Linus Rath
8b9df1b633
Merge branch 'feat/multi-instance' into feat/multi-instance-data
2026-10-31 23:43:48 +01:00
Linus Rath
eb0005f3ef
feat: share telemetry and update-check state across instances, with one instance id and login count #1066
2026-10-31 23:10:30 +01:00
Linus Rath
7148dd2ded
feat: keep account archives in the shared store #1066
2026-10-31 23:04:02 +01:00
Linus Rath
9651098634
fix: keep both templates when two settings saves arrive at once #1066
2026-10-31 22:58:14 +01:00
Linus Rath
585e10041e
fix: refuse to save over stored settings or plugin credentials that no longer decrypt #1066
2026-10-31 22:54:35 +01:00
Linus Rath
fd4a319eae
feat: show the storage and how many instances checked in on the admin overview #1066
2026-10-31 22:46:08 +01:00
Linus Rath
1b2d81be27
feat: hold each instance back until it has loaded from the shared store and add a readiness check #1066
2026-10-31 22:40:51 +01:00
Linus Rath
d23a2869d1
Merge remote-tracking branch 'origin/main' into fix/found-fix-server
...
# Conflicts:
# Dockerfile
# docker-compose.yml
2026-10-31 18:17:39 +01:00
Linus Rath
f884ffe441
Merge branch 'fix/found-fix-ui' into fix/found-fix-server
2026-10-31 18:17:13 +01:00
Linus Rath
ddc24e4fc7
fix: let a browser an admin signed in from before past the shared admin login limit
2026-10-31 17:55:29 +01:00
Linus Rath
825d6e76f8
fix: let admins switch off usage stats by clearing the collector address
2026-10-31 17:51:09 +01:00
Linus Rath
f11ddf82dd
fix: tell banner plugins when an admin opened the mailbox through impersonation
2026-10-31 17:48:29 +01:00
Linus Rath
1e462fc67e
Merge pull request #1436 from shukiv/fix/impersonation-expired-app-passwords
...
fix: let a mailbox be opened through the handoff more than five times
2026-10-31 16:24:52 +01:00
Linus Rath
5931cd1678
feat: send an oauth resource indicator when one is configured #1461
2026-10-31 16:14:35 +01:00
Linus Rath
3bdbdb1364
docs: move the mobile hand-off contract to the website
2026-10-31 14:32:39 +01:00
Linus Rath
f74ff49f58
feat: give the mobile app its organisation policy for its access token
2026-10-31 14:10:53 +01:00
Linus Rath
fb3ba0275a
feat: hand the mobile app a one-time code instead of the sign-in in its link
2026-10-31 14:06:44 +01:00
Linus Rath
cabb174108
feat: register a client for bulwark mobile in the oauth auto-setup #1459
2026-10-31 00:56:49 +01:00
Linus Rath
66351e0d31
feat: show admins the changelog of every plugin version an update brings or a rollback undoes
2026-10-30 02:02:40 +01:00
Linus Rath
cf0eb03c4a
feat: show the sender's BIMI logo as the sender icon when the message passes DMARC
...
Stalwart does no BIMI, so sender icons were only ever favicons, which
anyone controls for any domain. The webmail server now does the
receiver side itself at /api/bimi, and avatars ask it only for
messages whose own Authentication-Results say dmarc=pass for the exact
From domain.
- `lib/bimi/`: DMARC policy check (quarantine or reject, pct=100, the
parent domain's sp and p for subdomains), the assertion record with
fallback to the parent domain, mark certificate validation (chain to
pinned DigiCert, GlobalSign and SSL.com VMC roots, BIMI key purpose,
validity, SAN, SCTs present, CRL revocation, logo from the logotype
extension), SVG Tiny PS checks and rendering to PNG, caching
- logos backed only by the DNS record show by default; the admin
setting "Require a mark certificate" (`BIMI_REQUIRE_CERTIFICATE`)
limits them to VMC and CMC backed ones
- a check mark beside the sender's name for certificate-backed logos
- avatars try contact photo, BIMI logo, plugin avatar, favicon; the
sender warning shield still wins, and logos follow the sender icons
setting and the no-third-party-traffic mode
- the two-label public suffix list moved to `lib/root-domain.ts`
SCT signatures are not verified and only the default selector is used.
