FreeScout - Package Updates

[Package Updates]

[1.16.8]

• Update freescout to 1.8.217
• Full Changelog
• Fixed On-Off switch on RTL (#5352)
• Fixed "Zipper: Path traversal detected" error (#5354)
• Fixed redirect check in Helper::sanitizeRemoteUrl() (Security: GHSA-22wf-848c-c856)
• Improved sanitizing Auto Reply message (Security: GHSA-q3fh-rj9h-jfrc)
• Fixed permissions check for user Notifications settings (Security: GHSA-f489-qxv6-gvgg)
• Make user invite link expirable after 7 days (Security: GHSA-hqff-cwx7-3jpm)

[Package Updates]

[1.16.9]

• Update freescout to 1.8.218
• Full Changelog
• Added indexes to several tables (#5328)
• Fixed decoding ISO-2022-JP emails (#5356)
• Require DB Password and check PHP Path direcotory in tools.php (Security: GHSA-jx2w-fhmw-rg39)
• Patched PHPUnit (Security: GHSA-qrr6-mg7r-m243)
• Fixed Helper::linkify() for emails (#5362)
• Do not allow to merge convesation with itself.
• Fixed linking messages into conversations (#5372)
• Fixed fetching emails into multiple mailboxes (#5368)
• Do not log "Untrusted host" error (#5361)
• Allow to use CIDR in APP_REMOTE_HOST_WHITE_LIST (#5363)

[Package Updates]

[1.16.10]

• Update freescout to 1.8.219
• Full Changelog
• Added Catalan tranlation (#5376)
• Show warning message in the interface when browser does not support Content Security Policy (CSP).
• Fixed an error on PHP 7.1 (#5377)
• Added table prefix to raw DB queries (#5385)
• Added hash to open tracking URL (Security: GHSA-qjr9-6v9q-3r72)
• Added throttle to the Forgot Password form and return identical response regardless of whether the email exists (Security: GHSA-jvmv-2qcp-7855)
• Fixed error tracking on creating user profile from invite link (#5390)

[Package Updates]

[1.16.11]

• Update freescout to 1.8.220
• Full Changelog
• After installing this releases replies sent by agents to the previously received email notifications will not be sent to customers. Only replies to the newly received email notifications will be sent. This is a breaking change.
• Add configurable threshold to suppress transient fetch errors in Logs Monitoring (#5399)
• Clear JS and CSS builds when clearing cache.
• Check hash in replies to user email notifications (Security: GHSA-6r38-6mcf-2ww3)
• Fixed checking trusted hosts during installation.
• Activate the module right after activating the license.

[Package Updates]

[1.16.12]

• Update freescout to 1.8.221
• Full Changelog
• Links to attachments uploaded before the FreeScout version of 2020-03-06 will become unavailable. This is a breaking change.
• Improved permissions check when deleting notes (Security: GHSA-9vx8-gx3p-9mh6)
• Improved permissions check when editing messages (GHSA-3w38-h42v-3h6w)
• Fixed signature when moving conversations between mailboxes (#5419)
• Optimized Helper::stripDangerousTags() to avoid pcre.backtrack_limit hit (#5424)
• Show detailed error on uploading attachments (#5426)
• Deprecated links to attachments without a token (Security: GHSA-wg74-ww4w-2qpc)
• Updated module activation logic.

[Package Updates]

[1.16.13]

• Update freescout to 1.8.222
• Full Changelog
• Updated German translation.
• Fixed undefined $signature_mailbox error on sending (#5427)
• Send Auto Reply from the alias the customer emailed to (#5428)

[Package Updates]

[1.16.14]

• Update freescout to 1.8.223
• Full Changelog
• Disabled backward compatibility for old Message-ID format on fetching (Security: GHSA-8vm3-wwq4-ggfx)
• Improved open tracking hash not to conflict with SpamAssasin (#5431)
• Fixed signature when moving conversation between mailboxes (#5419)
• Fixed preg_replace_callback() error in Html2Text (#5433)
• Fixed prototype pollution in getQueryParam() (Security: GHSA-w5fc-8pp3-f755)
• Fixed fetching message sent to multiple mailboxes from own mailbox (#5434)

[Package Updates]

[1.16.15]

• Update freescout to 1.8.224
• Full Changelog
• Added throttling to file upload routes (Security: GHSA-ph4f-2jhx-q76w)
• Fixed user-setup empty invite_hash issue (Security: GHSA-jqj5-r72v-v29g)
• Improved downloading log files logic (Security: GHSA-858x-8f77-9vc5)
• Restricted .pht files upload (Security: GHSA-27vp-fpg8-j8wv)
• Improved sanitizing customer Websites field.
• Enabled browser check - now it will be impossible to access FreeScout instance from a browser which does not support CSP.

