The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.
v5.1.0 contains an important security update (CSRF prevention - CVE-2025-58430) along with other minor bug fixes and improvements.
What's new?
- ALTCHA (self-contained proof-of-work CAPTCHA alternative) in addition to hCaptcha (deprecated)
- Refactored media gallery with a new UI and improved UX.
- Bulk subscriber blocklisting directly from the bounces UI.
- Auto-creation of OIDC users with default user and list roles.
How to upgrade
As always, take a backup of your database before upgrading.
Binary
Download the latest binary. Stop and replace the old binary. Run ./listmonk --upgrade
. Start the app again.
Docker
:::shell
# cd /directory/with/docker-compose.yml
docker-compose down
docker-compose pull && docker-compose run --rm app ./listmonk --upgrade
docker-compose up -d app db
Changelog
- 30846f84 Ignore altcha.umd.js from frontend build so that goreleaser ignores it.
- e27a3904 Expand the warning on
subscribers:sql_query
permission on arbitrary SQL functions. - 6d993165 Auto-translate new i18n language strings.
- d4007d51 Fix Go tpl expressions breaking in Visual editor HTML.
- deb41f8d Add i18n translation helper script.
- 81d05e4d Suppress optin e-mail send errors on subscriber insert/edit APIs.
- fcbebc27 Update Cypress trests on the campaign file attach UI.
- e8b0eafc Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 (#2634)
- 301c13a6 Add optional
subject
param to tx API. Closes [#2333]. - ad66878e Fix list action icons not showing on the UI based on permissions. Closes [#2640].
- fbe4c5c9 Make
session
cookie samesite to prevent CSRF requests. - ea88b944 Add link for n8n node (#2649)
- 7d388908 Change OIDC init to lazy-load instead of loading once on boot. Fixes [#2626].
- 96111646 Refresh i18n language files.
- 09d291e1 Add support for built-in ALTCHA CAPTCHA implementation.
- 38387d00 Fix
List-Unsubscribe
header incorrectly sent on opt-in confirmation. Closes [#2619]. - eef00213 Add support for loading secrets from *_FILE env vars in Docker environment.
- 4a93184c Bump tmp from 0.2.3 to 0.2.4 in /frontend (#2617)
- ad67fc62 Refactor landing page on the website.
- 4d74cf45 Tweak log viewer to optionally hide filename from log lines (on the import UI).
- 26c61f8e Bump form-data from 4.0.1 to 4.0.4 in /frontend (#2587)
- fb39d618 Refactor media gallery UI.
- ba24c64f Add subsriber blocklisting on the bounces UI (#2409)
- c9c678c0 Add support for OIDC user auto-creation (#2578)
- 66d7413b Update OpenAPI specification (#2581)
- ae84fa37 Add listmonk-mcp to SDKs documentation (#2573)
- 6b7e4232 Update OIDC doc with latest KeyCloak realm URL (#2568)
- 89b27042 Update deps and remove obsolete
replace
in go.mod. Closes [#2567]. - 98d2ad6e Add Korean i18n translation (#2565)
- 38c784fe Update release details on the static homepage.