LoginSign Up
← Back to all sparks
K

Keila

MKT AUTO
Velocity5.0

Open-source email newsletter and marketing automation tool.

www.keila.io ↗

Keila ships a third 0.40 patch for dependency CVEs and drops unsigned unsubscribe links.

email-newsletterself-hostedopen-sourcesecurityopt-in
◆Current state
Keila is an open-source newsletter platform on Elixir/Phoenix. 0.40.0 on 29 October made welcome and double opt-in emails editable and now requires PostgreSQL 14 and TLS. 0.40.1 fixed stored XSS in forms and campaigns, and 0.40.2 on 4 November updates dependencies for three high-severity CVEs, ends support for unsigned pre-0.11 unsubscribe links, signs out other sessions on password change and caps API pages at 1,000 entries.
◆Where it's heading
Two security patches in a week after a feature release suggests a security review is under way. The breaking removal of old unsubscribe links fits the same tightening.
◆Prediction
Further 0.40.x patches are possible while the review continues; the next feature direction is unclear from the entries.

◆Recent moves

  1. 9d ago

    Keila 0.40.2: dependency CVE fixes, unsigned unsubscribe links removed

    The second security patch in a week updates Bandit and two other dependencies for high-severity CVEs. It also removes unsigned unsubscribe links from before 0.11, which breaks links in very old emails, and signs out other sessions on password change.

    View source ↗
  2. 14d ago

    Keila 0.40.1 fixes stored XSS in forms and campaigns

    Keila 0.40.1 fixes several stored XSS vulnerabilities in forms and campaigns and compares link HMAC signatures in constant time. Instances that accept untrusted users should update.

    View source ↗
  3. 16d ago

    Keila 0.40: editable opt-in emails, PostgreSQL 14 and TLS required

    Keila 0.40 makes welcome and double opt-in emails fully editable and adds sortable form fields and Swedish, with breaking changes: PostgreSQL 14 or newer is required and the system mailer now requires STARTTLS instead of opportunistic TLS. Self-hosters need to check versions and SMTP settings before upgrading.

    View source ↗
  4. 2mo ago

    Keila v0.30.3

    v0.30.3 adds campaign ID as a template variable, TLS/STARTTLS and SMTP auth method configurability via environment variables, Liquid template caching for significant render speedups on campaigns with large HTML bodies, and improved query performance for campaign stats and contact counts in large projects.

    View source ↗
  5. 4mo ago

    Keila v0.30.2

    v0.30.2 adds a line-height control for Classic template body text, manual contact status editing from the contact page, and API-created contact events in the activity log — small but useful additions for operators managing contacts programmatically.

    View source ↗
  6. 4mo ago

    Keila v0.30.1

    v0.30.1 patches a block editor crash on new campaign creation and fixes MJML self-closing tag rendering errors — immediate stability fixes following the v0.30.0 major release.

    View source ↗