Tachyon - Releases

The last three of the back-button regressions, two of which only show on a large mailbox or on a phone. Plus the end of the admin password error on Docker upgrades, calendars that could never be removed, and a way to log logins on their own.

Worth taking if your inbox holds more than 10,000 messages, because no conversation could be opened in one at all.

Fixed

• No thread could be opened in a folder holding more than message_list_limit messages, 10,000 by default, which showed as the full folder under a "Back to message list" button. That branch answers with the most recent slice rather than working out the whole uid list, and says in its own comment that it does not use THREAD; a request naming one thread fell into it and got the unthreaded folder back, with the thread uid still echoed in the response. It could not escape either, because the one thing that lifts the limit is a cached uid lookup that is itself skipped whenever a thread is named. A mailbox growing past 10,000 messages was enough to turn this on, which is why it had worked for years and why the IMAP server was never at fault. Reported by @floppybl (#156)
• The whole folder sat on screen, with no spinner, while a thread loaded. The test that drops the messages on screen when they no longer answer the request compares the folder, the search and the offset. Entering a conversation changes none of those from page 1, so nothing was dropped and the old list stayed there until the thread arrived. On a large mailbox that is indistinguishable from the thread never loading. From page 2 or later it did clear, because the offset moved, which is what made it look intermittent (#156)
• Moving to the next message across a page boundary flashed the next page's list, on mobile, where the list and the message are separate views rather than side by side. Crossing a boundary calls gotoPage(), which writes an address with no message in it, and the back-button work in 4.4.3 taught the route to read that as "close the message". The route now leaves the open message alone for the one dispatch where a selection is already pending. Reported by @lvarnava (#157)
• A Docker upgrade reported an admin password failure on every restart, on an installation where nothing was wrong and nothing needed doing. The entrypoint treated a missing admin_password.txt as a failure without asking whether a password was already configured, and on an existing installation that file is legitimately absent: it is written once, on the first run, and an administrator who read it and deleted it, which is the sensible thing to do with a password in clear, ends up in the same position as one who set their own. Three cases now, and only the last of them can fail. Reported by @jon4156 (#158)
• A CalDAV calendar could not be removed once it had been seen. The code that stores a discovered calendar only ever inserted or updated it, and nothing anywhere deleted one, so moving the URL from a single public collection to the DAV root left the old collection sitting next to the new ones for ever. A sync now reconciles what is stored against what discovery returned. A calendar missing from the listing is hidden at once, and its events are removed only after a second sync confirms it, because a PROPFIND answers per collection and one the server refuses while answering for the others is indistinguishable from one the user deleted. Clearing the URL, or setting sync to No, removes them all on save. Reported by @Quiwy (#164)

Changed

• A login can now be logged without logging every request. A successful login wrote nothing to the main log at all, so it could only be seen at level 6, among the per-request traffic; it is a notice now, at level 5. A failed login went only to the fail2ban file and to LOG_AUTHPRIV, both off by default, so the ordinary log could not tell a failure from no attempt at all; it is a warning, which is visible at the default level of 4. Both carry the ip and the login through the same substitutions the fail2ban format already uses, so nothing new is exposed and no password goes near them. Worth knowing before upgrading: an installation with logging enabled therefore starts recording the client ip and the login for failed attempts. Asked for by @dionysius (#163)
• The syslog driver sent everything at LOG_INFO. It pinned its own level in the constructor, so an error and a debug line arrived at the same priority and filtering by priority did nothing at all. Driver::Write had the severity the whole time and dropped it before handing the message over; the driver signature now carries it through to syslog(). Found in #163
• Translations updated for French and Polish

Five releases in two days, and three of them to clean up after one change of mine. Sorry. Writing the open message into the address bar, added in 4.4.3 so that Back works and a message can be linked, reset a different piece of the mailbox on every click, and each one surfaced as its own bug. Everything the address bar carries is now read and applied in one place, and the rest of the links that write it have been gone through rather than waited on.

If you are on 4.4.3, 4.4.4 or 4.4.5, take this one.

