listmonk

[](https://listmonk.app)

v6.1.0 has important security fixes in addition to several improvements and general bug fixes.

**As always, take a backup of your Postgres database before upgrading.**

## Security

This version has fixes for multiple campaign/list permission validation issues in multi-user environments.

## What's new

- New global Privacy setting to disable view and click tracking.

- Ability to proxy S3 media files through listmonk instead of linking to S3 directly.

- Lettermint bounce webhook provider.

- New global data refresh button on admin nav that works across all pages.

- A new 'Duplicate' button to visual e-mail builder block UI options.

- `PATCH /api/subscribers/:id` endpoint for partial subscriber updates.

- New granular `campaigns:send` permission, separate from campaigns:manage for finer access control.

- New `altbody` param to `/api/tx` for sending multipart plaintext bodies in transactional mails.

## How to upgrade

**As always, take a backup of your database before upgrading.**

**Binary**

Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again.

**Docker**

```shell

# cd /directory/with/docker-compose.yml

docker-compose down

docker-compose pull && docker-compose run --rm app ./listmonk --upgrade

docker-compose up -d app db

```

## Changelog

* 1b5e8d38c778e869003486d3c38bc7a964661e91 Bump picomatch from 2.3.1 to 2.3.2 in /frontend/email-builder (#2973)

* 86c94c80d2bfa79bf703b19d092ea7bcc5683626 Fix users without certain list permissions being able to see list names on subs.

* 50564c6954eaf63b90a7db0520bc7ab3bde0608a Remove unpredictable/useless 'back' button from public forms. Closes #1834.

* e9c1da1f25a16ba9dd614818daa205f18beada71 Add new `campaigns:send` permission and separate it from `campaigns:manage`.

* 00bae682a5d0ed3ed4c6c9d3a1f551dcbcdaafa5 Update go-pop3 with BOM fix. Closes #2959.

* 24817d5a9384be47529597ed877f7700a0832a63 Add `PATCH /api/subscribers/:id` to partially modify subscribers. Closes #1681.

* 1d5724831a3b467af17aa34c883c986b8affc5e2 Add a 'Duplicate' button to visual e-mail builder block UI options. Closes #2852.

* deeb3fb21a8dbb84e8d47797503f0f107ea0f190 Fix minor UI issues on analytics page. Closes #2446.

* 4e5e713be8ea93e62166cc2cc51386525ea89be5 Exclude non-http hrefs on the UI when adding `@TrackLink`. Closes #2859.

* 010655f357aca31558175511f144dba006b7ccee Don't make 'tracklink' checkbox on the UI on by default and remember last preference. Closes #2858. Closes #2862.

* 678d4ed99f99da969f405c22d502200a6c09dd79 Cleanup and optimize images on the static homepage.

* 501f305e0f286c2a5830824d21c9a6a3771d1151 Exclude roles API queries from Settings UI for users who don't have that perm. Closes #2965.

* 1525852e80360b3196ad0829c5e5fa6e7af2ee73 feat: add Lettermint as bounce webhook provider (#2935)

* cfd865b11fc3977ad30a177de5b151df8f8d1eae Bump yaml from 1.10.2 to 1.10.3 in /frontend/email-builder (#2968)

* 8702932aaf89bf4b8c29b2da0631eacb3bee8e79 Bump picomatch from 2.3.1 to 2.3.2 in /frontend (#2969)

* 0ee89f9097a0007ceef9aaf9e144b3845868fc8d Fix deleted lists breaking campaign query. Closes #2908.

* e908cc36da51a8cff004aade661d059eea389eaa Refactor and improve Cypress test scaffolding.

* 678c36defff7f768cf99c3f913bba8fb64aabecd Fix incorrect permission check in CSV import blocklisting.

* db82035d619348949512dafdaf60c86037cafc9e Wipe user sessions from DB on password reset/change.

* 347f5976759232c36e571cf58b4bfe33c2794f35 Fix serveral missing permission checks across multiple handlers.

* 171a597ff2f20e29dad9894418a4934f9ed30a58 Bump flatted from 3.3.1 to 3.4.2 in /frontend/email-builder (#2960)

* d3e8c4c33624cc1f0e06601d4a2e82f756a99630 Bump flatted from 3.3.2 to 3.4.2 in /frontend (#2962)

* c60ea79582ec7538f1a85d969600e46deb9d8030 Fix % encoded URLs breaking with `TrackLink`. Closes #2947.

