v3.124.0-beta.0

• warn about deliverability before a large send
• warn about deliverability before a large send

3.124.0-beta.0 (2026-09-05)

Features

• newsletters: warn about deliverability before a large send (0536c86)
• newsletters: warn about deliverability before a large send (49197be)

Bug Fixes

• gallery: give the Grid layout a lazy-loading pre-load band (#1287) (b1e5287)
• gallery: image-loading follow-ups — pre-load band, decode release, sanitizer dedup (905fc59)
• gallery: release the canvas decode when it is drawn, not at unmount (fbe9757), closes #1287
• gallery: release the canvas-mode decode, and drop a now-duplicate sanitizer (be8d79e)
• gallery: remove the inert image-protection prop surface from AuthenticatedImage (1f316ef)
• gallery: remove the inert image-protection prop surface from AuthenticatedImage (e734e41), closes #1297
• newsletters: make the warning's duration and queue claim honest (7b4a65e)
• remove the image-fragmentation surface (ae23b1a)
• remove the image-fragmentation surface (967224c)
• security: apply image-security defaults on every creation path (ab6c33d), closes #1296
• security: apply the Image-security defaults instead of storing them (#1296) (2e9bd54)
• security: apply the Image-security defaults instead of storing them (#1296) (8ca3610)
• security: check for an escaped identifier before consuming the escape (b6dc099), closes #1264
• security: close the remaining image-security default gaps (19c518a), closes #1296
• security: close two CSS url() bypasses the sanitizer dedup exposed (1cf8274)
• security: decode settings at the API boundary and honour the transaction (0e560eb), closes #1296
• security: one settings decoder, and the last creation path (0deef25), closes #1296
• security: re-check inline CSS after template substitution (027afb6), closes #1264
• security: reject array values for every field on the event update (933f2d8), closes #1296
• security: reject array values on the event update route too (8f3436f), closes #1296
• security: strip control characters before scanning CSS for url() (99f54a3), closes #1264
• security: use CSS whitespace, not JavaScript's, in the url() reader (4196e83), closes #1264
• security: validate CSS urls last, after every pass that moves text (1151e96), closes #1264