chore(deps): bump jwt from 2.8.1 to 3.2.0

Bumps [jwt](https://github.com/jwt/ruby-jwt) from 2.8.1 to 3.2.0. - [Release notes](https://github.com/jwt/ruby-jwt/releases) - [Changelog](https://github.com/jwt/ruby-jwt/blob/main/CHANGELOG.md) - [Commits](https://github.com/jwt/ruby-jwt/compare/v2.8.1...v3.2.0) --- updated-dependencies: - dependency-name: jwt dependency-version: 3.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
chore(main): release 3.3.6 (#3558 )
2026-06-17 11:45:44 +00:00 · 2026-05-18 19:09:10 +00:00 · 2026-04-28 17:19:33 +01:00 · 2026-04-24 23:03:50 +01:00 · 2026-04-24 22:55:46 +01:00 · 2026-04-24 22:24:18 +01:00
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,10 +52,10 @@ jobs:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - run: docker-compose pull
+      - run: docker compose pull
        env:
          POSTAL_IMAGE: ghcr.io/postalserver/postal:ci-${{ github.sha }}
-      - run: docker-compose run postal sh -c 'bundle exec rspec'
+      - run: docker compose run postal sh -c 'bundle exec rspec'
        env:
          POSTAL_IMAGE: ghcr.io/postalserver/postal:ci-${{ github.sha }}

@@ -63,9 +63,14 @@ jobs:
    name: Release (branch)
    runs-on: ubuntu-latest
    needs: [build]
-    if: startsWith(github.ref, 'refs/heads/')
+    if: >-
+      startsWith(github.ref, 'refs/heads/') &&
+      startsWith(github.ref, 'refs/heads/release-please-') != true &&
+      startsWith(github.ref, 'refs/heads/dependabot/') != true
    steps:
      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v2
      - uses: docker/login-action@v2
@@ -73,22 +78,35 @@ jobs:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - id: tag
+      - id: info
        run: |
-          TAG="${GITHUB_REF#refs/heads/}"
-          if [ -z "$TAG" ]; then exit 1; fi
-          if [[ $TAG == "main" ]]; then TAG="latest"; else TAG="branch-${TAG}"; fi
-          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          IMAGE=ghcr.io/postalserver/postal
+
+          REF="${GITHUB_REF#refs/heads/}"
+          if [ -z "$REF" ]; then exit 1; fi
+
+          VER="$(git describe --tags 2>/dev/null)"
+          echo "version=${VER}" >> "$GITHUB_OUTPUT"
+          echo "branch=${REF}" >> "$GITHUB_OUTPUT"
+
+          echo 'tags<<EOF' >> "$GITHUB_OUTPUT"
+          if [[ "$REF" == "main" ]]; then
+            echo "${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+          else
+            echo "${IMAGE}:branch-${REF}" >> "$GITHUB_OUTPUT"
+          fi
+          echo 'EOF' >> "$GITHUB_OUTPUT"
      - uses: docker/build-push-action@v4
        with:
          push: true
-          tags: |
-            ghcr.io/postalserver/postal:${{ steps.tag.outputs.tag }}
-            ghcr.io/postalserver/postal:commit-${{ github.sha }}
+          tags: ${{ steps.info.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          target: full
          platforms: linux/amd64
+          build-args: |
+            VERSION=${{ steps.info.outputs.version }}
+            BRANCH=${{ steps.info.outputs.branch }}

  publish-image:
    name: Publish Image
--- a/.gitignore
+++ b/.gitignore
@@ -29,7 +29,11 @@ vendor/bundle

 Procfile.local
 VERSION
+BRANCH

 .rubocop-https*
 .env*

+node_modules
+yarn.lock
+
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "3.3.0"
+  ".": "3.3.6"
 }
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.2.2
+3.4.6
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,97 @@

 This file contains all the latest changes and updates to Postal.

+## [3.3.6](https://github.com/postalserver/postal/compare/3.3.5...3.3.6) (2026-04-28)
+
+
+### Bug Fixes
+
+* **messages:** sandbox rendered email HTML as extra XSS defence ([cad2aa6](https://github.com/postalserver/postal/commit/cad2aa6808519a3ff25215f09f4966d9fa3bb372))
+
+
+### Miscellaneous Chores
+
+* ignore node modules and yarn.lock ([b611d57](https://github.com/postalserver/postal/commit/b611d577af79b8e1e75b6d47fa04d1ba03e34eec))
+
+
+### Code Refactoring
+
+* **auth:** tighten return_to validation ([84f4e20](https://github.com/postalserver/postal/commit/84f4e20f05db2d11b0144f95960c956f8221e657))
+* **helpers:** escape interpolated values in select options ([9243524](https://github.com/postalserver/postal/commit/924352403553dcfcc569876ca76c219493fac9d6))
+* **tracking:** remove unused src image proxy ([dca7f90](https://github.com/postalserver/postal/commit/dca7f90b9046247c0d953567be35921167e79d87))
+
+## [3.3.5](https://github.com/postalserver/postal/compare/3.3.4...3.3.5) (2026-02-01)
+
+
+### Bug Fixes
+
+* **deliveries:** escape delivery details to prevent HTML injection ([11419f9](https://github.com/postalserver/postal/commit/11419f99140e13688a9613cab3ee03f8d3cbae45))
+* **health_server:** use rackup handler instead of rack handler ([7c47422](https://github.com/postalserver/postal/commit/7c47422c865e738c4d6af0fed1cca4405288341f))
+* oidc scopes are invalid when concatenated ([#3332](https://github.com/postalserver/postal/issues/3332)) ([9c5f96a](https://github.com/postalserver/postal/commit/9c5f96ae90cf06dcd5db776806865752f667bd95))
+* typo in process logging ([#3212](https://github.com/postalserver/postal/issues/3212)) ([b7e5232](https://github.com/postalserver/postal/commit/b7e5232e077b3c9b7a999dcb6676fba0ec61458e))
+* typo in the credentials page ([fd3c7cc](https://github.com/postalserver/postal/commit/fd3c7ccdf6dc4ee0a76c9523cbd735159e4b8000))
+* update url for v2 config ([#3225](https://github.com/postalserver/postal/issues/3225)) ([e00098b](https://github.com/postalserver/postal/commit/e00098b8003cf37f2708f536871b3ade377aed2d))
+
+
+### Documentation
+
+* **process.rb:** add help about time unit used by metric ([#3339](https://github.com/postalserver/postal/issues/3339)) ([f5325c4](https://github.com/postalserver/postal/commit/f5325c49ff1152ad53eaaec98717ad3412d379ae))
+
+
+### Miscellaneous Chores
+
+* **deps:** upgrade puma, net-imap and other deps ([c03c44b](https://github.com/postalserver/postal/commit/c03c44b442a29aa9881c1e1aae60bead9776a6b6))
+* **dockerfile:** reduce container size ([86de372](https://github.com/postalserver/postal/commit/86de372382bd62bdd5d1372254f8817b0360bd56))
+* remove version from docker-compose.yml ([c78000c](https://github.com/postalserver/postal/commit/c78000ca8f2998aa04648f465060768db6467de6))
+* upgrade resolv to 0.6.2 ([d00d978](https://github.com/postalserver/postal/commit/d00d978872a96369544303d08f6a9d11cdf56b62))
+* upgrade to rails 7.1 and ruby 3.4 ([#3457](https://github.com/postalserver/postal/issues/3457)) ([ab6d443](https://github.com/postalserver/postal/commit/ab6d4430baa33a05f1aa66e776cc2a5bcaa0ede8))
+* upgrade uri gem to 1.0.3 ([f193b8e](https://github.com/postalserver/postal/commit/f193b8e77fc096382ab7aaa6a2c29641b4cb12df))
+
+## [3.3.4](https://github.com/postalserver/postal/compare/3.3.3...3.3.4) (2024-06-20)
+
+
+### Bug Fixes
+
+* fix `postal version` command ([4fa88ac](https://github.com/postalserver/postal/commit/4fa88acea0dececd0eae485506a2ad8268fbea59))
+* fix issue running message pruning task ([3a33e53](https://github.com/postalserver/postal/commit/3a33e53d843584757bb00898746aa059d7616db4))
+* raise NotImplementedError when no call method on a scheduled task ([2b0919c](https://github.com/postalserver/postal/commit/2b0919c1454eabea93db96f50ecbd8e36bb89f1f))
+
+## [3.3.3](https://github.com/postalserver/postal/compare/3.3.2...3.3.3) (2024-04-18)
+
+
+### Bug Fixes
+
+* **legacy-api:** allow _expansions to be provided as true to return all expansions ([39f704c](https://github.com/postalserver/postal/commit/39f704c256fc3e71a1dc009acc77796a1efffead)), closes [#2932](https://github.com/postalserver/postal/issues/2932)
+
+## [3.3.2](https://github.com/postalserver/postal/compare/3.3.1...3.3.2) (2024-03-21)
+
+
+### Code Refactoring
+
+* **versioning:** improve how current version and branch is determined and set ([07c6b31](https://github.com/postalserver/postal/commit/07c6b317f2b9dc04b6a8c88df1e6aa9e54597504))
+
+## [3.3.1](https://github.com/postalserver/postal/compare/3.3.0...3.3.1) (2024-03-21)
+
+
+### Bug Fixes
+
+* **smtp-sender:** ensure relays without a host are excluded ([3a56ec8](https://github.com/postalserver/postal/commit/3a56ec8a74950e0162d98f1af5f58a67a82d6455))
+* **smtp-sender:** fixes `SMTPSender.smtp_relays` ([b3264b9](https://github.com/postalserver/postal/commit/b3264b942776e254d3c351c94c435d172a514e18))
+
+
+### Miscellaneous Chores
+
+* **container:** add the branch name to the container ([bee5098](https://github.com/postalserver/postal/commit/bee509832edc151d97fe5bfc48c4973452873fc8))
+* **github-actions:** don't generate commit- tags ([d65bbe0](https://github.com/postalserver/postal/commit/d65bbe0579037c5df962a18134bc007f5159d7e5))
+* **github-actions:** don't run for dependabot or release-please PRs and fetch whole repo ([adaf2b0](https://github.com/postalserver/postal/commit/adaf2b07502e9ed91290873ad8465051c6fd814f))
+* **github-actions:** include a version string on branch-*/latest images ([64bc7dc](https://github.com/postalserver/postal/commit/64bc7dcf7c0a8e006ab6eb6e8b4a52ad5e7e6528))
+* **ui:** display branch in footer if present ([1823617](https://github.com/postalserver/postal/commit/18236171ebc398c157f2e61b15c7df9f91205284))
+
+
+### Code Refactoring
+
+* remove moonrope but maintain legacy API actions ([#2889](https://github.com/postalserver/postal/issues/2889)) ([4d9654d](https://github.com/postalserver/postal/commit/4d9654dac47d59c760be96388d0421de74d3e6ac))
+
 ## [3.3.0](https://github.com/postalserver/postal/compare/3.2.2...3.3.0) (2024-03-18)


--- a/33
+++ b/33
@@ -1,22 +1,25 @@
-FROM ruby:3.2.2-bullseye AS base
+FROM ruby:3.4.6-slim-bookworm AS base

 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-  software-properties-common dirmngr apt-transport-https \
-  && (curl -sL https://deb.nodesource.com/setup_20.x | bash -) \
+  && apt-get install --no-install-recommends -y curl \
+  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

+RUN (curl -sL https://deb.nodesource.com/setup_20.x | bash -)
+
 # Install main dependencies
 RUN apt-get update && \
  apt-get install -y --no-install-recommends \
-  build-essential  \
-  netcat \
-  curl \
-  libmariadb-dev \
-  libcap2-bin \
-  nano \
-  nodejs
+    build-essential  \
+    netcat-openbsd \
+    libmariadb-dev \
+    libcap2-bin \
+    nano \
+    libyaml-dev \
+    nodejs \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*

 RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/ruby

@@ -31,7 +34,7 @@ RUN mkdir -p /opt/postal/app /opt/postal/config
 WORKDIR /opt/postal/app

 # Install bundler
-RUN gem install bundler -v 2.5.6 --no-doc
+RUN gem install bundler -v 2.7.2 --no-doc

 # Install the latest and active gem dependencies and re-run
 # the appropriate commands to handle installs.
@@ -43,8 +46,10 @@ COPY ./docker/wait-for.sh /docker-entrypoint.sh
 COPY --chown=postal . .

