If the library they depend on isnt getting fixed then it needs to be worked around (doable with HTML sanitisation) or use another library that's usable for the

If the library they depend on isnt getting fixed then it needs to be worked around (doable with HTML sanitisation) or use another library that's usable for the purpose of an email client. If neither of those are doable, the software needs a warning that it's vulnerable to a such a terrible privacy exploit. People over however many years this has been possible deserve to know that their email client has been allowing any random person in the internet to easily get their IP address or know they're on their computer. If you can't do this why are you maintaining software, it's unmaintained at that point. The replies to the bug report are just terrible attitude even if factually correct.