[Package Updates]

[1.16.16]

• Update freescout to 1.8.225
• Full Changelog
• Added throttling and authentication in tools.php (Security: GHSA-w2p9-3666-vw9j)
• Fixed color of texts in logs table (#5442)
• Patched symfony/routing (Security: CVE-2026-45065)
• Upgraded symfony/polyfill-intl-idn to 1.38.1 (Security: CVE-2026-46644)
• Fixed path traversal in Log Viewer (Security: GHSA-9ph7-f3hc-95gg)
• Moved option to UI: "User can see only assigned conversations" (#701)
• Improved Helper::stripDangerousTags() to strip nested tags (Security: GHSA-jpq8-j69f-mj98)
• Fixed saving mailbox signature by non-admin users (#5443)

[Package Updates]

[1.16.17]

• Update freescout to 1.8.226
• Full Changelog
• Paginate by SEARCH count so the newest emails are never dropped (#546)
• Fixed json_decode() error in User::hasManageMailboxPermission() (#5465)
• Fixed Error 500 in ConversationsController::view when a user has no Mine folder (#5466)
• Fixed "Could not scan for classes" error (#5469)
• Escape channel name in LIKE query in PolycastServiceProvider.php (Security: GHSA-gh3r-jh6q-wrvj)
• Fixed access check in realtime Polycast events (Security: GHSA-gh3r-jh6q-wrvj)
• Improved RealtimeConvNewThread event access check (Security: GHSA-w668-wq26-6c94)
• Prevent sending blank email when Summernote leaves empty HTML tags (#5478)
• Check access permissions when searching conversations by number (Security: GHSA-wqq7-4q7m-273v)
• Fixed: customer Waiting Since shows time of the last customer message instead of the first (#5475)

[Package Updates]

[1.16.18]

• Update freescout to 1.8.229
• Full Changelog
• Fixed "Undefined variable $addressString" (#5487)
• Fixed "Undefined array key 10004" on outbound Guzzle request without a proxy (#5486)
• Fixed "Undefined variable $ensureAddressesAreSafe" (#5487)
• Fixed permissions check when merging conversations (Security: GHSA-v8vc-cmf9-gg2c)
• Patched security issues in dependency libraries: GHSA-vm85-hxw5-5432, GHSA-hq7v-mx3g-29hw, GHSA-34xg-wgjx-8xph, GHSA-cwxw-98qj-8qjx, GHSA-wpwq-4j6v-78m3, GHSA-h5x3-xfc9-m39h, GHSA-5vg9-5847-vvmq

[Package Updates]

[1.16.19]

• Update freescout to 1.8.230
• Full Changelog
• Save conversation subject when pressing Enter in the subject field (#5492)
• Do not send notifications to users when customer replies to a Spam conversation.
• Improved showing bell notifications (#5491)
• Enabled Core.EscapeNonASCIICharacters in Purifier (#5481)
• Improved remote URL sanitizing (Security: GHSA-6w8v-qp43-vg2h)
• Send CSP header in /ajax-html/ URLs (Security: GHSA-2g42-f97q-973x)
• Fixed real time bell notifications (#5499)
• Fixed separating replies from Outlook (#5504)

[Package Updates]

[1.16.20]

• Update description

[Package Updates]

[1.16.21]

• Update freescout to 1.8.231
• Full Changelog
• Check customer visibility in load_customer_info ajax action (Security: GHSA-cr68-27qv-p5m4)
• Restricted access to Assigned Conversations option in user profiles (GHSA-m4hc-rc98-38jc)
• Change customer when received a reply to a conversation from completely new email address (Security: GHSA-j49f-9g94-3wh4)
• Tighten throttling in Forgot Password requests (GHSA-jvmv-2qcp-7855)
• Allow to define PHP path via PHP_PATH .env parameter for tools.php script (#5507)
• Update customer in threads when merging customers (#5505)
• Do not allow to send reply till all uploads finished (#5515)
• Create a new conversation for email notifications forwarded to another mailbox (#4515)
• Fixed missing space in browser push notifications (#5520)
• Show warning on Status page when HTTPS is used but SESSION_SECURE_COOKIE=true is not set.