 # Export the version
-ARG VERSION=unspecified
-RUN echo $VERSION > VERSION
+ARG VERSION
+ARG BRANCH
+RUN if [ "$VERSION" != "" ]; then echo $VERSION > VERSION; fi \
+  && if [ "$BRANCH" != "" ]; then echo $BRANCH > BRANCH; fi

 # Set paths for when running in a container
 ENV POSTAL_CONFIG_FILE_PATH=/config/postal.yml
--- a/19
+++ b/19
@@ -1,6 +1,7 @@
 # frozen_string_literal: true

 source "https://rubygems.org"
+gem "abbrev"
 gem "authie"
 gem "autoprefixer-rails"
 gem "bcrypt"
@@ -17,15 +18,18 @@ gem "jwt"
 gem "kaminari"
 gem "klogger-logger"
 gem "konfig-config", "~> 3.0"
+gem "logger"
 gem "mail"
-gem "moonrope"
+gem "mutex_m"
 gem "mysql2"
 gem "nifty-utils"
 gem "nilify_blanks"
 gem "nio4r"
+gem "ostruct"
 gem "prometheus-client"
 gem "puma"
-gem "rails", "= 7.0.8.1"
+gem "rackup"
+gem "rails", "= 7.1.5.2"
 gem "resolv"
 gem "secure_headers"
 gem "sentry-rails"
@@ -48,12 +52,15 @@ end

 group :development do
  gem "annotate"
-  gem "database_cleaner", require: false
-  gem "factory_bot_rails", require: false
-  gem "rspec", require: false
-  gem "rspec-rails", require: false
  gem "rubocop"
  gem "rubocop-rails"
+end
+
+group :test do
+  gem "database_cleaner-active_record"
+  gem "factory_bot_rails"
+  gem "rspec"
+  gem "rspec-rails"
  gem "shoulda-matchers"
  gem "timecop"
  gem "webmock"
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,70 +1,83 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    abbrev (0.1.2)
+    actioncable (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activestorage (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activestorage (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
      mail (>= 2.7.1)
      net-imap
      net-pop
      net-smtp
-    actionmailer (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      actionview (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    actionmailer (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      actionview (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
      mail (~> 2.5, >= 2.5.4)
      net-imap
      net-pop
      net-smtp
-      rails-dom-testing (~> 2.0)
-    actionpack (7.0.8.1)
-      actionview (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-      rack (~> 2.0, >= 2.2.4)
+      rails-dom-testing (~> 2.2)
+    actionpack (7.1.5.2)
+      actionview (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
+      nokogiri (>= 1.8.5)
+      racc
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activestorage (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    actiontext (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activestorage (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (7.0.8.1)
-      activesupport (= 7.0.8.1)
+    actionview (7.1.5.2)
+      activesupport (= 7.1.5.2)
      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.8.1)
-      activesupport (= 7.0.8.1)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (7.1.5.2)
+      activesupport (= 7.1.5.2)
      globalid (>= 0.3.6)
-    activemodel (7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activerecord (7.0.8.1)
-      activemodel (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activestorage (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    activemodel (7.1.5.2)
+      activesupport (= 7.1.5.2)
+    activerecord (7.1.5.2)
+      activemodel (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
+      timeout (>= 0.4.0)
+    activestorage (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
      marcel (~> 1.0)
-      mini_mime (>= 1.1.0)
-    activesupport (7.0.8.1)
+    activesupport (7.1.5.2)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
      minitest (>= 5.1)
+      mutex_m
+      securerandom (>= 0.3)
      tzinfo (~> 2.0)
    addressable (2.8.6)
      public_suffix (>= 2.0.2, < 6.0)
@@ -74,13 +87,14 @@ GEM
      rake (>= 10.4, < 14.0)
    ast (2.4.2)
    attr_required (1.0.2)
-    authie (4.1.3)
-      activerecord (>= 6.1, < 8.0)
+    authie (5.0.0)
+      activerecord (>= 6.1, < 9.0)
    autoprefixer-rails (10.4.13.0)
      execjs (~> 2)
-    base64 (0.2.0)
+    base64 (0.3.0)
    bcrypt (3.1.20)
-    bigdecimal (3.1.6)
+    benchmark (0.4.1)
+    bigdecimal (3.2.3)
    bindata (2.5.0)
    builder (3.2.4)
    chronic (0.10.2)
@@ -91,27 +105,25 @@ GEM
      coffee-script-source
      execjs
    coffee-script-source (1.12.2)
-    concurrent-ruby (1.2.3)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.4)
    crack (1.0.0)
      bigdecimal
      rexml
    crass (1.0.6)
-    database_cleaner (2.0.2)
-      database_cleaner-active_record (>= 2, < 3)
-    database_cleaner-active_record (2.1.0)
+    database_cleaner-active_record (2.2.2)
      activerecord (>= 5.a)
-      database_cleaner-core (~> 2.0.0)
+      database_cleaner-core (~> 2.0)
    database_cleaner-core (2.0.1)
-    date (3.3.4)
-    deep_merge (1.2.2)
-    diff-lcs (1.5.0)
+    date (3.4.1)
+    diff-lcs (1.6.2)
    domain_name (0.6.20240107)
    dotenv (3.0.2)
-    dynamic_form (1.3.1)
-      actionview (> 5.2.0)
-      activemodel (> 5.2.0)
+    drb (2.2.3)
+    dynamic_form (1.2.0)
    email_validator (2.2.4)
      activemodel
+    erb (5.0.2)
    erubi (1.12.0)
    execjs (2.7.0)
    factory_bot (6.4.6)
@@ -128,7 +140,7 @@ GEM
    ffi (1.15.5)
    gelf (3.1.0)
      json
-    globalid (1.2.1)
+    globalid (1.3.0)
      activesupport (>= 6.1)
    haml (6.3.0)
      temple (>= 0.8.2)
@@ -137,8 +149,13 @@ GEM
    hashdiff (1.1.0)
    hashie (5.0.0)
    highline (2.1.0)
-    i18n (1.14.1)
+    i18n (1.14.7)
      concurrent-ruby (~> 1.0)
+    io-console (0.8.1)
+    irb (1.15.2)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
    jquery-rails (4.5.1)
      rails-dom-testing (>= 1, < 3)
      railties (>= 4.2.0)
@@ -151,7 +168,7 @@ GEM
      bindata
      faraday (~> 2.0)
      faraday-follow_redirects
-    jwt (2.8.1)
+    jwt (3.2.0)
      base64
    kaminari (1.2.2)
      activesupport (>= 4.1.0)
@@ -171,7 +188,8 @@ GEM
      rouge (>= 3.30, < 5.0)
    konfig-config (3.0.0)
      hashie
-    loofah (2.22.0)
+    logger (1.7.0)
+    loofah (2.24.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
    mail (2.8.1)
@@ -179,19 +197,14 @@ GEM
      net-imap
      net-pop
      net-smtp
-    marcel (1.0.2)
-    method_source (1.0.0)
+    marcel (1.1.0)
    mini_mime (1.1.5)
-    mini_portile2 (2.8.5)
-    minitest (5.22.2)
-    moonrope (2.0.2)
-      deep_merge (~> 1.0)
-      json
-      rack (>= 1.4)
+    minitest (5.25.5)
+    mutex_m (0.3.0)
    mysql2 (0.5.6)
    net-http (0.4.1)
      uri
-    net-imap (0.4.10)
+    net-imap (0.5.11)
      date
      net-protocol
    net-pop (0.1.2)
@@ -204,17 +217,14 @@ GEM
    nilify_blanks (1.4.0)
      activerecord (>= 4.0.0)
      activesupport (>= 4.0.0)
-    nio4r (2.7.0)
-    nokogiri (1.16.2)
-      mini_portile2 (~> 2.8.2)
+    nio4r (2.7.4)
+    nokogiri (1.18.10-aarch64-linux-gnu)
      racc (~> 1.4)
-    nokogiri (1.16.2-aarch64-linux)
+    nokogiri (1.18.10-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.16.2-arm64-darwin)
+    nokogiri (1.18.10-x86_64-darwin)
      racc (~> 1.4)
-    nokogiri (1.16.2-x86_64-darwin)
-      racc (~> 1.4)
-    nokogiri (1.16.2-x86_64-linux)
+    nokogiri (1.18.10-x86_64-linux-gnu)
      racc (~> 1.4)
    omniauth (2.1.2)
      hashie (>= 3.4.6)
@@ -239,15 +249,22 @@ GEM
      tzinfo
      validate_url
      webfinger (~> 2.0)
+    ostruct (0.6.3)
    parallel (1.22.1)
    parser (3.2.1.1)
      ast (~> 2.4.1)
+    pp (0.6.2)
+      prettyprint
+    prettyprint (0.2.0)
    prometheus-client (4.2.2)
+    psych (5.2.6)
+      date
+      stringio
    public_suffix (5.0.4)
-    puma (6.4.2)
+    puma (7.0.4)
      nio4r (~> 2.0)
-    racc (1.7.3)
-    rack (2.2.8.1)
+    racc (1.8.1)
+    rack (3.2.1)
    rack-oauth2 (2.2.1)
      activesupport
      attr_required
@@ -255,57 +272,69 @@ GEM
      faraday-follow_redirects
      json-jwt (>= 1.11.0)
      rack (>= 2.1.0)
-    rack-protection (3.2.0)
+    rack-protection (4.1.1)
      base64 (>= 0.1.0)
-      rack (~> 2.2, >= 2.2.4)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.1)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
    rack-test (2.1.0)
      rack (>= 1.3)
-    rails (7.0.8.1)
-      actioncable (= 7.0.8.1)
-      actionmailbox (= 7.0.8.1)
-      actionmailer (= 7.0.8.1)
-      actionpack (= 7.0.8.1)
-      actiontext (= 7.0.8.1)
-      actionview (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activemodel (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activestorage (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    rackup (2.2.1)
+      rack (>= 3)
+    rails (7.1.5.2)
+      actioncable (= 7.1.5.2)
+      actionmailbox (= 7.1.5.2)
+      actionmailer (= 7.1.5.2)
+      actionpack (= 7.1.5.2)
+      actiontext (= 7.1.5.2)
+      actionview (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activemodel (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activestorage (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
      bundler (>= 1.15.0)
-      railties (= 7.0.8.1)
+      railties (= 7.1.5.2)
    rails-dom-testing (2.2.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.0)
+    rails-html-sanitizer (1.6.2)
      loofah (~> 2.21)
-      nokogiri (~> 1.14)
-    railties (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-      method_source
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
+      irb
+      rackup (>= 1.0.0)
      rake (>= 12.2)
-      thor (~> 1.0)
-      zeitwerk (~> 2.5)
+      thor (~> 1.0, >= 1.2.2)
+      zeitwerk (~> 2.6)
    rainbow (3.1.1)
    rake (13.1.0)
+    rdoc (6.14.2)
+      erb
+      psych (>= 4.0.0)
    regexp_parser (2.7.0)
-    resolv (0.3.0)
-    rexml (3.2.5)
+    reline (0.6.2)
+      io-console (~> 0.5)
+    resolv (0.6.2)
+    rexml (3.4.4)
    rouge (4.2.0)
-    rspec (3.12.0)
-      rspec-core (~> 3.12.0)
-      rspec-expectations (~> 3.12.0)
-      rspec-mocks (~> 3.12.0)
-    rspec-core (3.12.1)
-      rspec-support (~> 3.12.0)
-    rspec-expectations (3.12.2)
+    rspec (3.13.1)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.5)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-mocks (3.12.4)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
+      rspec-support (~> 3.13.0)
    rspec-rails (6.1.1)
      actionpack (>= 6.1)
      activesupport (>= 6.1)
@@ -314,7 +343,7 @@ GEM
      rspec-expectations (~> 3.12)
      rspec-mocks (~> 3.12)
      rspec-support (~> 3.12)
-    rspec-support (3.12.0)
+    rspec-support (3.13.6)
    rubocop (1.48.1)
      json (~> 2.3)
      parallel (~> 1.10)
@@ -343,6 +372,7 @@ GEM
      sprockets-rails
      tilt
    secure_headers (6.5.0)
+    securerandom (0.4.1)
    sentry-rails (5.16.1)
      railties (>= 5.0)
      sentry-ruby (~> 5.16.1)
@@ -357,6 +387,7 @@ GEM
      actionpack (>= 5.2)
      activesupport (>= 5.2)
      sprockets (>= 3.0.0)
+    stringio (3.1.7)
    swd (2.0.3)
      activesupport (>= 3)
      attr_required (>= 0.0.5)
@@ -366,7 +397,7 @@ GEM
    thor (1.3.0)
    tilt (2.3.0)
    timecop (0.9.8)
-    timeout (0.4.1)
+    timeout (0.4.3)
    turbolinks (5.2.1)
      turbolinks-source (~> 5.2)
    turbolinks-source (5.2.0)
@@ -375,7 +406,7 @@ GEM
    uglifier (4.2.0)
      execjs (>= 0.3.0, < 3)
    unicode-display_width (2.4.2)
-    uri (0.13.0)
+    uri (1.0.3)
    validate_url (1.0.15)
      activemodel (>= 3.0.0)
      public_suffix
@@ -387,8 +418,9 @@ GEM
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.8.1)
-    websocket-driver (0.7.6)
+    webrick (1.9.1)
+    websocket-driver (0.8.0)
+      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
    zeitwerk (2.6.13)
@@ -396,18 +428,18 @@ GEM
 PLATFORMS
  aarch64-linux
  arm64-darwin
-  ruby
  x86_64-darwin
  x86_64-linux

