listmonk v6.0.0 release notes

v6.0.0 is a major release with a significant number of improvements and fixes.

As always, take a backup of your Postgres database before upgrading.

What’s new?

TOTP two-factor authentication.
E-mail-based Forgot password reset flow.
Ability to archive lists.
Subscriber activity in the Subscriber profile UI.
Ability to send transactional mails to non-subscribers via the /api/tx API.
Campaign-level JSON {} attributes just like subscriber attributes.
Granular override on subscriptions / subscriber profile in bulk import.
In-built Postgres VACUUM cron in Maintenance settings for large databases.
CORS origin configuration in Security settings

In addition, there are several other bug fixes and improvements.

Security

This version addresses the issue of arbitrary

How to upgrade

As always, take a backup of your database before upgrading.

Binary

Download the latest binary. Stop and replace the old binary. Run ./listmonk --upgrade. Start the app again.

Docker

# cd /directory/with/docker-compose.yml

docker-compose down
docker-compose pull && docker-compose run --rm app ./listmonk --upgrade
docker-compose up -d app db

Changelog

00f303c2 Add v6.0.0 migration file.
5673e61e Add attribs to campaign docs.
2d560fa5 Upgrade altcha JS to latest version.
d7a41f75 Auto-translate new i18n language strings.
556cb370 Fix Cypres tests.
e20ed060 Rename v5.2.0 migration to v6.0.0.
95528653 Apply minor style fixes to admin.
f1dd8a4c Add support for campaign-level JSON attributes.
e49c8d06 Refresh i18n language files.
a65608c1 Split ‘overwrite’ on import UI into 2 separate options (userinfo and subscription status). Closes #2496
77fb9ddc Fix invalid syntax in bundled visual template.
576309d9 Add viewport meta tag to visual builder default template. Closes #2751.
c6bc9a63 Show duration in seconds also on campaigns page. Closes #2796.
5f935435 Fix user menu not showing in responsive view on the UI. Closes #2793.
74dc5a01 Add sandboxing to campaign preview iframe.
d8027932 Bump qs from 6.13.1 to 6.14.1 in /frontend (#2844)
373682aa Fix and imporve bulk deletion in campaigns and queries.
3f5bc8d3 Improve zh-TW (Traditional Chinese) translation (#2840)
183d0ea2 Bump github.com/altcha-org/altcha-lib-go from 0.2.2 to 1.0.0 (#2819)
787c7585 Fix #2778 ‘Track Link’ status is lost when re-saving an existing link in the Rich Text Editor (#2829)
1a68363f Add missing i18n German translations (#2830)
e215e1e5 Added Cloudron install button in doc (#2826)
e8fb9d59 Fix incorrect --new-config file write error message. Closes #2818.
c6511173 fix confusing formatting issue in dev setup docs (#2813)
55540a21 Remove confusing field validation behaviour on S3 settings UI. Closes #2806.
e703c37e Add env var support for static-dir and i18n-dir flags (#2807)
9feb59f4 Update it.json (#2803)
a998c91f Correct status field reference in documentation (#2808)
1c361647 Translate English phrases to Slovak in sk.json (#2810)
045f0ebf Fix broken language string on CAPTCHA settings on UI. Closes #2781.
570bb46d Add cron-based VACUUM ANALYZE support for DB maintenance.
67ad4d54 Add external recipient support to /api/tx endpoint.
583f92a6 Add bulk deletion (by id or query) to lists and campaigns.
2b609073 Add list permission check to campaign creation.
b46e0d69 Fix list update query returning incorrect state on lists with no campaigns.
c108a61b Change LISTMONK_db__host from ‘listmonk_db’ to ‘db’ (#2787)
c888b7f8 Update default sample visual template with tracked link examples (#2788)
06e6b67a Add Cloudzy logo to providers list on the homepage (#2777)
e526a5f9 Fix list name not being updated in campaign_lists on list update. Closes #2734.
20746045 Add archival support to lists.
6417f30d Stop recording to send count on campaign creation.
12b80699 Remove incorrect settings dependency on Media UI.
581aad44 Add SMTP status check and basic heuristics to classify hard/soft bounce in POP3 scan.
3bf8bdb4 Split queries.sql into multiple files for better readability and maintainability. Closes #2738. (#2776)
81704898 Split models file to domain specific files (#2775)
750ce91c Fix incorrect doc for query param in /api/campaign. Closes #2772.
60f7ac93 Bump js-yaml from 4.1.0 to 4.1.1 in /frontend/email-builder (#2767)
296245a1 Add 2FA TOTP support for authentication.
4c3b58cb Bump golang.org/x/crypto from 0.40.0 to 0.45.0 (#2766)
75998ca5 Add Forgot password reset flow to the admin. Closes #2753.
ea1eb3f8 Add warning to users:manage permission in docs. Closes #2752.
a2bfc0b7 feat: add subscriber activity tracking UI in admin panel (#2756)
b3f60a95 Bump js-yaml from 4.1.0 to 4.1.1 in /frontend (#2761)
425c0d71 Update 3rd party instructions re Fly.io install (#2757)
e469296b Fix duplicate operationId in OpenAPI spec (#2758)
22bcd70f feat: add Northflank deploy button (#2736)
60c069d7 Fix per_page=all not working on GET bounces API. Closes #2678.
b7e8b1ee Fix tx handler incorrectly sanitizing subscriber_emails[]. Closes #2726.
cdf0a5c1 Add CORS configuration to security settings.
827a2081 Bump vite from 5.4.20 to 5.4.21 in /frontend (#2722)
e8156e03 Update Czech translation (#2694)
c666c4ff Bump vite from 5.4.19 to 5.4.20 in /frontend (#2691)
39658c44 Add minor security enhancements (#2682)
2085abef Handle Postmark spam complaints. (#2679)
fb60455d Bump vite from 5.4.18 to 5.4.20 in /frontend/email-builder (#2660)
27f58efa Bump axios from 1.8.2 to 1.12.0 in /frontend (#2666)
06275f19 Update Czech translations (#2688)
2c5dc614 Update it.json (#2667)
d661fa87 Fix typo in docs (#2664)
a76099e9 incorrect ALTCHA Form challengeurl (#2654)
943a961b Update release details on the static homepage.