After i install maildev with this command: sudo npm install -g maildev I got 10 vulnerabilities (2 moderate, 3 high, 5 critical). This is the full log:

npm WARN deprecated [email protected]: The package has been renamed toopen` npm WARN deprecated [email protected]: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797) npm WARN deprecated [email protected]: All versions below 4.0.1 of Nodemailer are deprecated. See https://nodemailer.com/status/

added 118 packages, and audited 119 packages in 15s

1 package is looking for funding run npm fund for details

10 vulnerabilities (2 moderate, 3 high, 5 critical)

To address all issues, run: npm audit fix

Run npm audit for details. `

@sobuctb You can try set "utf-8" as default charset for MailParser.

v1.1.0/lib/mailserver.js#L83 instead of

  var parseStream = new MailParser({
    streamAttachments: true,
  })

put

 var parseStream = new MailParser({
    streamAttachments: true,
    defaultCharset: "utf-8",
  })

Can I instruct maildev from maildev/helm to use specific directory by passing MAILDEV_MAIL_DIRECTORY? Tried to use it throught env vars in deployment.yaml - no effect. When pass as command line argument get error - unknown param

Try:

docker run -p 80:80 -p 25:25 djfarrelly/maildev

instead.

Used this, command for setting up the HTTP server and the SMTP server but none of them is working.

docker pull djfarrelly/maildev docker run -p 1080:80 -p 1025:25 djfarrelly/maildev

I want to use maildev smtpserver, can I do that?

If yes, can you care to explain is there is a documentation for it, or maybe the process of it?

The following vulnerabilities have been reported, with the latest one being Critical:

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 2)
+--------------------+------------------+----------+-------------------+---------------+---------------------------------------+
|      LIBRARY       | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+--------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| nodemailer         | CVE-2020-7769    | CRITICAL | 3.1.8             | 6.4.16        | Command injection in nodemailer       |
|                    |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-7769  |
+                    +                  +          +-------------------+               +                                       +
|                    |                  |          | 5.0.0             |               |                                       |
|                    |                  |          |                   |               |                                       |
+--------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| socket.io          | CVE-2020-28481   | MEDIUM   | 2.2.0             | 2.4.0         | Insecure defaults due to CORS         |
|                    |                  |          |                   |               | misconfiguration in socket.io         |
|                    |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-28481 |
+--------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| xmlhttprequest-ssl | CVE-2020-28502   | HIGH     | 1.5.5             | 1.6.2         | nodejs-xmlhttprequest: Code injection |
|                    |                  |          |                   |               | through user input to xhr.send        |
|                    |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-28502 |
+--------------------+------------------+----------+-------------------+---------------+---------------------------------------+

I want to use maildev smtpserver, can I do that?

If yes, can you care to explain is there is a documentation for it, or maybe the process of it?

Hello @djfarrelly ,

The Open Government Products group in Singapore (@opengovsg) are regular users of maildev and would like to assume responsibilities to maintain this repository and publish changes to npm and Docker Hub.

The specific individuals that we hope you would grant relevant access to are:

@LoneRifle (myself)
@liangyuanruo
@seaerchin

Echoing @thirsch , we would be likewise a little sad if the work done by @DominikSerafin and others is in vain, and would like to continue stewardship of this package that you have created. We also have a fork that we can fall back on for our own needs, but would love the opportunity to keep the canonical package going.

@kl3sk I don't plan to do any more work or maintenance on maildev any time soon.

So, @thirsch, with that in mind, if @djfarrelly could publish the recent changes as a new release on npm/Docker, I'm not sure if I need any additional permissions or access.

Hi @djfarrelly, do you see any chance to give more permissions to @DominikSerafin? It's very sad to see this great project dying...

@DominikSerafin you said that #154 was fixed at least. And it is. But could you consider an option to not group them ?

@a-h-abid I only have collaborator access to commit code to this repo. I'm unable to release a new version to npm/Docker.

• Declare a new CLI option, --log-mail-contents; when specified, maildev will log the JSON representation of each incoming mail, equivalent to the payloads emitted for 'new' events
• Implement the logging of mail contents by adding a listener for 'new' events emitted by mailserver, and logging the events
• Add relevant documentation in README

Fixes #354

Hi @DominikSerafin , Have you made any new releases for this repo ?

Same goes for xmlhttprequest-ssl and should be upgraded to 1.6.2 or later: CVE-2020-28502

https://github.com/maildev/maildev/pull/355 will fix this.

Due to CVE-2020-28502, the xmlhttprequest-ssl dependency should be upgraded to 1.6.2 or later.

Fantastic addons in the fork! Any update on the status of releasing a new version here?