 DEPENDENCIES
+  abbrev
  annotate
  authie
  autoprefixer-rails
  bcrypt
  chronic
  coffee-rails (~> 5.0)
-  database_cleaner
+  database_cleaner-active_record
  domain_name
  dotenv
  dynamic_form
@@ -422,17 +454,20 @@ DEPENDENCIES
  kaminari
  klogger-logger
  konfig-config (~> 3.0)
+  logger
  mail
-  moonrope
+  mutex_m
  mysql2
  nifty-utils
  nilify_blanks
  nio4r
  omniauth-rails_csrf_protection
  omniauth_openid_connect
+  ostruct
  prometheus-client
  puma
-  rails (= 7.0.8.1)
+  rackup
+  rails (= 7.1.5.2)
  resolv
  rspec
  rspec-rails
@@ -449,4 +484,4 @@ DEPENDENCIES
  webrick

 BUNDLED WITH
-   2.5.6
+   2.7.2
--- a/api/authenticator.rb
+++ b/api/authenticator.rb
@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-authenticator :server do
-  friendly_name "Server Authenticator"
-  header "X-Server-API-Key", "The API token for a server that you wish to authenticate with.", example: "f29a45f0d4e1744ebaee"
-  error "InvalidServerAPIKey", "The API token provided in X-Server-API-Key was not valid.", attributes: { token: "The token that was looked up" }
-  error "ServerSuspended", "The mail server has been suspended"
-  lookup do
-    if key = request.headers["X-Server-API-Key"]
-      if credential = Credential.where(type: "API", key: key).first
-        if credential.server.suspended?
-          error "ServerSuspended"
-        else
-          credential.use
-          credential
-        end
-      else
-        error "InvalidServerAPIKey", token: key
-      end
-    end
-  end
-  rule :default, "AccessDenied", "Must be authenticated as a server." do
-    identity.is_a?(Credential)
-  end
-end
-
-authenticator :anonymous do
-  rule :default, "MustNotBeAuthenticated", "Must not be authenticated." do
-    identity.nil?
-  end
-end
--- a/api/controllers/messages_api_controller.rb
+++ b/api/controllers/messages_api_controller.rb
@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-controller :messages do
-  friendly_name "Messages API"
-  description "This API allows you to access message details"
-  authenticator :server
-
-  action :message do
-    title "Return message details"
-    description "Returns all details about a message"
-    param :id, "The ID of the message", type: Integer, required: true
-    returns Hash, structure: :message, structure_opts: { paramable: { expansions: false } }
-    error "MessageNotFound", "No message found matching provided ID", attributes: { id: "The ID of the message" }
-    action do
-      begin
-        message = identity.server.message(params.id)
-      rescue Postal::MessageDB::Message::NotFound
-        error "MessageNotFound", id: params.id
-      end
-      structure :message, message, return: true
-    end
-  end
-
-  action :deliveries do
-    title "Return deliveries for a message"
-    description "Returns an array of deliveries which have been attempted for this message"
-    param :id, "The ID of the message", type: Integer, required: true
-    returns Array, structure: :delivery, structure_opts: { full: true }
-    error "MessageNotFound", "No message found matching provided ID", attributes: { id: "The ID of the message" }
-    action do
-      begin
-        message = identity.server.message(params.id)
-      rescue Postal::MessageDB::Message::NotFound
-        error "MessageNotFound", id: params.id
-      end
-      message.deliveries.map do |d|
-        structure :delivery, d
-      end
-    end
-  end
-end
--- a/api/controllers/send_api_controller.rb
+++ b/api/controllers/send_api_controller.rb
@@ -1,112 +0,0 @@
-# frozen_string_literal: true
-
-controller :send do
-  friendly_name "Send API"
-  description "This API allows you to send messages"
-  authenticator :server
-
-  action :message do
-    title "Send a message"
-    description "This action allows you to send a message by providing the appropriate options"
-    # Acceptable Parameters
-    param :to, "The e-mail addresses of the recipients (max 50)", type: Array
-    param :cc, "The e-mail addresses of any CC contacts (max 50)", type: Array
-    param :bcc, "The e-mail addresses of any BCC contacts (max 50)", type: Array
-    param :from, "The e-mail address for the From header", type: String
-    param :sender, "The e-mail address for the Sender header", type: String
-    param :subject, "The subject of the e-mail", type: String
-    param :tag, "The tag of the e-mail", type: String
-    param :reply_to, "Set the reply-to address for the mail", type: String
-    param :plain_body, "The plain text body of the e-mail", type: String
-    param :html_body, "The HTML body of the e-mail", type: String
-    param :attachments, "An array of attachments for this e-mail", type: Array
-    param :headers, "A hash of additional headers", type: Hash
-    param :bounce, "Is this message a bounce?", type: :boolean
-    # Errors
-    error "ValidationError", "The provided data was not sufficient to send an email", attributes: { errors: "A hash of error details" }
-    error "NoRecipients", "There are no recipients defined to receive this message"
-    error "NoContent", "There is no content defined for this e-mail"
-    error "TooManyToAddresses", "The maximum number of To addresses has been reached (maximum 50)"
-    error "TooManyCCAddresses", "The maximum number of CC addresses has been reached (maximum 50)"
-    error "TooManyBCCAddresses", "The maximum number of BCC addresses has been reached (maximum 50)"
-    error "FromAddressMissing", "The From address is missing and is required"
-    error "UnauthenticatedFromAddress", "The From address is not authorised to send mail from this server"
-    error "AttachmentMissingName", "An attachment is missing a name"
-    error "AttachmentMissingData", "An attachment is missing data"
-    # Return
-    returns Hash
-    # Action
-    action do
-      attributes = {}
-      attributes[:to] = params.to
-      attributes[:cc] = params.cc
-      attributes[:bcc] = params.bcc
-      attributes[:from] = params.from
-      attributes[:sender] = params.sender
-      attributes[:subject] = params.subject
-      attributes[:reply_to] = params.reply_to
-      attributes[:plain_body] = params.plain_body
-      attributes[:html_body] = params.html_body
-      attributes[:bounce] = params.bounce ? true : false
-      attributes[:tag] = params.tag
-      attributes[:custom_headers] = params.headers
-      attributes[:attachments] = []
-      (params.attachments || []).each do |attachment|
-        next unless attachment.is_a?(Hash)
-
-        attributes[:attachments] << { name: attachment["name"], content_type: attachment["content_type"], data: attachment["data"], base64: true }
-      end
-      message = OutgoingMessagePrototype.new(identity.server, request.ip, "api", attributes)
-      message.credential = identity
-      if message.valid?
-        result = message.create_messages
-        { message_id: message.message_id, messages: result }
-      else
-        error message.errors.first
-      end
-    end
-  end
-
-  action :raw do
-    title "Send a raw RFC2822 message"
-    description "This action allows you to send us a raw RFC2822 formatted message along with the recipients that it should be sent to. This is similar to sending a message through our SMTP service."
-    param :mail_from, "The address that should be logged as sending the message", type: String, required: true
-    param :rcpt_to, "The addresses this message should be sent to", type: Array, required: true
-    param :data, "A base64 encoded RFC2822 message to send", type: String, required: true
-    param :bounce, "Is this message a bounce?", type: :boolean
-    returns Hash
-    error "UnauthenticatedFromAddress", "The From address is not authorised to send mail from this server"
-    action do
-      # Decode the raw message
-      raw_message = Base64.decode64(params.data)
-
-      # Parse through mail to get the from/sender headers
-      mail = Mail.new(raw_message.split("\r\n\r\n", 2).first)
-      from_headers = { "from" => mail.from, "sender" => mail.sender }
-      authenticated_domain = identity.server.find_authenticated_domain_from_headers(from_headers)
-
-      # If we're not authenticated, don't continue
-      if authenticated_domain.nil?
-        error "UnauthenticatedFromAddress"
-      end
-
-      # Store the result ready to return
-      result = { message_id: nil, messages: {} }
-      params.rcpt_to.uniq.each do |rcpt_to|
-        message = identity.server.message_db.new_message
-        message.rcpt_to = rcpt_to
-        message.mail_from = params.mail_from
-        message.raw_message = raw_message
-        message.received_with_ssl = true
-        message.scope = "outgoing"
-        message.domain_id = authenticated_domain.id
-        message.credential_id = identity.id
-        message.bounce = params.bounce
-        message.save
-        result[:message_id] = message.message_id if result[:message_id].nil?
-        result[:messages][rcpt_to] = { id: message.id, token: message.token }
-      end
-      result
-    end
-  end
-end
--- a/api/structures/delivery_api_structure.rb
+++ b/api/structures/delivery_api_structure.rb
@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-structure :delivery do
-  basic :id
-  basic :status
-  basic :details
-  basic :output, value: proc { o.output&.strip }
-  basic :sent_with_ssl, value: proc { o.sent_with_ssl }
-  basic :log_id
-  basic :time, value: proc { o.time&.to_f }
-  basic :timestamp, value: proc { o.timestamp.to_f }
-end
--- a/api/structures/message_api_structure.rb
+++ b/api/structures/message_api_structure.rb
@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-structure :message do
-  basic :id
-  basic :token
-
-  expansion(:status) do
-    {
-      status: o.status,
-      last_delivery_attempt: o.last_delivery_attempt&.to_f,
-      held: o.held,
-      hold_expiry: o.hold_expiry&.to_f
-    }
-  end
-
-  expansion(:details) do
-    {
-      rcpt_to: o.rcpt_to,
-      mail_from: o.mail_from,
-      subject: o.subject,
-      message_id: o.message_id,
-      timestamp: o.timestamp.to_f,
-      direction: o.scope,
-      size: o.size,
-      bounce: o.bounce,
-      bounce_for_id: o.bounce_for_id,
-      tag: o.tag,
-      received_with_ssl: o.received_with_ssl
-    }
-  end
-
-  expansion(:inspection) do
-    {
-      inspected: o.inspected,
-      spam: o.spam,
-      spam_score: o.spam_score.to_f,
-      threat: o.threat,
-      threat_details: o.threat_details
-    }
-  end
-
-  expansion(:plain_body) { o.plain_body }
-
-  expansion(:html_body) { o.html_body }
-
-  expansion(:attachments) do
-    o.attachments.map do |attachment|
-      {
-        filename: attachment.filename.to_s,
-        content_type: attachment.mime_type,
-        data: Base64.encode64(attachment.body.to_s),
-        size: attachment.body.to_s.bytesize,
-        hash: Digest::SHA1.hexdigest(attachment.body.to_s)
-      }
-    end
-  end
-
-  expansion(:headers) { o.headers }
-
-  expansion(:raw_message) { Base64.encode64(o.raw_message) }
-
-  expansion(:activity_entries) do
-    {
-      loads: o.loads,
-      clicks: o.clicks
-    }
-  end
-end
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -62,10 +62,13 @@ class ApplicationController < ActionController::Base
  end

  def url_with_return_to(url)
-    if params[:return_to].blank? || !params[:return_to].starts_with?("/")
+    return_to = params[:return_to]
+    if return_to.blank? ||
+       !return_to.start_with?("/") ||
+       return_to.start_with?("//", "/\\")
      url_for(url)
    else
-      params[:return_to]
+      return_to
    end
  end