2026-10-30 00:12:24 +01:00
Linus Rath
50b3ddccec
feat: let admins keep the refresh token valid on sign-out so Stalwart keeps the consent #1388
2026-10-29 20:47:18 +01:00
Linus Rath
0b4e501142
feat: make the login email placeholder configurable #1423
2026-10-29 20:24:26 +01:00
Linus Rath
d875714f35
feat: offer remember me on the sso-only login and apply it to every sso path #1437
2026-10-29 20:06:44 +01:00
Linus Rath
623c9e1792
feat: let operators set accessibility statement, barrier report, help, Easy Read and sign language links
2026-10-29 18:27:35 +01:00
Shuki Vaknin
322274fff8
fix: let a mailbox be opened through the handoff more than five times
...
Each impersonation handoff makes an app password on the target mailbox
that expires after 8 hours. Stalwart keeps an app password after its
expiresAt and counts it against the mailbox's limit (5 by default), and
nothing deleted the expired ones, so after five handoffs every further
one failed with "You have exceeded your quota of 5 app passwords" and the
mailbox could no longer be opened that way.
Before making a new one, the handoff now lists the mailbox's app
passwords and deletes its own expired ones, recognised by the
"Support session " description. The user's own app passwords and a
session still running are never touched. It is best effort: if the list
or the delete fails, the handoff tries to create the password as before.
2026-10-29 16:37:06 +00:00
Linus Rath
f12a13e1fd
feat: create documents in the formats the document editor can edit from New file #1393
2026-10-29 00:01:13 +01:00
Linus Rath
d10d6b60ce
fix: tell admins the OAuth setup needs a webmail sign-in and disable it until there is one
2026-10-28 17:40:26 +01:00
Linus Rath
9e809a31db
Merge branch 'feat/org-features' into feat/org-thirdparty
2026-10-28 05:27:58 +01:00
Linus Rath
1a747ac9dd
feat: limit the page's CSP to the configured hosts with no third-party traffic #903
2026-10-28 04:30:41 +01:00
Linus Rath
031d94635c
refactor: keep the outgoing host descriptions out of the browser bundle and scan every URL form #903
2026-10-28 04:30:23 +01:00
Linus Rath
defe4e93f3
fix: bind the sign-in time to the refresh token and count unstamped sessions from a fixed time
2026-10-28 03:42:19 +01:00
Linus Rath
cefb20db4e
test: give the plugin proxy route test the config reader the mode needs #903
2026-10-28 03:10:14 +01:00
Linus Rath
6e5d8faec6
feat: refuse to restore or renew sessions older than the admin-set maximum length
2026-10-28 02:30:32 +01:00
Linus Rath
92c9110f3c
feat: show the third-party traffic switch and what stays reachable in Organisation > Security #903
2026-10-28 02:24:13 +01:00
Linus Rath
553f1e9149
feat: add a switch that stops all third-party traffic #903
2026-10-28 02:19:06 +01:00
Linus Rath
084cf3cf3a
fix: fetch the policy again only for an account of a domain it doesn't cover
2026-10-28 01:08:56 +01:00
Linus Rath
4004b9be7c
feat: let admins export and import the whole user policy as one file
2026-10-28 00:44:31 +01:00
Linus Rath
4b69f1307f
feat: let admins scope the user policy per domain or group
2026-10-28 00:29:02 +01:00
Linus Rath
67982b19bf
fix: register the webmail as a first-party OAuth client on Stalwart 1.0 so SSO users keep full access
2026-10-26 20:25:43 +01:00
Linus Rath
004f0948d5
fix: ask Stalwart 1.0 for mail, contacts, calendar and file access when signing in with SSO
2026-10-26 20:25:42 +01:00
Linus Rath
8860dde005
fix: sign in with password and TOTP on Stalwart 1.0
2026-10-26 20:25:42 +01:00
Linus Rath
8a3351bbc9
fix: refuse an oversized plugin approval upload before reading it
2026-10-26 15:15:58 +01:00
Linus Rath
42117da498
fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)
2026-10-26 15:00:56 +01:00
Linus Rath
ae897b42a4
fix: make the impersonation handoff really clear the previous account list and ignore ?impersonated=1 links from elsewhere
2026-10-26 14:58:31 +01:00
Linus Rath
eb2787bcc9
fix: end admin sessions on sign-out and when the admin password changes
2026-10-26 14:52:04 +01:00
Linus Rath
121d2d5e31
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
2026-10-26 14:52:04 +01:00
Linus Rath
08969fde67
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
2026-10-26 14:52:04 +01:00
Linus Rath
07e6ecce1a
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
2026-10-26 14:52:04 +01:00
Linus Rath
885ecdaa07
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
2026-10-26 14:52:04 +01:00
Linus Rath
e6c911899c
fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards
2026-10-26 11:48:39 +01:00
Linus Rath
Shuki Vaknin