cypht

v2.10.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

atom e-mail ews imap jmap news-reader

+6 more

php pop3 rss smtp webmail webmail-client

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 1mo

Update symfony/yaml to version 6.4.40 to fix CVE-2026‑45304, CVE-2026‑45305, and CVE-2026‑45133.

Why it matters: The update patches three high‑severity CVEs (CVSS scores above 7) affecting the symfony/yaml dependency; all deployments using versions prior to 6.4.40 must upgrade immediately.

Summary

AI summary

Frontend responsive fixes, backend error handling improvements, SMTP and profile module bug resolutions, workflow validation updates, dependency upgrades.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Update symfony/yaml to 6.4.40 fixing CVE-2026-45304, CVE-2026-45305, and CVE-2026-45133. Update symfony/yaml to 6.4.40 fixing CVE-2026-45304, CVE-2026-45305, and CVE-2026-45133. Source: llm_adapter@2026-06-13 Confidence: high	—
Feature	Low	Enable inline reading pane in combined, search, tag, and feed views. Enable inline reading pane in combined, search, tag, and feed views. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix
Bugfix	Medium	Guard undefined POST keys in privacy_setting_callback preventing fatal errors. Guard undefined POST keys in privacy_setting_callback preventing fatal errors. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Medium	Prevent unread total from resetting to zero on certain actions. Prevent unread total from resetting to zero on certain actions. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Medium	Fix scheduled message send issues in the SMTP module. Fix scheduled message send issues in the SMTP module. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Low	Improve responsive layout and truncate long labels on the frontend. Improve responsive layout and truncate long labels on the frontend. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Low	Fix coverage report failures due to wrong SQLite DSN in CI workflow. Fix coverage report failures due to wrong SQLite DSN in CI workflow. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Low	Remove duplicate --testdox flag causing CI coverage job exit code 1. Remove duplicate --testdox flag causing CI coverage job exit code 1. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Low	Validate Dependabot PR titles and add dependency scopes in CI workflow. Validate Dependabot PR titles and add dependency scopes in CI workflow. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Low	Fix PHP fatal error from array_merge with non‑array argument in backend code. Fix PHP fatal error from array_merge with non‑array argument in backend code. Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Low	Fix TypeError when merging arrays that receive false as an argument. Fix TypeError when merging arrays that receive false as an argument. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Fix TypeError when merging arrays that receive true as an argument. Fix TypeError when merging arrays that receive true as an argument. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Remove duplicate DSN badge on SMTP server change when DSN is unsupported. Remove duplicate DSN badge on SMTP server change when DSN is unsupported. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Fix mobile layout for advanced search results and truncate long list labels. Fix mobile layout for advanced search results and truncate long list labels. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Initialize markdown editor on SPA compose navigation. Initialize markdown editor on SPA compose navigation. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Reset markdown compose body after scheduled send success. Reset markdown compose body after scheduled send success. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Pass sidebar search_terms on SPA search icon click. Pass sidebar search_terms on SPA search icon click. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Exclude contact items from EWS FindItem results to prevent GetItem crash. Exclude contact items from EWS FindItem results to prevent GetItem crash. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Fix PHP fatal error: Uncaught TypeError when array_merge receives false. Fix PHP fatal error: Uncaught TypeError when array_merge receives false. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Fix PHP fatal error: Uncaught TypeError when array_merge receives true. Fix PHP fatal error: Uncaught TypeError when array_merge receives true. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Bugfix	Low	Prevent crash when deleting a folder from a mailbox with active Sieve support. Prevent crash when deleting a folder from a mailbox with active Sieve support. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—

Full changelog

81 changes from 7 contributors (2 new contributors). 44 files were affected.