--- a/app/controllers/legacy_api/base_controller.rb
+++ b/app/controllers/legacy_api/base_controller.rb
@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+module LegacyAPI
+  # The Legacy API is the Postal v1 API which existed from the start with main
+  # aim of allowing e-mails to sent over HTTP rather than SMTP. The API itself
+  # did not feature much functionality. This API was implemented using Moonrope
+  # which was a self documenting API tool, however, is now no longer maintained.
+  # In light of that, these controllers now implement the same functionality as
+  # the original Moonrope API without the actual requirement to use any of the
+  # Moonrope components.
+  #
+  # Important things to note about the API:
+  #
+  #   * Moonrope allow params to be provided as JSON in the body of the request
+  #     along with the application/json content type. It also allowed for params
+  #     to be sent in the 'params' parameter when using the
+  #     application/x-www-form-urlencoded content type. Both methods are supported.
+  #
+  #   * Authentication is performed using a X-Server-API-Key variable.
+  #
+  #   * The method used to make the request is not important. Most clients use POST
+  #     but other methods should be supported. The routing for this legacvy
+  #     API supports GET, POST, PUT and PATCH.
+  #
+  #   * The status code for responses will always be 200 OK. The actual status of
+  #     a request is determined by the value of the 'status' attribute in the
+  #     returned JSON.
+  class BaseController < ActionController::Base
+
+    skip_before_action :set_browser_id
+    skip_before_action :verify_authenticity_token
+
+    before_action :start_timer
+    before_action :authenticate_as_server
+
+    private
+
+    # The Moonrope API spec allows for parameters to be provided in the body
+    # along with the application/json content type or they can be provided,
+    # as JSON, in the 'params' parameter when used with the
+    # application/x-www-form-urlencoded content type. This legacy API needs
+    # support both options for maximum compatibility.
+    #
+    # @return [Hash]
+    def api_params
+      if request.headers["content-type"] =~ /\Aapplication\/json/
+        return params.to_unsafe_hash
+      end
+
+      if params["params"].present?
+        return JSON.parse(params["params"])
+      end
+
+      {}
+    end
+
+    # The API returns a length of time to complete a request. We'll start
+    # a timer when the request starts and then use this method to calculate
+    # the time taken to complete the request.
+    #
+    # @return [void]
+    def start_timer
+      @start_time = Time.now.to_f
+    end
+
+    # The only method available to authenticate to the legacy API is using a
+    # credential from the server itself. This method will attempt to find
+    # that credential from the X-Server-API-Key header and will set the
+    # current_credential instance variable if a token is valid. Otherwise it
+    # will render an error to halt execution.
+    #
+    # @return [void]
+    def authenticate_as_server
+      key = request.headers["X-Server-API-Key"]
+      if key.blank?
+        render_error "AccessDenied",
+                     message: "Must be authenticated as a server."
+        return
+      end
+
+      credential = Credential.where(type: "API", key: key).first
+      if credential.nil?
+        render_error "InvalidServerAPIKey",
+                     message: "The API token provided in X-Server-API-Key was not valid.",
+                     token: key
+        return
+      end
+
+      if credential.server.suspended?
+        render_error "ServerSuspended"
+        return
+      end
+
+      credential.use
+      @current_credential = credential
+    end
+
+    # Render a successful response to the client
+    #
+    # @param [Hash] data
+    # @return [void]
+    def render_success(data)
+      render json: { status: "success",
+                     time: (Time.now.to_f - @start_time).round(3),
+                     flags: {},
+                     data: data }
+    end
+
+    # Render an error response to the client
+    #
+    # @param [String] code
+    # @param [Hash] data
+    # @return [void]
+    def render_error(code, data = {})
+      render json: { status: "error",
+                     time: (Time.now.to_f - @start_time).round(3),
+                     flags: {},
+                     data: data.merge(code: code) }
+    end
+
+    # Render a parameter error response to the client
+    #
+    # @param [String] message
+    # @return [void]
+    def render_parameter_error(message)
+      render json: { status: "parameter-error",
+                     time: (Time.now.to_f - @start_time).round(3),
+                     flags: {},
+                     data: { message: message } }
+    end
+
+  end
+end
--- a/app/controllers/legacy_api/messages_controller.rb
+++ b/app/controllers/legacy_api/messages_controller.rb
@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+module LegacyAPI
+  class MessagesController < BaseController
+
+    # Returns details about a given message
+    #
+    #   URL:            /api/v1/messages/message
+    #
+    #   Parameters:     id              => REQ: The ID of the message
+    #                   _expansions     => An array of types of details t
+    #                                      to return
+    #
+    #   Response:       A hash containing message information
+    #                   OR an error if the message does not exist.
+    #
+    def message
+      if api_params["id"].blank?
+        render_parameter_error "`id` parameter is required but is missing"
+        return
+      end
+
+      message = @current_credential.server.message(api_params["id"])
+      message_hash = { id: message.id, token: message.token }
+      expansions = api_params["_expansions"]
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("status"))
+        message_hash[:status] = {
+          status: message.status,
+          last_delivery_attempt: message.last_delivery_attempt&.to_f,
+          held: message.held,
+          hold_expiry: message.hold_expiry&.to_f
+        }
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("details"))
+        message_hash[:details] = {
+          rcpt_to: message.rcpt_to,
+          mail_from: message.mail_from,
+          subject: message.subject,
+          message_id: message.message_id,
+          timestamp: message.timestamp.to_f,
+          direction: message.scope,
+          size: message.size,
+          bounce: message.bounce,
+          bounce_for_id: message.bounce_for_id,
+          tag: message.tag,
+          received_with_ssl: message.received_with_ssl
+        }
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("inspection"))
+        message_hash[:inspection] = {
+          inspected: message.inspected,
+          spam: message.spam,
+          spam_score: message.spam_score.to_f,
+          threat: message.threat,
+          threat_details: message.threat_details
+        }
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("plain_body"))
+        message_hash[:plain_body] = message.plain_body
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("html_body"))
+        message_hash[:html_body] = message.html_body
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("attachments"))
+        message_hash[:attachments] = message.attachments.map do |attachment|
+          {
+            filename: attachment.filename.to_s,
+            content_type: attachment.mime_type,
+            data: Base64.encode64(attachment.body.to_s),
+            size: attachment.body.to_s.bytesize,
+            hash: Digest::SHA1.hexdigest(attachment.body.to_s)
+          }
+        end
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("headers"))
+        message_hash[:headers] = message.headers
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("raw_message"))
+        message_hash[:raw_message] = Base64.encode64(message.raw_message)
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("activity_entries"))
+        message_hash[:activity_entries] = {
+          loads: message.loads,
+          clicks: message.clicks
+        }
+      end
+
+      render_success message_hash
+    rescue Postal::MessageDB::Message::NotFound
+      render_error "MessageNotFound",
+                   message: "No message found matching provided ID",
+                   id: api_params["id"]
+    end
+
+    # Returns all the deliveries for a given message
+    #
+    #   URL:            /api/v1/messages/deliveries
+    #
+    #   Parameters:     id              => REQ: The ID of the message
+    #
+    #   Response:       A array of hashes containing delivery information
+    #                   OR an error if the message does not exist.
+    #
+    def deliveries
+      if api_params["id"].blank?
+        render_parameter_error "`id` parameter is required but is missing"
+        return
+      end
+
+      message = @current_credential.server.message(api_params["id"])
+      deliveries = message.deliveries.map do |d|
+        {
+          id: d.id,
+          status: d.status,
+          details: d.details,
+          output: d.output&.strip,
+          sent_with_ssl: d.sent_with_ssl,
+          log_id: d.log_id,
+          time: d.time&.to_f,
+          timestamp: d.timestamp.to_f
+        }
+      end
+      render_success deliveries
+    rescue Postal::MessageDB::Message::NotFound
+      render_error "MessageNotFound",
+                   message: "No message found matching provided ID",
+                   id: api_params["id"]
+    end
+
+  end
+end
--- a/app/controllers/legacy_api/send_controller.rb
+++ b/app/controllers/legacy_api/send_controller.rb
@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+module LegacyAPI
+  class SendController < BaseController
+
+    ERROR_MESSAGES = {
+      "NoRecipients" => "There are no recipients defined to receive this message",
+      "NoContent" => "There is no content defined for this e-mail",
+      "TooManyToAddresses" => "The maximum number of To addresses has been reached (maximum 50)",
+      "TooManyCCAddresses" => "The maximum number of CC addresses has been reached (maximum 50)",
+      "TooManyBCCAddresses" => "The maximum number of BCC addresses has been reached (maximum 50)",
+      "FromAddressMissing" => "The From address is missing and is required",
+      "UnauthenticatedFromAddress" => "The From address is not authorised to send mail from this server",
+      "AttachmentMissingName" => "An attachment is missing a name",
+      "AttachmentMissingData" => "An attachment is missing data"
+    }.freeze
+
+    # Send a message with the given options
+    #
+    #   URL:            /api/v1/send/message
+    #
+    #   Parameters:     to              => REQ: An array of emails addresses
+    #                   cc              => An array of email addresses to CC
+    #                   bcc             => An array of email addresses to BCC
+    #                   from            => The name/email to send the email from
+    #                   sender          => The name/email of the 'Sender'
+    #                   reply_to        => The name/email of the 'Reply-to'
+    #                   plain_body      => The plain body
+    #                   html_body       => The HTML body
+    #                   bounce          => Is this message a bounce?
+    #                   tag             => A custom tag to add to the message
+    #                   custom_headers  => A hash of custom headers
+    #                   attachments     => An array of attachments
+    #                                      (name, content_type and data (base64))
+    #
+    #   Response:       A array of hashes containing message information
+    #                   OR an error if there is an issue sending the message
+    #
+    def message
+      attributes = {}
+      attributes[:to] = api_params["to"]
+      attributes[:cc] = api_params["cc"]
+      attributes[:bcc] = api_params["bcc"]
+      attributes[:from] = api_params["from"]
+      attributes[:sender] = api_params["sender"]
+      attributes[:subject] = api_params["subject"]
+      attributes[:reply_to] = api_params["reply_to"]
+      attributes[:plain_body] = api_params["plain_body"]
+      attributes[:html_body] = api_params["html_body"]
+      attributes[:bounce] = api_params["bounce"] ? true : false
+      attributes[:tag] = api_params["tag"]
+      attributes[:custom_headers] = api_params["headers"] if api_params["headers"]
+      attributes[:attachments] = []
+
+      (api_params["attachments"] || []).each do |attachment|
+        next unless attachment.is_a?(Hash)
+
+        attributes[:attachments] << { name: attachment["name"], content_type: attachment["content_type"], data: attachment["data"], base64: true }
+      end
+
+      message = OutgoingMessagePrototype.new(@current_credential.server, request.ip, "api", attributes)
+      message.credential = @current_credential
+      if message.valid?
+        result = message.create_messages
+        render_success message_id: message.message_id, messages: result
+      else
+        render_error message.errors.first, message: ERROR_MESSAGES[message.errors.first]
+      end
+    end
+
+    # Send a message by providing a raw message
+    #
+    #   URL:            /api/v1/send/raw
+    #
+    #   Parameters:     rcpt_to         => REQ: An array of email addresses to send
+    #                                      the message to
+    #                   mail_from       => REQ: the address to send the email from
+    #                   data            => REQ: base64-encoded mail data
+    #
+    #   Response:       A array of hashes containing message information
+    #                   OR an error if there is an issue sending the message
+    #
+    def raw
+      unless api_params["rcpt_to"].is_a?(Array)
+        render_parameter_error "`rcpt_to` parameter is required but is missing"
+        return
+      end
+
+      if api_params["mail_from"].blank?
+        render_parameter_error "`mail_from` parameter is required but is missing"
+        return
+      end
+
+      if api_params["data"].blank?
+        render_parameter_error "`data` parameter is required but is missing"
+        return
+      end
+
+      # Decode the raw message
+      raw_message = Base64.decode64(api_params["data"])
+
+      # Parse through mail to get the from/sender headers
+      mail = Mail.new(raw_message.split("\r\n\r\n", 2).first)
+      from_headers = { "from" => mail.from, "sender" => mail.sender }
+      authenticated_domain = @current_credential.server.find_authenticated_domain_from_headers(from_headers)
+
+      # If we're not authenticated, don't continue
+      if authenticated_domain.nil?
+        render_error "UnauthenticatedFromAddress"
+        return
+      end
+
+      # Store the result ready to return
+      result = { message_id: nil, messages: {} }
+      if api_params["rcpt_to"].is_a?(Array)
+        api_params["rcpt_to"].uniq.each do |rcpt_to|
+          message = @current_credential.server.message_db.new_message
+          message.rcpt_to = rcpt_to
+          message.mail_from = api_params["mail_from"]
+          message.raw_message = raw_message
+          message.received_with_ssl = true
+          message.scope = "outgoing"
+          message.domain_id = authenticated_domain.id
+          message.credential_id = @current_credential.id
+          message.bounce = api_params["bounce"] ? true : false
+          message.save
+          result[:message_id] = message.message_id if result[:message_id].nil?
+          result[:messages][rcpt_to] = { id: message.id, token: message.token }
+        end
+      end
+      render_success result
+    end
+
+  end
+end
--- a/app/controllers/messages_controller.rb
+++ b/app/controllers/messages_controller.rb
@@ -89,6 +89,18 @@ class MessagesController < ApplicationController
  end

  def html_raw
+    override_content_security_policy_directives(
+      default_src: %w('none'),
+      script_src: %w('none'),
+      style_src: %w('unsafe-inline'),
+      img_src: %w(* data:),
+      font_src: %w(*),
+      frame_ancestors: %w('self'),
+      form_action: %w('none'),
+      base_uri: %w('none')
+    )
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["Referrer-Policy"] = "no-referrer"
    render html: @message.html_body_without_tracking_image.html_safe
  end

