Linus Rath 3494d2f138 fix: keep the app's "Sign in via webmail" working past its first token expiry ...

The mobile handoff returned the provider's token endpoint and the
webmail's client id as they were. With a confidential client the phone
could not renew (it has no secret), and a provider on another host was
refused by the app outright. The handoff now returns the same bundle a
paired phone gets: such grants renew through `/api/auth/pair/token` with
a sealed refresh token.

2026-09-27 04:34:19 +02:00

..

account/stalwart/jmap

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

admin

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

auth

fix: keep the app's "Sign in via webmail" working past its first token expiry

2026-09-27 04:34:19 +02:00

caldav/discover

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

calendar-agenda

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

config

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

connector/capabilities

feat: resolve deep links to the local instance

2026-09-20 19:59:37 +02:00

dev-jmap/[...path]

fix: keep the mock JMAP server out of release builds

2026-09-26 17:07:31 +02:00

favicon

fix: serve sender favicons only as inert raster images

2026-09-26 16:24:11 +02:00

fetch-ical

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

health

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

og-image

fix: don't export OG_WIDTH/OG_HEIGHT from the og-image route

2026-08-17 00:18:59 +02:00

plugin-approval-status

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

plugin-signing-pubkey

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

plugins

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

push/preview

fix: open a push notification's message in the account it came from

2026-09-26 16:12:20 +02:00

pwa-icon/[size]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

pwa-screenshot/[variant]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

settings

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00

setup

fix: pin resolved IP for stored custom JMAP endpoints and branding URLs

2026-08-26 23:02:19 +02:00

system/update-status

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

translate

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

webdav

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

wopi

fix: open and save files shared with you in the office editor #1094

2026-09-26 22:28:34 +02:00