Linus Rath 66351e0d31 feat: show admins the changelog of every plugin version an update brings or a rollback undoes

2026-10-30 02:02:40 +01:00

..

account/stalwart/jmap

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

account-archive

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

admin

feat: show admins the changelog of every plugin version an update brings or a rollback undoes

2026-10-30 02:02:40 +01:00

auth

feat: let admins keep the refresh token valid on sign-out so Stalwart keeps the consent #1388

2026-10-29 20:47:18 +01:00

bimi

feat: show the sender's BIMI logo as the sender icon when the message passes DMARC

2026-10-30 00:12:24 +01:00

caldav/discover

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

calendar-agenda

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

config

feat: make the login email placeholder configurable #1423

2026-10-29 20:24:26 +01:00

connector/capabilities

feat: add a switch that stops all third-party traffic #903

2026-10-28 02:19:06 +01:00

dev-jmap/[...path]

feat: limit the page's CSP to the configured hosts with no third-party traffic #903

2026-10-28 04:30:41 +01:00

favicon

feat: show the sender's BIMI logo as the sender icon when the message passes DMARC

2026-10-30 00:12:24 +01:00

fetch-ical

fix: stop reading a mail server's answer past a size limit in the JMAP, WebDAV, push preview and agenda routes

2026-10-26 14:52:04 +01:00

health

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

og-image

fix: don't export OG_WIDTH/OG_HEIGHT from the og-image route

2026-08-17 00:18:59 +02:00

plugin-approval-status

fix: refuse an oversized plugin approval upload before reading it

2026-10-26 15:15:58 +01:00

plugin-proxy

feat: add a switch that stops all third-party traffic #903

2026-10-28 02:19:06 +01:00

plugin-secrets

test: give the plugin proxy route test the config reader the mode needs #903

2026-10-28 03:10:14 +01:00

plugin-signing-pubkey

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

plugins

feat: add a switch that stops all third-party traffic #903

2026-10-28 02:19:06 +01:00

push/preview

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

pwa-icon/[size]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

pwa-screenshot/[variant]

feat: branded OpenGraph/Twitter link previews with generated card image

2026-08-16 23:40:25 +02:00

settings

feat: let admins scope the user policy per domain or group

2026-10-28 00:29:02 +01:00

setup

fix: refuse a session secret under 32 characters in the setup wizard, which broke admin sign-in afterwards

2026-10-26 11:48:39 +01:00

system/update-status

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00

translate

feat: add a switch that stops all third-party traffic #903

2026-10-28 02:19:06 +01:00

webdav

fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)

2026-10-26 15:00:56 +01:00

wopi

feat: create documents in the formats the document editor can edit from New file #1393

2026-10-29 00:01:13 +01:00