# What changed in emails

> 5 changes in emails 1 from its official release notes, upgrade guides and advisories: 2 breaking, 3 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/pypi/emails/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## emails 1

### Breaking changes

- Fetching resources from loopback, private, link-local, or other non-public addresses now raises this error, including when rendering untrusted HTML. (1.1.3) — [release notes](https://github.com/lavr/python-emails/releases/tag/v1.1.3)
- TLS certificates are now verified when fetching remote resources; verification defaults to true. (1.1.3) — [release notes](https://github.com/lavr/python-emails/releases/tag/v1.1.3)

### Security

- CSS @import rules are no longer fetched while styles are inlined. (1.1.3) — [release notes](https://github.com/lavr/python-emails/releases/tag/v1.1.3)
- The URL validator can be customized or disabled for trusted HTML; by default, fetching URLs that resolve to non-public addresses is rejected to mitigate SSRF. (1.1.3) — [release notes](https://github.com/lavr/python-emails/releases/tag/v1.1.3)
- External stylesheets are loaded via `fetch_url`, so they honor `requests_params` and the default timeout. (1.1.3) — [release notes](https://github.com/lavr/python-emails/releases/tag/v1.1.3)