4.0.2

What's Changed

• Strip control characters (CR/LF) from attachment filenames and from decoded header parameter and MIME-encoded-word values -- thanks @iliaal
• Add configurable limits to MIME parsing, each recording a parse error when reached (override via DI config) -- thanks @iliaal:
  • maxMimePartDepth (default 256) — maximum multipart nesting depth
  • maxHeaderCount (default 1000) — maximum headers per part
  • maxHeaderSizeBytes (default 1048576) — maximum total header bytes per part
• Append child parts in O(n) rather than O(n²) -- thanks @iliaal
• Generate MIME boundaries with random_bytes() -- thanks @iliaal

Security

This release fixes two privately reported vulnerabilities:

• GHSA-36h5-qg4p-q2qf -- CRLF header injection via attachment filename.
• GHSA-f6v3-2qmr-vfjx -- uncontrolled resource consumption (CPU/memory) when parsing untrusted MIME.

Found and reported privately by @iliaal, who also proposed fixes that informed the patches. Upgrading is recommended.

3.0.6

What's Changed

• Strip control characters (CR/LF) from attachment filenames and from decoded header parameter and MIME-encoded-word values -- thanks @iliaal
• Add configurable limits to MIME parsing, each recording a parse error when reached (override via DI config) -- thanks @iliaal:
  • maxMimePartDepth (default 256) — maximum multipart nesting depth
  • maxHeaderCount (default 1000) — maximum headers per part
  • maxHeaderSizeBytes (default 1048576) — maximum total header bytes per part
• Append child parts in O(n) rather than O(n²) -- thanks @iliaal.
• Generate MIME boundaries with random_bytes() -- thanks @iliaal.

Security

This release fixes two privately reported vulnerabilities:

• GHSA-36h5-qg4p-q2qf -- CRLF header injection via attachment filename.
• GHSA-f6v3-2qmr-vfjx -- uncontrolled resource consumption (CPU/memory) when parsing untrusted MIME.

Found and reported privately by @iliaal, who also proposed fixes that informed the patches. Upgrading is recommended.

4.0.1

Full Changelog: 4.0.0...4.0.1

4.0.0

Full Changelog: 3.0.5...4.0.0

3.0.5

What's Changed

• Php 8.5 support by @phpfui in #260

Full Changelog: 3.0.4...3.0.5

3.0.4

What's Changed

• Fix getAttachmentPart typo in IMessage.php docs by @seanmckenzie428 in #245

New Contributors

• @seanmckenzie428 made their first contribution in #245

Full Changelog: 3.0.3...3.0.4

3.0.3

• Fix to allow empty address groups #241
• Ignore ws between rfc2047 parts in q-part #240
• Fix PartBuilder parent parameter type

Full Changelog: 3.0.2...3.0.3

3.0.2

What's Changed

• Replace global DI library functions with corresponding objects for PRS-4 compliance by @phpfui in #238

Full Changelog: 3.0.1...3.0.2

3.0.1

Fixes version constraints for php-di, guzzlehttp/psr7 and phpunit.

2.4.1

What's Changed

• Fixed some deprecation messages by @stollr in #237