Linus Rath
eb2787bcc9
fix: end admin sessions on sign-out and when the admin password changes
2026-10-26 14:52:04 +01:00
Linus Rath
121d2d5e31
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
2026-10-26 14:52:04 +01:00
Linus Rath
08969fde67
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
2026-10-26 14:52:04 +01:00
Linus Rath
07e6ecce1a
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
2026-10-26 14:52:04 +01:00
Linus Rath
885ecdaa07
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
2026-10-26 14:52:04 +01:00
Linus Rath
fb793220b7
fix: keep plugin switches from shrinking next to long labels, like the app's settings switches
2026-10-26 14:52:04 +01:00
Linus Rath
e314e56661
fix: keep the own and a group's scheduled mail apart when their ids are the same
2026-10-26 12:26:58 +01:00
Linus Rath
d355e45b77
fix: stop Send now from dropping a group identity's delayed mail back into Drafts
2026-10-26 12:26:58 +01:00
Linus Rath
3508412b8b
fix: stop reply and send from slowing down on deeply nested quotes
2026-10-26 12:26:58 +01:00
Linus Rath
5b4db7f1d8
fix: keep emoji and organizer names with a colon intact in exported events
2026-10-26 12:25:32 +01:00
Linus Rath
7e0be4625a
test: copy a file the reworked demo drive still has in the mock server tests
2026-10-26 12:25:31 +01:00
Linus Rath
02e8541571
test: search the reworked demo calendar in the demo search tests
2026-10-26 12:25:31 +01:00
Linus Rath
88b960d605
fix: stop deleting the active account's mail after removing the account whose folder is open
2026-10-26 12:25:08 +01:00
Linus Rath
863aa81d1c
fix: stop a synced settings file from passing as an admin session
2026-10-26 11:48:39 +01:00
Linus Rath
30cb676fad
fix: write the admin config, password hash and setup token readable only by the app's own user
2026-10-26 11:48:38 +01:00
Linus Rath
3036769645
fix: let the allowed frame ancestors saved in the admin dashboard reach the frame-ancestors header
2026-10-26 11:48:38 +01:00
Linus Rath
a4c6d7867a
test: expect the plugin sandbox assets among the CORS-enabled static paths
2026-10-26 11:48:38 +01:00
Linus Rath
0f0ebc906b
fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78)
2026-10-26 11:48:38 +01:00
Linus Rath
fa3e76652f
fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to
2026-10-26 11:36:57 +01:00
Linus Rath
5bd03d175d
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
2026-10-26 11:33:38 +01:00
Linus Rath
b9fc9bc9c0
fix: stop synced settings from piling up a new file for every extra slash after the server address
2026-10-26 11:33:38 +01:00
Linus Rath
01a1dc47a6
fix: load push notification previews when the webmail reaches the mail server on an internal address
2026-10-26 11:33:37 +01:00
Linus Rath
1fc44b4813
fix: show the push notification for mail in an account shared into another signed-in login
2026-10-26 11:33:37 +01:00
Linus Rath
9ed3354550
fix: send a password and TOTP sign-in to the server the user typed, not the default one
2026-10-26 11:33:37 +01:00
Linus Rath
192d32819c
fix: stop a bare login name from claiming an address on another domain
2026-10-26 11:33:37 +01:00
Linus Rath
680742c3ef
fix: end a password and TOTP sign-in without remember me with the browser session
2026-10-26 11:33:37 +01:00
Linus Rath
ec0fed19cc
fix: stop reading a marketplace bundle download once it passes the package size limit
2026-10-26 11:29:37 +01:00
Linus Rath
e762943f7b
fix: let a plugin move a single message that is not in the open list
2026-10-26 11:29:37 +01:00
Linus Rath
8e66c9f6ad
fix: keep plugin approval requests that several users send at once
2026-10-26 11:29:37 +01:00
Linus Rath
c4a399f5b8
fix: stop plugin moves from filing another account's messages while its folder is open
2026-10-26 11:29:37 +01:00
Linus Rath
3f2f27321c
fix: keep an unquoted cid: image from swallowing the rest of the message
2026-10-26 11:22:10 +01:00
Linus Rath
afdd79b29d
fix: keep a mail full of bare blockquotes from freezing the reader
2026-10-26 11:22:10 +01:00
Linus Rath
3caa83f1a6
fix: download winmail.dat parts whose type a browser would drop instead of opening them
2026-10-26 11:22:10 +01:00
Linus Rath
cf2c27157d
Merge branch 'main' into feat/stalwart-1.0
...