--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -3,6 +3,7 @@
 module ApplicationHelper

  def format_delivery_details(server, text)
+    text = h(text)
    text.gsub!(/<msg:(\d+)>/) do
      id = ::Regexp.last_match(1).to_i
      link_to("message ##{id}", organization_server_message_path(server.organization, server, id), class: "u-link")
@@ -32,7 +33,7 @@ module ApplicationHelper
        s << "<optgroup label='Server Domains'>"
        server_domains.each do |domain|
          selected = domain == selected_domain ? "selected='selected'" : ""
-          s << "<option value='#{domain.id}' #{selected}>#{domain.name}</option>"
+          s << "<option value='#{h(domain.id)}' #{selected}>#{h(domain.name)}</option>"
        end
        s << "</optgroup>"
      end
@@ -42,7 +43,7 @@ module ApplicationHelper
        s << "<optgroup label='Organization Domains'>"
        organization_domains.each do |domain|
          selected = domain == selected_domain ? "selected='selected'" : ""
-          s << "<option value='#{domain.id}' #{selected}>#{domain.name}</option>"
+          s << "<option value='#{h(domain.id)}' #{selected}>#{h(domain.name)}</option>"
        end
        s << "</optgroup>"
      end
@@ -59,7 +60,7 @@ module ApplicationHelper
        http_endpoints.each do |endpoint|
          value = "#{endpoint.class}##{endpoint.uuid}"
          selected = value == selected_value ? "selected='selected'" : ""
-          s << "<option value='#{value}' #{selected}>#{endpoint.description}</option>"
+          s << "<option value='#{h(value)}' #{selected}>#{h(endpoint.description)}</option>"
        end
        s << "</optgroup>"
      end
@@ -70,7 +71,7 @@ module ApplicationHelper
        smtp_endpoints.each do |endpoint|
          value = "#{endpoint.class}##{endpoint.uuid}"
          selected = value == selected_value ? "selected='selected'" : ""
-          s << "<option value='#{value}' #{selected}>#{endpoint.description}</option>"
+          s << "<option value='#{h(value)}' #{selected}>#{h(endpoint.description)}</option>"
        end
        s << "</optgroup>"
      end
@@ -81,7 +82,7 @@ module ApplicationHelper
        address_endpoints.each do |endpoint|
          value = "#{endpoint.class}##{endpoint.uuid}"
          selected = value == selected_value ? "selected='selected'" : ""
-          s << "<option value='#{value}' #{selected}>#{endpoint.address}</option>"
+          s << "<option value='#{h(value)}' #{selected}>#{h(endpoint.address)}</option>"
        end
        s << "</optgroup>"
      end
@@ -93,11 +94,18 @@ module ApplicationHelper

          selected = (selected_value == mode ? "selected='selected'" : "")
          text = t("route_modes.#{mode.underscore}")
-          s << "<option value='#{mode}' #{selected}>#{text}</option>"
+          s << "<option value='#{h(mode)}' #{selected}>#{h(text)}</option>"
        end
        s << "</optgroup>"
      end
    end.html_safe
  end

+  def postal_version_string
+    string = Postal.version
+    string += " (#{Postal.branch})" if Postal.branch &&
+                                       Postal.branch != "main"
+    string
+  end
+
 end
--- a/app/lib/worker/process.rb
+++ b/app/lib/worker/process.rb
@@ -202,7 +202,7 @@ module Worker
          logger.info "stopping tasks thread"
          ActiveRecord::Base.connection_pool.with_connection do
            if WorkerRole.release(:tasks)
-              logger.info "releasesd tasks role"
+              logger.info "released tasks role"
            end
          end
        end
@@ -298,7 +298,7 @@ module Worker
                                  labels: [:thread, :job]

      register_prometheus_histogram :postal_worker_job_runtime,
-                                    docstring: "The time taken to process jobs",
+                                    docstring: "The time taken to process jobs (in seconds)",
                                    labels: [:thread, :job]

      register_prometheus_counter :postal_worker_errors,
@@ -306,11 +306,11 @@ module Worker
                                  labels: [:error]

      register_prometheus_histogram :postal_worker_task_runtime,
-                                    docstring: "The time taken to process tasks",
+                                    docstring: "The time taken to process tasks (in seconds)",
                                    labels: [:task]

      register_prometheus_histogram :postal_message_queue_latency,
-                                    docstring: "The length of time between a message being queued and being dequeued"
+                                    docstring: "The length of time between a message being queued and being dequeued (in seconds)"
    end

  end
--- a/app/models/credential.rb
+++ b/app/models/credential.rb
@@ -31,7 +31,7 @@ class Credential < ApplicationRecord
  validate :validate_key_cannot_be_changed
  validate :validate_key_for_smtp_ip

-  serialize :options, Hash
+  serialize :options, type: Hash

  before_validation :generate_key

--- a/app/models/webhook_request.rb
+++ b/app/models/webhook_request.rb
@@ -34,7 +34,7 @@ class WebhookRequest < ApplicationRecord
  validates :url, presence: true
  validates :event, presence: true

-  serialize :payload, Hash
+  serialize :payload, type: Hash

  class << self

--- a/app/scheduled_tasks/application_scheduled_task.rb
+++ b/app/scheduled_tasks/application_scheduled_task.rb
@@ -7,7 +7,7 @@ class ApplicationScheduledTask
  end

  def call
-    # override me
+    raise NotImplementedError
  end

  attr_reader :logger
--- a/app/scheduled_tasks/process_message_retention_scheduled_task.rb
+++ b/app/scheduled_tasks/process_message_retention_scheduled_task.rb
@@ -2,7 +2,7 @@

 class ProcessMessageRetentionScheduledTask < ApplicationScheduledTask

-  def perform
+  def call
    Server.all.each do |server|
      if server.raw_message_retention_days
        # If the server has a maximum number of retained raw messages, remove any that are older than this
--- a/app/senders/smtp_sender.rb
+++ b/app/senders/smtp_sender.rb
@@ -244,11 +244,11 @@ class SMTPSender < BaseSender
      relays = Postal::Config.postal.smtp_relays
      return nil if relays.nil?

-      relays.map do |relay|
+      relays = relays.filter_map do |relay|
        next unless relay.host.present?

-        SMTPClient::Server.new(relay.host, relay.port, ssl_mode: relay.ssl_mode)
-      end.compact
+        SMTPClient::Server.new(relay.host, port: relay.port, ssl_mode: relay.ssl_mode)
+      end

      @smtp_relays = relays.empty? ? nil : relays
    end
--- a/app/util/health_server.rb
+++ b/app/util/health_server.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true

 require "socket"
-require "rack/handler/webrick"
+require "rackup/handler/webrick"
 require "prometheus/client/formats/text"

 class HealthServer
@@ -55,11 +55,11 @@ class HealthServer
      port = ENV.fetch("HEALTH_SERVER_PORT", default_port)
      bind_address = ENV.fetch("HEALTH_SERVER_BIND_ADDRESS", default_bind_address)

-      Rack::Handler::WEBrick.run(new(**options),
-                                 Port: port,
-                                 BindAddress: bind_address,
-                                 AccessLog: [],
-                                 Logger: LoggerProxy.new)
+      Rackup::Handler::WEBrick.run(new(**options),
+                                   Port: port,
+                                   BindAddress: bind_address,
+                                   AccessLog: [],
+                                   Logger: LoggerProxy.new)
    rescue Errno::EADDRINUSE
      Postal.logger.info "health server port (#{bind_address}:#{port}) is already " \
                         "in use, not starting health server"
@@ -95,7 +95,7 @@ class HealthServer
        Postal.logger.info "stopped health server", component: "health-server"
      when /\AWEBrick [\d.]+/,
           /\Aruby ([\d.]+)/,
-           /\ARack::Handler::WEBrick is mounted/,
+           /\ARackup::Handler::WEBrick is mounted/,
           /\Aclose TCPSocket/,
           /\Agoing to shutdown/
        # Don't actually print routine messages to avoid too much
--- a/app/views/credentials/_form.html.haml
+++ b/app/views/credentials/_form.html.haml
@@ -38,7 +38,7 @@
        = f.select :hold, [["Process all messages", false], ["Hold messages from this credential", true]], {}, :class => 'input input--select'
        %p.fieldSet__text
          You may wish to automatically hold all messages that are sent by this credential. This allows you to preview them
-          for they are delivered to their recipients. This is useful for credentials for development environments.
+          before they are delivered to their recipients. This is useful for credentials for development environments.

  .fieldSetSubmit.buttonSet
    = f.submit @credential.new_record? ? "Create credential" : "Save credential", :class => 'button button--positive js-form-submit'
--- a/app/views/layouts/application.html.haml
+++ b/app/views/layouts/application.html.haml
@@ -55,6 +55,8 @@
        %footer.siteContent__footer
          %ul.footer__links
            %li.footer__name
-              Powered by #{link_to "Postal", "https://postalserver.io", target: '_blank'} #{Postal.version}.
+              Powered by
+              #{link_to "Postal", "https://postalserver.io", target: '_blank'}
+              #{postal_version_string}
            %li= link_to "Documentation", "https://docs.postalserver.io", target: '_blank'
            %li= link_to "Ask for help", "https://discussions.postalserver.io", target: '_blank'
--- a/app/views/messages/html.html.haml
+++ b/app/views/messages/html.html.haml
@@ -14,4 +14,4 @@
        This means that we no longer store the raw data for this e-mail
        or the e-mail didn't include a HTML part.
 - else
-  %iframe{:width => "100%", :height => "100%", :src => html_raw_organization_server_message_path(organization, @server, @message.id)}
+  %iframe{:width => "100%", :height => "100%", :sandbox => "allow-popups allow-popups-to-escape-sandbox", :referrerpolicy => "no-referrer", :src => html_raw_organization_server_message_path(organization, @server, @message.id)}
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -6,7 +6,7 @@ Rails.application.configure do
  # In the development environment your application's code is reloaded on
  # every request. This slows down response time but is perfect for development
  # since you don't have to restart the web server when you make code changes.
-  config.cache_classes = false
+  config.enable_reloading = true

  # Do not eager load code on boot.
  config.eager_load = false
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -4,7 +4,7 @@ Rails.application.configure do
  # Settings specified here will take precedence over those in config/application.rb.

  # Code is not reloaded between requests.
-  config.cache_classes = true
+  config.enable_reloading = false

  # Eager load code on boot. This eager loads most of Rails and
  # your application in memory, allowing both threaded web servers
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -7,7 +7,7 @@ Rails.application.configure do
  # test suite. You never need to work with it otherwise. Remember that
  # your test database is "scratch space" for the test suite and is wiped
  # and recreated between test runs. Don't rely on the data there!
-  config.cache_classes = true
+  config.enable_reloading = false

  # Do not eager load code on boot. This avoids loading your whole application
  # just for the purpose of running a single test. If you are using a tool that
--- a/config/initializers/secret_key.rb
+++ b/config/initializers/secret_key.rb
@@ -1,8 +1,8 @@
 # frozen_string_literal: true

 if Postal::Config.rails.secret_key
-  Rails.application.secrets.secret_key_base = Postal::Config.rails.secret_key
+  Rails.application.credentials.secret_key_base = Postal::Config.rails.secret_key
 else
  warn "No secret key was specified in the Postal config file. Using one for just this session"
-  Rails.application.secrets.secret_key_base = SecureRandom.hex(128)
+  Rails.application.credentials.secret_key_base = SecureRandom.hex(128)
 end
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,6 +1,12 @@
 # frozen_string_literal: true

 Rails.application.routes.draw do
+  # Legacy API Routes
+  match "/api/v1/send/message" => "legacy_api/send#message", via: [:get, :post, :patch, :put]
+  match "/api/v1/send/raw" => "legacy_api/send#raw", via: [:get, :post, :patch, :put]
+  match "/api/v1/messages/message" => "legacy_api/messages#message", via: [:get, :post, :patch, :put]
+  match "/api/v1/messages/deliveries" => "legacy_api/messages#deliveries", via: [:get, :post, :patch, :put]
+
  scope "org/:org_permalink", as: "organization" do
    resources :domains, only: [:index, :new, :create, :destroy] do
      match :verify, on: :member, via: [:get, :post]
--- a/doc/config/environment-variables.md
+++ b/doc/config/environment-variables.md
@@ -105,7 +105,7 @@ This document contains all the environment variables which are available for thi
 | `OIDC_ISSUER` | String | The OIDC issuer URL |  |
 | `OIDC_IDENTIFIER` | String | The client ID for OIDC |  |
 | `OIDC_SECRET` | String | The client secret for OIDC |  |
-| `OIDC_SCOPES` | Array of strings | Scopes to request from the OIDC server. | openid,email |
+| `OIDC_SCOPES` | Array of strings | Scopes to request from the OIDC server. | ["openid", "email"] |
 | `OIDC_UID_FIELD` | String | The field to use to determine the user's UID | sub |
 | `OIDC_EMAIL_ADDRESS_FIELD` | String | The field to use to determine the user's email address | email |
 | `OIDC_NAME_FIELD` | String | The field to use to determine the user's name | name |
--- a/doc/config/yaml.yml
+++ b/doc/config/yaml.yml
@@ -239,7 +239,8 @@ oidc:
  secret: 
  # Scopes to request from the OIDC server.
  scopes:
-    - openid,email
+    - openid
+    - email
  # The field to use to determine the user's UID
  uid_field: sub
  # The field to use to determine the user's email address
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,3 @@
-version: "3"
 services:
  postal:
    image: ${POSTAL_IMAGE}
--- a/lib/postal/config.rb
+++ b/lib/postal/config.rb
@@ -13,7 +13,6 @@ require "dotenv"
 require "klogger"

 require_relative "error"
-require_relative "version"
 require_relative "config_schema"
 require_relative "legacy_config_source"
 require_relative "signer"
@@ -59,7 +58,7 @@ module Postal
          unless silence_config_messages
            warn "WARNING: Using legacy config file format. Upgrade your postal.yml to use"
            warn "version 2 of the Postal configuration or configure using environment"
-            warn "variables. See https://postalserver.io/config-v2 for details."
+            warn "variables. See https://docs.postalserver.io/config-v2 for details."
          end
          sources << LegacyConfigSource.new(yaml)
        when 2
@@ -131,7 +130,7 @@ module Postal
          notifier.notify!(short_message: short_message, **{
            facility: Config.gelf.facility,
            _environment: Config.rails.environment,
-            _version: Postal::VERSION.to_s,
+            _version: Postal.version.to_s,
            _group_ids: group_ids.join(" ")
          }.merge(payload.transform_keys { |k| "_#{k}".to_sym }.transform_values(&:to_s)))
        end
@@ -146,13 +145,41 @@ module Postal
      ActiveRecord::Base.connection_pool.disconnect!

