listmonk version history

- Nightly build from master branch (commit e1b0a8bb) - May contain bugs and breaking changes - Available on Docker Hub and GitHub Container Registry - Warning: Use at your own risk

[](https://listmonk.app) v6.2.0 has important security fixes in addition to several improvements and general bug fixes. **As always, take a backup of your Postgres database before upgrading.** ## Security This version has fixes for multiple campaign/list permission validation issues in multi-user environments. ## What's new - Embed inline images (CID) in e-mails. - Define trusted URLs and redirect to them after subscriber form submission. - SMTP-server selection based on 'from e-mail' domains. - Template expression support in campaign custom headers. - "Outlook compatbility mode" option in the Visual e-mail builder UI. - Support for Azure bounce webhooks. ## How to upgrade **As always, take a backup of your database before upgrading.** **Binary** Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again. **Docker** ```shell # cd /directory/with/docker-compose.yml docker-compose down docker-compose pull && docker-compose run --rm app ./listmonk --upgrade docker-compose up -d ap

[](https://listmonk.app) v6.1.0 has important security fixes in addition to several improvements and general bug fixes. **As always, take a backup of your Postgres database before upgrading.** ## Security This version has fixes for multiple campaign/list permission validation issues in multi-user environments. ## What's new - New global Privacy setting to disable view and click tracking. - Ability to proxy S3 media files through listmonk instead of linking to S3 directly. - Lettermint bounce webhook provider. - New global data refresh button on admin nav that works across all pages. - A new 'Duplicate' button to visual e-mail builder block UI options. - `PATCH /api/subscribers/:id` endpoint for partial subscriber updates. - New granular `campaigns:send` permission, separate from campaigns:manage for finer access control. - New `altbody` param to `/api/tx` for sending multipart plaintext bodies in transactional mails. ## How to upgrade **As always, take a backup of your database before upgrading.** **Binary** Download the latest binary

[](https://listmonk.app) v6.0.0 is a major release with a significant number of improvements and fixes. **As always, take a backup of your Postgres database before upgrading.** ## What's new? - TOTP two-factor authentication. - E-mail-based `Forgot password` reset flow. - Ability to archive lists. - Subscriber activity in the Subscriber profile UI. - Ability to send transactional mails to non-subscribers via the `/api/tx` API. - Campaign-level JSON `{}` attributes just like subscriber attributes. - Granular override on subscriptions / subscriber profile in bulk import. - In-built Postgres VACUUM cron in `Maintenance` settings for large databases. - CORS origin configuration in `Security` settings In addition, there are several other bug fixes and improvements. ## Security This version [addresses](https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565) the issue of arbitrary <script>s in a campaign created by a non-admin user with the campaign management permission executing when a super admin previews that campaign, allowin

[](https://listmonk.app) v5.1.0 contains an important security update (CSRF prevention - CVE-2025-58430) along with other minor bug fixes and improvements. ## What's new? - ALTCHA (self-contained proof-of-work CAPTCHA alternative) in addition to hCaptcha (deprecated) - Refactored media gallery with a new UI and improved UX. - Bulk subscriber blocklisting directly from the bounces UI. - Auto-creation of OIDC users with default user and list roles. #### Breakings change to subscription-form.html If you are loading a custom `subscription-form.html` static template with `--static-dir`, you have to update your template with the breaking changes (CAPTCHA logic) from the new [subscription-form.html](https://github.com/knadh/listmonk/blob/v5.1.0/static/public/templates/subscription-form.html) ## How to upgrade **As always, take a backup of your database before upgrading.** **Binary** Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again. **Docker** ```shell # cd /directory/with/docker-compos

[](https://listmonk.app) v5.0.3 contains fixes for some minor, but annoying bugs, primarily SMTP errors not being captured and displayed while sending test mails. ## How to upgrade **As always, take a backup of your database before upgrading.** **Binary** Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again. **Docker** ```shell # cd /directory/with/docker-compose.yml docker-compose down docker-compose pull && docker-compose run --rm app ./listmonk --upgrade docker-compose up -d app db ``` ## Changelog * 48643aa9 Disallow `POST /api/subscription` on disabling public subscription in settings. Closes #2530. * a424f01f Print full line with error in the importer log. Close #2549. * 4f6880d3 Fix opt-in send errors silently ignored on signup form. Closes #2535. * b71d80e5 Upgrade `smtppool` lib with error-return bugfix. Ref: #2503 * 419f88a9 Fix incorrect line counts due to empty lines in CSV importer (#2542) * aa864fd5 Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#25

