v2.75.0

2.75.0 (2026-07-28)

Features

• web-safe-html: fold quoted thread history into a collapse marker (25d45bf)

Bug Fixes

• account: serialize account updates so a refreshed token is not lost (e577825)
• api: match IPv4-mapped peer addresses against the address allowlists (5acff06)
• api: trust X-Forwarded-For only from declared proxies (6e93ea7)
• api: warn about a spoofable admin allowlist when the proxy list is empty (4309abe)
• deps: bump imapflow to 1.6.1 to restore IMAP account verification (c2a5437)
• deps: update @postalsys/email-ai-tools to 1.13.15 (89ec145)
• deps: update dependencies (@bull-board 8.3.2) (a5644f3)
• logging: stop logging decrypted setting values and lower Redis reconnect noise (5c62ac4)
• oauth: pin external account token_url to Google STS (27ade81)
• queue: retain failed queue entries instead of deleting them on arrival (e83af35)
• server: drain workers on shutdown and back off crash-looping respawns (29b3b5d)
• webhooks: filter webhook egress and stop following redirects (e44bed5)
• webhooks: report the refused redirect status and probe through the delivery path (9f7c666)
• webhooks: stop retrying an endpoint that answers with a redirect (bbb6055)