# Conflicts:
# components/contacts/contacts-app.tsx
# components/email/__tests__/composer-discard.test.tsx
# components/email/calendar-invitation-banner.tsx
# components/email/email-composer.tsx
# components/mail/mail-app.tsx
# components/pro/pro-compose-tab-body.tsx
# components/pro/pro-email-tab-body.tsx
# components/ui/__tests__/avatar.test.tsx
# components/ui/avatar.tsx
# hooks/use-mailbox-drop.ts
# lib/__tests__/calendar-alerts.test.ts
# lib/__tests__/jmap-calendar-tasks.test.ts
# lib/__tests__/jmap-send-threading.test.ts
# lib/demo/demo-client.ts
# lib/demo/fixtures/calendars.ts
# lib/jmap/client-interface.ts
# lib/jmap/client.ts
# lib/web-push.ts
# stores/__tests__/contact-store.test.ts
# stores/__tests__/email-store-thread-key.test.ts
# stores/calendar-store.ts
# stores/contact-store.ts
# stores/email-store.ts
2026-10-26 10:14:12 +01:00
Linus Rath
7845b2caea
fix: place calendar events at their clock time on DST change days
2026-10-25 14:17:59 +01:00
Linus Rath
f7a4087c91
feat: split the Mountain View inbox into Unread and Everything else, as Gmail's unread first
2026-10-25 13:13:46 +01:00
Linus Rath
5a9c318ec5
fix: keep mails that paint their own page background from flashing white in dark mode
2026-10-25 12:39:28 +01:00
Linus Rath
171fd1ea4c
perf: load React DOM and the UI kit only in plugin frames that draw
2026-10-25 02:56:14 +01:00
Linus Rath
f20892ccec
fix: start plugins when the sign-in races the first plugin start
2026-10-25 02:24:41 +01:00
Linus Rath
5edbbf0816
perf: start plugin slot frames without waiting for the plugin's own frame
2026-10-25 02:24:08 +01:00
Linus Rath
e38e326efb
perf: load plugin frames as a plain page instead of a Next app
...
Every plugin iframe loaded /plugin-sandbox, a force-dynamic Next page.
Each frame then fetched, parsed and hydrated Next's client router on top
of React and the runtime, and the server rendered the page once per
frame, one after another when a dozen plugins started together.
Sandboxed frames have opaque origins, so the browser's code cache never
helps, and they run on the host page's main thread: with 12 plugins
the frames took 2.5-3 s to come up after the app had loaded.
The sandbox routes now return a small HTML page with the UI kit's
stylesheet and the runtime as an ES module, both built ahead of time:
- `scripts/build-plugin-sandbox.mjs` bundles the runtime with esbuild
and compiles `plugin-kit.css` with the app's Tailwind setup into
`public/plugin-sandbox-assets/`, with a manifest. Named Tabler imports
are pointed at the icons' own files, so the full icon set stays in a
chunk that only loads for an icon name the kit doesn't ship.
- `npm run build`, `npm run dev`, the Dockerfile and the perf-guard
workflow run it before `next build`.
- `lib/plugin-sandbox/sandbox-document.ts` writes the page; proxy.ts
still sets the sandbox CSP and the script carries its nonce.
- The assets are served from public/ with CORS and immutable caching.
A frame on an idle page is ready in 255 ms instead of 362 ms, eleven at
once in 1.0 s instead of 2.1 s.
2026-10-25 02:01:47 +01:00
Linus Rath
181a0d7d88
perf: send plugin frames only the translations of the current language
2026-10-25 02:26:17 +02:00
Linus Rath
52959e8135
fix: stop plugin panels flashing white in the dark theme
2026-10-25 02:22:59 +02:00
Linus Rath
c066d40180
perf: check cached plugin bundles without reading them, and download in parallel
2026-10-25 02:18:18 +02:00
Linus Rath
be8adde945
perf: fetch the server plugin list once per page load
2026-10-25 02:15:13 +02:00
Linus Rath
9a568aa4f4
perf: write the plugin list to storage once per burst of changes
2026-10-25 02:12:50 +02:00
Linus Rath
782d4f8bf5
perf: stop loading the app's stores in every plugin frame
2026-10-25 02:09:37 +02:00
Linus Rath
23eb3c5a2f
fix: start plugins after signing in, not only after the next reload
2026-10-25 02:06:35 +02:00
Linus Rath
af07bb3cd3
fix: list admin plugins when the browser can't cache their code #1327
2026-10-24 22:37:16 +02:00
Linus Rath
a49ab079ec
fix: sanitize quoted and signature HTML in re-opened drafts (GHSA-g35q-3gpc-x2rr)
2026-10-24 22:13:19 +02:00
Linus Rath