* e35bf878539c209e07f3f192a304d1fd5ba9cc9b Fix incorrect timestamps in dashboard analytics materialized views. (#2952)

* 5f4f360d5fc0039f4c9eb45f3dbceec71d45eb6f Fix attachments incorrectly accuring for every recipient in test mails. Closes #2949.

* 1e3d311b6196f03cd1f279cf5d6e321a245792e5 Add expiry+TTL to Altcha CAPTCHA tokens. Closes #2684.

* 915ee0444934be7e095298ddcc8b5b8aca98e1c7 Skip windows/arm-32 bit builds in goreleaser (which was breaking) that was removed in go 1.26

* be7b60ae9f3b54b250fa0c30e25c671acbcaf974 Add new 'altbody' param to /api/tx to send multipart plaintext bodies in transactional mails. Closes #2486

* 1d33d95d30e933f9ac4a16cbf4f56d86ee84f155 Bump Hodor to 0.3.4 (adds python3, shellcheck, file, diffstat) (#2943)

* bf24c3f5c636b7b3fe7106fcf7157f275362c38f build: bump Go version to 1.26.1 to fix stdlib CVEs (#2941)

* 00180b68455f2b2d773c0dffea5364ad0e75466c Hodor: require hodor-review label to run, re-run on subsequent pushes (#2940)

* 3adacba1e8c9c1a1bf80ac3ae0cbbd35f98b6f5e Fix Hodor: use docker run directly (0.3.2 entrypoint changed) (#2939)

* ece5a63f32999c9b474fc467f342689cc1fd90ba Fix pipe batch hanging and corrupting campaign runtime state if `NextSubscribers()` throws an error.

* 97b72e99f102519efdf898039cc1f2165bcba9c1 Fix pre-existing non-permitted lists on a subscriber being wiped incorrectly on update. Closes #2902.

* ee7bccc746db2e1791048ef1cf672c2022305451 Throw an error if there isn't a single permitted list in subscriber create/update. Closes #2905.

* b628510edcee987edc0d7cb32370656e75d0cc89 Fix potential hanging campaign pipes if the pipe queue ever becomes full.

* 16d5e5436c2bd92924ac629b14e6f0bb4c18ca96 Fix incorrect subscriber checkpoint in campaign stats update.

* 0f32991fea7f3a7ae4fc4ceb2db6adfb37cf81c6 Apply improvements to Danish i18n (#2928)

* 0808015468a296fde5afe800346efa83202e0579 feat: add Lettermint SMTP preset (#2932)

* 458bca149a032edff2521d1afa3886049de949d0 Bump immutable from 5.0.3 to 5.1.5 in /frontend (#2936)

* 19b53d8d1201dd5553259ca2d9534db58c09b0b0 Add Hodor AI code review workflow (#2937)

* c8b1f6f31bd6cbf6e59c5a9925baad28f9feb8f5 Standardize spelling of "opt-in" in docs. (#2931)

* 8b633643274ea9ef4bfeedec123ff05300f532f3 Update security-reports.md (#2929)

* 62778d7f849c0546bc7b77d080591748c9a1b84d Bump rollup from 4.30.1 to 4.59.0 in /frontend (#2926)

* 73962764dae41515c97c8d7a92a049445a8d2cc2 Bump rollup from 4.24.4 to 4.59.0 in /frontend/email-builder (#2925)

* 2e9f0e009b7cf5b2e6d6fc95d26dfe4b7472c0af Updated Danish translation (#2927)

* fdd7dbbb00d0e45b710144fb5beb77f5a883c066 Incorporate `SOURCE_DATE_EPOCH` in build. Closes #2802.

* 7fd5ed0a6e53b4fabbf27a850712dbbcce575087 Add Hodor AI code review workflow (#2923)

* 756c5aad3bae1fd26c04e43363754282e7e2168f Fix nightly docker push workflow.