      config = ActiveRecord::Base.configurations
-                                 .configs_for(env_name: Rails.env)
+                                 .configs_for(env_name: Config.rails.environment)
                                 .first
                                 .configuration_hash

      ActiveRecord::Base.establish_connection(config.merge(pool: new_size))
    end

+    # Return the branch name which created this release
+    #
+    # @return [String, nil]
+    def branch
+      return @branch if instance_variable_defined?("@branch")
+
+      @branch ||= read_version_file("BRANCH")
+    end
+
+    # Return the version
+    #
+    # @return [String, nil]
+    def version
+      return @version if instance_variable_defined?("@version")
+
+      @version ||= read_version_file("VERSION") || "0.0.0"
+    end
+
+    private
+
+    def read_version_file(file)
+      path = File.expand_path("../../../" + file, __FILE__)
+      return unless File.exist?(path)
+
+      value = File.read(path).strip
+      value.empty? ? nil : value
+    end
+
  end

  Config = initialize_config
--- a/lib/postal/config_schema.rb
+++ b/lib/postal/config_schema.rb
@@ -550,7 +550,7 @@ module Postal
      string :scopes do
        description "Scopes to request from the OIDC server."
        array
-        default "openid,email"
+        default ["openid", "email"]
      end

      string :uid_field do
--- a/lib/postal/version.rb
+++ b/lib/postal/version.rb
@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-module Postal
-
-  VERSION_PATH = File.expand_path("../../VERSION", __dir__)
-  if File.file?(VERSION_PATH)
-    VERSION = File.read(VERSION_PATH).strip.delete_prefix("v")
-  else
-    VERSION = "0.0.0-dev"
-  end
-
-  def self.version
-    VERSION
-  end
-
-  Version = VERSION
-
-end
--- a/lib/tracking_middleware.rb
+++ b/lib/tracking_middleware.rb
@@ -48,25 +48,11 @@ class TrackingMiddleware
      Sentry.capture_exception(e) if defined?(Sentry)
    end

-    source_image = request.params["src"]
-    case source_image
-    when nil
+    if request.params["src"].nil?
      headers = {}
      headers["Content-Type"] = "image/png"
      headers["Content-Length"] = TRACKING_PIXEL.bytesize.to_s
      [200, headers, [TRACKING_PIXEL]]
-    when /\Ahttps?:\/\//
-      response = Postal::HTTP.get(source_image, timeout: 3)
-      return [404, {}, ["Not found"]] unless response[:code] == 200
-
-      headers = {}
-      headers["Content-Type"] = response[:headers]["content-type"]&.first
-      headers["Last-Modified"] = response[:headers]["last-modified"]&.first
-      headers["Cache-Control"] = response[:headers]["cache-control"]&.first
-      headers["Etag"] = response[:headers]["etag"]&.first
-      headers["Content-Length"] = response[:body].bytesize.to_s
-      [200, headers, [response[:body]]]
-
    else
      [400, {}, ["Invalid/missing source image"]]
    end
--- a/script/generate_api_docs.sh
+++ b/script/generate_api_docs.sh
@@ -1,21 +0,0 @@
-#!/bin/bash
-
-set -e
-
-if [ ! -d /tmp/postal-api/.git ];
-then
-  git clone git@github.com:atech/postal-api /tmp/postal-api
-else
-  git -C /tmp/postal-api reset --hard HEAD
-  git -C /tmp/postal-api pull origin master
-fi
-
-rm -Rf /tmp/postal-api/*
-
-bundle exec moonrope api /tmp/postal-api
-
-cd /tmp/postal-api
-
-git add .
-git commit -m "update docs"
-git push origin master
--- a/script/version.rb
+++ b/script/version.rb
@@ -1,5 +1,5 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true

-require File.expand_path("../lib/postal/version", __dir__)
+require File.expand_path("../lib/postal/config", __dir__)
 puts Postal.version
--- a/spec/apis/legacy_api/messages/message_spec.rb
+++ b/spec/apis/legacy_api/messages/message_spec.rb
@@ -88,6 +88,49 @@ RSpec.describe "Legacy Messages API", type: :request do
          end
        end

+        context "when all expansions are requested" do
+          let(:expansions) { true }
+
+          it "returns details about the message" do
+            expect(response.status).to eq 200
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "success"
+            expect(parsed_body["data"]).to match({
+              "id" => message.id,
+              "token" => message.token,
+              "status" => { "held" => false,
+                            "hold_expiry" => nil,
+                            "last_delivery_attempt" => nil,
+                            "status" => "Pending" },
+              "details" => { "bounce" => false,
+                             "bounce_for_id" => 0,
+                             "direction" => "outgoing",
+                             "mail_from" => "test@example.com",
+                             "message_id" => message.message_id,
+                             "rcpt_to" => "john@example.com",
+                             "received_with_ssl" => nil,
+                             "size" => kind_of(String),
+                             "subject" => "An example message",
+                             "tag" => nil,
+                             "timestamp" => kind_of(Float) },
+              "inspection" => { "inspected" => false,
+                                "spam" => false,
+                                "spam_score" => 0.0,
+                                "threat" => false,
+                                "threat_details" => nil },
+              "plain_body" => message.plain_body,
+              "html_body" => message.html_body,
+              "attachments" => [],
+              "headers" => message.headers,
+              "raw_message" => Base64.encode64(message.raw_message),
+              "activity_entries" => {
+                "loads" => [],
+                "clicks" => []
+              }
+            })
+          end
+        end
+
        context "when the status expansion is requested" do
          let(:expansions) { ["status"] }

--- a/spec/apis/legacy_api/send/message_spec.rb
+++ b/spec/apis/legacy_api/send/message_spec.rb
@@ -40,192 +40,195 @@ RSpec.describe "Legacy Send API", type: :request do
      let(:server) { create(:server) }
      let(:credential) { create(:credential, server: server) }
      let(:domain) { create(:domain, owner: server) }
-      let(:default_params) do
-        {
-          to: ["test@example.com"],
-          cc: ["cc@example.com"],
-          bcc: ["bcc@example.com"],
-          from: "test@#{domain.name}",
-          sender: "sender@#{domain.name}",
-          tag: "test-tag",
-          reply_to: "reply@example.com",
-          plain_body: "plain text",
-          html_body: "<p>html</p>",
-          attachments: [{ name: "test1.txt", content_type: "text/plain", data: Base64.encode64("hello world 1") },
-                        { name: "test2.txt", content_type: "text/plain", data: Base64.encode64("hello world 2") },],
-          headers: { "x-test-header-1" => "111", "x-test-header-2" => "222" },
-          bounce: false,
-          subject: "Test"
-        }
-      end
-      let(:params) { default_params }

-      before do
-        post "/api/v1/send/message",
-             headers: { "x-server-api-key" => credential.key,
-                        "content-type" => "application/json" },
-             params: params.to_json
-      end
-
-      context "when no recipients are provided" do
-        let(:params) { default_params.merge(to: [], cc: [], bcc: []) }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "NoRecipients"
-          expect(parsed_body["data"]["message"]).to match(/there are no recipients defined to receive this message/i)
+      context "when parameters are provided in a JSON body" do
+        let(:default_params) do
+          {
+            to: ["test@example.com"],
+            cc: ["cc@example.com"],
+            bcc: ["bcc@example.com"],
+            from: "test@#{domain.name}",
+            sender: "sender@#{domain.name}",
+            tag: "test-tag",
+            reply_to: "reply@example.com",
+            plain_body: "plain text",
+            html_body: "<p>html</p>",
+            attachments: [{ name: "test1.txt", content_type: "text/plain", data: Base64.encode64("hello world 1") },
+                          { name: "test2.txt", content_type: "text/plain", data: Base64.encode64("hello world 2") },],
+            headers: { "x-test-header-1" => "111", "x-test-header-2" => "222" },
+            bounce: false,
+            subject: "Test"
+          }
        end
-      end
+        let(:params) { default_params }

-      context "when no content is provided" do
-        let(:params) { default_params.merge(html_body: nil, plain_body: nil) }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "NoContent"
-          expect(parsed_body["data"]["message"]).to match(/there is no content defined for this e-mail/i)
+        before do
+          post "/api/v1/send/message",
+               headers: { "x-server-api-key" => credential.key,
+                          "content-type" => "application/json" },
+               params: params.to_json
        end
-      end

-      context "when the number of 'To' recipients exceeds the maximum" do
-        let(:params) { default_params.merge(to: ["a@a.com"] * 51) }
+        context "when no recipients are provided" do
+          let(:params) { default_params.merge(to: [], cc: [], bcc: []) }

-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "TooManyToAddresses"
-          expect(parsed_body["data"]["message"]).to match(/the maximum number of To addresses has been reached/i)
-        end
-      end
-
-      context "when the number of 'CC' recipients exceeds the maximum" do
-        let(:params) { default_params.merge(cc: ["a@a.com"] * 51) }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "TooManyCCAddresses"
-          expect(parsed_body["data"]["message"]).to match(/the maximum number of CC addresses has been reached/i)
-        end
-      end
-
-      context "when the number of 'BCC' recipients exceeds the maximum" do
-        let(:params) { default_params.merge(bcc: ["a@a.com"] * 51) }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "TooManyBCCAddresses"
-          expect(parsed_body["data"]["message"]).to match(/the maximum number of BCC addresses has been reached/i)
-        end
-      end
-
-      context "when the 'From' address is missing" do
-        let(:params) { default_params.merge(from: nil) }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "FromAddressMissing"
-          expect(parsed_body["data"]["message"]).to match(/the from address is missing and is required/i)
-        end
-      end
-
-      context "when the 'From' address is not authorised" do
-        let(:params) { default_params.merge(from: "test@another.com") }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "UnauthenticatedFromAddress"
-          expect(parsed_body["data"]["message"]).to match(/the from address is not authorised to send mail from this server/i)
-        end
-      end
-
-      context "when an attachment is missing a name" do
-        let(:params) { default_params.merge(attachments: [{ name: nil, content_type: "text/plain", data: Base64.encode64("hello world 1") }]) }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "AttachmentMissingName"
-          expect(parsed_body["data"]["message"]).to match(/an attachment is missing a name/i)
-        end
-      end
-
-      context "when an attachment is missing data" do
-        let(:params) { default_params.merge(attachments: [{ name: "test1.txt", content_type: "text/plain", data: nil }]) }
-
-        it "returns an error" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "error"
-          expect(parsed_body["data"]["code"]).to eq "AttachmentMissingData"
-          expect(parsed_body["data"]["message"]).to match(/an attachment is missing data/i)
-        end
-      end
-
-      context "when an attachment entry is not a hash" do
-        let(:params) { default_params.merge(attachments: [123, "string"]) }
-
-        it "continues as if it wasn't there" do
-          parsed_body = JSON.parse(response.body)
-          ["test@example.com", "cc@example.com", "bcc@example.com"].each do |rcpt_to|
-            message_id = parsed_body["data"]["messages"][rcpt_to]["id"]
-            message = server.message(message_id)
-            expect(message.attachments).to be_empty
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "NoRecipients"
+            expect(parsed_body["data"]["message"]).to match(/there are no recipients defined to receive this message/i)
          end
        end
-      end

-      context "when given a complete email to send" do
-        it "returns details of the messages created" do
-          parsed_body = JSON.parse(response.body)
-          expect(parsed_body["status"]).to eq "success"
-          expect(parsed_body["data"]["messages"]).to match({
-            "test@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ },
-            "cc@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ },
-            "bcc@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ }
-          })
+        context "when no content is provided" do
+          let(:params) { default_params.merge(html_body: nil, plain_body: nil) }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "NoContent"
+            expect(parsed_body["data"]["message"]).to match(/there is no content defined for this e-mail/i)
+          end
        end

