<![CDATA[FreeScout - Package Updates]]>This topic is to track FreeScout package updates.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/2494/freescout-package-updatesRSS for NodeFri, 11 Sep 2026 14:07:30 GMTSat, 09 May 2020 16:40:45 GMT60<![CDATA[Reply to FreeScout - Package Updates on Sat, 05 Sep 2026 12:27:04 GMT]]>[1.16.31]

  • Update freescout to 1.8.239
  • Full Changelog
  • Removed black outline when clicking on links in Chrome.
  • Disabled support of legacy attachment URLs with MD5 tokens (GHSA-89ww-mfww-5vr6)
  • Fixed linking messages into conversations in Outlook (#4922)
  • Take into account IPv6 transition addresses in Helper::sanitizeRemoteUrl() (GHSA-v5xm-qw3f-qm98)
  • Fixed preserving CSS custom properties during minification (#5611)
  • Fixed emails sometimes being sent as raw MIME source when sending via mail() function (#5615)
]]>https://forum.cloudron.io/post/129063https://forum.cloudron.io/post/129063Sat, 05 Sep 2026 12:27:04 GMT<![CDATA[Reply to FreeScout - Package Updates on Tue, 01 Sep 2026 05:34:25 GMT]]>[1.16.30]

  • Update freescout to 1.8.238
  • Full Changelog
  • Allow to configure fetching max execution time via APP_FETCH_MAX_EXECUTION_TIME (#5605)
  • Allow to change default modal loader via data-loader parameter.
  • Fixed .note-actions position in the editor toolbar on middle-size screens.
  • Escape message in showFloatingAlert()
  • Improved populating conversation_id field in add_conversation_id_column_to_notifications_table migration.
]]>https://forum.cloudron.io/post/128776https://forum.cloudron.io/post/128776Tue, 01 Sep 2026 05:34:25 GMT<![CDATA[Reply to FreeScout - Package Updates on Sun, 30 Aug 2026 07:24:09 GMT]]>[1.16.29]

  • Update freescout to 1.8.237
  • Full Changelog
  • Minimum supported PHP version now is PHP 7.4+.
  • Added X-Content-Type-Options: nosniff header.
  • Added Strict-Transport-Security header.
  • Check authentication in /polycast/connect and require channels parameter in /polycast/receve (GHSA-7x4c-p73f-67x5)
  • Improve OAuth IMAP token refresh logic to avoid errors in logs every hour (#5582)
  • Adjust error message check in FetchEmails for increasing sleep time (#5584)
  • Correctly process customer reply to a previous agent reply after moving a conversation (#5590)
  • Fixed user notifications when conversation is moved (#5596)
  • Do not allow unsafe symlinks when UnZipping (GHSA-rw7g-qq32-c669)
  • Improved audio downloading/playing (#5597)
]]>https://forum.cloudron.io/post/128707https://forum.cloudron.io/post/128707Sun, 30 Aug 2026 07:24:09 GMT<![CDATA[Reply to FreeScout - Package Updates on Fri, 28 Aug 2026 07:05:38 GMT]]>[1.16.28]

  • add missing 127.0.1.1 system own ip/hostname to whitelist
]]>https://forum.cloudron.io/post/128627https://forum.cloudron.io/post/128627Fri, 28 Aug 2026 07:05:38 GMT<![CDATA[Reply to FreeScout - Package Updates on Mon, 24 Aug 2026 11:59:14 GMT]]>[1.16.27]

  • Update freescout to 1.8.236
  • Full Changelog
  • Remove temporary SwiftMailer files in freescout:clean-tmp command (#5558)
  • Store conversation number in "Send Errors" log (#5571)
  • Trigger user notifications when moving conversations (#5580)
  • Improved PHP 8.5 compatibility (#5568,#5567)
  • Fixed CTRL+ keyboard shortcuts on Mac (#5572)
  • Apply module migrations when the Modules folder resolves outside the app folder (#5574)
  • Allow text/rfc822-headers Content Type when processing incoming bounce messages (#5584)
  • Improve error message check in FetchEmail when sleep time between connections is increased (#5584)
  • Check folder type in empty_folder action (GHSA-6mhr-m8m9-6q6h)
  • Check access to mailboxes when non-admin creates users (GHSA-w36p-9vhj-x273)
]]>https://forum.cloudron.io/post/128491https://forum.cloudron.io/post/128491Mon, 24 Aug 2026 11:59:14 GMT<![CDATA[Reply to FreeScout - Package Updates on Wed, 19 Aug 2026 07:12:39 GMT]]>[1.16.26]

