v5.1.0

mikeyobrien/ralph-orchestratorv5.1.0Sep 9, 2025by github-actions[bot]

AI Summary

A security update addressing CSRF prevention (CVE-2025-58430) and introduces ALTCHA CAPTCHA along with UI and OIDC improvements.

Key Highlights

Critical security update: CSRF prevention (CVE-2025-58430)
Replaced hCaptcha with ALTCHA CAPTCHA
Refactored media gallery with improved UX
Added bulk subscriber blocklisting and OIDC user auto-creation

Breaking Changes

Updated `subscription-form.html` template requires changes to CAPTCHA logic

New Features

ALTCHA CAPTCHA support
Bulk subscriber blocklisting
OIDC user auto-creation
Secrets loading from *_FILE environment variables

Full Release Notes

[![listmonk-logo](https://user-images.githubusercontent.com/547147/134940003-1de03d83-8c7b-459b-8056-baa8d5f3b448.png)](https://listmonk.app)

v5.1.0 contains an important security update (CSRF prevention - CVE-2025-58430) along with other minor bug fixes and improvements.

## What's new?
- ALTCHA (self-contained proof-of-work CAPTCHA alternative) in addition to hCaptcha (deprecated)
- Refactored media gallery with a new UI and improved UX.
- Bulk subscriber blocklisting directly from the bounces UI.
- Auto-creation of OIDC users with default user and list roles.

#### Breakings change to subscription-form.html
If you are loading a custom `subscription-form.html` static template with `--static-dir`, you have to update your template with the breaking changes (CAPTCHA logic) from the new [subscription-form.html](https://github.com/knadh/listmonk/blob/v5.1.0/static/public/templates/subscription-form.html)

## How to upgrade
**As always, take a backup of your database before upgrading.**

**Binary**

Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again.

**Docker**
```shell
# cd /directory/with/docker-compose.yml

docker-compose down
docker-compose pull && docker-compose run --rm app ./listmonk --upgrade
docker-compose up -d app db
```

## Changelog
* 30846f84 Ignore altcha.umd.js from frontend build so that goreleaser ignores it.
* e27a3904 Expand the warning on `subscribers:sql_query` permission on arbitrary SQL functions.
* 6d993165 Auto-translate new i18n language strings.
* d4007d51 Fix Go tpl expressions breaking in Visual editor HTML.
* deb41f8d Add i18n translation helper script.
* 81d05e4d Suppress optin e-mail send errors on subscriber insert/edit APIs.
* fcbebc27 Update Cypress trests on the campaign file attach UI.
* e8b0eafc Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 (#2634)
* 301c13a6 Add optional `subject` param to tx API. Closes #2333.
* ad66878e Fix list action icons not showing on the UI based on permissions. Closes #2640.
* fbe4c5c9 Make `session` cookie samesite to prevent CSRF requests.
* ea88b944 Add link for n8n node (#2649)
* 7d388908 Change OIDC init to lazy-load instead of loading once on boot. Fixes #2626.
* 96111646 Refresh i18n language files.
* 09d291e1 Add support for built-in ALTCHA CAPTCHA implementation.
* 38387d00 Fix `List-Unsubscribe` header incorrectly sent on opt-in confirmation. Closes #2619.
* eef00213 Add support for loading secrets from *_FILE env vars in Docker environment.
* 4a93184c Bump tmp from 0.2.3 to 0.2.4 in /frontend (#2617)
* ad67fc62 Refactor landing page on the website.
* 4d74cf45 Tweak log viewer to optionally hide filename from log lines (on the import UI).
* 26c61f8e Bump form-data from 4.0.1 to 4.0.4 in /frontend (#2587)
* fb39d618 Refactor media gallery UI.
* ba24c64f Add subsriber blocklisting on the bounces UI (#2409)
* c9c678c0 Add support for OIDC user auto-creation (#2578)
* 66d7413b Update OpenAPI specification (#2581)
* ae84fa37 Add listmonk-mcp to SDKs documentation (#2573)
* 6b7e4232 Update OIDC doc with latest KeyCloak realm URL (#2568)
* 89b27042 Update deps and remove obsolete `replace` in go.mod. Closes #2567.
* 98d2ad6e Add Korean i18n translation (#2565)
* 38c784fe Update release details on the static homepage.