Commit Graph

Select branches

Hide Pull Requests

dev

feat/demo-data

feat/stalwart-1.0

main

test/cross-account-move-pins

#1002

#1002

#1003

#1004

#1005

#1008

#1013

#1016

#1017

#1018

#1019

#102

#1025

#1025

#1030

#1031

#1032

#1034

#1035

#1035

#1036

#1037

#1040

#1040

#1041

#1051

#1052

#1053

#1054

#1055

#1056

#1057

#1058

#1059

#1060

#1061

#1063

#1064

#1065

#1070

#1071

#1071

#1079

#1079

#1080

#1080

#1083

#1084

#1088

#1088

#109

#1092

#1095

#1097

#1098

#1098

#1101

#1103

#1105

#1106

#1108

#1109

#1112

#1117

#1121

#1122

#1125

#1127

#1131

#1132

#1133

#1134

#1135

#1136

#1138

#1139

#1140

#1141

#1142

#1144

#1145

#1147

#1148

#1150

#1151

#1151

#1152

#1153

#1154

#1155

#1157

#1162

#1163

#1163

#1165

#1168

#1174

#1175

#1176

#1177

#1178

#1180

#1182

#1183

#1183

#1184

#1186

#1188

#1191

#1191

#1193

#1195

#1200

#1201

#1202

#1210

#1211

#1212

#1213

#1216

#122

#1220

#1234

#124

#1244

#1245

#1247

#1251

#1254

#1256

#1258

#1262

#1265

#1268

#1269

#1270

#1272

#1274

#1275

#1276

#1276

#1282

#1285

#1286

#1287

#1288

#1295

#1295

#1296

#1297

#1298

#1299

#1300

#1305

#1305

#1306

#1307

#1311

#1312

#1316

#1317

#1323

#1326

#1330

#1333

#1334

#1335

#1338

#1341

#1345

#1346

#1355

#1358

#1360

#1362

#1363

#1370

#1373

#1379

#1380

#1384

#1386

#1386

#1389

#1394

#1395

#1399

#1400

#1401

#1402

#1406

#1410

#1417

#1418

#1419

#1421

#1426

#1427

#1428

#1433

#1434

#1436

#1442

#1442

#1443

#1443

#1444

#1444

#1445

#1445

#1446

#1448

#1454

#1456

#1464

#1465

#1466

#1467

#1479

#1479

#1481

#1481

#1482

#1482

#1483

#1484

#1489

#1489

#153

#154

#157

#158

#159

#160

#165

#169

#180

#181

#182

#183

#190

#197

#200

#208

#211

#215

#219

#225

#229

#235

#238

#241

#242

#245

#249

#251

#261

#263

#277

#286

#290

#292

#293

#294

#304

#305

#314

#321

#322

#333

#335

#337

#342

#344

#348

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#370

#371

#372

#373

#374

#376

#378

#380

#381

#384

#385

#386

#388

#391

#394

#396

#403

#405

#412

#413

#419

#42

#420

#424

#426

#427

#432

#438

#440

#441

#442

#443

#445

#446

#447

#449

#450

#451

#452

#453

#454

#455

#458

#462

#463

#464

#467

#468

#469

#474

#476

#477

#478

#479

#483

#486

#487

#488

#490

#491

#492

#494

#501

#502

#503

#506

#508

#509

#51

#511

#512

#513

#516

#517

#520

#521

#527

#528

#529

#530

#531

#532

#534

#535

#536

#538

#541

#544

#545

#546

#547

#548

#549

#55

#550

#551

#555

#558

#559

#561

#562

#564

#565

#566

#567

#568

#574

#575

#581

#582

#584

#586

#587

#589

#590

#591

#594

#595

#597

#598

#605

#606

#607

#608

#609

#610

#613

#614

#616

#619

#622

#623

#628

#629

#630

#631

#637

#640

#642

#643

#645

#651

#652

#653

#657

#659

#660

#661

#662

#663

#664

#668

#669

#673

#675

#676

#677

#679

#68

#680

#681

#685

#686

#688

#689

#689

#697

#698

#704

#705

#706

#707

#708

#709

#71

#710

#712

#713

#714

#715

#717

#724

#729

#736

#737

#739

#740

#742

#743

#745

#746

#747

#748

#749

#750

