Linus Rath
eeb6ccc4db
fix: create each account's Archive when bulk archiving in the unified inbox
2026-10-26 12:25:08 +01:00
Linus Rath
e6c911899c
fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards
2026-10-26 11:48:39 +01:00
Linus Rath
863aa81d1c
fix: stop a synced settings file from passing as an admin session
2026-10-26 11:48:39 +01:00
Linus Rath
30cb676fad
fix: write the admin config, password hash and setup token readable only by the app's own user
2026-10-26 11:48:38 +01:00
Linus Rath
3036769645
fix: let the allowed frame ancestors saved in the admin dashboard reach the frame-ancestors header
2026-10-26 11:48:38 +01:00
Linus Rath
a4c6d7867a
test: expect the plugin sandbox assets among the CORS-enabled static paths
2026-10-26 11:48:38 +01:00
Linus Rath
0f0ebc906b
fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78)
2026-10-26 11:48:38 +01:00
Linus Rath
fa3e76652f
fix: keep plugin credentials of a bare-name token sign-in under the account it resolved to
2026-10-26 11:36:57 +01:00
Linus Rath
5bd03d175d
fix: show all-day events on their own day in the Calendar Agenda for viewers west of the server's time zone
2026-10-26 11:33:38 +01:00
Linus Rath
b9fc9bc9c0
fix: stop synced settings from piling up a new file for every extra slash after the server address
2026-10-26 11:33:38 +01:00
Linus Rath
01a1dc47a6
fix: load push notification previews when the webmail reaches the mail server on an internal address
2026-10-26 11:33:37 +01:00
Linus Rath
1fc44b4813
fix: show the push notification for mail in an account shared into another signed-in login
2026-10-26 11:33:37 +01:00
Linus Rath
9ed3354550
fix: send a password and TOTP sign-in to the server the user typed, not the default one
2026-10-26 11:33:37 +01:00
Linus Rath
f9ccc6adf1
fix: clear the refresh token of an OAuth account that could not be restored
2026-10-26 11:33:37 +01:00
Linus Rath
192d32819c
fix: stop a bare login name from claiming an address on another domain
2026-10-26 11:33:37 +01:00
Linus Rath
680742c3ef
fix: end a password and TOTP sign-in without remember me with the browser session
2026-10-26 11:33:37 +01:00
Linus Rath
ec0fed19cc
fix: stop reading a marketplace bundle download once it passes the package size limit
2026-10-26 11:29:37 +01:00
Linus Rath
e762943f7b
fix: let a plugin move a single message that is not in the open list
2026-10-26 11:29:37 +01:00
Linus Rath
8e66c9f6ad
fix: keep plugin approval requests that several users send at once
2026-10-26 11:29:37 +01:00
Linus Rath
c4a399f5b8
fix: stop plugin moves from filing another account's messages while its folder is open
2026-10-26 11:29:37 +01:00
Linus Rath
cb51847ab3
fix: refuse plugin approval requests while user plugins or their review are turned off (GHSA-qc44-275p-gqw9)
2026-10-26 11:29:36 +01:00
Linus Rath
b5c6b67ba4
fix: keep a link in a printed message from redirecting the webmail tab
2026-10-26 11:22:10 +01:00
Linus Rath
3f2f27321c
fix: keep an unquoted cid: image from swallowing the rest of the message
2026-10-26 11:22:10 +01:00
Linus Rath
6014142358
fix: show conversation and attached-message attachment names without directional override characters
2026-10-26 11:22:10 +01:00
Linus Rath
c133659c83
fix: run links in conversation messages through the reader's link gate
2026-10-26 11:22:10 +01:00
Linus Rath
afdd79b29d
fix: keep a mail full of bare blockquotes from freezing the reader
2026-10-26 11:22:10 +01:00
Linus Rath
3caa83f1a6
fix: download winmail.dat parts whose type a browser would drop instead of opening them
2026-10-26 11:22:10 +01:00
Linus Rath
d76a472022
Merge branch 'feat/stalwart-1.0'
2026-10-26 10:14:20 +01:00
Linus Rath
cf2c27157d
Merge branch 'main' into feat/stalwart-1.0
...
