📖 Notes

Happy New Year 🎉

This is a re-release of 2025-12-11, but I've reverted one change.
My fix for the Browser caused trouble/confusion, so I've removed it.

One feature and lots of bug fixes.

This release introduces $message_id_format (docs).

💎 Sponsors

Special thanks to our sponsors:

Jakub Jindra @jindraj	Scott Kostyshak @scottkosty	Igor Serebryany @igor47	Mark Korondi @kmARC	Bastian Bittorf @bittorf
Nicolas Évrard @nicoe	Robert Ricci @ricci	Farzad Sadeghi @terminaldweller	Nick Price @DominoTree

• Robert Labudda
• Morgan Kelly
• 罗昭铭
• Aboudoulaye Yatera
• Marton Balazs (@martonbalazs)
• Kirill Rekhov (@krekhovx)
• Joonas Laine
• Anonymous (Liberapay)

Become a sponsor of NeoMutt

❤️ Thanks

Many thanks to our new contributors:

• Sam Koved (@skoved)
• Bjarni Ingi Gislason

and our regular contributors:

• Marius Gedminas (@mgedmin)
• Emir Sari (@bitigchi)
• Страхиња Радић (@Strahinja)
• Carlos Henrique Lima Melara (@charles2910)
• Thomas Adam (@ThomasAdam)
• Dennis Schön (@roccoblues)
• Keith Bowes (@keithbowes)
• Pietro Cerutti (@gahr)

🔒 Security

• #4725 deprecate old ssl and tls options

🎁 Features

• #4718 add $message_id_format
• Notmuch: hide some old/deprecated features

🐞 Bug Fixes

• #4666 limit: force refresh of index bar
• #4671 Update the status bar on thread [un]collapse
• #4673 shrink history file on every new entry
• #4679 Flush S/MIME passkey on failure to sign
• #4684 execute message-hook sooner
• #4687 fix: exec auto-completion
• #4688 Fix infinite loop in GnuTLS socket I/O when socket blocks
• #4696 cmd_parse_fetch(): debug: avoid NULL dereference
• #4697 expunge: guard against segfault
• #4719 alias: complete when only one match
• #4726 imap: protect against crash on shutdown
• fix resolve for tagged save
• help: fix sorting of unbound functions
• help: hide deprecated functions

🔧 Changed Config

• New: message_id_format = "<%z@%f>"
• Deprecated ssl_use_sslv2
• Deprecated ssl_use_sslv3
• Deprecated ssl_use_tlsv1
• Deprecated ssl_use_tlsv1_1

🏴 Translations

• 100% ✳️ Esperanto
• 100% 🇱🇹 Lithuanian
• 100% 🇷🇸 Serbian
• 100% 🇹🇷 Turkish

📚 Docs

• #4665 Revamp the S/MIME docs
• #4680 Document how to use S/MIME with GPGMe
• #4692 update the contribution guidelines
• fix deprecated $pager example
• lots man pages fixes
• update help for sort options

🏗️ Build

• #4668 fix build for re-entrant ncurses
• #4727 make openssl/gnutls mutually exclusive
• libkey: light refactoring
• lua: create liblua

⚙️ Code

• #4695 Replace some TAILQ uses with ARRAY
• convert the ctype wrappers to use bool
• global invert OptNoCurses to OptGui
• key: collapse redirector functions
• move km_init() earlier in startup
• opcodes: add flags to MenuFuncOp
• pass focused window to global functions
• Use buf_at() to get a char from a Buffer
• use StringArray everywhere

📖 Notes

This Release has been superseded by 2026-01-05.

It's safe to use, but 2026-01-05 is better.

📖 Notes

This is a small release: one new config option and some bug fixes.

