Community PRs and targeted feature work. Highlights:
Features
- Archive now operates on the whole conversation, matching Gmail (#49)
- Russian and Ukrainian locales, full translation sets (#59 @VsevolodSauta)
- Custom favicon with unread badge painted over the base mail icon;
also fixes stale sidebar counters on JMAP push (#63 @jabiinfante)
- Optional domain-favicon avatars with a privacy-preserving proxy and
a freemail denylist so the same provider logo isn't shown for every
sender on a shared host (#22)
Fixes
- Print (Ctrl+P, button, menu) produces a clean single-column page for
plain text and HTML emails alike, with actions/reply panels hidden,
dark-mode overridden, and wide newsletters shrunk to fit A4
- Contacts now load past 500 entries by batching ContactCard/get to
the server's maxObjectsInGet (#45 @capitanroy, #46)
- Sieve filter destinations use the full Parent/Child folder path so
Stalwart can resolve them (#62 @travier)
- OIDC over plain HTTP shows a clear HTTPS-required banner instead of
throwing crypto.subtle is undefined (#23 @jothoma1)
- Missing contacts delete-confirm translation keys added to every
locale (only Dutch had them before)
- Favicon badge hook stopped tearing out Next.js's managed icon link,
fixing a parentNode-is-null crash on route changes
- Contact empty-state action buttons fit their container (#56)
- Print layout excludes sidebar/list (#55 @prastowoagungwidodo)
Docs
- README example for OAUTH_ONLY=true to disable Basic Auth (#61
@travier)
Infrastructure
- Container images also published under jmap-webmail:1 for major-tag
pinning (#57 @joelpurra, closes#54)
Defense-in-depth. All current callers pass hardcoded tailwind class
strings, so this is not exploitable today, but a future caller that
forwarded a user-controlled value would get HTML injection through the
class attribute. Run the value through escapeHtml() and add a test
covering the attribute-escape case.
The plain-text email renderer escaped <, >, and & before building anchor
tags for linkified URLs, but did not escape " or '. A crafted URL
containing a quote broke out of the href attribute and could inject
event handlers into the rendered HTML. Affects both the single-email
viewer and the threaded conversation view.
Fix by extracting a shared plainTextToSafeHtml helper that escapes all
five HTML-significant characters in the correct order before
linkification. Both views route through it. Regression tests parse the
output and assert no event handler lands on the anchor element.
Reported privately by Linus Rath. Thank you for the responsible
disclosure.
Also bumps dependencies flagged by npm audit:
- Next.js 16.1.5 -> 16.2.4 (DoS in Server Components)
- next-intl 4.5.8 -> 4.9.1 (open redirect)
- DOMPurify 3.3.1 -> 3.4.0 (FORBID_TAGS bypass)
- picomatch, vite, brace-expansion resolve transitively
Also carries the Apache JAMES compose fix from the 1.4.0 cycle (explicit
text/plain type on textBody per RFC 8621 section 4.1.4) and the missing
email_viewer.send translation.
Release 1.4.1.
New features:
- Sandboxed iframe rendering for rich HTML emails (CSS isolation)
- Mobile bottom action bar (Reply, Archive, Delete, More)
- Long-press context menu with haptic feedback on touch devices
- Tag counts sidebar section with batch JMAP queries
- Empty folder for Junk/Trash with batch delete progress
- Extra-compact density option (28px desktop, 44px touch)
- SPF/DKIM/DMARC security tooltips with plain-language explanations
- Resizable sidebars with drag, touch, and keyboard support
- Expandable sender info panel in email viewer
- API retry with exponential backoff for transient JMAP failures
- OAuth-only mode (OAUTH_ONLY env var)
Improvements:
- CSS-first responsive layout (no blink on orientation change)
- Touch-friendly context menu submenus (tap-to-expand)
- Click-to-toggle more-actions dropdown (was hover-only)
- Wide HTML emails horizontally scrollable in iframe
- All 8 locales updated with new translation keys
- Reusable email templates with local storage persistence
- Dynamic placeholder variables ({{recipientName}}, {{date}}, etc.) with auto-fill
- Template manager modal with category filtering and search
- Template picker integrated in composer toolbar (Ctrl+Shift+T)
- Settings tab for template management
- 48 unit tests for template utilities
- i18n support for all 8 languages
Add organizer/attendee UI with RSVP, contact autocomplete for participants,
scheduling messages, and inline calendar invitation banner in email viewer
with auto-detect .ics attachments, RSVP/import to calendar, and cancellation display.
Add client-side calendar event notification system that evaluates JMAP
CalendarEventAlert triggers and displays toast notifications when alert
times are reached. Includes configurable notification sound, acknowledged
alert persistence, and proactive event fetching for background alerts.
Also mounts ToastContainer globally to fix silent toast failures.
This release significantly expands internationalization support and adds comprehensive identity management features.
Internationalization (i18n):
- Add 5 new languages: Spanish, Italian, German, Dutch, Portuguese
- Expand from 3 to 8 total supported languages
- Redesign language switcher for better scalability (dropdown UI)
- Complete translations for all features across all languages
Identity Management:
- Multiple sender identities with per-identity signatures
- Sub-addressing support (user+tag@domain.com)
- Context-aware tag suggestions for sub-addresses
- Identity badges in email viewer and list
- Full CRUD operations for managing identities
Newsletter Management:
- RFC 2369 List-Unsubscribe support (one-click unsubscribe)
- HTTP and mailto unsubscribe methods
- Security validation prevents XSS attacks
- Two-step confirmation with persistent dismissal
Security & Accessibility:
- Dark mode email readability (intelligent color transformation)
- WCAG 2.0 Level AA color contrast compliance
- Comprehensive XSS prevention with validation utilities
- Unit test coverage for security-critical code (57 validation tests)
Testing:
- Add unit tests for validation utilities
- Add unit tests for email sanitization
- Add unit tests for color transformation
- Full test coverage for XSS attack vectors
Matthieu MALVACHE