PHPMailer Files

This is a maintenance and minor security release.

What's changed

• Validate MessageDate before including it in headers.
• Minor feature: some common non-RFC date formats and DateTime instances are now automatically converted to the right format for MessageDate.
• Strip breaks from XMailer, ContentType, and CharSet properties.
• Strip breaks from username and password properties before use in POP3.
• Enforce strict checks on Encoding values.
• Ease BC IMAP issues by allowing the parseAddresses $useimap parameter to be false or null without triggering a deprecation warning.
• Updated Turkish and Norwegian translations.
• Test case cleanup and improvements by @jrfnl.
• Fix crash if Mailer ended up empty.
• Use Ubuntu 24.04 for tests.

Security changes

We received several duplicate reports of the same issue, buried deep in reams of AI slop. Specifically, several PHPMailer properties and two POP3 properties were not sanitised before use. These properties are typically only set by developers, not exposed to user input, and would also have to be mishandled by host applications to become a problem. Nevertheless, these properties have now been rendered harmless.

New Contributors

• @Musty-26 made their first contribution in https://github.com/PHPMailer/PHPMailer/pull/3303
• @ClearanceClarence made their first contribution in https://github.com/PHPMailer/PHPMailer/pull/3306
• @cri2net made their first contribution in https://github.com/PHPMailer/PHPMailer/pull/3307
• @jsoref made their first contribution in https://github.com/PHPMailer/PHPMailer/pull/3315
• @masskrdjn made their first contribution in https://github.com/PHPMailer/PHPMailer/pull/3328

Full Changelog: https://github.com/PHPMailer/PHPMailer/compare/v7.0.2...v7.1.0