I decided to write a small blurb here to provide some transparency about FossaMail and where I'm going with this.
FossaMail hasn't been updated to 25 yet. What gives?
Simply put: I haven't had time yet to do what I want to do for the new major version of FossaMail.
Version 25 of FossaMail will no longer use the Mozilla core (Firefox 24 ESR) back-end like it did before, and instead it will continue from here on out with the updated and current Pale Moon core back-end. This means a big change in how the mail client is built, which needs extra time and attention. Since my focus has been on updating and doing some rapid, much-needed development on the Pale Moon core, FossaMail has been on the back-burner. No worries, it hasn't been forgotten about!
Will FossaMail continue to be compatible with Thunderbird?
Yes. I have no plans to change the basic way FossaMail handles extensions. It will still be a re-branded and reconfigured Thunderbird mail/news core, and the "comm" part will remain in line with Thunderbird and compatible with Thunderbird extensions (and carry the Thunderbird GUID).
Only the back-end will change which is used for drawing the UI and displaying your mail. This is very similar to how e.g. SeaMonkey draws on a "linked in" Firefox core while remaining its own front-end, regardless of the back-end change.
When can we expect an update? Am I at risk now?
There will be an update sometime after Pale Moon 25.1 has been released, and "when it's done" as per usual. No date is set yet for this update release.
You shouldn't be at risk as regards security in the mail client, since a mail client is much less exposed to vulnerabilities than a web browser is. For example, FossaMail will not allow JavaScript to be executed in HTML e-mails (unlike what a browser has to do with a web page). There are currently no known issues with libraries in FossaMail that could be exploited through normal use.