Fixed

• Opening a message from page 2 or later jumped back to page 1, after which the previous and next arrows walked a list that no longer held the open message and appeared to do nothing. A message link has nowhere to record the page, so the route reported page one for every one of them and the list was reloaded at the top. Reported by @lvarnava (#157)
• Opening a message from a search threw the search away and reloaded the whole folder behind it. The link dropped the search, which the route has always been able to carry after the uid. Found while fixing #157, not reported
• Clicking the conversation count showed the whole list, and Back to list stayed in the thread. The test that stops every message click refetching the list compared the folder, page and search, and the thread uid is none of those: it travels inside the folder part, so entering or leaving a thread changed nothing it looked at and the reload was skipped in both directions. Reported by @floppybl (#156)
• Reloading the browser while reading a message inside a thread came back with the whole folder behind it. The thread uid was applied only when the address bar held no message. Found by going through the remaining links rather than from a report

Take this one if you run 4.4.3 or 4.4.4 and any of your folders has a space, an accent or a nested path: opening a message showed nothing at all.

Fixed

• A message opened to an empty body, in any folder whose name is not plain ASCII. The fix for #153 in 4.4.4 put the correct folder hash into the address bar, and then the route handler took that hash for a folder name: it compared it against the open message's full name, which never matches, built a replacement message naming a folder that does not exist, and the request for it was dropped without a word. So the body loaded and was immediately replaced by nothing. Both the comparison and the new message now use the folder's full name, which the route handler has already resolved. Diagnosed, down to the line, by @remmmi (#155)
• Installing the Debian package over an older tachyon package stopped on a file conflict. The rename in 4.4.3 left tachyon-webmail owning the same paths without declaring that it replaces them, so apt install ./tachyon-webmail_*.deb aborted unless the old package was removed first, which broke unattended installs. A versioned Replaces hands the files over. There is deliberately no Breaks: Debian's unrelated tachyon ray tracer also satisfies << 4.4.3~, and apt would have offered to remove it. Diagnosed and tested, including against python-apt, by @ZaphodB (#154)
• Asking for a message in a folder that cannot be resolved now says so in the browser console, with [debug] javascript = On. It returned false in silence before, which is how the two bugs above stayed invisible while the message view simply sat empty

Changed

• Installing the Debian package now warns, once, while an older tachyon package is still installed. Replaces hands over the shared files but does not remove that package, and what stays behind is a complete older copy of the application under /usr/share/tachyon, missing the security fixes from 4.4.0 through 4.4.3. Run apt remove tachyon to clear it

Take this one if you run 4.4.3: clicking a message could fill the search box and open nothing, for anyone whose folders are not named in plain ASCII.

Fixed

• Clicking a message filled the search box and showed nothing, on 4.4.3 only. Message links name a folder by a URL-safe hash of its full name, because a full name may hold the hierarchy delimiter and anything else; the click path passed the full name instead, so a folder like Lists/dev produced extra path segments, no route matched it, and the tail was read as page and search. A folder named only [a-z0-9._-] hashes to itself, which is why INBOX behaved normally and this reached release: Dovecot's default . delimiter is in that class, Mailcow's / is not. Two older instances of the same mistake go with it, in the folder jumped to when a message is not in the current list, which is also how "select next after delete" moves, and in the notification for several new messages. Reported by @codiflow (#153)
• The admin Contacts connection test reported plain success while contacts were switched off, so a green result said less than it appeared to and sent an administrator hunting for the fault elsewhere. It now has three outcomes: the database failing, the database answering while the feature is off, and both together. Found through #145

Added

• A line or two of the message body under the subject in the list, off by default, with a setting under General for one line or two. The text comes from the IMAP server over PREVIEW (RFC 8970), which means no extra fetching and no HTML to strip, since the server is required to hand over plain text. Where a server cannot do it the setting says so rather than appearing to work, and where an administrator has turned it off the setting is hidden. Asked for by @DanClarke-io (#148)
• A show/passphrase toggle on both login screens. Hidden by default, and it cannot submit the form or reveal anything before the page has finished loading. Asked for by @goddies (#131)
• A Material theme, modelled on Material Design 3, in light and dark, with no web fonts fetched. Thanks to @DanClarke-io (#151)
• MailClient::MessageListByTuples(), a supported way for a plugin to hand the core a page of [folder, uid] pairs and have it fetched and rendered, for search backed by an external index or a conversation ordering. The caller's order is kept across folders, repeats collapse, and pairs that could not be read are reported back. Asked for by @remmmi (#140)