#751

#764

#765

#766

#767

#768

#769

#770

#772

#773

#775

#777

#778

#782

#783

#784

#789

#792

#793

#796

#798

#800

#801

#802

#806

#807

#808

#809

#810

#811

#812

#815

#82

#824

#829

#831

#832

#833

#834

#835

#836

#846

#851

#852

#853

#854

#859

#860

#861

#862

#863

#866

#868

#872

#874

#875

#876

#877

#880

#886

#888

#890

#893

#894

#895

#897

#898

#899

#906

#906

#910

#914

#916

#917

#918

#920

#921

#925

#926

#926

#927

#928

#929

#93

#932

#934

#939

#941

#944

#945

#947

#948

#949

#953

#955

#955

#959

#965

#967

#968

#974

#975

#976

#977

#979

#980

#981

#983

#986

#987

#988

#99

#990

#991

#994

#995

#996

#997

1.10.0

1.11.0

1.11.0-beta.1

1.11.0-beta.2

1.11.0-beta.3

1.11.1

1.11.2

1.12.0

1.13.0

1.14.0

1.14.1

1.14.2

1.15.0

1.16.0

1.17.0

1.17.1

1.17.2

1.18.0

1.19.0

1.19.1

1.3.0

1.3.9

1.4.0

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.8.0

1.8.1

1.9.0

1.9.1

1.9.2

Mono Color

• adf30bef40 fix(email-composer): normalize forwarded inline-image cids to prevent duplicate blobs 🐛 Aaron Guise 2026-09-29 18:30:25 +13:00
• 115c66ec8d chore(email-composer): drop unused test imports flagged by lint 🧹 Aaron Guise 2026-09-29 18:18:01 +13:00
• 888b606fcb fix(email-composer): normalize bracketed content-ids for inline reply/forward images 🐛 Aaron Guise 2026-09-29 18:17:19 +13:00
• 695cc7303f fix(calendar): add translations for the all-day expand toggle Sebastian SanitzandClaude Opus 5.5 2026-09-29 00:08:15 +02:00
• ea6d0ee678 fix(calendar): size the week view all-day area from the visible week Sebastian SanitzandClaude Opus 5.5 2026-09-28 23:42:30 +02:00
• 0b3e47e3d2 fix: keep the composer body reachable in short reading panes #1114 Linus Rath 2026-09-27 21:54:02 +02:00
• dec4d644d0 docs: label the discord badge as member count Linus Rath 2026-09-27 19:03:54 +02:00
• 0c04d504f7 docs: add guidelines for AI-assisted contributions Linus Rath 2026-09-27 18:47:37 +02:00
• 61ae1d4a0f chore: allow app store distribution through an AGPL additional permission Linus Rath 2026-09-27 18:40:54 +02:00
• aed0d27320 fix: stop the mail list flashing a reload right after the page opens Linus Rath 2026-09-27 18:21:24 +02:00
• 569c796522 ci: sign published images and release files with build provenance Linus Rath 2026-09-27 15:22:17 +02:00
• be3c4b0d99 feat: draw calendar events as solid blocks and toasts as plain cards Linus Rath 2026-09-27 12:45:19 +02:00
• 9ab2035113 fix: centre the unread dot on the sender avatar Linus Rath 2026-09-27 11:28:06 +02:00
• 3ed484df35 feat: offer the code from sign-in mail as a copy chip in the list and reader Linus Rath 2026-09-27 11:19:48 +02:00
• d923b92034 fix: recover from transient application configuration failures Lucius7nya 2026-09-27 15:23:59 +08:00
• e4ef2fa3d6 fix: keep an abandoned pairing re-auth from breaking the next sign-in Linus Rath 2026-09-27 04:56:48 +02:00
• 377c283d86 fix: say up front when the mobile app cannot use an http mail server Linus Rath 2026-09-27 04:53:49 +02:00
• 473e5c8bff fix: clean up after pairings a phone never completes Linus Rath 2026-09-27 04:51:30 +02:00