  • Update freescout to 1.8.235
  • Full Changelog
  • Fixed icon tags in the editor (#5564)
  • Fixed variables in mailbox signatures (#5565)
  • Check checkIsOnlyAssigned() when editing or deleting user threads (GHSA-89fj-jcr7-2c68)
  • Perform user->canSeeOnlyAssignedConversations() check in ConversationsController->conversationsFilterQuery() and Conversation::getChats() (GHSA-c83g-9f2m-9cmw)
  • Check HTTP_CF_CONNECTING_IP in Request and escape values in Logs Monitor emails (GHSA-9cm3-qvj2-8hg4)
  • Check user access to the conversation when processing reply to email notification (GHSA-83xx-8c27-gq78)
  • Fixed actor in web notifications (#5566)
  • Removed folder_id_state index from Conversations table.
]]>https://forum.cloudron.io/post/128261https://forum.cloudron.io/post/128261Wed, 19 Aug 2026 07:12:39 GMT<![CDATA[Reply to FreeScout - Package Updates on Mon, 17 Aug 2026 11:20:30 GMT]]>[1.16.25]

  • Update freescout to 1.8.234
  • Full Changelog
  • Custom modules now should use the following functions when working with Conversation statuses:
  • Check conversation status: $conversation->isActive(), $conversation->isPending(), $conversation->isClosed(), $conversation->isSpam()
  • Check if conversation has one of the listed statuses: $conversation->hasStatus() and Conversation::compareStatus()
  • Checking "status" field in a query: Conversation::addStatusCondition()
  • Allow <code> and <kbd> tags in Purifier config (#5556)
  • Allow to extend conversation statuses via hooks.
  • Fixed conversation ID in BroadcastNotification::fetchPayloadData() (#5553)
  • Use Helper::hashEquals() instead of hash_equals().
  • Fixed path to PostTooLargeException (#5560)
  • Check Curl HTTP Code in Helper::getRemoteFileContents() (#5552)
]]>https://forum.cloudron.io/post/128196https://forum.cloudron.io/post/128196Mon, 17 Aug 2026 11:20:30 GMT<![CDATA[Reply to FreeScout - Package Updates on Fri, 07 Aug 2026 07:37:19 GMT]]>[1.16.24]

  • Update freescout to 1.8.233
  • Full Changelog
  • Sound notifications for chat messages.
  • Allow to switch "Waiting Since" field into the "Time of the last customer activity" via WAITING_SINCE_AS_FIRST_UNANSWERED_CUSTOMER_MESSAGE .env parameter (#5225)
  • Fixed CTRL+Z after loading draft in the editor (#4837)
  • Do not insert <hr> tag on CTRL+ENTER click (#4909)
  • Create forward-note for each recipient when forwarding conversation to multiple recipients (#5441)
  • Fixed too long References header in emails to customers (#5542)
  • Fixed Outlook reply separator for incoming emails (#5544)
  • Strip Outlook reply header from the body of replies sent to email notifications (#5545)
  • Allow style attribute in inline elements in Purifier config (#5547)
]]>https://forum.cloudron.io/post/127871https://forum.cloudron.io/post/127871Fri, 07 Aug 2026 07:37:19 GMT<![CDATA[Reply to FreeScout - Package Updates on Thu, 06 Aug 2026 08:22:08 GMT]]>[1.16.23]

  • add white list ip ranges and store mail password encrypted fixing #15783
]]>https://forum.cloudron.io/post/127793https://forum.cloudron.io/post/127793Thu, 06 Aug 2026 08:22:08 GMT<![CDATA[Reply to FreeScout - Package Updates on Fri, 31 Jul 2026 09:53:19 GMT]]>[1.16.22]