Changed

• The login-o365 documentation no longer offers the two redirect URI forms as equal alternatives. Microsoft permits a query parameter in a redirect URI only for work and school registrations, so a personal Outlook account must use the path form, which is the extension's default. Raised in #114
• Translations updated for Polish and Russian

Worth taking if you run 4.4.2: opening Drafts could fail outright on PHP 8.4, the Debian package pulled in a second PHP, and logging out did not end the session.

Security

• Logging out left the server-side session alive. Logout() asked the browser to drop two cookies and nothing else: the StorageType::SESSION record that getMainAccountFromToken() actually checks stayed where it was, and the clear of the SESSION_TOKEN cookie had been commented out. Anyone holding a copy of the cookies from before the logout kept full mailbox access without the password, and since FileStorage::Get() touches the file on every read, a session being replayed never aged into the three hour sweep either. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-gc87-g2gf-xj6q)
• Backup restore ran without an admin session. JsonAdminRestoreData asked only whether the request had reached the admin panel, which is true for anyone able to load it, and the core rule requiring a login for Admin* actions did not cover it: a plugin action is dispatched as PluginJsonAdminRestoreData, so the test on the name starting with Admin never matched. The restore now demands an admin login, ignores the client's Content-Type, and will only write to the four directories and the one contacts database a backup legitimately contains, refusing the archive outright if it holds anything else. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-5r45-3mqm-hcvg)
• The IMAP sequence-set range pattern had no end anchor, so a value merely starting like a range was passed through whole and anything following it was read as more of the IMAP command. Nothing in the tree feeds it anything but server-derived integers, so this was a sharp edge rather than a hole, but it is the single place every FETCH, STORE and COPY sequence is built. Found while answering @remmmi (#140)

Fixed

• Opening Drafts could report "unknown error" and show nothing, on PHP 8.4. A draft holds whatever was typed, so an address can have no domain at all, and idn_to_utf8('') throws a ValueError on 8.4 where older versions returned false. That happened while the message list was being serialised, so the whole response failed rather than one address. Reported by @daniu-de (#122)
• The Debian package pulled in a second PHP. 4.4.2 added a versioned php-fpm (>= 2:8.2~) dependency, which no unversioned Provides can satisfy, so an existing working php8.3-fpm stopped counting and apt installed 8.4 beside it. The constraints are gone, as they were in 4.4.1; the 8.2 floor is still enforced at startup by Integrity::phpVersion(). Reported by @lvarnava (#134)
• The package is now called tachyon-webmail. Debian already ships an unrelated tachyon in bookworm/main, a parallel ray tracer. Reported by @lvarnava (#135)
• A fresh install could log that it had created the admin password and where to read it, and that password was then refused. It was written to admin_password.txt before the hash was stored, and Config::Save() returns a bool that nothing looked at, so wherever application.ini could not be written the file existed and held a password that had never been stored anywhere. Saved first now, and the file is written only if that worked. Reported by @jon4156 (#133)
• The ics-viewer fix listed in 4.4.2 reached releases but not git checkouts: #127 widened the match in message.js and left message.min.js, the file the plugin actually loads, untouched. Release packaging runs terser over every plugin, which is how this turned up
• In the Nextcloud file picker, the "Select folder" footer showed where it means nothing. It used the hidden binding, which any author rule carrying a display beats, and is now bound on visible. The button is also relabelled to the already-translated save string. Reported by @lvarnava (#117)

Added

• The Back button now closes an open message, and a message has its own link. The route has always understood #/mailbox/<folder>/m<uid>, so a pasted link worked, but nothing ever wrote such a hash. Opening a message now pushes a history entry, arrow keys replace it rather than leaving one per message, and the preview pane filling itself at folder load writes nothing. Idea from @remmmi (#141)
• Back out of the last of the client's own history entries and you are asked before you leave, rather than simply landing wherever you were before
• The Nextcloud folder picker opens on the folder used last, with each level on the way down opened, so a nested folder is reached rather than only a top level one. Asked for by @lvarnava (#117)

Changed

• The date format setting now previews with a date whose parts cannot be confused for one another. Thanks to Antonios Vamporakis (#137)
• Translations updated for Polish and French, and plugin strings for Polish, French and Russian

A release worth taking promptly: 4.4.0 and 4.4.1 could make login impossible on a host without the sodium extension.