• a5583aa8e8 fix: re-check a paired phone's token endpoint against the current config Linus Rath 2026-09-27 04:50:38 +02:00
• 5c1da4efa7 fix: refuse a pairing re-auth the identity provider did not make fresh Linus Rath 2026-09-27 04:49:54 +02:00
• 75bffd35e6 fix: limit pairing password attempts per mail account and per day Linus Rath 2026-09-27 04:49:03 +02:00
• 3494d2f138 fix: keep the app's "Sign in via webmail" working past its first token expiry Linus Rath 2026-09-27 04:34:19 +02:00
• 96e0e6b036 fix: keep the pairing QR on screen while the Security tab checks the server Linus Rath 2026-09-27 04:18:09 +02:00
• 1446fd39dc fix: link the mobile app from every account with a sign-in of its own Linus Rath 2026-09-27 04:16:18 +02:00
• bb80d01ddf fix: keep a pairing re-auth from signing the browser in as another account Linus Rath 2026-09-27 04:14:15 +02:00
• 32b2afee3b fix: stop sending the webmail's OAuth client secret to user-chosen mail servers Linus Rath 2026-09-27 04:12:47 +02:00
• ce5f177d53 refactor: move Stalwart's password and TOTP login into a shared helper Linus Rath 2026-09-27 04:11:30 +02:00
• 5ce8c89c51 fix: open and save files shared with you in the office editor #1094 Linus Rath 2026-09-26 22:28:34 +02:00
• e2a4145939 chore: release 1.11.2 1.11.2 Linus Rath 2026-09-26 22:18:23 +02:00
• 5c3c3bea99 fix: keep next's metadata modules in the standalone build so the server starts Linus Rath 2026-09-26 22:15:53 +02:00
• e82391c846 chore: release 1.11.1 1.11.1 Linus Rath 2026-09-26 21:56:13 +02:00
• 2522dbd804 fix: keep the plugin denylist and unit tests from breaking Lite and Docker builds Linus Rath 2026-09-26 21:38:57 +02:00
• 09e0e2cfb3 fix: show events you declined struck through in the calendar #1110 Linus Rath 2026-09-26 21:32:08 +02:00
• 078e9f9676 feat: show tasks with due dates in the calendar month view #1107 Linus Rath 2026-09-26 20:47:13 +02:00
• 7b25d3a95b fix: keep message list from jumping while attachment chips load Linus Rath 2026-09-26 20:24:23 +02:00
• a920e91cae fix: keep mail deleted during a list refresh from reappearing #966 Linus Rath 2026-09-26 19:11:30 +02:00
• eb7b6f8dab fix: point Stalwart installs at a tagged Lite release and publish checksums Linus Rath 2026-09-26 17:30:47 +02:00
• 6ff94d439e fix: pin Lite pages to their own inline scripts and guard the Stalwart bundle Linus Rath 2026-09-26 17:27:00 +02:00
• d155cead41 fix: revoke Lite refresh tokens on sign-out and keep no failed-login password Linus Rath 2026-09-26 17:13:59 +02:00
• c329d486a7 fix: keep the mock JMAP server out of release builds Linus Rath 2026-09-26 17:07:31 +02:00
• 05fe7f8780 fix: stop handing instance details to visitors who are not signed in Linus Rath 2026-09-26 17:03:24 +02:00
• 47342e9e08 fix: clear the accounts' leftovers when everyone signs out Linus Rath 2026-09-26 16:55:34 +02:00
• 0040e5daca fix: keep plugin storage per account and delete it on sign-out Linus Rath 2026-09-26 16:47:29 +02:00
• 204cd09951 fix: end office editor sessions when the user signs out Linus Rath 2026-09-26 16:40:46 +02:00
• a2253982e5 fix: limit wrong passwords tried through the login pre-check Linus Rath 2026-09-26 16:36:58 +02:00
• 5622eca36b fix: refuse a used impersonation link after a restart or on another replica Linus Rath 2026-09-26 16:34:58 +02:00