* c6bf543a67db8298da3ca693374c20b50b0104a6 Add a link to security reporting docs to SECURITY.md

* d0fb8d6238c7785091aa8cc1aab40478d7f6cb53 Add a global data refresh button on top nav that works on all pages (#2861)

* c381e4c206b11d5e43c41e280f7566442e3b6c3c Add global setting to disable view and click tracking (#2920)

* 07078ebd5ff5e1addd9dc9947279dd5e80deffa4 Bump systeminformation from 5.28.5 to 5.31.1 in /frontend (#2910)

* 97de0b14ea5c9299dc6bb80f9de74264744ed551 Add `docker-compose.override.yml` to .gitignore (#2917)

* 7b64b8b1c97b558948c210e390af59ecbd1287f5 Add a page on security reporting listing down recurring non-issue reports.

* 6d5787bd32529408ab9263844291fa8fa433f5e2 Skip non-available email- messenger during campaign creation and default to 'email'. Closes #2901.

* c417df6eeae13e12348eb4d9fb750caee11967ee Fix untranslated 'Delete' string on lists page. Closes #2904.

* 68c86147897cbb0811cbbaafc3b9642ae7ae854b Change `docker manifest` to `docker buildx imagetools` in nightly job to fix manifest error.

* 5436d08c21164cba5ba338cf63c4f309494d5777 Add `--amend` to nightly Docker build (after it stopped working randomly).

* cc14bcbed946d34d02bf9177b61472b135464f11 Bump qs from 6.14.1 to 6.14.2 in /frontend (#2906)

* 8cf9a7fc8e6c6f10ee84a46033380bc5f7131624 Bump axios from 1.12.0 to 1.13.5 in /frontend (#2899)

* 5a8ecfb3f81021b6ed5c81c88367ae7ed0ab2a80 Add support for proxying S3 media files through a custom path (#2863)

* 0d9e66aee9bd9922b7fddc0f0fade1901c02e514 Increase campaign/template preview modal height. Closes #2857.

* f5bec86d4e5f46978b35c876db2d09716ef12899 Display campaign name + subject in subscriber activity tab on the UI. Closes #2874.

* e7b09fd09484a50ac3e420118de313633f183922 Fix incorrect skipping of +1 count in sliding window check. Closes #2894.

* 8d1b9fdb2ea74b7b7a557c256635e6ab4db646d0 Add substring matching to list search like campaign search. Closes #2896.

* dce582a51c2b4cc9ea3acd30cc85e20fdb61d198 Fix bounce POP scanner incorrectly returning errors while scanning. Closes #2884.

* c5631ebcbb69161e6923d0c2bfc4c1cb1b9ef3e1 Update de language (#2895)

* 2adee6ab30fb727c2cffb2bc9282e3e33a43c388 fix: Update dev Dockerfile to use Go 1.24.1 to match go.mod (#2879)

* 3c73267208ed2eca954c74089406cb4a84b9da1c Bump lodash from 4.17.21 to 4.17.23 in /frontend (#2881)

* 881bcd67c30f7c171d878a9e5fe2f017e3e8432b Add automated `nightly` releases.

* 577036afe9bb3e669bb53c7b676e925e2d45b5bb Increase GitHub issue auto-close interval to 5 months.

* fff3c7f66cfd352e4e440538ff97eeac250fa490 update listmonk TypeScript SDK scope from @solytude to @maloma (#2875)

* 60060489ae5b58990dace50552baaff5d9380504 fix: convert forwardemail webhook truthsource property to string (#2869)

* 29c406f0366f16456e1e8136630208e8cc44557b Add left/right float options to TinyMCE image popup. Closes #2865.

* cd1bb1bc2045e8fb0827530947441e0721722d22 Docs update to OIDC - adds Google Workspace / Google Cloud (#2866)

* 267263a17639107c36247ed36dcd804adfa444a9 Update release details on the static homepage.

* 504a14273f816802b2b92056ebad87c40cceb276 Upgrade `smtppool` lib to handle 421 rate limit errors.

* 480fe5f9e8da05b8108b2837fc7fd08f57190db7 Improve i18n Taiwan Chinese translation quality (#2856)

* 2d999528b3f1b2c1962a0d022c3d8c350ab64406 Add warning icon to `subscribers:sql_query` permission and link to docs on the Roles UI.

* 83bdad3c3bfc2a62317a9d699f44ee5df3da964e Add detailed docs on the risks of the `subscribers:sql_query` permission and Postgres privileges.

* 4e5008895b9c418f8dced767aed0f6361f994f94 docs: add @solytude/listmonk TypeScript SDK to community SDKs (#2849)