Fixed

• Upgrading to 4.4.0 could make login impossible on a host without the sodium extension, with Folders error: HTTP Token mismatch after every attempt. openssl_get_cipher_methods() lists ciphers the provider will not actually use, and on OpenSSL 3 that includes aes-256-cbc-hmac-sha1, which is the shipped default. Encryption fell back to xxtea, correctly, but the hardening added in 4.4.0 then refused xxtea whenever openssl_decrypt() merely existed, so the server rejected the tokens it had just minted and no session could be established. The cipher is now tried rather than looked up, a working one is used when the configured one is not, and the refusal asks whether openssl can really be used. Affected installs are signed out once and move to proper encryption. Reported by @realsimix (#121)
• Save in Nextcloud selected a folder, turned its spinner and wrote nothing. The plugin called \OCP\Files::getStorage(), which Nextcloud deprecated in 14 and has since removed, so the call threw and the save failed silently. The same call was in the "Save as .eml" path. Reported by @BlackIkeEagle (#116)
• The Nextcloud file picker put a select button on every folder row and floated its checkboxes out of line. Folders now carry a radio confirmed from the footer, file names are clickable labels, and the rows line up. Reported by @lvarnava (#117)
• A plugin updated to a build-numbered version kept reporting the version before it and offered the same update for ever. The release-time bump wrote the new version into packages.json but packaged an index.php still declaring the old one, and the admin panel reads the installed version from that constant. Reported by @ivnmad (#119)
• Several callers passed HTTP headers as an associative array, which reached curl as bare values and were sent malformed and dropped: the integrity check, the breach lookup, which therefore travelled without its API key, and the CardDAV upload path, which answered 403 supported-address-data. Thanks to @FathiBenNasr (#124)
• Only the first data-* attribute was stripped from a composed message, because removing an attribute while iterating a live DOMNamedNodeMap ends the iteration. The rest went out in sent mail and saved drafts. Thanks to @FathiBenNasr (#126)
• An empty contact list on either side of a CardDAV sync deleted everything on the other. An empty list is more often a fault than an intent, so deletions in that direction are now skipped and logged. Thanks to @FathiBenNasr (#125)
• The ics-viewer panel never appeared on invitations from Evolution or Exchange, which put the calendar part inline and repeat it as application/ics rather than attaching text/calendar. Thanks to @FathiBenNasr (#127)

Security

• The two-factor-auth plugin keeps its TOTP secret sealed rather than in clear, and backup codes only as hashes. A code from an already-accepted 30 second step is refused, and five failures in fifteen minutes lock that account's second factor for fifteen. Existing enrolments and printed backup codes carry over untouched. Thanks to @FathiBenNasr (#128)
• The avatars plugin answered without a session and fetched a URL chosen by whoever asked, with the SSRF gate switched off, then cached the result under any address. Only instances with bimi or favicon enabled were affected; both default to off

Changed

• The Debian package gains a signed tachyon_<version>-1_all.changes file for importing into reprepro or aptly, declares php-xml, without which a clean Debian 13 install fails the integrity check, and requires PHP 8.2 or later. php-openssl, php-exif and php-sodium are dropped, none of them being real packages on Debian. Thanks to @dionysius (#129)
• The two-factor secret is now tied to APP_SALT. Lose or regenerate SALT.php, by restoring a backup without it for instance, and every user loses their second factor with no way back but an administrator clearing their record. Before this the secret was stored in clear and survived such a change. Back up SALT.php with the data directory

