LoginSign Up
← Back to all sparks
M

Mautic

MKT AUTO
Velocity5.0

Open-source marketing automation platform for email, social, and lead management.

www.mautic.org ↗

Mautic is patching three supported branches at once while 7.2 grinds through release candidates.

open-source-marketing-automationsecurity-patchingcampaign-enginegrapesjs-builderrelease-candidates
◆Current state
The project maintains 5.2, 6.0, and 7.1 simultaneously, and it showed: one coordinated security release patched SQL injection, SSRF, and server-side template injection across all three branches on the same day. Since then the visible work has been a 7.1.3 bugfix rollup — campaign restart and infinite email-resend loops, GrapesJS builder regressions — and a 7.2 release candidate line now on its second RC, tagged in late July with no compiled release notes.
◆Where it's heading
This is maintenance-shaped output from a community project carrying a wide support matrix. The 7.2 RC notes are dominated by dependency bumps, refactoring, and developer-experience work rather than new marketing automation capability, and the campaign engine keeps surfacing scheduling bugs that suggest that subsystem is where the complexity sits. A second RC without notes points to stabilisation rather than late feature additions.
◆Prediction
Expect 7.2.0 to reach stable off the current RC line, and expect any further fixes to be backported across all three supported branches as the coordinated May security release was.

◆Recent moves

  1. 14d ago

    7.2.0-rc2: second release candidate on the 7.2 line

    The second 7.2 release candidate ships without compiled release notes — the body is a single merge commit for a services-configuration refactor. It reads as stabilisation of the RC line rather than added capability, consistent with the refactor-heavy first RC.

    View source ↗
  2. 1mo ago

    7.1.3 fixes campaign resend loops, restores GrapesJS typography

    A bugfix rollup that matters more than its version number suggests: it stops campaigns restarting on every cron run and kills an infinite email-resend loop triggered by deleting a decision. It also restores typography and styling tools in the GrapesJS builder that had been disabled.

    View source ↗
  3. 2mo ago

    7.2.0 RC: dependency cleanup and configurable campaign cache TTL

    The 7.2 release candidate is weighted toward refactoring, dependency updates, and developer experience, with a configurable campaign event cache TTL as the operator-facing change. Useful housekeeping rather than new automation capability.

    View source ↗
  4. 2mo ago

    7.1.2 security release patches SQL injection, SSRF, and SSTI

    A security release patching SQL injection in API contact filtering, SSRF in the Focus component, and server-side template injection in theme templates. For a self-hosted product handling contact data, these are the advisories that force an unscheduled upgrade.

    View source ↗
  5. 2mo ago

    6.0.9 backports the SQL injection, SSRF, and SSTI fixes

    The same three advisories backported to the 6.0 branch and released the same day. The simultaneous patching across branches is the clearest evidence of how wide a support matrix this project carries.

    View source ↗
  6. 2mo ago

    5.2.11 backports the same three security advisories

    The third arm of the coordinated security release, covering the 5.2 branch. Operators still on the oldest supported line get the same fixes rather than being pushed to upgrade major versions under pressure.

    View source ↗