Linus Rath 256855b294 fix: refuse to sign plugins on an instance whose signing key differs from the others #1066

2026-11-01 00:54:57 +01:00

..

account/stalwart/jmap

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

account-archive

Merge branch 'feat/multi-instance-auth' into feat/multi-instance

2026-11-01 00:13:17 +01:00

admin

Merge branch 'feat/multi-instance' into feat/multi-instance-ext

2026-11-01 00:28:15 +01:00

auth

fix: answer 503 when an impersonation link's use can't be recorded and keep used links as expiring keys #1066

2026-11-01 00:07:41 +01:00

bimi

feat: show the sender's BIMI logo as the sender icon when the message passes DMARC

2026-10-30 00:12:24 +01:00

caldav/discover

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

calendar-agenda

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

config

feat: send an oauth resource indicator when one is configured #1461

2026-10-31 16:14:35 +01:00

connector/capabilities

feat: add a switch that stops all third-party traffic #903

2026-10-28 02:19:06 +01:00

dev-jmap/[...path]

feat: limit the page's CSP to the configured hosts with no third-party traffic #903

2026-10-28 04:30:41 +01:00

favicon

feat: show the sender's BIMI logo as the sender icon when the message passes DMARC

2026-10-30 00:12:24 +01:00

fetch-ical

fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes

2026-10-26 14:52:04 +01:00

health

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

og-image

fix: show a re-uploaded logo or icon at once instead of after a restart

2026-11-01 00:24:07 +01:00

plugin-approval-status

feat: share plugin approvals and plugin settings between instances #1066

2026-11-01 00:13:09 +01:00

plugin-proxy

feat: hold each instance back until it has loaded from the shared store and add a readiness check #1066

2026-10-31 22:40:51 +01:00

plugin-secrets

fix: refuse to save over stored settings or plugin credentials that no longer decrypt #1066

2026-10-31 22:54:35 +01:00

plugin-signing-pubkey

fix: refuse to sign plugins on an instance whose signing key differs from the others #1066

2026-11-01 00:54:57 +01:00

plugins

feat: add a switch that stops all third-party traffic #903

2026-10-28 02:19:06 +01:00

push/preview

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

pwa-icon/[size]

fix: show a re-uploaded logo or icon at once instead of after a restart

2026-11-01 00:24:07 +01:00

pwa-screenshot/[variant]

fix: show a re-uploaded logo or icon at once instead of after a restart

2026-11-01 00:24:07 +01:00

ready

feat: hold each instance back until it has loaded from the shared store and add a readiness check #1066

2026-10-31 22:40:51 +01:00

settings

fix: keep both templates when two settings saves arrive at once #1066

2026-10-31 22:58:14 +01:00

setup

fix: show a re-uploaded logo or icon at once instead of after a restart

2026-11-01 00:24:07 +01:00

system/update-status

fix: answer 503 on the update status routes while the shared store is down #1066

2026-10-31 23:58:21 +01:00

translate

feat: add a switch that stops all third-party traffic #903

2026-10-28 02:19:06 +01:00

webdav

feat: hold each instance back until it has loaded from the shared store and add a readiness check #1066

2026-10-31 22:40:51 +01:00

wopi

feat: hold each instance back until it has loaded from the shared store and add a readiness check #1066

2026-10-31 22:40:51 +01:00