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published

Added

• OAuth2 for additional accounts, not only the one you log in with. A Gmail, Office 365 or generic OAuth2 account can be added from Settings, Accounts without an app password, and so without turning on 2-step verification to obtain one (#90)
• The generic OAuth2 plugin is now genuinely generic. Its endpoints, scopes, userinfo URL and the domains it answers for are configuration, so it serves any provider that does RFC 7628 and can say which address was authorized
• Swipe sideways on a phone to reach the next or previous message. The list is hidden while a message is open, so reading a run of mail otherwise meant closing each one and finding your place again. The message follows your finger, and a chevron appears once the gesture has gone far enough to act on (#102)
• Delivery receipts carry an envelope id, so a notification arriving days later can be tied to the message that caused it (#96)

Fixed

• Encrypting a message without also signing it broke both send and save, with TypeError: e.findIndex is not a function and nothing sent or saved. Choosing the crypto method in 4.2.4 started treating a value as a list that collapses to false when the feature is off, and for a draft regardless. Inherited from SnappyMail, where nothing ever did more than read its length (#103)
• S/MIME messages would not decrypt on Exchange. The MIME headers openssl needs were read from BODY[<part>.MIME], which Exchange answers with NIL, correctly: the message is not multipart, so there is no part-level header and the Content-Type is the message's own. The body reached openssl as a bare base64 blob with nothing reporting why. Diagnosed from an IMAP trace supplied by @reaisinc (#92)
• View original, Download original and attachment downloads failed in the installed app. Running as a PWA, a link opened in a tab lands in the browser, a separate context, so the request goes out cross-site and without the session cookie that identifies the account. The content is now fetched inside the app and handed over as a blob; an ordinary browser tab still streams from the server as before (#81)
• Delivery receipts asked for success and failure but never delay. Many servers decline success notifications as backscatter protection while honouring delay, so a queued or retried message reported nothing at all (#96)
• Requesting a delivery receipt did nothing on a domain set to use php mail(), which cannot pass the SMTP parameters one needs. The request was discarded in silence. The admin panel now says what the setting costs, beside the setting (#96)
• The Office 365 add-account flow could not work on a default install. Its signed state carried a CSRF token compared against the session's, and that value comes from a cookie the cross-site redirect withholds, so a fresh one was minted and the comparison could never match. This guarded its plain login too (#90)
• The Gmail plugin's token refresh wrote the new expiry to an undefined variable, so every IMAP, SMTP and Sieve connection refreshed the token again for the life of the session

Changed

• Release tarballs carry real timestamps. PharData gave every entry an mtime of 1970, so an install deployed from the tarball served Last-Modified: Thu, 01 Jan 1970 for every asset, leaving browsers nothing to revalidate against and letting a bad cached copy outlive a reinstall. The zip was never affected
• Russian and Chinese are more complete, thanks to @lvarnava and @dreamawake

Added

• Delivery receipts carry an envelope id, so a notification that turns up days later can be matched to the message that caused it (#96)

Fixed

• Requesting a delivery receipt did nothing whatsoever on a domain set to use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so the request was discarded in silence, with the tick box in the compose window doing precisely nothing. The admin panel now says what the setting costs beside the setting itself, and both places a request used to be dropped without a word are logged. Found by @lvarnava, who noticed the one domain it worked on was the one with the box unticked (#96)
• Delivery receipts asked for success and failure but never delay. Plenty of servers decline to send success notifications as backscatter protection while still honouring delay, so a message that was queued or retried reported nothing at all to the sender (#96)
• Placeholder text was invisible on Xv, Linen and Squares. The rule meant to colour it was written with one colon rather than two, so it matched nothing and had never applied on any theme. Those three are also the only ones pairing a light wallpaper with a translucent black login box, which composited to mid grey; their own labels sat at 3.86:1, below the readable threshold, which nobody had reported (#94)
• The messages per page limit now caps the default, rather than the larger of the two setting the ceiling. A default above the limit was handing every new user a number their own settings screen would refuse the moment they opened it (#73)
• PDF attachments lost their preview link and the eye badge added in 4.0.5. The check read navigator.mimeTypes, a deprecated API that browsers now populate only while the built-in PDF viewer is enabled, so it came back empty on anything current. It asks navigator.pdfViewerEnabled instead