-        it "adds an appropriate received header" do
-          parsed_body = JSON.parse(response.body)
-          message_id = parsed_body["data"]["messages"]["test@example.com"]["id"]
-          message = server.message(message_id)
-          expect(message.headers["received"].first).to match(/\Afrom api/)
+        context "when the number of 'To' recipients exceeds the maximum" do
+          let(:params) { default_params.merge(to: ["a@a.com"] * 51) }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "TooManyToAddresses"
+            expect(parsed_body["data"]["message"]).to match(/the maximum number of To addresses has been reached/i)
+          end
        end

-        it "creates appropriate message objects" do
-          parsed_body = JSON.parse(response.body)
-          ["test@example.com", "cc@example.com", "bcc@example.com"].each do |rcpt_to|
-            message_id = parsed_body["data"]["messages"][rcpt_to]["id"]
+        context "when the number of 'CC' recipients exceeds the maximum" do
+          let(:params) { default_params.merge(cc: ["a@a.com"] * 51) }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "TooManyCCAddresses"
+            expect(parsed_body["data"]["message"]).to match(/the maximum number of CC addresses has been reached/i)
+          end
+        end
+
+        context "when the number of 'BCC' recipients exceeds the maximum" do
+          let(:params) { default_params.merge(bcc: ["a@a.com"] * 51) }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "TooManyBCCAddresses"
+            expect(parsed_body["data"]["message"]).to match(/the maximum number of BCC addresses has been reached/i)
+          end
+        end
+
+        context "when the 'From' address is missing" do
+          let(:params) { default_params.merge(from: nil) }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "FromAddressMissing"
+            expect(parsed_body["data"]["message"]).to match(/the from address is missing and is required/i)
+          end
+        end
+
+        context "when the 'From' address is not authorised" do
+          let(:params) { default_params.merge(from: "test@another.com") }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "UnauthenticatedFromAddress"
+            expect(parsed_body["data"]["message"]).to match(/the from address is not authorised to send mail from this server/i)
+          end
+        end
+
+        context "when an attachment is missing a name" do
+          let(:params) { default_params.merge(attachments: [{ name: nil, content_type: "text/plain", data: Base64.encode64("hello world 1") }]) }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "AttachmentMissingName"
+            expect(parsed_body["data"]["message"]).to match(/an attachment is missing a name/i)
+          end
+        end
+
+        context "when an attachment is missing data" do
+          let(:params) { default_params.merge(attachments: [{ name: "test1.txt", content_type: "text/plain", data: nil }]) }
+
+          it "returns an error" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "error"
+            expect(parsed_body["data"]["code"]).to eq "AttachmentMissingData"
+            expect(parsed_body["data"]["message"]).to match(/an attachment is missing data/i)
+          end
+        end
+
+        context "when an attachment entry is not a hash" do
+          let(:params) { default_params.merge(attachments: [123, "string"]) }
+
+          it "continues as if it wasn't there" do
+            parsed_body = JSON.parse(response.body)
+            ["test@example.com", "cc@example.com", "bcc@example.com"].each do |rcpt_to|
+              message_id = parsed_body["data"]["messages"][rcpt_to]["id"]
+              message = server.message(message_id)
+              expect(message.attachments).to be_empty
+            end
+          end
+        end
+
+        context "when given a complete email to send" do
+          it "returns details of the messages created" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "success"
+            expect(parsed_body["data"]["messages"]).to match({
+              "test@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ },
+              "cc@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ },
+              "bcc@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ }
+            })
+          end
+
+          it "adds an appropriate received header" do
+            parsed_body = JSON.parse(response.body)
+            message_id = parsed_body["data"]["messages"]["test@example.com"]["id"]
            message = server.message(message_id)
-            expect(message).to have_attributes(
-              server: server,
-              rcpt_to: rcpt_to,
-              mail_from: params[:from],
-              subject: params[:subject],
-              message_id: kind_of(String),
-              timestamp: kind_of(Time),
-              domain_id: domain.id,
-              credential_id: credential.id,
-              bounce: false,
-              tag: params[:tag],
-              headers: hash_including("x-test-header-1" => ["111"],
-                                      "x-test-header-2" => ["222"],
-                                      "sender" => [params[:sender]],
-                                      "to" => ["test@example.com"],
-                                      "cc" => ["cc@example.com"],
-                                      "reply-to" => ["reply@example.com"]),
-              plain_body: params[:plain_body],
-              html_body: params[:html_body],
-              attachments: [
-                have_attributes(content_type: /\Atext\/plain/, filename: "test1.txt", body: have_attributes(to_s: "hello world 1")),
-                have_attributes(content_type: /\Atext\/plain/, filename: "test2.txt", body: have_attributes(to_s: "hello world 2")),
-              ]
-            )
+            expect(message.headers["received"].first).to match(/\Afrom api/)
+          end
+
+          it "creates appropriate message objects" do
+            parsed_body = JSON.parse(response.body)
+            ["test@example.com", "cc@example.com", "bcc@example.com"].each do |rcpt_to|
+              message_id = parsed_body["data"]["messages"][rcpt_to]["id"]
+              message = server.message(message_id)
+              expect(message).to have_attributes(
+                server: server,
+                rcpt_to: rcpt_to,
+                mail_from: params[:from],
+                subject: params[:subject],
+                message_id: kind_of(String),
+                timestamp: kind_of(Time),
+                domain_id: domain.id,
+                credential_id: credential.id,
+                bounce: false,
+                tag: params[:tag],
+                headers: hash_including("x-test-header-1" => ["111"],
+                                        "x-test-header-2" => ["222"],
+                                        "sender" => [params[:sender]],
+                                        "to" => ["test@example.com"],
+                                        "cc" => ["cc@example.com"],
+                                        "reply-to" => ["reply@example.com"]),
+                plain_body: params[:plain_body],
+                html_body: params[:html_body],
+                attachments: [
+                  have_attributes(content_type: /\Atext\/plain/, filename: "test1.txt", body: have_attributes(to_s: "hello world 1")),
+                  have_attributes(content_type: /\Atext\/plain/, filename: "test2.txt", body: have_attributes(to_s: "hello world 2")),
+                ]
+              )
+            end
          end
        end
      end
--- a/spec/apis/legacy_api/send/raw_spec.rb
+++ b/spec/apis/legacy_api/send/raw_spec.rb
@@ -60,13 +60,14 @@ RSpec.describe "Legacy Send API", type: :request do
          bounce: false
        }
      end
+      let(:content_type) { "application/json" }
      let(:params) { default_params }

      before do
        post "/api/v1/send/raw",
             headers: { "x-server-api-key" => credential.key,
-                        "content-type" => "application/json" },
-             params: params.to_json
+                        "content-type" => content_type },
+             params: content_type == "application/json" ? params.to_json : params
      end

      context "when rcpt_to is not provided" do
@@ -146,6 +147,21 @@ RSpec.describe "Legacy Send API", type: :request do
            )
          end
        end
+
+        context "when params are provided as a param" do
+          let(:content_type) { nil }
+          let(:params) { { params: default_params.to_json } }
+
+          it "returns details of the messages created" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["data"]["message_id"]).to be_a String
+            expect(parsed_body["data"]["messages"]).to be_a Hash
+            expect(parsed_body["data"]["messages"]).to match({
+              "test1@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ },
+              "test2@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ }
+            })
+          end
+        end
      end
    end
  end
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe ApplicationHelper, type: :helper do
+  describe "#endpoint_options_for_select" do
+    let(:server) { create(:server) }
+
+    context "when an endpoint has HTML characters in its description" do
+      let(:payload) { %q(x'"><script>alert(1)</script>) }
+
+      before do
+        create(:http_endpoint, server: server, name: payload)
+      end
+
+      it "HTML-escapes the endpoint description in the option text" do
+        html = helper.endpoint_options_for_select(server)
+
+        # The raw payload must not appear verbatim — if it does, the browser
+        # will execute the <script> tag.
+        expect(html).not_to include("<script>alert(1)</script>")
+
+        # Escaped form should appear instead.
+        expect(html).to include("&lt;script&gt;alert(1)&lt;/script&gt;")
+      end
+
+      it "does not allow the payload to break out of the option tag" do
+        html = helper.endpoint_options_for_select(server)
+
+        # The ' and > characters in the payload must be escaped so they
+        # cannot close the opening <option value='...'> or terminate the
+        # element early.
+        expect(html).not_to match(/<option[^>]*>[^<]*<script/)
+      end
+    end
+  end
+end
--- a/spec/lib/tracking_middleware_spec.rb
+++ b/spec/lib/tracking_middleware_spec.rb
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rack/test"
+
+RSpec.describe TrackingMiddleware do
+  include Rack::Test::Methods
+
+  let(:inner_app) { ->(_env) { [200, {}, ["inner"]] } }
+  let(:app) { described_class.new(inner_app) }
+
+  let(:server) { create(:server) }
+  let(:message) do
+    MessageFactory.incoming(server) do |_msg, mail|
+      mail.html_part = Mail::Part.new do
+        content_type "text/html; charset=UTF-8"
+        body "<html><body>hi</body></html>"
+      end
+    end
+  end
+
+  def track_headers
+    { "HTTP_X_POSTAL_TRACK_HOST" => "1" }
+  end
+
+  describe "GET /img/:server_token/:message_token (open tracking pixel)" do
+    before do
+      get "/img/#{server.token}/#{message.token}", {}, track_headers
+    end
+
+    it "returns the tracking pixel PNG" do
+      expect(last_response.status).to eq 200
+      expect(last_response.headers["Content-Type"]).to eq "image/png"
+      expect(last_response.body.bytesize).to be > 0
+    end
+
+    it "records a load for the message" do
+      # Re-fetch the message so loads are read fresh from the DB.
+      reloaded = server.message_db.message(message.id)
+      expect(reloaded.loads.size).to eq 1
+    end
+  end
+
+  describe "GET /img/:server_token/:message_token?src=<url> (image proxy)" do
+    let(:attacker_url) { "http://internal.example.com/secret" }
+
+    before do
+      stub_request(:get, attacker_url).to_return(status: 200, body: "internal-secret")
+    end
+
+    it "does not fetch the URL and returns 400" do
+      get "/img/#{server.token}/#{message.token}", { src: attacker_url }, track_headers
+
+      expect(last_response.status).to eq 400
+      expect(WebMock).not_to have_requested(:get, attacker_url)
+    end
+
+    it "does not fetch the URL even when the message token is invalid" do
+      get "/img/#{server.token}/nonexistent", { src: attacker_url }, track_headers
+
+      expect(WebMock).not_to have_requested(:get, attacker_url)
+    end
+  end
+
+  describe "when the track-host header is missing" do
+    it "passes the request through to the inner app untouched" do
+      get "/img/#{server.token}/#{message.token}"
+      expect(last_response.body).to eq "inner"
+    end
+  end
+end
--- a/spec/models/server_spec.rb
+++ b/spec/models/server_spec.rb
@@ -120,6 +120,8 @@ describe Server do
  end

  describe "deletion" do
+    let(:server) { create(:server) }
+
    it "removes the database" do
      expect(server.message_db.provisioner).to receive(:drop).once
      server.provision_database = true
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -10,15 +10,13 @@ require "rspec/rails"
 require "spec_helper"
 require "factory_bot"
 require "timecop"
-require "database_cleaner"
 require "webmock/rspec"
 require "shoulda-matchers"

 DatabaseCleaner.allow_remote_database_url = true
 ActiveRecord::Base.logger = Logger.new("/dev/null")

-Dir[File.expand_path("factories/*.rb", __dir__)].each { |f| require f }
-Dir[File.expand_path("helpers/**/*.rb", __dir__)].each { |f| require f }
+Dir[File.expand_path("helpers/**/*.rb", __dir__)].reject { |f| f.end_with?("_spec.rb") }.each { |f| require f }