What's Changed

fix(docker): point docker compose to latest Cypht release 2.9.0 by @IrAlfred in https://github.com/cypht-org/cypht/pull/1968
fix(workflow): fix coverage report failing due to wrong SQLite DSN and phpunit binary by @IrAlfred in https://github.com/cypht-org/cypht/pull/1969
fix(workflow): remove duplicate --testdox flag causing coverage job exit code 1 by @IrAlfred in https://github.com/cypht-org/cypht/pull/1972
fix(workflow): validate dependabot PR titles and add deps scopes by @IrAlfred in https://github.com/cypht-org/cypht/pull/1973
fix(other): uncaught TypeError: array_merge(): Argument #1 must be of type array, false given by @IrAlfred in https://github.com/cypht-org/cypht/pull/1976
build(deps): bump idna from 3.7 to 3.15 in /tests/selenium by @dependabot[bot] in https://github.com/cypht-org/cypht/pull/1971
fix(frontend): improve responsive layout and truncate long labels by @Grandi0z in https://github.com/cypht-org/cypht/pull/1970
refactor(frontend): fix mobile layout for advanced search results and truncate long list labels by @Grandi0z in https://github.com/cypht-org/cypht/pull/1965
fix(frontend): remove duplicate DSN badge on SMTP server change with each server when DSN is unsupported by @IrAlfred in https://github.com/cypht-org/cypht/pull/1977
fix(backend): php fatal error: Uncaught TypeError: array_merge(): Argument #1 must be of type array, true given by @mercihabam in https://github.com/cypht-org/cypht/pull/1978
build(deps): update symfony/yaml to 6.4.40 to fix CVE-2026-45304/45305/45133 by @IrAlfred in https://github.com/cypht-org/cypht/pull/1980
fix(backend): handle undefined array key name by @Baraka24 in https://github.com/cypht-org/cypht/pull/1844
fix(module/smtp): resolve scheduled message send issues by @IrAlfred in https://github.com/cypht-org/cypht/pull/1984
fix(module/profiles): fix table responsiveness and improve delete UX by @IrAlfred in https://github.com/cypht-org/cypht/pull/1985
fix(frontend): init markdown editor on SPA compose navigation by @IrAlfred in https://github.com/cypht-org/cypht/pull/1986
fix(backend): guard undefined POST keys (update and pop) in privacy_setting_callback by @IrAlfred in https://github.com/cypht-org/cypht/pull/1987
fix(other): prevent unread total from resetting to zero by @FrizkyTrixter in https://github.com/cypht-org/cypht/pull/1988
fix(frontend): use attr() over data() to prevent Cash.js hex coercion by @IrAlfred in https://github.com/cypht-org/cypht/pull/1990
fix(docs): fix IMAP_AUTH_TLS comment behavior by @IrAlfred in https://github.com/cypht-org/cypht/pull/1992
fix(frontend): reset markdown compose body after scheduled send success by @IrAlfred in https://github.com/cypht-org/cypht/pull/1993
fix(frontend): pass sidebar search_terms on SPA search icon click by @IrAlfred in https://github.com/cypht-org/cypht/pull/1994
fix(backend): ews exclude contact items from FindItem results to prevent GetItem crash by @IrAlfred in https://github.com/cypht-org/cypht/pull/1995
fix(other): fix some GitHub module issues by @IrAlfred in https://github.com/cypht-org/cypht/pull/1739
fix(module/inline_message): enable inline reading pane in combined, search, tag and feed views by @michaelsmolka in https://github.com/cypht-org/cypht/pull/1997
fix(frontend): render extra header buttons properly without third-party override by @mercihabam in https://github.com/cypht-org/cypht/pull/1996
fix(other): show nav menu on change password page after refresh by @IrAlfred in https://github.com/cypht-org/cypht/pull/2000
fix(backend): "Uncaught Error: Cannot use object of type stdClass as array" thrown when deleting a folder from a mailbox with active Sieve support by @mercihabam in https://github.com/cypht-org/cypht/pull/1999
fix(other): update version reference to 2.10.0 for upcoming release by @IrAlfred in https://github.com/cypht-org/cypht/pull/2003

New Contributors

@FrizkyTrixter made their first contribution in https://github.com/cypht-org/cypht/pull/1988
@michaelsmolka made their first contribution in https://github.com/cypht-org/cypht/pull/1997

Full Changelog: https://github.com/cypht-org/cypht/compare/v2.9.0...v2.10.0

Security Fixes

CVE-2026-45304, CVE-2026-45305, CVE-2026-45133 — update symfony/yaml to 6.4.40

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cypht

Get notified when new releases ship.

About cypht

Cypht: Lightweight Open Source webmail aggregator [PHP, JS]. Supports IMAP/SMTP, JMAP and EWS (Exchange Web Services)