Changed

• The README credits Weblate and charts progress per language, as the Libre plan asks
• CONTRIBUTING opens with translating, the one kind of contribution that needs none of the toolchain, and its release switches, gulp advice and debug config keys match the code again
• SECURITY.md listed 3.x as the supported line and asked for encrypted email without giving either an address or a key, so there was no way to report a vulnerability privately. Private reporting is enabled on the repository and the policy points at it
• Seven dead files left over from SnappyMail and RainLoop are gone from the repository root, along with a roadmap that finished months ago
• Release assets upload with gh, and packages.json is no longer re-committed when only the signatures moved
• Russian and Danish are substantially more complete, thanks to @lvarnava and @BrainDeLook

Added

• A Calendar button on the folder panel, beside the Contacts one that was already there (#75)
• Messages per page is now two admin settings rather than one: a default, and a separate limit on what a user may choose. Both are on the General tab instead of only in the config file (#73)

Fixed

• A long webmail title broke two-factor enrolment outright. The title is the QR code's issuer and appears in it twice, and percent-encoding turns one Cyrillic character into six bytes, so a 60 character title came to 744 bytes against the 213 a QR code of that size holds. The title is shortened now rather than the code failing, and the failure it used to produce named neither the real input nor the real limit (#80)
• The settings input capped messages per page at 50 while the save clamped at 100 and the admin could configure anything, so a site set higher could not be matched from the settings screen (#73)
• A still-enabled SnappyMail could leave the Nextcloud session holding a user id but no passphrase, so auto-login found nothing to send and presented an empty password field with nothing to explain it (#72)
• The General and Config admin tabs edit the same keys, and General never re-read them, so a value changed on Config still showed the old number and saving put it back
• Search filters were not applied on a fresh login, because the settings lookup needed a session that imap.after-login runs before. Thanks to @wojt-janowski
• Weblate's safe-html autofix had escaped & to & inside translated strings. Those render as text, not HTML, so eight languages were displaying the entity. A CI check now fails on it rather than leaving it to review

Changed

• Russian is substantially more complete, thanks to @lvarnava and @BrainDeLook

Fixed

• The SnappyMail logo was still shipping in nine places, including desktop notifications, the admin About tab and both the Nextcloud and ownCloud integrations. Its Braille dots read SNAPPY (#51)
• Search filters were shared by every account on the install, so a rule filing mail into a folder that exists in one mailbox ran against all of them. Because the rules run during login, the resulting failure was reported as a failed login. Filters are now per address, and an existing list stays with the account that created it
• Deleting a search filter appeared to do nothing while actually deleting it
• Search filters moved messages out of INBOX even when they were found elsewhere
• Editing an account at an internationalised domain failed with "Unknown error". The account list is sent to the client in unicode while accounts are stored under the ASCII form, and the address was not converted back on the way in, so the lookup found nothing
• A sender with no avatar answered 404, which logged a console error for most of a normal message list, and was the one response carrying no cache headers, so every render asked again and redid the lookups behind it

Added

• Add an invitation to a calendar from the message it arrived in. Handles files holding several events, and recurring series with moved occurrences
• Import a whole .ics file into a calendar
• A date picker in place of the native one, which rendered in the browser's locale and ignored everything Tachyon asked of it, plus a date format setting that follows the interface language by default
• Week numbers and first day of the week are user settings
• Release artifacts are signed, and the public key ships alongside them

Changed

• Seven designs that shipped as a light theme and a dark theme are now one theme each, switched with the light/dark toggle: Stripes, Love, Snow, Blurred, Squares, Wood, and Shine (formerly DarkShine and NightShine). A saved theme migrates on its own, and an account on a dark build lands on the merged theme already in dark mode
• Default, Linen, A, Xv and Clear gained a dark mode; Magnetic gained a light one. All 16 themes now answer the toggle

Fixed

• The admin panel's update button downloaded the cPanel package rather than the webmail one, so updating always failed
• Image whitelist entries were being overwritten by whichever session wrote last, rather than expiring as it appeared
• The Contacts menu opened partly off screen on phones (#50)
• The calendar grid was dark grey on light themes and white on some dark ones
• The event editor honours a 24-hour clock, keeps its fields inside the dialog, and moving the start past the end carries the end with it
• Nextcloud translation catalogues registered under the old app id, so none of them loaded
• fail2ban filters, AUR package metadata and release signing still described SnappyMail

The last three of the back-button regressions, two of which only show on a large mailbox or on a phone. Plus the end of the admin password error on Docker upgrades, calendars that could never be removed, and a way to log logins on their own.

