Linus Rath
bec17e6a7b
test: reset the stored-credential budget between pairing tests
2026-10-26 16:33:08 +01:00
Linus Rath
d72bff95f9
fix: stop acting on a message of a signed-out account through the active account
2026-10-26 16:11:51 +01:00
Linus Rath
f0392a6705
fix: check a meeting reply's sender against the attendee who answers, not the organizer
2026-10-26 15:15:58 +01:00
Linus Rath
e120ac6361
fix: let plugins read the message of the account they name, as ids repeat across accounts
2026-10-26 15:15:58 +01:00
Linus Rath
f829d4a2e8
fix: ask the next user again before running plugins installed by someone who signed out
2026-10-26 15:15:58 +01:00
Linus Rath
d29309ed0d
fix: keep plugin embed origins out of the page CSP while plugins are turned off
2026-10-26 15:15:58 +01:00
Linus Rath
42117da498
fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)
2026-10-26 15:00:56 +01:00
Linus Rath
ae897b42a4
fix: make the impersonation handoff really clear the previous account list and ignore ?impersonated=1 links from elsewhere
2026-10-26 14:58:31 +01:00
Linus Rath
f02e96b47a
fix: stop the password and TOTP sign-in from re-posting the password to another host when the mail server redirects
2026-10-26 14:58:31 +01:00
Linus Rath
eb2787bcc9
fix: end admin sessions on sign-out and when the admin password changes
2026-10-26 14:52:04 +01:00
Linus Rath
121d2d5e31
fix: stop buffering up to 100 MB of every unauthenticated request body before routing
2026-10-26 14:52:04 +01:00
Linus Rath
08969fde67
fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes
2026-10-26 14:52:04 +01:00
Linus Rath
07e6ecce1a
fix: show a plain new-mail notification instead of another login's message when two signed-in logins have the same account id
2026-10-26 14:52:04 +01:00
Linus Rath
885ecdaa07
fix: keep the server's path prefix in the CalDAV addresses shown in calendar settings
2026-10-26 14:52:04 +01:00
Linus Rath
fb793220b7
fix: keep plugin switches from shrinking next to long labels, like the app's settings switches
2026-10-26 14:52:04 +01:00
Linus Rath
e314e56661
fix: keep the own and a group's scheduled mail apart when their ids are the same
2026-10-26 12:26:58 +01:00
Linus Rath
d355e45b77
fix: stop Send now from dropping a group identity's delayed mail back into Drafts
2026-10-26 12:26:58 +01:00
Linus Rath
3508412b8b
fix: stop reply and send from slowing down on deeply nested quotes
2026-10-26 12:26:58 +01:00
Linus Rath
5b4db7f1d8
fix: keep emoji and organizer names with a colon intact in exported events
2026-10-26 12:25:32 +01:00
Linus Rath
7e0be4625a
test: copy a file the reworked demo drive still has in the mock server tests
2026-10-26 12:25:31 +01:00
Linus Rath
02e8541571
test: search the reworked demo calendar in the demo search tests
2026-10-26 12:25:31 +01:00
Linus Rath
863aa81d1c
fix: stop a synced settings file from passing as an admin session
2026-10-26 11:48:39 +01:00
Linus Rath
3036769645
fix: let the allowed frame ancestors saved in the admin dashboard reach the frame-ancestors header
2026-10-26 11:48:38 +01:00
Linus Rath
a4c6d7867a
test: expect the plugin sandbox assets among the CORS-enabled static paths
2026-10-26 11:48:38 +01:00
Linus Rath
0f0ebc906b
fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78)
2026-10-26 11:48:38 +01:00
Linus Rath
5bd03d175d
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
2026-10-26 11:33:38 +01:00
Linus Rath
b9fc9bc9c0
fix: stop synced settings from piling up a new file for every extra slash after the server address
2026-10-26 11:33:38 +01:00
Linus Rath
01a1dc47a6
fix: load push notification previews when the webmail reaches the mail server on an internal address
2026-10-26 11:33:37 +01:00
Linus Rath
1fc44b4813
fix: show the push notification for mail in an account shared into another signed-in login
2026-10-26 11:33:37 +01:00
Linus Rath
9ed3354550
fix: send a password and TOTP sign-in to the server the user typed, not the default one
2026-10-26 11:33:37 +01:00
Linus Rath
192d32819c
fix: stop a bare login name from claiming an address on another domain
2026-10-26 11:33:37 +01:00
Linus Rath
680742c3ef
fix: end a password and TOTP sign-in without remember me with the browser session
2026-10-26 11:33:37 +01:00
Linus Rath
e762943f7b
fix: let a plugin move a single message that is not in the open list
2026-10-26 11:29:37 +01:00
Linus Rath
c4a399f5b8
fix: stop plugin moves from filing another account's messages while its folder is open
2026-10-26 11:29:37 +01:00
Linus Rath
3f2f27321c
fix: keep an unquoted cid: image from swallowing the rest of the message
2026-10-26 11:22:10 +01:00
Linus Rath
afdd79b29d
fix: keep a mail full of bare blockquotes from freezing the reader
2026-10-26 11:22:10 +01:00
Linus Rath
3caa83f1a6
fix: download winmail.dat parts whose type a browser would drop instead of opening them
2026-10-26 11:22:10 +01:00
Linus Rath
cf2c27157d
Merge branch 'main' into feat/stalwart-1.0
...
