v6.0.0

[![listmonk-logo](https://user-images.githubusercontent.com/547147/134940003-1de03d83-8c7b-459b-8056-baa8d5f3b448.png)](https://listmonk.app)

v6.0.0 is a major release with a significant number of improvements and fixes.

**As always, take a backup of your Postgres database before upgrading.**

## What's new?
- TOTP two-factor authentication.
- E-mail-based `Forgot password` reset flow.
- Ability to archive lists.
- Subscriber activity in the Subscriber profile UI.
- Ability to send transactional mails to non-subscribers via the `/api/tx` API.
- Campaign-level JSON `{}` attributes just like subscriber attributes.
- Granular override on subscriptions / subscriber profile in bulk import.
- In-built Postgres VACUUM cron in `Maintenance` settings for large databases.
- CORS origin configuration in `Security` settings

In addition, there are several other bug fixes and improvements.

## Security
This version [addresses](https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565) the issue of arbitrary <script>s in a campaign created by a non-admin user with the campaign management permission executing when a super admin previews that campaign, allowing API calls on the super admin user's account to execute on their session.

## How to upgrade
**As always, take a backup of your database before upgrading.**

**Binary**

Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again.

**Docker**
```shell
# cd /directory/with/docker-compose.yml

docker-compose down
docker-compose pull && docker-compose run --rm app ./listmonk --upgrade
docker-compose up -d app db
```



## Changelog
* 00f303c2 Add v6.0.0 migration file.
* 5673e61e Add `attribs` to campaign docs.
* 2d560fa5 Upgrade altcha JS to latest version.
* d7a41f75 Auto-translate new i18n language strings.
* 556cb370 Fix Cypres tests.
* e20ed060 Rename v5.2.0 migration to v6.0.0.
* 95528653 Apply minor style fixes to admin.
* f1dd8a4c Add support for campaign-level JSON attributes.
* e49c8d06 Refresh i18n language files.
* a65608c1 Split 'overwrite' on import UI into 2 separate options (userinfo and subscription status). Closes #2496
* 77fb9ddc Fix invalid syntax in bundled visual template.
* 576309d9 Add `viewport` meta tag to visual builder default template. Closes #2751.
* c6bc9a63 Show duration in seconds also on campaigns page. Closes #2796.
* 5f935435 Fix user menu not showing in responsive view on the UI. Closes #2793.
* 74dc5a01 Add sandboxing to campaign preview iframe.
* d8027932 Bump qs from 6.13.1 to 6.14.1 in /frontend (#2844)
* 373682aa Fix and imporve bulk deletion in campaigns and queries.
* 3f5bc8d3 Improve zh-TW (Traditional Chinese) translation (#2840)
* 183d0ea2 Bump github.com/altcha-org/altcha-lib-go from 0.2.2 to 1.0.0 (#2819)
* 787c7585 Fix #2778 'Track Link' status is lost when re-saving an existing link in the Rich Text Editor (#2829)
* 1a68363f Add missing i18n German translations (#2830)
* e215e1e5 Added Cloudron install button in doc (#2826)
* e8fb9d59 Fix incorrect `--new-config` file write error message. Closes #2818.
* c6511173 fix confusing formatting issue in dev setup docs (#2813)
* 55540a21 Remove confusing field validation behaviour on S3 settings UI. Closes #2806.
* e703c37e Add env var support for static-dir and i18n-dir flags (#2807)
* 9feb59f4 Update it.json (#2803)
* a998c91f Correct status field reference in documentation (#2808)
* 1c361647 Translate English phrases to Slovak in sk.json (#2810)
* 045f0ebf Fix broken language string on CAPTCHA settings on UI. Closes #2781.
* 570bb46d Add cron-based `VACUUM ANALYZE` support for DB maintenance.
* 67ad4d54 Add external recipient support to `/api/tx` endpoint.
* 583f92a6 Add bulk deletion (by id or query) to lists and campaigns.
* 2b609073 Add list permission check to campaign creation.
* b46e0d69 Fix list update query returning incorrect state on lists with no campaigns.
* c108a61b Change LISTMONK_db__host from 'listmonk_db' to 'db' (#2787)
* c888b7f8 Update default sample visual template with tracked link examples (#2788)
* 06e6b67a Add Cloudzy logo to providers list on the homepage (#2777)
* e526a5f9 Fix list name not being updated in `campaign_lists` on list update. Closes #2734.
* 20746045 Add archival support to lists.
* 6417f30d Stop recording `to send` count on campaign creation.
* 12b80699 Remove incorrect settings dependency on Media UI.
* 581aad44 Add SMTP status check and basic heuristics to classify hard/soft bounce in POP3 scan.
* 3bf8bdb4 Split queries.sql into multiple files for better readability and maintainability. Closes #2738. (#2776)
* 81704898 Split models file to domain specific files (#2775)
* 750ce91c Fix incorrect doc for `query` param in `/api/campaign`. Closes #2772.
* 60f7ac93 Bump js-yaml from 4.1.0 to 4.1.1 in /frontend/email-builder (#2767)
* 296245a1 Add 2FA TOTP support for authentication.
* 4c3b58cb Bump golang.org/x/crypto from 0.40.0 to 0.45.0 (#2766)
* 75998ca5 Add `Forgot password` reset flow to the admin. Closes #2753.
* ea1eb3f8 Add warning to `users:manage` permission in docs. Closes #2752.
* a2bfc0b7 feat: add subscriber activity tracking UI in admin panel (#2756)
* b3f60a95 Bump js-yaml from 4.1.0 to 4.1.1 in /frontend (#2761)
* 425c0d71 Update 3rd party instructions re Fly.io install (#2757)
* e469296b Fix duplicate operationId in OpenAPI spec (#2758)
* 22bcd70f feat: add Northflank deploy button (#2736)
* 60c069d7 Fix `per_page=all` not working on GET bounces API. Closes #2678.
* b7e8b1ee Fix `tx` handler incorrectly sanitizing `subscriber_emails[]`. Closes #2726.
* cdf0a5c1 Add CORS configuration to security settings.
* 827a2081 Bump vite from 5.4.20 to 5.4.21 in /frontend (#2722)
* e8156e03 Update Czech translation (#2694)
* c666c4ff Bump vite from 5.4.19 to 5.4.20 in /frontend (#2691)
* 39658c44 Add minor security enhancements (#2682)
* 2085abef Handle Postmark spam complaints. (#2679)
* fb60455d Bump vite from 5.4.18 to 5.4.20 in /frontend/email-builder (#2660)
* 27f58efa Bump axios from 1.8.2 to 1.12.0 in /frontend (#2666)
* 06275f19 Update Czech translations (#2688)
* 2c5dc614 Update it.json (#2667)
* d661fa87 Fix typo in docs (#2664)
* a76099e9 incorrect ALTCHA Form challengeurl (#2654)
* 943a961b Update release details on the static homepage.