3.0.10

What's Changed

• Strip control characters from the parsed protocol parameter used for a signature part's Content-Type
• Record a parse error for header lines containing a CR not followed by LF
• Match RFC 2047 encoded words in linear time regardless of charset length

Security

This release fixes two reported vulnerabilities:

• GHSA-AAAA -- header injection through the parsed protocol parameter in setAsMultipartSigned(), not covered by the fix for GHSA-gmgm-r6fh-fq6g reported by @4n86rakam1
• GHSA-BBBB -- CPU exhaustion from regex backtracking when decoding encoded words in long header parameters reported by aweiaaaaa (account deleted)

Upgrading is recommended.