[Package Updates]

[1.16.22]

• Update freescout to 1.8.232
• Full Changelog
• Use salt in tools.php auth.
• Return empty value in Helper::decrypt() when decryption fails.
• Tighten throttling Forgot Password requests (Security: GHSA-jvmv-2qcp-7855)
• Throttle ResetPasswordController controller.
• Escape title in symfony ExceptionHandler.
• Purify mailbox signature HTML on saving.
• Sanitize module alias on activating a license.
• Use hash_equals() when checking attachment token.
• Revert changing last_reply_at field update logic #5501
• Restrict file extensions uploaded by support agents.

[Package Updates]

[1.16.23]

• add white list ip ranges and store mail password encrypted fixing #15783

[Package Updates]

[1.16.24]

• Update freescout to 1.8.233
• Full Changelog
• Sound notifications for chat messages.
• Allow to switch "Waiting Since" field into the "Time of the last customer activity" via WAITING_SINCE_AS_FIRST_UNANSWERED_CUSTOMER_MESSAGE .env parameter (#5225)
• Fixed CTRL+Z after loading draft in the editor (#4837)
• Do not insert <hr> tag on CTRL+ENTER click (#4909)
• Create forward-note for each recipient when forwarding conversation to multiple recipients (#5441)
• Fixed too long References header in emails to customers (#5542)
• Fixed Outlook reply separator for incoming emails (#5544)
• Strip Outlook reply header from the body of replies sent to email notifications (#5545)
• Allow style attribute in inline elements in Purifier config (#5547)

[Package Updates]

[1.16.25]

• Update freescout to 1.8.234
• Full Changelog
• Custom modules now should use the following functions when working with Conversation statuses:
• Check conversation status: $conversation->isActive(), $conversation->isPending(), $conversation->isClosed(), $conversation->isSpam()
• Check if conversation has one of the listed statuses: $conversation->hasStatus() and Conversation::compareStatus()
• Checking "status" field in a query: Conversation::addStatusCondition()
• Allow <code> and <kbd> tags in Purifier config (#5556)
• Allow to extend conversation statuses via hooks.
• Fixed conversation ID in BroadcastNotification::fetchPayloadData() (#5553)
• Use Helper::hashEquals() instead of hash_equals().
• Fixed path to PostTooLargeException (#5560)
• Check Curl HTTP Code in Helper::getRemoteFileContents() (#5552)

[Package Updates]

[1.16.26]

• Update freescout to 1.8.235
• Full Changelog
• Fixed icon tags in the editor (#5564)
• Fixed variables in mailbox signatures (#5565)
• Check checkIsOnlyAssigned() when editing or deleting user threads (GHSA-89fj-jcr7-2c68)
• Perform user->canSeeOnlyAssignedConversations() check in ConversationsController->conversationsFilterQuery() and Conversation::getChats() (GHSA-c83g-9f2m-9cmw)
• Check HTTP_CF_CONNECTING_IP in Request and escape values in Logs Monitor emails (GHSA-9cm3-qvj2-8hg4)
• Check user access to the conversation when processing reply to email notification (GHSA-83xx-8c27-gq78)
• Fixed actor in web notifications (#5566)
• Removed folder_id_state index from Conversations table.

[Package Updates]

[1.16.27]

• Update freescout to 1.8.236
• Full Changelog
• Remove temporary SwiftMailer files in freescout:clean-tmp command (#5558)
• Store conversation number in "Send Errors" log (#5571)
• Trigger user notifications when moving conversations (#5580)
• Improved PHP 8.5 compatibility (#5568,#5567)
• Fixed CTRL+ keyboard shortcuts on Mac (#5572)
• Apply module migrations when the Modules folder resolves outside the app folder (#5574)
• Allow text/rfc822-headers Content Type when processing incoming bounce messages (#5584)
• Improve error message check in FetchEmail when sleep time between connections is increased (#5584)
• Check folder type in empty_folder action (GHSA-6mhr-m8m9-6q6h)
• Check access to mailboxes when non-admin creates users (GHSA-w36p-9vhj-x273)