The current version supplied with XC5 is is 5.2.22, released 9/1/2017 which is located here in XC5; /vendor/phpmailer/phpmailer
The current '5.2 stable branch' release however is 5.2.26, released 4/11/2017 (LINK to tar.gz file
The phpmailer text is as follows:
PHPMailer 5.2 (which is compatible with PHP 5.0 - 7.0) is no longer being supported for feature updates, and will only be receiving security updates from now on. You will find the latest version of 5.2 in the 5.2-stable branch, and future versions of 5.2 will be tagged with 5.2.x version numbers, so existing Composer configs should remain working. If you're using PHP 5.5 or later, we recommend you make the necessary changes to switch to the 6.0 release.
The latest 6.0 release is 6.0.5, released 28/03/2018 (LINK to tar.gz file
We're using PHP 7.2.4 and wanting to configure phpmailer to be far more secure and acceptable externally i.e. utilise DMARC, DKIM, SPF which we do on all none XC generated e-mail traffic anyway.
Within XC5, everyone already has the option of bypassing phpmailer and using SMTP instead, but we don't want to, as phpmailer is fast efficient and (normally...) straightforward to configure and use.
The questions for XC then, is:
When will the phpmailer provided by XC be updated?
We can update the XC supplied version ourselves easily enough, but then this falls into the trap of future XC5 upgrades from hell
Or... we could spend a lot of time, writing a lot of changes into a custom module to achieve the same.
An XC phpmailer upgrade (which is overdue anyway) is our preferred option. We do not want to do all the DMARC, DKIM, SPF configuration work twice i.e. once on the current out of date XC5 version and then again once it's upgrade to 6.0.5 > because the two are different and have different features.
If we need to raise a bug ticket, we will, but we've posted it here first as others may have input too...