• 034ee27057 fix: keep the setup token out of access logs, referers and history Linus Rath 2026-09-26 16:32:38 +02:00
• 582960ae06 ci: publish latest only from stable releases and scope workflow tokens Linus Rath 2026-09-26 16:30:23 +02:00
• 3ac6c25c71 fix: keep sibling subdomains from widening the sidebar-app frame-src Linus Rath 2026-09-26 16:27:03 +02:00
• 0ccb533405 fix: serve sender favicons only as inert raster images Linus Rath 2026-09-26 16:24:11 +02:00
• 02703d8b3d fix: stop not-found pages outside the app tree from being framed Linus Rath 2026-09-26 16:22:49 +02:00
• e7dc992721 fix: never let ALLOWED_FRAME_ANCESTORS frame the admin dashboard or setup Linus Rath 2026-09-26 16:21:02 +02:00
• 4f386f7a78 fix: keep runtime state and secrets out of the standalone build and image Linus Rath 2026-09-26 16:19:26 +02:00
• f9af701bb9 fix: keep the Lite session when the token endpoint is only rate limiting Linus Rath 2026-09-26 16:17:29 +02:00
• aa0075a8e1 fix: write only the changed keywords when tagging or pinning a message Linus Rath 2026-09-26 16:16:13 +02:00
• 4858eb0915 fix: open a push notification's message in the account it came from Linus Rath 2026-09-26 16:12:20 +02:00
• 40edc41def fix: turn settings sync back on after signing out of one of several accounts Linus Rath 2026-09-26 16:08:22 +02:00
• efdc6a1dc3 fix: keep a reply draft in its thread when it is re-opened or undone Linus Rath 2026-09-26 16:06:28 +02:00
• e7a48f13f3 fix: report writes the server refused instead of showing them as done Linus Rath 2026-09-26 16:02:42 +02:00
• 89ebb3a6ce fix: report a failed message-list read instead of an empty folder Linus Rath 2026-09-26 15:57:11 +02:00
• bdd79648b0 fix: stop a quoted sender name from adding a recipient to a draft Linus Rath 2026-09-26 15:48:27 +02:00
• c49f13db28 fix: list a shared folder reachable through two logins only once in cross views Stefan Hildebrandt 2026-09-25 19:41:16 +02:00
• 34fb9d247a fix: keep daily recurring events going past a DST gap Linus Rath 2026-09-26 15:45:59 +02:00
• 7676975f7e fix: page each account of a merged list from its own position Linus Rath 2026-09-26 15:43:32 +02:00
• 04010ce41b fix: split the state poll to fit the server's call limit Linus Rath 2026-09-26 15:39:48 +02:00
• d583443292 fix: keep an open draft on its own account across an account switch Linus Rath 2026-09-26 15:37:18 +02:00
• 9033aa7cca fix: reset the account security page when switching accounts Linus Rath 2026-09-26 15:34:13 +02:00
• e98a0e6351 fix: drop folder and filter fetches that finish after an account switch Linus Rath 2026-09-26 15:31:05 +02:00
• 7cc486a13c fix: apply only the last of overlapping account switches Linus Rath 2026-09-26 15:27:50 +02:00
• 5cc3ddba91 fix: keep iCal subscriptions with the login that created them Linus Rath 2026-09-26 15:24:30 +02:00
• a5a06bb25f fix: never replay a JMAP write after a dropped connection Linus Rath 2026-09-26 15:20:29 +02:00
• 9f11210b6a fix: undo and edit a group-identity send in the group's own account Linus Rath 2026-09-26 15:18:20 +02:00
• 4bbcf9cdd7 fix: check telemetry targets at connect time and fail closed Linus Rath 2026-09-26 15:15:23 +02:00