Worth taking if your inbox holds more than 10,000 messages, because no conversation could be opened in one at all.

Fixed

• No thread could be opened in a folder holding more than message_list_limit messages, 10,000 by default, which showed as the full folder under a "Back to message list" button. That branch answers with the most recent slice rather than working out the whole uid list, and says in its own comment that it does not use THREAD; a request naming one thread fell into it and got the unthreaded folder back, with the thread uid still echoed in the response. It could not escape either, because the one thing that lifts the limit is a cached uid lookup that is itself skipped whenever a thread is named. A mailbox growing past 10,000 messages was enough to turn this on, which is why it had worked for years and why the IMAP server was never at fault. Reported by @floppybl (#156)
• The whole folder sat on screen, with no spinner, while a thread loaded. The test that drops the messages on screen when they no longer answer the request compares the folder, the search and the offset. Entering a conversation changes none of those from page 1, so nothing was dropped and the old list stayed there until the thread arrived. On a large mailbox that is indistinguishable from the thread never loading. From page 2 or later it did clear, because the offset moved, which is what made it look intermittent (#156)
• Moving to the next message across a page boundary flashed the next page's list, on mobile, where the list and the message are separate views rather than side by side. Crossing a boundary calls gotoPage(), which writes an address with no message in it, and the back-button work in 4.4.3 taught the route to read that as "close the message". The route now leaves the open message alone for the one dispatch where a selection is already pending. Reported by @lvarnava (#157)
• A Docker upgrade reported an admin password failure on every restart, on an installation where nothing was wrong and nothing needed doing. The entrypoint treated a missing admin_password.txt as a failure without asking whether a password was already configured, and on an existing installation that file is legitimately absent: it is written once, on the first run, and an administrator who read it and deleted it, which is the sensible thing to do with a password in clear, ends up in the same position as one who set their own. Three cases now, and only the last of them can fail. Reported by @jon4156 (#158)
• A CalDAV calendar could not be removed once it had been seen. The code that stores a discovered calendar only ever inserted or updated it, and nothing anywhere deleted one, so moving the URL from a single public collection to the DAV root left the old collection sitting next to the new ones for ever. A sync now reconciles what is stored against what discovery returned. A calendar missing from the listing is hidden at once, and its events are removed only after a second sync confirms it, because a PROPFIND answers per collection and one the server refuses while answering for the others is indistinguishable from one the user deleted. Clearing the URL, or setting sync to No, removes them all on save. Reported by @Quiwy (#164)

Changed

• A login can now be logged without logging every request. A successful login wrote nothing to the main log at all, so it could only be seen at level 6, among the per-request traffic; it is a notice now, at level 5. A failed login went only to the fail2ban file and to LOG_AUTHPRIV, both off by default, so the ordinary log could not tell a failure from no attempt at all; it is a warning, which is visible at the default level of 4. Both carry the ip and the login through the same substitutions the fail2ban format already uses, so nothing new is exposed and no password goes near them. Worth knowing before upgrading: an installation with logging enabled therefore starts recording the client ip and the login for failed attempts. Asked for by @dionysius (#163)
• The syslog driver sent everything at LOG_INFO. It pinned its own level in the constructor, so an error and a debug line arrived at the same priority and filtering by priority did nothing at all. Driver::Write had the severity the whole time and dropped it before handing the message over; the driver signature now carries it through to syslog(). Found in #163
• Translations updated for French and Polish

Five releases in two days, and three of them to clean up after one change of mine. Sorry. Writing the open message into the address bar, added in 4.4.3 so that Back works and a message can be linked, reset a different piece of the mailbox on every click, and each one surfaced as its own bug. Everything the address bar carries is now read and applied in one place, and the rest of the links that write it have been gone through rather than waited on.

