Notes

This release is mostly bug-fixes.

• Expando handling (%x things) should now be robust, including escaping chars like <
• CLI Crypto is no-longer devel

Thanks

Many thanks to our new contributors:

• Colin Wee (@googlebleh)
• 李经纬 (@ljw20180420)
• Viacheslav Chimishuk (@vchimishuk)

and our regular contributors:

• Alejandro Colomar (@alejandro-colomar)
• Jakub Jindra (@jindraj)
• Carlos Henrique Lima Melara (@charles2910)
• Pietro Cerutti (@gahr)
• Emir Sari (@bitigchi)
• Ryan d’Huart (@homoelectromagneticus)
• Gerrit Rüsing (@kbcb)
• vuori (@vuori)
• James Cook (@falsifian)

Security

• Fixed: CVE-2024-49393
• Fixed: CVE-2024-49394
• #4300 Read the protected Message-ID

Features

• #4336 Allow toggling numeric configs, e.g. :toggle pager_index_lines
• #4427 alias: tag/untag pattern
• query: tag with <space>

Contrib

• #4400 mutt_oauth2.py: Fix reference to client_secret

Bug Fixes

• #4399 fix duplicate save-hook
• #4403 expando: fix escaping
• #4404 browser: fix enter-quit-enter
• #4405 pager: fix repaint
• #4407 config: warn about deprecated variables
• #4425 Refresh alias/query dialog on alias/query format change
• #4433 compose: fix redraw on attachment
• #4436 compose: fix search with arrow_cursor
• #4438 autocrypt: fix copy_normalize_addr()
• alias: fix cli crash
• expando: fix relative dates
• expando: padding default to space

Translations

• 100% German
• 100% Turkish
• 99% Czech
• 99% Slovak
• 82% French

Docs

• drop refs to always-enabled features
• fix typo in unmacro
• fix broken link
• ncrypt: fix typo in config.c

Build

• #4409 Use FreeBSD 14.1 in Cirrus CI

Code

• #4294 Create memory alloc wrappers
• #4391 Don’t return the result of realpath() on failure
• #4417 Fix memory leak in hcache
• #4423 Lots of expando refactoring
• fix type of PatternFlags.tag
• tidy: smime_get_key_by_str()