v1.0.6

Security release addressing the findings of the Mautic marketplace allowlist review (marketplace-allowlist#21):

• XSS (high): the inline builder settings printed into a <script> block are now encoded with JSON_HEX_TAG, so a config value containing </script> can no longer break out of the block. Covered by a new functional test.
• SSRF (medium): base_url is only honoured when it parses to an http(s) URL; any other scheme falls back to the provider default.
• Telemetry (low): a failure to persist the generation record is now logged at error level instead of being swallowed silently.

Upgrading is recommended for all installations.

v1.0.5

An explicit language request in the prompt now overrides the language the prompt is written in. Previously the rule always mirrored the prompt's own language, contradicting requests such as a Portuguese prompt asking for English copy. The request's own language remains the default when nothing is asked.

v1.0.4

Fixes generations coming out in the wrong language. The system prompt's language rule used Portuguese and German as illustrative examples, and at low reasoning effort models pattern-matched the named languages instead of applying the rule, so an English prompt could produce Portuguese or French copy. The rule now names no language. Measured on the production pipeline: 4/4 English for an English prompt (was ~1/3), 3/3 Portuguese for a Portuguese prompt (unchanged).

v1.0.3

Follow-up to the wider panel: the builder's top options bar is anchored at right: 15% in GrapesJS core, which left its rightmost buttons hidden underneath the 300px panel. It now anchors to the panel edge, so every button stays visible.

v1.0.2

The builder's right panel is now 300px wide instead of GrapesJS's 15% default, giving the prompt textarea and the settings fields room to breathe. The canvas gives up the same width, so nothing overlaps.

v1.0.1

• The default placeholder image label is now in English (text=Image instead of text=Imagem).
• README: full demo capture (starter cleanup, hero generation, four-image mosaic, image picker swap) and the project title now reads Mautic AI Email Sections.

v1.0.0

First public release.

• AI Section block in the GrapesJS email builder: describe a section, get validated MJML in place.
• Edit mode via the toolbar wand, with preservation invariants (images and personalisation tokens are hard-protected; links and text volume soft-protected).
• Allowlist MJML validator with retry feedback to the model; output is treated as untrusted until it passes.
• Two LLM providers behind one interface: OpenAI-compatible (OpenAI, LiteLLM, Ollama, LM Studio) and the Anthropic Messages API.
• Builder personalisation tokens offered to the model, theme token files per Mautic theme with language-variant resolution (mytheme-pt / mytheme-en), and a brand voice field.
• Generation telemetry table and a purge command for retention.