❤️ Thanks

Many thanks to our new contributor:

• Gopi Krishna Menon (@gopi487krishna)

and our regular contributors:

• Pietro Cerutti (@gahr)
• Dennis Schön (@roccoblues)
• Ryan d'Huart (@HomoElectromagneticus)
• Marius Gedminas (@mgedmin)
• Thomas Klausner (@0-wiz-0)
• Róbert Horváth (@r001)
• Rayford Shireman (@rayfordshire)
• Gerrit Rüsing (@kbcb)
• Emir Sari (@bitigchi)
• Alejandro Colomar (@alejandro-colomar)

🔒 Security

• #4623 ncrypt/crypt.c: Protect Message-ID

🎁 Features

• #4644 Provide an option to confirm on an empty To

✨ Contrib

• #4645 Add ayu-dark-256 colorscheme

🐞 Bug Fixes

• #4635 Handle a non-existing message_cache_dir
• #4642 Decouple $crypt_encryption_info and $crypt_protected_headers_weed from $devel_security
• #4650 Return success after querying for config

🔧 Changed Config

• Add: confirm_empty_to = no
  Confirm when sending an e-mail with an empty To:

🏴 Translations

• 100% 🇩🇪 German
• 100% 🇹🇷 Turkish
• 99% 🇭🇺 Hungarian
• 98% 🇱🇹 Lithuanian
• 89% 🇫🇷 French

🏗️ Build

• #4636 Update FreeBSD CI and workaround pkg bug
• actions: use checkout v5

⚙️ Code

• #4023 tweak observer event types
• #4628 Use the standard countof instead of our mutt_array_size()
• #4637 Update types in test dummy code
• #4638 remove useless const qualifier from log_queue_get()
• #4655 Make sure ctype(3) function arguments are valid
• #4657 Fix warning about unused function and data
• #4659 Include term.h and [n]curses.h consistently

📖 Notes

This is a small Bug-Fix Release.

The only big change is the new complete Esperanto Translation.
Thanks Keith!

❤️ Thanks

Many thanks to our new contributors:

• Keith Bowes (@keithbowes)
• Juris Lambda (@jxlambda)
• Luz Paz (@luzpaz)

and our regular contributors:

• Pietro Cerutti (@gahr)
• Marius Gedminas (@mgedmin)
• EC Herenz (@Knusper)

✨ Contrib

• #4616 Fix gpg-json output

🐞 Bug Fixes

• #4600 main: don't stop if /var/spool/mail is missing
• #4602 color: fix quoted maths
• #4604 Don't consider "weed" when writing an email to file
• #4605 help: fix leaks
• #4612 imap: check for incomplete Mailboxes on sync
• #4622 fix label completion crash

🏴 Translations

• #4622 update Esperanto translation
• Update lt_LT translations

📚 Docs

• docs: fix broken functions

🏗️ Build

• #4607 Check for DocBook XSL
• #4618 Build and test on FreeBSD

📖 Notes

This is (mostly) a Bug-Fix Release.

Most of other changes are improving the startup/help, e.g.

• neomutt -h # Clearer help
• neomutt -h send # Specific help with examples
• neomutt -DD # Dump different (changed) config

❤️ Thanks

Many thanks to our new contributors:

• @wbob
• @Leif-W
• Michael J Gruber (@mjg)

and our regular contributors:

• Chao-Kuei Hung (@ckhung)
• Pietro Cerutti (@gahr)
• Rayford Shireman (@rayfordshire)
• Gerrit Rüsing (@kbcb)
• Ian Zimmerman (@nobrowser)
• Ryan d'Huart (@HomoElectromagneticus)
• Dennis Schön (@roccoblues)
• Emir Sari (@bitigchi)
• Mateus Etto (@Yutsuten)
• Marius Gedminas (@mgedmin)

🎁 Features

• #4493 config: don't quote enums
• #4493 link config dump to docs
• #4494 refactor the Help Page for clarity
• #4554 CLI: neomutt -DD -- Dump Different
• #4593 browser: tag select rather than descend

🐞 Bug Fixes

• #3469 source: fix variable interpretation
• #4370 mutt_oauth2: refactor sasl_string computation
• #4536 expand tabs to spaces in compose preview
• #4537 fix dumping of initial values
• #4538 move real_name init
• #4542 Remove MUTT_NEWFOLDER, fix appending to mbox
• #4546 Respect Ignore when modifying an email's headers
• #4549 fix refresh on toggle hide_thread_subject
• #4550 buffer: fix seek
• #4551 add comma to single <complete-query> match
• #4595 notmuch: check for parse failure
• #4596 query: allow <>s around email addresses
• pager: fix normal/stripe colour
• fix colour leaks in pager
• fix array leak in the verify certificate dialog

