSON responses ([#732](https://github.com/axllent/mailpit/issues/732))

This release adds an optional feature to mitigate DNS rebinding attacks ([read more](https://mailpit.axllent.org/docs/configuration/http/#dns-rebinding-mitigation)), as well as other hardening fixes.

### Security
• Add `--allowed-hosts` flag to mitigate DNS rebinding against the API

### Chore
• Update Go dependencies
• Update node dependencies
• Update Github Actions

### Fix
• Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list
• Pass line-boundary state to drainData to prevent SMTP desync
• Allow SP inside quoted local-parts per RFC 5321 ([#731](https://github.com/axllent/mailpit/issues/731))
• Bound header-rewrite scanner to header block and fail closed on missing header
• Prevent quadratic CPU in proxy CSS rewriter via O(1) asset dedup

### Feature
• Add deep dark theme ([#728](https://github.com/axllent/mailpit/issues/728))
• Add debounced search refresh for filtered views on new messages

### Chore
• Make read/unread message state clearly distinguishable (WCAG AA)
• Add accessible names to icon-only buttons and fix sender tag mismatch
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update GitHub Actions

### Fix
• Include all IANA special-use IPv4 ranges in IsInternalIP check
• Prevent SMTP command injection via drainData fragment-boundary bypass
• Validate Send API custom header keys per RFC 5322

### Chore
• Add software license information ([#724](https://github.com/axllent/mailpit/issues/724))
• Update Go dependencies
• Update node dependencies
• Update GitHub Actions dependencies

### Fix
• Database lock when delete request contains duplicate IDs ([#723](https://github.com/axllent/mailpit/issues/723))

### Test
• Add tests for requests containing duplicate & invalid IDs

### Security

- Add sandbox attribute to message iframe for extra layer of security (already protected via CSP headers)

### Feature

- Add option to disable auto-VACUUMing of the SQLite database (#661)

### Chore

- Update Go dependencies
- Update node dependencies