v3.3.7

3.3.7 (2026-06-03)

Bug Fixes

• http: prevent SSRF in outbound webhook and HTTP endpoint requests (11c9814)
• message-db: prevent SQL injection via condition keys (GHSA-x2hq-rfpg-3xr5) (4314a6e)
• specs: stub IPv6 support in address guard IPv6 literal spec (029bfe0)

Miscellaneous Chores

• deps: upgrade rack & rails (0445e5c)
• update security vulnerability reporting instructions (8be1e27)

v3.3.6

3.3.6 (2026-04-28)

Bug Fixes

• messages: sandbox rendered email HTML as extra XSS defence (cad2aa6)

Miscellaneous Chores

• ignore node modules and yarn.lock (b611d57)

Code Refactoring

• auth: tighten return_to validation (84f4e20)
• helpers: escape interpolated values in select options (9243524)
• tracking: remove unused src image proxy (dca7f90)

v3.3.5

3.3.5 (2026-02-01)

Bug Fixes

• deliveries: escape delivery details to prevent HTML injection (11419f9)
• health_server: use rackup handler instead of rack handler (7c47422)
• oidc scopes are invalid when concatenated (#3332) (9c5f96a)
• typo in process logging (#3212) (b7e5232)
• typo in the credentials page (fd3c7cc)
• update url for v2 config (#3225) (e00098b)

Documentation

• process.rb: add help about time unit used by metric (#3339) (f5325c4)

Miscellaneous Chores

• deps: upgrade puma, net-imap and other deps (c03c44b)
• dockerfile: reduce container size (86de372)
• remove version from docker-compose.yml (c78000c)
• upgrade resolv to 0.6.2 (d00d978)
• upgrade to rails 7.1 and ruby 3.4 (#3457) (ab6d443)
• upgrade uri gem to 1.0.3 (f193b8e)

v3.3.4

3.3.4 (2024-06-20)

Bug Fixes

• fix postal version command (4fa88ac)
• fix issue running message pruning task (3a33e53)
• raise NotImplementedError when no call method on a scheduled task (2b0919c)

v3.3.3

3.3.3 (2024-04-18)

Bug Fixes

• legacy-api: allow _expansions to be provided as true to return all expansions (39f704c), closes #2932

v3.3.2

3.3.2 (2024-03-21)

Code Refactoring

• versioning: improve how current version and branch is determined and set (07c6b31)

v3.3.1

3.3.1 (2024-03-21)

Bug Fixes

• smtp-sender: ensure relays without a host are excluded (3a56ec8)
• smtp-sender: fixes SMTPSender.smtp_relays (b3264b9)

Miscellaneous Chores

• container: add the branch name to the container (bee5098)
• github-actions: don't generate commit- tags (d65bbe0)
• github-actions: don't run for dependabot or release-please PRs and fetch whole repo (adaf2b0)
• github-actions: include a version string on branch-*/latest images (64bc7dc)
• ui: display branch in footer if present (1823617)

Code Refactoring

• remove moonrope but maintain legacy API actions (#2889) (4d9654d)

v3.3.0

3.3.0 (2024-03-18)

Features

• prometheus: add postal_message_queue_latency metric (ee8d829)
• worker: allow number of threads to be configured (7e2accc)
• worker: scale connection pool with worker threads (ea542a0)

Bug Fixes

• message-dequeuer: ability to disable batching (4fcb9e9)

Miscellaneous Chores

• config-docs: update docs for latest oidc defaults (364eba6)
• config-docs: update proxy protocol to mention v1 (45dd8aa)

v3.2.2

3.2.2 (2024-03-14)

Bug Fixes

• don't use authentication on org & server deletion (be45652)
• smtp-server: fixes proxy protocol (9240612)

Miscellaneous Chores

• allow config location message to be suppressed (f760cdb)
• hide further config messages (1c67f72)
• suppress config location on default-dkim-record (aa76aae)

Tests

• add tests for the legacy API (3d208d6)

v3.2.1

3.2.1 (2024-03-13)

Bug Fixes

• fixes postal default-dkim-record (58dddeb)