# Conflicts:
# components/contacts/contacts-app.tsx
# components/email/__tests__/composer-discard.test.tsx
# components/email/calendar-invitation-banner.tsx
# components/email/email-composer.tsx
# components/mail/mail-app.tsx
# components/pro/pro-compose-tab-body.tsx
# components/pro/pro-email-tab-body.tsx
# components/ui/__tests__/avatar.test.tsx
# components/ui/avatar.tsx
# hooks/use-mailbox-drop.ts
# lib/__tests__/calendar-alerts.test.ts
# lib/__tests__/jmap-calendar-tasks.test.ts
# lib/__tests__/jmap-send-threading.test.ts
# lib/demo/demo-client.ts
# lib/demo/fixtures/calendars.ts
# lib/jmap/client-interface.ts
# lib/jmap/client.ts
# lib/web-push.ts
# stores/__tests__/contact-store.test.ts
# stores/__tests__/email-store-thread-key.test.ts
# stores/calendar-store.ts
# stores/contact-store.ts
# stores/email-store.ts
2026-10-26 10:14:12 +01:00
Linus Rath
7845b2caea
fix: place calendar events at their clock time on DST change days
2026-10-25 14:17:59 +01:00
Linus Rath
f7a4087c91
feat: split the Mountain View inbox into Unread and Everything else, as Gmail's unread first
2026-10-25 13:13:46 +01:00
Linus Rath
5a9c318ec5
fix: keep mails that paint their own page background from flashing white in dark mode
2026-10-25 12:39:28 +01:00
Linus Rath
171fd1ea4c
perf: load React DOM and the UI kit only in plugin frames that draw
2026-10-25 02:56:14 +01:00
Linus Rath
f20892ccec
fix: start plugins when the sign-in races the first plugin start
2026-10-25 02:24:41 +01:00
Linus Rath
5edbbf0816
perf: start plugin slot frames without waiting for the plugin's own frame
2026-10-25 02:24:08 +01:00
Linus Rath
e38e326efb
perf: load plugin frames as a plain page instead of a Next app
...
Every plugin iframe loaded /plugin-sandbox, a force-dynamic Next page.
Each frame then fetched, parsed and hydrated Next's client router on top
of React and the runtime, and the server rendered the page once per
frame, one after another when a dozen plugins started together.
Sandboxed frames have opaque origins, so the browser's code cache never
helps, and they run on the host page's main thread: with 12 plugins
the frames took 2.5-3 s to come up after the app had loaded.
The sandbox routes now return a small HTML page with the UI kit's
stylesheet and the runtime as an ES module, both built ahead of time:
- `scripts/build-plugin-sandbox.mjs` bundles the runtime with esbuild
and compiles `plugin-kit.css` with the app's Tailwind setup into
`public/plugin-sandbox-assets/`, with a manifest. Named Tabler imports
are pointed at the icons' own files, so the full icon set stays in a
chunk that only loads for an icon name the kit doesn't ship.
- `npm run build`, `npm run dev`, the Dockerfile and the perf-guard
workflow run it before `next build`.
- `lib/plugin-sandbox/sandbox-document.ts` writes the page; proxy.ts
still sets the sandbox CSP and the script carries its nonce.
- The assets are served from public/ with CORS and immutable caching.
A frame on an idle page is ready in 255 ms instead of 362 ms, eleven at
once in 1.0 s instead of 2.1 s.
2026-10-25 02:01:47 +01:00
Linus Rath
181a0d7d88
perf: send plugin frames only the translations of the current language
2026-10-25 02:26:17 +02:00
Linus Rath
52959e8135
fix: stop plugin panels flashing white in the dark theme
2026-10-25 02:22:59 +02:00
Linus Rath
c066d40180
perf: check cached plugin bundles without reading them, and download in parallel
2026-10-25 02:18:18 +02:00
Linus Rath
be8adde945
perf: fetch the server plugin list once per page load
2026-10-25 02:15:13 +02:00
Linus Rath
9a568aa4f4
perf: write the plugin list to storage once per burst of changes
2026-10-25 02:12:50 +02:00
Linus Rath