  • Update freescout to 1.8.232
  • Full Changelog
  • Use salt in tools.php auth.
  • Return empty value in Helper::decrypt() when decryption fails.
  • Tighten throttling Forgot Password requests (Security: GHSA-jvmv-2qcp-7855)
  • Throttle ResetPasswordController controller.
  • Escape title in symfony ExceptionHandler.
  • Purify mailbox signature HTML on saving.
  • Sanitize module alias on activating a license.
  • Use hash_equals() when checking attachment token.
  • Revert changing last_reply_at field update logic #5501
  • Restrict file extensions uploaded by support agents.
]]>https://forum.cloudron.io/post/127533https://forum.cloudron.io/post/127533Fri, 31 Jul 2026 09:53:19 GMT<![CDATA[Reply to FreeScout - Package Updates on Sat, 25 Jul 2026 19:16:58 GMT]]>[1.16.21]

  • Update freescout to 1.8.231
  • Full Changelog
  • Check customer visibility in load_customer_info ajax action (Security: GHSA-cr68-27qv-p5m4)
  • Restricted access to Assigned Conversations option in user profiles (GHSA-m4hc-rc98-38jc)
  • Change customer when received a reply to a conversation from completely new email address (Security: GHSA-j49f-9g94-3wh4)
  • Tighten throttling in Forgot Password requests (GHSA-jvmv-2qcp-7855)
  • Allow to define PHP path via PHP_PATH .env parameter for tools.php script (#5507)
  • Update customer in threads when merging customers (#5505)
  • Do not allow to send reply till all uploads finished (#5515)
  • Create a new conversation for email notifications forwarded to another mailbox (#4515)
  • Fixed missing space in browser push notifications (#5520)
  • Show warning on Status page when HTTPS is used but SESSION_SECURE_COOKIE=true is not set.
]]>https://forum.cloudron.io/post/127204https://forum.cloudron.io/post/127204Sat, 25 Jul 2026 19:16:58 GMT<![CDATA[Reply to FreeScout - Package Updates on Fri, 24 Jul 2026 10:59:19 GMT]]>[1.16.20]

  • Update description
]]>https://forum.cloudron.io/post/127146https://forum.cloudron.io/post/127146Fri, 24 Jul 2026 10:59:19 GMT<![CDATA[Reply to FreeScout - Package Updates on Sun, 19 Jul 2026 08:32:36 GMT]]>[1.16.19]

  • Update freescout to 1.8.230
  • Full Changelog
  • Save conversation subject when pressing Enter in the subject field (#5492)
  • Do not send notifications to users when customer replies to a Spam conversation.
  • Improved showing bell notifications (#5491)
  • Enabled Core.EscapeNonASCIICharacters in Purifier (#5481)
  • Improved remote URL sanitizing (Security: GHSA-6w8v-qp43-vg2h)
  • Send CSP header in /ajax-html/ URLs (Security: GHSA-2g42-f97q-973x)
  • Fixed real time bell notifications (#5499)
  • Fixed separating replies from Outlook (#5504)
]]>https://forum.cloudron.io/post/126949https://forum.cloudron.io/post/126949Sun, 19 Jul 2026 08:32:36 GMT<![CDATA[Reply to FreeScout - Package Updates on Sat, 04 Jul 2026 20:49:34 GMT]]>[1.16.18]

  • Update freescout to 1.8.229
  • Full Changelog
  • Fixed "Undefined variable $addressString" (#5487)
  • Fixed "Undefined array key 10004" on outbound Guzzle request without a proxy (#5486)
  • Fixed "Undefined variable $ensureAddressesAreSafe" (#5487)
  • Fixed permissions check when merging conversations (Security: GHSA-v8vc-cmf9-gg2c)
  • Patched security issues in dependency libraries: GHSA-vm85-hxw5-5432, GHSA-hq7v-mx3g-29hw, GHSA-34xg-wgjx-8xph, GHSA-cwxw-98qj-8qjx, GHSA-wpwq-4j6v-78m3, GHSA-h5x3-xfc9-m39h, GHSA-5vg9-5847-vvmq
]]>https://forum.cloudron.io/post/126415https://forum.cloudron.io/post/126415Sat, 04 Jul 2026 20:49:34 GMT<![CDATA[Reply to FreeScout - Package Updates on Sat, 27 Jun 2026 19:53:28 GMT]]>[1.16.17]