• 49e8d08c23 fix: never follow redirects on OAuth token and revocation requests Linus Rath 2026-09-26 15:13:41 +02:00
• 928633d087 fix: close remote-content gaps in the print view and the external-URL checks Linus Rath 2026-09-26 15:11:46 +02:00
• b73d0dfabf fix: stop reflecting a user-chosen server's error body from the TOTP login Linus Rath 2026-09-26 15:08:35 +02:00
• 32280b9cc1 fix: cap admin sign-in attempts across all clients (GHSA-7pj2-232x-6698) Linus Rath 2026-09-26 15:07:09 +02:00
• 8b3e29fe75 fix: sign out every account whose client is gone instead of leaving it resumable Linus Rath 2026-09-26 15:03:54 +02:00
• 6d2255ad0d fix: keep plugin http.post away from credentialed and admin routes Linus Rath 2026-09-26 15:01:42 +02:00
• 3f01e94319 fix: key synced settings on the account a bearer token belongs to Linus Rath 2026-09-26 14:59:55 +02:00
• e0bfdfa437 fix: stop filter rule data from breaking out into the Sieve script Linus Rath 2026-09-26 14:56:01 +02:00
• 6e94b1a330 fix: treat image-map links like anchors so they cannot keep the opener Linus Rath 2026-09-26 14:53:40 +02:00
• d13db4c756 test: give the conversation view remote-block test room to import Linus Rath 2026-09-26 14:51:40 +02:00
• 3ac2ab1d97 fix: keep remote images in a quoted reply from loading in the composer Linus Rath 2026-09-26 14:51:14 +02:00
• c20527cc29 fix: block remote content in the .eml attachment preview Linus Rath 2026-09-26 14:50:22 +02:00
• 809db3b38d fix: block remote content in the mobile conversation view Linus Rath 2026-09-26 14:45:20 +02:00
• f0aa0eedab fix: show what a mailto unsubscribe sends and limit it to one recipient Linus Rath 2026-09-26 14:41:14 +02:00
• 6f1cad1c98 fix: close theme CSS sanitizer bypasses and enforce :root/.dark selectors Linus Rath 2026-09-26 14:36:02 +02:00
• ad84588f6a fix: keep an SVG attachment thumbnail from running script in the webmail origin Linus Rath 2026-09-26 14:30:19 +02:00
• f98779b0d0 fix: require manifest permissions for plugin hooks and slots Linus Rath 2026-09-26 14:26:33 +02:00
• 1f19796cc2 fix: ignore admin status from a server the admin never configured (GHSA-j867-89p4-v8hm) Linus Rath 2026-09-26 14:20:36 +02:00
• 76154187fa fix: only let a Stalwart superuser into the admin dashboard, not a tenant admin (GHSA-v6hr-cmxm-pv73) Linus Rath 2026-09-26 14:18:48 +02:00
• dd796d7325 fix: serve WOPI file downloads as inert attachments Linus Rath 2026-09-26 14:16:42 +02:00
• 012fe6edad fix: stop a crafted winmail.dat from freezing the tab Linus Rath 2026-09-26 14:15:10 +02:00
• 8f7124c878 fix: stop a sender from faking a DMARC or DKIM pass in the security badges Linus Rath 2026-09-26 14:13:33 +02:00
• 9b9b4f7ef1 fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g) Linus Rath 2026-09-26 14:08:44 +02:00
• 11eb0bfb16 fix: keep the Stalwart master password out of impersonated sessions Linus Rath 2026-09-26 14:05:05 +02:00
• 5d017fd2b1 fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard Linus Rath 2026-09-26 14:00:01 +02:00
• 3668618c2d fix: translate the themes settings panel Linus Rath 2026-09-26 12:54:30 +02:00
• 6d54b2e851 Merge branch 'main' of https://github.com/bulwarkmail/webmail Linus Rath 2026-09-26 12:41:47 +02:00