# Conflicts:
# components/contacts/contacts-app.tsx
# components/email/__tests__/composer-discard.test.tsx
# components/email/calendar-invitation-banner.tsx
# components/email/email-composer.tsx
# components/mail/mail-app.tsx
# components/pro/pro-compose-tab-body.tsx
# components/pro/pro-email-tab-body.tsx
# components/ui/__tests__/avatar.test.tsx
# components/ui/avatar.tsx
# hooks/use-mailbox-drop.ts
# lib/__tests__/calendar-alerts.test.ts
# lib/__tests__/jmap-calendar-tasks.test.ts
# lib/__tests__/jmap-send-threading.test.ts
# lib/demo/demo-client.ts
# lib/demo/fixtures/calendars.ts
# lib/jmap/client-interface.ts
# lib/jmap/client.ts
# lib/web-push.ts
# stores/__tests__/contact-store.test.ts
# stores/__tests__/email-store-thread-key.test.ts
# stores/calendar-store.ts
# stores/contact-store.ts
# stores/email-store.ts
2026-10-26 10:14:12 +01:00
Linus Rath
7845b2caea
fix: place calendar events at their clock time on DST change days
2026-10-25 14:17:59 +01:00
Linus Rath
3bfba19ca5
fix: give Mountain View's list chips Gmail's height and spacing
2026-10-25 13:14:24 +01:00
Linus Rath
f7a4087c91
feat: split the Mountain View inbox into Unread and Everything else, as Gmail's unread first
2026-10-25 13:13:46 +01:00
Linus Rath
e31f55064e
fix: use the current calendar and contacts icons in the Mountain View side panel
2026-10-25 12:56:48 +01:00
Linus Rath
cb663d2222
fix: keep settings switches full width next to long labels
2026-10-25 12:49:55 +01:00
Linus Rath
0b1463b7d5
feat: show attachment and code chips as Gmail pills in Mountain View
2026-10-25 12:48:49 +01:00
Linus Rath
39c8b14574
fix: open the admin panel in the desktop layout without a phone-layout flash
2026-10-25 12:42:02 +01:00
Linus Rath
5a9c318ec5
fix: keep mails that paint their own page background from flashing white in dark mode
2026-10-25 12:39:28 +01:00
Linus Rath
07627b3a60
fix: give every app's sidebar header and toolbar the same height as mail
2026-10-25 12:30:23 +01:00
Linus Rath
9c360694bf
fix: send paragraphs with the spacing the composer shows #1340
2026-10-25 12:27:13 +01:00
Linus Rath
171fd1ea4c
perf: load React DOM and the UI kit only in plugin frames that draw
2026-10-25 02:56:14 +01:00
Linus Rath
a7cfa5b160
fix: rebuild the plugin sandbox while npm run dev runs, and build it for the integration image
2026-10-25 02:26:18 +01:00
Linus Rath
f20892ccec
fix: start plugins when the sign-in races the first plugin start
2026-10-25 02:24:41 +01:00
Linus Rath
5edbbf0816
perf: start plugin slot frames without waiting for the plugin's own frame
2026-10-25 02:24:08 +01:00
Linus Rath
e38e326efb
perf: load plugin frames as a plain page instead of a Next app
...
Every plugin iframe loaded /plugin-sandbox, a force-dynamic Next page.
Each frame then fetched, parsed and hydrated Next's client router on top
of React and the runtime, and the server rendered the page once per
frame, one after another when a dozen plugins started together.
Sandboxed frames have opaque origins, so the browser's code cache never
helps, and they run on the host page's main thread: with 12 plugins
the frames took 2.5-3 s to come up after the app had loaded.
The sandbox routes now return a small HTML page with the UI kit's
stylesheet and the runtime as an ES module, both built ahead of time:
- `scripts/build-plugin-sandbox.mjs` bundles the runtime with esbuild
and compiles `plugin-kit.css` with the app's Tailwind setup into
`public/plugin-sandbox-assets/`, with a manifest. Named Tabler imports
are pointed at the icons' own files, so the full icon set stays in a
chunk that only loads for an icon name the kit doesn't ship.
- `npm run build`, `npm run dev`, the Dockerfile and the perf-guard
workflow run it before `next build`.
- `lib/plugin-sandbox/sandbox-document.ts` writes the page; proxy.ts
still sets the sandbox CSP and the script carries its nonce.
- The assets are served from public/ with CORS and immutable caching.
A frame on an idle page is ready in 255 ms instead of 362 ms, eleven at
once in 1.0 s instead of 2.1 s.
2026-10-25 02:01:47 +01:00
Linus Rath
6be0f70452
perf: skip plugin round trips when a slot re-renders with the same props
2026-10-25 02:40:43 +02:00
Linus Rath
181a0d7d88
perf: send plugin frames only the translations of the current language
2026-10-25 02:26:17 +02:00
Linus Rath
52959e8135
fix: stop plugin panels flashing white in the dark theme
2026-10-25 02:22:59 +02:00
Linus Rath
c066d40180
perf: check cached plugin bundles without reading them, and download in parallel
2026-10-25 02:18:18 +02:00
Linus Rath
be8adde945
perf: fetch the server plugin list once per page load
2026-10-25 02:15:13 +02:00
Linus Rath
9a568aa4f4
perf: write the plugin list to storage once per burst of changes
2026-10-25 02:12:50 +02:00
Linus Rath