Back to Catalog
listmonk logo

listmonk

High performance, self-hosted newsletter and mailing list manager

app

Alternative to: mailchimp

Website Repository Docs
About Versions (41)
Back to Versions

v5.1.0

2025-09-09

listmonk-logo

v5.1.0 contains an important security update (CSRF prevention - CVE-2025-58430) along with other minor bug fixes and improvements.

What’s new?

  • ALTCHA (self-contained proof-of-work CAPTCHA alternative) in addition to hCaptcha (deprecated)
  • Refactored media gallery with a new UI and improved UX.
  • Bulk subscriber blocklisting directly from the bounces UI.
  • Auto-creation of OIDC users with default user and list roles.

Breakings change to subscription-form.html

If you are loading a custom subscription-form.html static template with --static-dir, you have to update your template with the breaking changes (CAPTCHA logic) from the new subscription-form.html

How to upgrade

As always, take a backup of your database before upgrading.

Binary

Download the latest binary. Stop and replace the old binary. Run ./listmonk --upgrade. Start the app again.

Docker

# cd /directory/with/docker-compose.yml

docker-compose down
docker-compose pull && docker-compose run --rm app ./listmonk --upgrade
docker-compose up -d app db

Changelog

  • 30846f84 Ignore altcha.umd.js from frontend build so that goreleaser ignores it.
  • e27a3904 Expand the warning on subscribers:sql_query permission on arbitrary SQL functions.
  • 6d993165 Auto-translate new i18n language strings.
  • d4007d51 Fix Go tpl expressions breaking in Visual editor HTML.
  • deb41f8d Add i18n translation helper script.
  • 81d05e4d Suppress optin e-mail send errors on subscriber insert/edit APIs.
  • fcbebc27 Update Cypress trests on the campaign file attach UI.
  • e8b0eafc Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 (#2634)
  • 301c13a6 Add optional subject param to tx API. Closes #2333.
  • ad66878e Fix list action icons not showing on the UI based on permissions. Closes #2640.
  • fbe4c5c9 Make session cookie samesite to prevent CSRF requests.
  • ea88b944 Add link for n8n node (#2649)
  • 7d388908 Change OIDC init to lazy-load instead of loading once on boot. Fixes #2626.
  • 96111646 Refresh i18n language files.
  • 09d291e1 Add support for built-in ALTCHA CAPTCHA implementation.
  • 38387d00 Fix List-Unsubscribe header incorrectly sent on opt-in confirmation. Closes #2619.
  • eef00213 Add support for loading secrets from *_FILE env vars in Docker environment.
  • 4a93184c Bump tmp from 0.2.3 to 0.2.4 in /frontend (#2617)
  • ad67fc62 Refactor landing page on the website.
  • 4d74cf45 Tweak log viewer to optionally hide filename from log lines (on the import UI).
  • 26c61f8e Bump form-data from 4.0.1 to 4.0.4 in /frontend (#2587)
  • fb39d618 Refactor media gallery UI.
  • ba24c64f Add subsriber blocklisting on the bounces UI (#2409)
  • c9c678c0 Add support for OIDC user auto-creation (#2578)
  • 66d7413b Update OpenAPI specification (#2581)
  • ae84fa37 Add listmonk-mcp to SDKs documentation (#2573)
  • 6b7e4232 Update OIDC doc with latest KeyCloak realm URL (#2568)
  • 89b27042 Update deps and remove obsolete replace in go.mod. Closes #2567.
  • 98d2ad6e Add Korean i18n translation (#2565)
  • 38c784fe Update release details on the static homepage.
Changelog on GitHub →