🏴 Translations

• 100% 🇩🇪 German
• 100% 🇹🇷 Turkish
• 96% 🇱🇹 Lithuanian
• 86% 🇫🇷 French
• 49% 🇹🇼 Chinese (Traditional)

🏗️ Build

• #4552 Deprecate some configure options that aren't used anymore
• build: workaround for unused-result warning

⚙️ Code

• #4492 colour refactoring
• #4543 debug: Chain old SEGV Handler
• #4545 Allow nested ARRAY_FOREACH()
• #4553 config: API has_been_set()
• #4557 config: drop ConfigSet from API functions
• #4558 drop obsolete pgp/smime menus
• #4559 array: foreach_reverse()
• #4560 Change description of verify-key to be crypto-scheme agnostic
• #4561 expando: move EnvList out of library
• #4570 Simplify the management of NeoMutt Commands
• #4571 libcli - parse the command line
• #4580 Split CLI Usage into sections
• #4582 pager: fix lost NT_PAGER notifications
• #4591 pager: fix refresh on config/colour changes
• array: upgrade get_elem_list()
• Buffer refactoring
• coverity: fix defects
• improve localise_config()
• main: drop -B (batch mode) option
• merge init.[ch] into main.c
• refactor version code
• neomutt: home_dir, username, env
• query: unify NeoMutt -D and -Q
• refactor main.c/init.c
• sidebar: streamline expando callbacks
• test: lots of parse coverage
• window refactoring
• window: force recalc|repaint on new windows

♻️ Upstream

• Update mutt/queue.h
• Fix NULL pointer dereference when calling imap_logout_all()

📖 Notes

This is a small Bug-Fix Release.

DO NOT use the 2025-01-09 release.
I'm really sorry, but it had a problem with mbox Mailboxes.

❤️ Thanks

Many thanks to our new contributors:

• Helge Deller (@hdeller)

and our regular contributors:

• Ryan d'Huart (@HomoElectromagneticus)
• Pietro Cerutti (@gahr)
• Dennis Schön (@roccoblues)
• Chao-Kuei Hung (@ckhung)
• Страхиња Радић (@Strahinja)
• Gerrit Rüsing (@kbcb)
• Marius Gedminas (@mgedmin)
• Jakub Jindra (@jindraj)

🐞 Bug Fixes

• #4477 fix crash in folder-hook
• #4480 fix memory leak in compose message preview (fixes #4478)
• #4483 query: fix comma-separated names
• #4485 lua: fix lua_mutt_call()
• #4490 notmuch: refresh the Email if the filename changes
• fix: no new mail message
• fix display of certificate fingerprints
• fix prompt colour

🏴 Translations

• 100% 🇨🇿 Czech
• 100% 🇩🇪 German
• 100% 🇱🇹 Lithuanian
• 100% 🇷🇸 Serbian
• 100% 🇸🇰 Slovakian
• 100% 🇹🇷 Turkish
• 91% 🇫🇷 French
• 41% 🇹🇼 Chinese (Traditional)

🏗️ Build

• #4479 Fix DT_NUMBER entries on 32-bit endian platforms

⚙️ Code

• #4481 Simplify mutt_file_fopen()
• colour refactoring
• standardise variable names for temporary files

BROKEN - DO NOT USE

Use Release 2025-01-13 or later

📖 Notes

Compose Message Preview

A new feature this release: Compose Message Preview -- See the email you're about to send.
Thanks Dennis! (@roccoblues)

To enable it: set compose_show_preview = yes
More info: https://neomutt.org/feature/compose-message-preview

Config Changes

Along with a lot of code refactoring there have been some config changes.
They unify the Alias and Query Dialogs -- same behaviour, same format strings.

The changes are backwards compatible.