  • Update freescout to 1.8.226
  • Full Changelog
  • Paginate by SEARCH count so the newest emails are never dropped (#546)
  • Fixed json_decode() error in User::hasManageMailboxPermission() (#5465)
  • Fixed Error 500 in ConversationsController::view when a user has no Mine folder (#5466)
  • Fixed "Could not scan for classes" error (#5469)
  • Escape channel name in LIKE query in PolycastServiceProvider.php (Security: GHSA-gh3r-jh6q-wrvj)
  • Fixed access check in realtime Polycast events (Security: GHSA-gh3r-jh6q-wrvj)
  • Improved RealtimeConvNewThread event access check (Security: GHSA-w668-wq26-6c94)
  • Prevent sending blank email when Summernote leaves empty HTML tags (#5478)
  • Check access permissions when searching conversations by number (Security: GHSA-wqq7-4q7m-273v)
  • Fixed: customer Waiting Since shows time of the last customer message instead of the first (#5475)
]]>https://forum.cloudron.io/post/126189https://forum.cloudron.io/post/126189Sat, 27 Jun 2026 19:53:28 GMT<![CDATA[Reply to FreeScout - Package Updates on Sat, 13 Jun 2026 08:05:48 GMT]]>[1.16.16]

  • Update freescout to 1.8.225
  • Full Changelog
  • Added throttling and authentication in tools.php (Security: GHSA-w2p9-3666-vw9j)
  • Fixed color of texts in logs table (#5442)
  • Patched symfony/routing (Security: CVE-2026-45065)
  • Upgraded symfony/polyfill-intl-idn to 1.38.1 (Security: CVE-2026-46644)
  • Fixed path traversal in Log Viewer (Security: GHSA-9ph7-f3hc-95gg)
  • Moved option to UI: "User can see only assigned conversations" (#701)
  • Improved Helper::stripDangerousTags() to strip nested tags (Security: GHSA-jpq8-j69f-mj98)
  • Fixed saving mailbox signature by non-admin users (#5443)
]]>https://forum.cloudron.io/post/125731https://forum.cloudron.io/post/125731Sat, 13 Jun 2026 08:05:48 GMT<![CDATA[Reply to FreeScout - Package Updates on Sat, 06 Jun 2026 07:49:47 GMT]]>[1.16.15]

  • Update freescout to 1.8.224
  • Full Changelog
  • Added throttling to file upload routes (Security: GHSA-ph4f-2jhx-q76w)
  • Fixed user-setup empty invite_hash issue (Security: GHSA-jqj5-r72v-v29g)
  • Improved downloading log files logic (Security: GHSA-858x-8f77-9vc5)
  • Restricted .pht files upload (Security: GHSA-27vp-fpg8-j8wv)
  • Improved sanitizing customer Websites field.
  • Enabled browser check - now it will be impossible to access FreeScout instance from a browser which does not support CSP.
]]>https://forum.cloudron.io/post/125554https://forum.cloudron.io/post/125554Sat, 06 Jun 2026 07:49:47 GMT<![CDATA[Reply to FreeScout - Package Updates on Sun, 31 May 2026 08:19:58 GMT]]>[1.16.14]

  • Update freescout to 1.8.223
  • Full Changelog
  • Disabled backward compatibility for old Message-ID format on fetching (Security: GHSA-8vm3-wwq4-ggfx)
  • Improved open tracking hash not to conflict with SpamAssasin (#5431)
  • Fixed signature when moving conversation between mailboxes (#5419)
  • Fixed preg_replace_callback() error in Html2Text (#5433)
  • Fixed prototype pollution in getQueryParam() (Security: GHSA-w5fc-8pp3-f755)
  • Fixed fetching message sent to multiple mailboxes from own mailbox (#5434)
]]>https://forum.cloudron.io/post/125309https://forum.cloudron.io/post/125309Sun, 31 May 2026 08:19:58 GMT<![CDATA[Reply to FreeScout - Package Updates on Mon, 25 May 2026 14:31:39 GMT]]>[1.16.13]

  • Update freescout to 1.8.222
  • Full Changelog
  • Updated German translation.
  • Fixed undefined $signature_mailbox error on sending (#5427)
  • Send Auto Reply from the alias the customer emailed to (#5428)
]]>https://forum.cloudron.io/post/125098https://forum.cloudron.io/post/125098Mon, 25 May 2026 14:31:39 GMT<![CDATA[Reply to FreeScout - Package Updates on Sat, 23 May 2026 12:59:16 GMT]]>[1.16.12]

