Skip to content

v0.3.31

Latest
Latest

Choose a tag to compare

View all tags
@7supersayin 7supersayin released this 27 Sep 15:34
· 2 commits to main since this release
v0.3.31
e3155d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Python clients now JSON-escape $VAR values. In langchain-atomicmail 0.3.30, pydantic-ai-atomicmail 0.3.30 and the Dify plugin, $VAR values were substituted into the JMAP JSON unescaped. reply.json fills $REPLY_SUBJECT from the inbound message, so a crafted subject could add method calls to a reply batch. Values are now escaped in string context, like the TypeScript runtime. Upgrade Python and Dify installs to 0.3.31. The TypeScript packages (npm, n8n, CLI, MCP) were not affected. If you pre-escaped values yourself (for example \n), pass raw text instead.

Fixed

  • reply.json picks its recipient like the hosted MCP server: the first usable Reply-To address, else From, else Sender. It replies to that one address only. Line breaks in the subject collapse to a space, and an existing Re: is kept.
  • Send examples in help and the docs now file the sender's copy in Sent and clear $draft on success, like the bundled presets.
  • list_sent.json returns keywords.

What's Changed

  • fix: JSON-safe vars in Python, reply parity with hosted MCP, send examples file in Sent by @7supersayin in #80
  • docs(changelog): release notes for 0.3.31 by @7supersayin in #81

Full Changelog: v0.3.30...v0.3.31

Contributors

7supersayin
Assets 4
Loading