❤️ Thanks

Many thanks to our new contributors:

• Chao-Kuei Hung (@ckhung)
• Dmitry Polunin (@frei-0xff)

and our regular contributors:

• Marius Gedminas (@mgedmin)
• Ryan d'Huart (@HomoElectromagneticus)
• Страхиња Радић (@Strahinja)
• Claes Nästén (@pekdon)
• Alejandro Colomar (@alejandro-colomar)
• Dennis Schön (@roccoblues)
• Scott Kostyshak (@scottkosty)
• Pietro Cerutti (@gahr)
• EC Herenz (@Knusper)
• Carlos Henrique Lima Melara (@charles2910)
• Emir Sari (@bitigchi)
• Gerrit Rüsing (@kbcb)

🎁 Features

• #4437 show message preview in compose view
• #4439 add trailing commas when editing addresses

🐞 Bug Fixes

• #4444 expando: fix overflow
• #4461 Spaces can be wide
• #4464 Remove BOM from UTF-8 text
• #4467 Bug with wrong fingerprints in certificate_file
• #4470 fix postponed sorting assertion failure
• #4472 fix: save_attachment_open() when overwriting
• #4473 add text-wrapping to compose message preview pager
• #4475 edit_headers: cleanup temporary file on error
• expando: fix crash on empty %[] date
• expando: fix container formatting
• browser: fix 'tag-' display
• query: fix memory leak
• fix more arrow_cursor + search

🔧 Changed Config

• Config Renames:
  • $pgp_sort_keys -> $pgp_key_sort
  • $sidebar_sort_method -> $sidebar_sort
  • $sort_alias -> $alias_sort
  • $sort_browser -> $browser_sort
• Changed Defaults:
  • set alias_format = "%3i %f%t %-15a %-56A | %C%> %Y"
  • set query_format = "%3i %t %-25N %-25E | %C%> %Y"

🏴 Translations

• 100% 🇩🇪 German
• 100% 🇱🇹 Lithuanian
• 100% 🇷🇸 Serbian
• 100% 🇹🇷 Turkish
• 89% 🇫🇷 French
• 39% 🇹🇼 Chinese (Traditional)

🛡️ Coverity Defects

• Explicit null dereferenced
• Overflowed constant
• Overflowed return value
• Resource leak

📚 Docs

• alias tags

🏗️ Build

• #4452 only use struct tm.tm_gmtoff if available

⚙️ Code

• #4294 refactor memory allocation
• #4442 remove unused fields from ComposeSharedData
• #4447 refactor 'sort' constants
• #4449 add mutt_window_swap()
• unify Menu data
• move config to libraries
• unify Alias/Query
• expando factor out callbacks
• refactor simple_dialog_new()
• test: add TEST_CHECK_NUM_EQ()
• fopen: tidy read-only

♻️ Upstream

• #4448 Update queue.h

📖 Notes

This release is mostly bug-fixes.

• Expando handling (%x things) should now be robust, including escaping chars like <
• CLI Crypto is no-longer devel

❤️ Thanks

Many thanks to our new contributors:

• Colin Wee (@googlebleh)
• 李经纬 (@ljw20180420)
• Viacheslav Chimishuk (@vchimishuk)

and our regular contributors:

• Alejandro Colomar (@alejandro-colomar)
• Jakub Jindra (@jindraj)
• Carlos Henrique Lima Melara (@charles2910)
• Pietro Cerutti (@gahr)
• Emir Sari (@bitigchi)
• Ryan d'Huart (@HomoElectromagneticus)
• Gerrit Rüsing (@kbcb)
• vuori (@vuori)
• James Cook (@falsifian)

🔒 Security

• Fixed: CVE-2024-49393
• Fixed: CVE-2024-49394
• #4300 Read the protected Message-ID

🎁 Features

• #4336 Allow toggling numeric configs, e.g. :toggle pager_index_lines
• #4427 alias: tag/untag pattern
• query: tag with <space>

✨ Contrib

• #4400 mutt_oauth2.py: Fix reference to client_secret

🐞 Bug Fixes

• #4399 fix duplicate save-hook
• #4403 expando: fix escaping
• #4404 browser: fix enter-quit-enter
• #4405 pager: fix repaint
• #4407 config: warn about deprecated variables
• #4425 Refresh alias/query dialog on alias/query format change
• #4433 compose: fix redraw on attachment
• #4436 compose: fix search with arrow_cursor
• #4438 autocrypt: fix copy_normalize_addr()
• alias: fix cli crash
• expando: fix relative dates
• expando: padding default to space