  • Update freescout to 1.8.221
  • Full Changelog
  • Links to attachments uploaded before the FreeScout version of 2020-03-06 will become unavailable. This is a breaking change.
  • Improved permissions check when deleting notes (Security: GHSA-9vx8-gx3p-9mh6)
  • Improved permissions check when editing messages (GHSA-3w38-h42v-3h6w)
  • Fixed signature when moving conversations between mailboxes (#5419)
  • Optimized Helper::stripDangerousTags() to avoid pcre.backtrack_limit hit (#5424)
  • Show detailed error on uploading attachments (#5426)
  • Deprecated links to attachments without a token (Security: GHSA-wg74-ww4w-2qpc)
  • Updated module activation logic.
]]>https://forum.cloudron.io/post/125051https://forum.cloudron.io/post/125051Sat, 23 May 2026 12:59:16 GMT<![CDATA[Reply to FreeScout - Package Updates on Sun, 17 May 2026 16:25:15 GMT]]>[1.16.11]

  • Update freescout to 1.8.220
  • Full Changelog
  • After installing this releases replies sent by agents to the previously received email notifications will not be sent to customers. Only replies to the newly received email notifications will be sent. This is a breaking change.
  • Add configurable threshold to suppress transient fetch errors in Logs Monitoring (#5399)
  • Clear JS and CSS builds when clearing cache.
  • Check hash in replies to user email notifications (Security: GHSA-6r38-6mcf-2ww3)
  • Fixed checking trusted hosts during installation.
  • Activate the module right after activating the license.
]]>https://forum.cloudron.io/post/124787https://forum.cloudron.io/post/124787Sun, 17 May 2026 16:25:15 GMT<![CDATA[Reply to FreeScout - Package Updates on Sat, 09 May 2026 08:04:17 GMT]]>[1.16.10]

  • Update freescout to 1.8.219
  • Full Changelog
  • Added Catalan tranlation (#5376)
  • Show warning message in the interface when browser does not support Content Security Policy (CSP).
  • Fixed an error on PHP 7.1 (#5377)
  • Added table prefix to raw DB queries (#5385)
  • Added hash to open tracking URL (Security: GHSA-qjr9-6v9q-3r72)
  • Added throttle to the Forgot Password form and return identical response regardless of whether the email exists (Security: GHSA-jvmv-2qcp-7855)
  • Fixed error tracking on creating user profile from invite link (#5390)
]]>https://forum.cloudron.io/post/124517https://forum.cloudron.io/post/124517Sat, 09 May 2026 08:04:17 GMT<![CDATA[Reply to FreeScout - Package Updates on Mon, 27 Apr 2026 08:34:49 GMT]]>[1.16.9]

  • Update freescout to 1.8.218
  • Full Changelog
  • Added indexes to several tables (#5328)
  • Fixed decoding ISO-2022-JP emails (#5356)
  • Require DB Password and check PHP Path direcotory in tools.php (Security: GHSA-jx2w-fhmw-rg39)
  • Patched PHPUnit (Security: GHSA-qrr6-mg7r-m243)
  • Fixed Helper::linkify() for emails (#5362)
  • Do not allow to merge convesation with itself.
  • Fixed linking messages into conversations (#5372)
  • Fixed fetching emails into multiple mailboxes (#5368)
  • Do not log "Untrusted host" error (#5361)
  • Allow to use CIDR in APP_REMOTE_HOST_WHITE_LIST (#5363)
]]>https://forum.cloudron.io/post/124042https://forum.cloudron.io/post/124042Mon, 27 Apr 2026 08:34:49 GMT<![CDATA[Reply to FreeScout - Package Updates on Mon, 20 Apr 2026 06:28:09 GMT]]>[1.16.8]

  • Update freescout to 1.8.217
  • Full Changelog
  • Fixed On-Off switch on RTL (#5352)
  • Fixed "Zipper: Path traversal detected" error (#5354)
  • Fixed redirect check in Helper::sanitizeRemoteUrl() (Security: GHSA-22wf-848c-c856)
  • Improved sanitizing Auto Reply message (Security: GHSA-q3fh-rj9h-jfrc)
  • Fixed permissions check for user Notifications settings (Security: GHSA-f489-qxv6-gvgg)
  • Make user invite link expirable after 7 days (Security: GHSA-hqff-cwx7-3jpm)
]]>https://forum.cloudron.io/post/123672https://forum.cloudron.io/post/123672Mon, 20 Apr 2026 06:28:09 GMT