 ActionMailer::Base.delivery_method = :test

--- a/spec/requests/messages_controller_spec.rb
+++ b/spec/requests/messages_controller_spec.rb
@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "MessagesController", type: :request do
+  let(:user) { create(:user, admin: true) }
+  let(:organization) { create(:organization, owner: user) }
+  let(:server) { create(:server, organization: organization) }
+
+  before do
+    post "/login", params: { email_address: user.email_address, password: "passw0rd" }
+  end
+
+  describe "GET /org/:org/servers/:server/messages/:id/html_raw" do
+    let(:xss_payload) { %(<script>alert("XSS")</script>) }
+    let(:message) do
+      payload = xss_payload
+      MessageFactory.incoming(server) do |_msg, mail|
+        mail.html_part = Mail::Part.new do
+          content_type "text/html; charset=UTF-8"
+          body %(<html><body><p>hello</p>#{payload}</body></html>)
+        end
+      end
+    end
+
+    before do
+      get "/org/#{organization.permalink}/servers/#{server.permalink}/messages/#{message.id}/html_raw"
+    end
+
+    it "returns the stored email HTML" do
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("hello")
+    end
+
+    it "serves a restrictive Content-Security-Policy that blocks scripts" do
+      csp = response.headers["Content-Security-Policy"]
+      expect(csp).to include("script-src 'none'")
+      expect(csp).to include("default-src 'none'")
+      expect(csp).to include("form-action 'none'")
+      expect(csp).to include("base-uri 'none'")
+    end
+
+    it "sets X-Content-Type-Options and Referrer-Policy on the response" do
+      expect(response.headers["X-Content-Type-Options"]).to eq "nosniff"
+      expect(response.headers["Referrer-Policy"]).to eq "no-referrer"
+    end
+  end
+
+  describe "messages/html view template" do
+    # We assert against the template source rather than rendering it in a
+    # request spec because the full application layout depends on the asset
+    # pipeline which is not configured in this test environment.
+    it "embeds the html_raw view inside a sandboxed iframe" do
+      template = Rails.root.join("app/views/messages/html.html.haml").read
+      expect(template).to match(/%iframe\{[^}]*:sandbox\s*=>/)
+    end
+  end
+end
--- a/spec/requests/sessions_controller_spec.rb
+++ b/spec/requests/sessions_controller_spec.rb
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "SessionsController", type: :request do
+  let(:user) { create(:user) }
+
+  describe "POST /login with return_to" do
+    def login_with(return_to:)
+      post "/login", params: {
+        email_address: user.email_address,
+        password: "passw0rd",
+        return_to: return_to
+      }
+    end
+
+    shared_examples "rejects unsafe return_to" do
+      it "does not redirect to the attacker-controlled location" do
+        login_with(return_to: unsafe_path)
+
+        expect(response).to have_http_status(:found)
+        # Whatever the fallback is, it must be same-origin: a Location that
+        # either omits a host or points at our own host. A browser must not
+        # end up at attacker.example.
+        location = response.location
+        expect(location).not_to include("attacker.example")
+        # Reject protocol-relative and absolute redirects entirely.
+        expect(location).not_to match(%r{\A//})
+        expect(location).not_to match(%r{\Ahttps?://attacker})
+      end
+    end
+
+    context "with a protocol-relative URL (//host)" do
+      let(:unsafe_path) { "//attacker.example/phish" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with a backslash-prefixed URL (/\\host)" do
+      let(:unsafe_path) { "/\\attacker.example/phish" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with an absolute http(s) URL" do
+      let(:unsafe_path) { "https://attacker.example/phish" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with a javascript: URL" do
+      let(:unsafe_path) { "javascript:alert(1)" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with a safe relative path" do
+      it "honours the return_to" do
+        login_with(return_to: "/org/acme/settings")
+        expect(response).to redirect_to("/org/acme/settings")
+      end
+    end
+
+    context "with no return_to" do
+      it "redirects to the default root" do
+        post "/login", params: {
+          email_address: user.email_address,
+          password: "passw0rd"
+        }
+        expect(response).to have_http_status(:found)
+        expect(response.location).not_to match(%r{\A//})
+      end
+    end
+  end
+end
--- a/spec/senders/smtp_sender_spec.rb
+++ b/spec/senders/smtp_sender_spec.rb
@@ -524,4 +524,41 @@ RSpec.describe SMTPSender do
      expect(sender.endpoints).to all have_received(:finish_smtp_session).at_least(:once)
    end
  end
+
+  describe ".smtp_relays" do
+    before do
+      if described_class.instance_variable_defined?("@smtp_relays")
+        described_class.remove_instance_variable("@smtp_relays")
+      end
+    end
+
+    it "returns nil if smtp relays is nil" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return(nil)
+      expect(described_class.smtp_relays).to be nil
+    end
+
+    it "returns nil if there are no smtp relays" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return([])
+      expect(described_class.smtp_relays).to be nil
+    end
+
+    it "does not return relays where the host is nil" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return([
+                                                                         Hashie::Mash.new(host: nil, port: 25, ssl_mode: "Auto"),
+                                                                         Hashie::Mash.new(host: "test.example.com", port: 25, ssl_mode: "Auto"),
+                                                                       ])
+      expect(described_class.smtp_relays).to match [kind_of(SMTPClient::Server)]
+    end
+
+    it "returns relays with options" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return([
+                                                                         Hashie::Mash.new(host: "test.example.com", port: 25, ssl_mode: "Auto"),
+                                                                         Hashie::Mash.new(host: "test2.example.com", port: 2525, ssl_mode: "TLS"),
+                                                                       ])
+      expect(described_class.smtp_relays).to match [
+        have_attributes(hostname: "test.example.com", port: 25, ssl_mode: "Auto"),
+        have_attributes(hostname: "test2.example.com", port: 2525, ssl_mode: "TLS"),
+      ]
+    end
+  end
 end
--- a/spec/services/webhook_delivery_service_spec.rb
+++ b/spec/services/webhook_delivery_service_spec.rb
@@ -59,8 +59,11 @@ RSpec.describe WebhookDeliveryService do
      end

      it "updates the last used at time on the webhook" do
-        service.call
-        expect(webhook.reload.last_used_at).to be_within(1.second).of(Time.current)
+        frozen_time = Time.current.change(usec: 0)
+        Timecop.freeze(frozen_time) do
+          service.call
+          expect(webhook.reload.last_used_at).to eq(frozen_time)
+        end
      end
    end
المؤلف	SHA1	الرسالة	التاريخ
dependabot[bot]	b3d50c1029	chore(deps): bump jwt from 2.8.1 to 3.2.0 Bumps [jwt](https://github.com/jwt/ruby-jwt) from 2.8.1 to 3.2.0. - [Release notes](https://github.com/jwt/ruby-jwt/releases) - [Changelog](https://github.com/jwt/ruby-jwt/blob/main/CHANGELOG.md) - [Commits](https://github.com/jwt/ruby-jwt/compare/v2.8.1...v3.2.0) --- updated-dependencies: - dependency-name: jwt dependency-version: 3.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-18 19:09:10 +00:00
github-actions[bot]	8ef89606bc	chore(main): release 3.3.6 (#3558 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-04-28 17:19:33 +01:00
Adam Cooke	84f4e20f05	refactor(auth): tighten return_to validation url_with_return_to only checked that return_to started with a forward slash, which also allowed protocol-relative values like //host and /\host. Rails 7.1 already refuses to follow those via redirect_to, so the user just saw a 500. Reject the same shapes in the helper instead so we fall back to the default URL cleanly. Adds a sessions request spec covering the rejected shapes plus the happy-path relative redirect.	2026-04-24 23:03:50 +01:00
Adam Cooke	9243524035	refactor(helpers): escape interpolated values in select options The endpoint and domain option helpers interpolated model attributes straight into an HTML string before marking the whole buffer html_safe. Wrap the interpolations in h() so untrusted attributes can't break out of the surrounding tag. Also stop the helpers glob in rails_helper from eagerly requiring _spec.rb files so helper specs can live under spec/helpers/, and add a small application helper spec covering the escape behaviour.	2026-04-24 22:55:46 +01:00
Adam Cooke	dca7f90b90	refactor(tracking): remove unused src image proxy The /img/<server>/<message> endpoint accepted a src=<url> query parameter and proxied the body of that URL back to the caller. Nothing in the codebase ever produces a src= parameter — the parser only inserts a plain tracking pixel and rewrites href links — so this branch is dead code inherited from the original AppMail import. Drop the src branch: requests with src now return 400. The no-src path that serves the tracking pixel and records loads is unchanged, and a spec covers both the pixel-serving path and the removed branch.	2026-04-24 22:24:18 +01:00
Adam Cooke	cad2aa6808	fix(messages): sandbox rendered email HTML as extra XSS defence The app-wide CSP already blocks inline script execution, but the HTML preview iframe for a stored email was same-origin and un-sandboxed, and the html_raw response had no per-action hardening. Add a sandbox on the iframe and tighten the CSP on html_raw to script-src 'none' with nosniff and no-referrer so the preview has defence in depth against a future CSP bypass or regression. Relates to GHSA-f6g9-8555-cw28.	2026-04-24 22:12:27 +01:00
Adam Cooke	b611d577af	chore: ignore node modules and yarn.lock	2026-04-24 21:34:57 +01:00
github-actions[bot]	d532922ff7	chore(main): release 3.3.5 (#3208 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-01 14:55:42 +00:00
Adam Cooke	11419f9914	fix(deliveries): escape delivery details to prevent HTML injection	2026-02-01 14:48:54 +00:00
Melle Douwsma	b7e5232e07	fix: typo in process logging (#3212 ) Signed-off-by: Melle Douwsma <melledouwsma@users.noreply.github.com>	2025-10-03 09:41:20 +01:00
Johan Kok	e00098b800	fix: update url for v2 config (#3225 ) This minor update resolves #3048 Signed-off-by: Johan Kok <johankok@users.noreply.github.com>	2025-10-03 09:40:22 +01:00
Adam Cooke	d00d978872	chore: upgrade resolv to 0.6.2	2025-10-02 14:39:27 +01:00
Adam Cooke	c78000ca8f	chore: remove version from docker-compose.yml	2025-10-02 14:38:42 +01:00
Adam Cooke	c03c44b442	chore(deps): upgrade puma, net-imap and other deps	2025-10-01 18:13:36 +01:00
Adam Cooke	86de372382	chore(dockerfile): reduce container size	2025-10-01 18:12:26 +01:00
Adam Cooke	7c47422c86	fix(health_server): use rackup handler instead of rack handler	2025-10-01 18:12:26 +01:00
Arthur Lutz	f5325c49ff	docs(process.rb): add help about time unit used by metric (#3339 ) Signed-off-by: Arthur Lutz <arthur.lutz@zenika.com>	2025-10-01 17:31:13 +01:00
Adam Cooke	f193b8e77f	chore: upgrade uri gem to 1.0.3	2025-10-01 16:47:59 +01:00
Adam Cooke	ab6d4430ba	chore: upgrade to rails 7.1 and ruby 3.4 (#3457 )	2025-10-01 16:42:39 +01:00
Matthieu Barthel	9c5f96ae90	fix: oidc scopes are invalid when concatenated (#3332 )	2025-05-08 07:51:46 +01:00
Som23Git	fd3c7ccdf6	fix: typo in the credentials page	2024-10-31 17:53:20 +00:00
github-actions[bot]	da90e75036	chore(main): release 3.3.4 (#3014 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-06-20 14:39:58 +01:00
Adam Cooke	2b0919c145	fix: raise NotImplementedError when no call method on a scheduled task	2024-06-20 14:27:20 +01:00
Adam Cooke	3a33e53d84	fix: fix issue running message pruning task	2024-06-20 14:27:20 +01:00
Adam Cooke	4fa88acea0	fix: fix `postal version` command	2024-06-20 14:27:18 +01:00
github-actions[bot]	d510499190	chore(main): release 3.3.3 (#2933 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-04-18 14:42:30 +01:00
Adam Cooke	39f704c256	fix(legacy-api): allow _expansions to be provided as true to return all expansions closes #2932	2024-04-18 14:38:44 +01:00
github-actions[bot]	c12f30e300	chore(main): release 3.3.2 (#2892 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-03-22 10:40:20 +00:00
Adam Cooke	5a2f31ed77	doc: fix doc for `Postal.version`	2024-03-21 14:58:11 +00:00
Adam Cooke	07c6b317f2	refactor(versioning): improve how current version and branch is determined and set Refactor `Postal.version`` and `Postal.branch` and remove `Postal::VERSION`.	2024-03-21 14:55:14 +00:00
github-actions[bot]	a3fab36da2	chore(main): release 3.3.1 (#2890 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-03-21 12:54:43 +00:00
Adam Cooke	3a56ec8a74	fix(smtp-sender): ensure relays without a host are excluded	2024-03-21 12:33:34 +00:00
Adam Cooke	b3264b9427	fix(smtp-sender): fixes `SMTPSender.smtp_relays`	2024-03-21 12:27:54 +00:00
Adam Cooke	6ef388577e	Merge pull request #2891 from postalserver/export-branch-to-image	2024-03-20 14:34:28 +00:00
Adam Cooke	18236171eb	chore(ui): display branch in footer if present	2024-03-20 14:30:32 +00:00
Adam Cooke	bee509832e	chore(container): add the branch name to the container	2024-03-20 14:28:44 +00:00
Adam Cooke	4d9654dac4	refactor: remove moonrope but maintain legacy API actions (#2889 )	2024-03-19 20:21:04 +00:00
Adam Cooke	adaf2b0750	chore(github-actions): don't run for dependabot or release-please PRs and fetch whole repo	2024-03-19 16:54:18 +00:00
Adam Cooke	64bc7dcf7c	chore(github-actions): include a version string on branch-*/latest images	2024-03-19 16:42:21 +00:00
Adam Cooke	d65bbe0579	chore(github-actions): don't generate commit- tags	2024-03-19 10:27:15 +00:00
@@ -1 +1 @@
 .2.2
 .4.6