Axigen 10.6.34

SECURITY

• Update OpenSSL to 3.5.6 LTS (security patch release) and other third-party dependencies (AXI-7218)
• Sanitize email body client-side to block CSS- and SVG-based privacy leaks and UI-redress (AXI-7244)
• Fix privilege escalation in WebAdmin /data/accounts and /metrics endpoints (AXI-7254)
• Fix denial of service scenario in WebMail Proxy (AXI-7255)
• Fix memory leak in ActiveSync (AXI-7266)
• Patch qs and react-router vulnerabilities (AXI-7284)

SERVER

• Fix attachments not being removed from mail queue when upload has failed (AXI-6423)
• Optimize avatar upload (AXI-7007)
• Fix CLI logLevel / output for cert command (AXI-7093)
• Fix crash caused by cacheGC stale iterator (AXI-7176)
• Add support for timezone aliases (AXI-7227)
• Fix batch ranges conversations in search folders non-deterministic ordering (AXI-7237)
• Mailbox API: Fix ability to update / delete avatar and update contact info when user is actually forbidden (AXI-7241)
• Increase maximum transaction cache to allow purging large domain naming tape (AXI-7246)
• Fix memory leak in POP3 Proxy (AXI-7263)
• Fix race in permanent search folder sync that could ignore the last change in a batch (AXI-7280)

WEBADMIN

• Fix incorrect toast message when deleting all queue items fails (AXI-7219)
• Show busy state while Let's Encrypt certificates are generated, renewed, or revoked (AXI-7240)
• Refresh compiled CSS to match current SCSS toolchain output (AXI-7242)

WEBMAIL

• Prevent preloader hang when a folder is named "null", "undefined", "false", "0", or "NaN" (AXI-7235)
• Fix wrong [refwMailId] for reply mails in Conversation View (AXI-4773)