🏴 Translations

• 100% 🇩🇪 German
• 100% 🇹🇷 Turkish
• 99% 🇨🇿 Czech
• 99% 🇸🇰 Slovak
• 82% 🇫🇷 French

📚 Docs

• drop refs to always-enabled features
• fix typo in unmacro
• fix broken link
• ncrypt: fix typo in config.c

🏗️ Build

• #4409 Use FreeBSD 14.1 in Cirrus CI

⚙️ Code

• #4294 Create memory alloc wrappers
• #4391 Don't return the result of realpath() on failure
• #4417 Fix memory leak in hcache
• #4423 Lots of expando refactoring
• fix type of PatternFlags.tag
• tidy: smime_get_key_by_str()

📖 Notes

This is mostly a bug-fix release, but there are two bigger changes to note.

First, it features the start of some work to improve message security.
(if you're knowledgeable and brave, see $devel_security below)

Second, it removes support for Mixmaster -- an anonymous remailer.
That was quite a lot of code that nobody used for many years.

❤️ Thanks

Many thanks to our new contributors:

• Daniel Klose
• Herbert J Skuhra
• Ryan d'Huart (@HomoElectromagneticus)

and our regular contributors:

• Marius Gedminas (@mgedmin)
• Alejandro Colomar (@alejandro-colomar)
• Pietro Cerutti (@gahr)
• Страхиња Радић (@Strahinja)
• James Cook (@falsifian)
• Gerrit Rüsing (@kbcb)
• Doron Behar (@doronbehar)
• Roberto Alvarado (@Robdres)
• Dennis Schön (@roccoblues)

🔒 Security

• #4243 - security: kill unnecessary blank lines
• #4251 - more security improvements
• #4282 - improve NeoMutt bailout handling

🎁 Features

• #4329 - remove mixmaster
• #4149 - honour umask in attach save

🐞 Bug Fixes

• #3945 - do not force username in addition to client certificate
• #4341 - Fix '%z' and '%Z in '%{...}' expando
• #4356 - Allow longer maildir filename suffixes
• #4357 - Don't force mbox stats calculations on startup
• #4365 - Fix sorting INBOX and its subfolders
• #4367 - Let ~Y match each tag individually
• #4371 - ignore macro events during autocrypt initialization
• #4383 - Generate the Message-ID earlier
• compose: fix $compose_confirm_detach_first

🔧 Changed Config

• set crypt_encryption_info = yes
  Add an informative block with details about the encryption
• set crypt_protected_headers_weed = no
  Controls wether NeoMutt will weed protected header fields
• set devel_security = no
  Devel feature: Security -- #4251
• $mixmaster is deprecated
• $mix_entry_format is deprecated

🏴 Translations

• 100% 🇩🇪 German
• 100% 🇱🇹 Lithuanian
• 100% 🇷🇸 Serbian
• 100% 🇪🇸 Spanish
• 81% 🇫🇷 French

📚 Docs

• #4350 - Fix configure script name in INSTALL.md
• fix para ordering

🏗️ Build

• #4280 - Update autosetup
• #4281 - Update acutest to the latest upstream commit
• #4289 - don't treat stddef.h specially
• #4306 - Add -std to CFLAGS too
• #4307 - require C11
• #4347 - Support BerkeleyDB 18.1
• #4362 - Assume 'struct timespec' exists
• fix idn2 typo

⚙️ Code

• #4113 - Close the hcache handle on failure to open the store
• #4214 - upgrade assert()
• #4283 - mutt/list.c: Use STAILQ_FOREACH_SAFE() in stailq deallocators
• #4296 - Use wmem*() functions with wide-character strings
• #4297 - ncrypt/crypt.c: Fix allocation size calculation
• #4305 - remove mutt_expand_path()
• #4308 - fix -Wdouble-promotion warnings
• #4310 - scanf: initialise out-vars
• #4312 - Allow opening the header cache in non-O_CREAT mode
• #4337 - Fix function pointer types
• #4348 - Check mutt_date_parse_date()s return value
• #4366 - Fix up slashes in imap_fix_path()
• #4378 - Fix padding with an empty string
• tidy expando library