[](https://listmonk.app) v5.0.2 contains an important security update which disables the `env` and `expandenv` [Sprig](https://masterminds.github.io/sprig/) template functions preventing accessing of env variables from templates. This affects v4.0.0 - v5.0.1 installations that have unprivileged users in a multi-user setup. ## How to upgrade **As always, take a backup of your database before upgrading.** **Binary** Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again. **Docker** ```shell # cd /directory/with/docker-compose.yml docker-compose down docker-compose pull && docker-compose run --rm app ./listmonk --upgrade docker-compose up -d app db ``` ## Changelog * d27d2c32 Remove dangerous tpl funcs in Sprig that's enabled by default. * 6fc6c1ec Fix Vietnamese translation issues (#2487) * d6f5292d Fix subscribers unsubscription status being reset to confirmed on save (#2517) * 8b8358e9 Add Nodion Deployment Option (#2518) * 3f395085 updates simples3 to latest version (#2520)

[](https://listmonk.app) v5.0.1 is a bug-fix release on top of the major v5.0.0 release. It features the addition of long pending features such as the visual drag-and-drop e-mail builder, per-campaign SMTP selection, and numerous other fixes and improvements. [](https://listmonk.app) ## What's new? * **Visual editor and templates** * The much requested and awaited visual e-mail builder and template editor is now integrated, with one-click conversion between formats. Thanks to @vividvilla for the big PR integrating [@usewaypoint/email-builder-js](https://github.com/usewaypoint/email-builder-js) * **Campaigns:** * Replace CodeFlask with the more mature and robust CodeMirror for a much better code-editing experience (HTML, CSS, Javascript, Markdown) on campaigns, forms, templates,and settings UI. * Ability to preview campaign archive view. * Make paused campaigns editable and allow unscheduling with new `Unschedule` button.

Skip this release and upgrade to [v5.0.2](https://github.com/knadh/listmonk/releases/tag/v5.0.2) instead for multiple fixes (UX bugs and a security fix) ## Changelog * 3b8a8c23 Add email-builder/dist to .gitignore. * 8902320a Update screenshot on README. * a7085cb5 Update homepage. * 11f52ee8 Switch migration version to v5 * 47e8f816 Default `body_source` to null instead of empty string in non-visual campaigns. * 925cdf28 Add visual template and new permissions to docs. * 1599957d Add and auto-translate missing i18n strings in all language packs. * db81dc1d Remove default dummy admin notification email settings. * 9de19ea2 Fix Codemirror Cypress tests in templates and form pages. * 92fc6469 Update sdks.md: add client for java/kotlin (#2426) * 81b62a4a Fix race condition in immediate campaign pause-start actions. * d3c8eca4 Upgrade Go deps. * 0dc29b7d Fix CSV example on the subscriber import UI. * 953deef4 Hide 'New' and 'Save' buttons on the templates UI if there's no manage permission. * 77913275 Make `Must` config variables non-`Must` so that the app doesn't panic on their absence. * 8fc3d27b Merge pull request #2423 from knadh/dependabot/npm_and_yarn/fronten

[](https://listmonk.app) v4.1.0 is a major release with a significant number of improvements and fixes. # ⚠️ Important: Upgrading from v3.x.x **As always, take a backup of your Postgres database before upgrading.** v4.1.0 is a major upgrade that introduces multi-user management and authentication features, fundamentally changing how login and authentication works. It no longer relies on the browser-based BasicAuth prompt and ships with a built-in login system. The upgrade automatically creates a new Super Admin user based on the `admin_username` and `admin_password` fields from the TOML configuration file, after which, the credentials in the TOML file are no longer needed. [Read more](https://listmonk.app/docs/upgrade/#upgrading-to-v4xx). ## What's new? - Multi-user support with granular permissions, user, role, per-list permissions and API token management. - Support for OIDC (OpenID Connect) authentication. - First-time Super Admin setup UI for fresh installations. - Significant performance improvements to SQL queries underlying concurrent campai