If you are on 4.4.3, 4.4.4 or 4.4.5, take this one.

Fixed

• Opening a message from page 2 or later jumped back to page 1, after which the previous and next arrows walked a list that no longer held the open message and appeared to do nothing. A message link has nowhere to record the page, so the route reported page one for every one of them and the list was reloaded at the top. Reported by @lvarnava (#157)
• Opening a message from a search threw the search away and reloaded the whole folder behind it. The link dropped the search, which the route has always been able to carry after the uid. Found while fixing #157, not reported
• Clicking the conversation count showed the whole list, and Back to list stayed in the thread. The test that stops every message click refetching the list compared the folder, page and search, and the thread uid is none of those: it travels inside the folder part, so entering or leaving a thread changed nothing it looked at and the reload was skipped in both directions. Reported by @floppybl (#156)
• Reloading the browser while reading a message inside a thread came back with the whole folder behind it. The thread uid was applied only when the address bar held no message. Found by going through the remaining links rather than from a report

Take this one if you run 4.4.3 or 4.4.4 and any of your folders has a space, an accent or a nested path: opening a message showed nothing at all.

Fixed

• A message opened to an empty body, in any folder whose name is not plain ASCII. The fix for #153 in 4.4.4 put the correct folder hash into the address bar, and then the route handler took that hash for a folder name: it compared it against the open message's full name, which never matches, built a replacement message naming a folder that does not exist, and the request for it was dropped without a word. So the body loaded and was immediately replaced by nothing. Both the comparison and the new message now use the folder's full name, which the route handler has already resolved. Diagnosed, down to the line, by @remmmi (#155)
• Installing the Debian package over an older tachyon package stopped on a file conflict. The rename in 4.4.3 left tachyon-webmail owning the same paths without declaring that it replaces them, so apt install ./tachyon-webmail_*.deb aborted unless the old package was removed first, which broke unattended installs. A versioned Replaces hands the files over. There is deliberately no Breaks: Debian's unrelated tachyon ray tracer also satisfies << 4.4.3~, and apt would have offered to remove it. Diagnosed and tested, including against python-apt, by @ZaphodB (#154)
• Asking for a message in a folder that cannot be resolved now says so in the browser console, with [debug] javascript = On. It returned false in silence before, which is how the two bugs above stayed invisible while the message view simply sat empty

Changed

• Installing the Debian package now warns, once, while an older tachyon package is still installed. Replaces hands over the shared files but does not remove that package, and what stays behind is a complete older copy of the application under /usr/share/tachyon, missing the security fixes from 4.4.0 through 4.4.3. Run apt remove tachyon to clear it

Take this one if you run 4.4.3: clicking a message could fill the search box and open nothing, for anyone whose folders are not named in plain ASCII.

Fixed

• Clicking a message filled the search box and showed nothing, on 4.4.3 only. Message links name a folder by a URL-safe hash of its full name, because a full name may hold the hierarchy delimiter and anything else; the click path passed the full name instead, so a folder like Lists/dev produced extra path segments, no route matched it, and the tail was read as page and search. A folder named only [a-z0-9._-] hashes to itself, which is why INBOX behaved normally and this reached release: Dovecot's default . delimiter is in that class, Mailcow's / is not. Two older instances of the same mistake go with it, in the folder jumped to when a message is not in the current list, which is also how "select next after delete" moves, and in the notification for several new messages. Reported by @codiflow (#153)
• The admin Contacts connection test reported plain success while contacts were switched off, so a green result said less than it appeared to and sent an administrator hunting for the fault elsewhere. It now has three outcomes: the database failing, the database answering while the feature is off, and both together. Found through #145

Added

• A line or two of the message body under the subject in the list, off by default, with a setting under General for one line or two. The text comes from the IMAP server over PREVIEW (RFC 8970), which means no extra fetching and no HTML to strip, since the server is required to hand over plain text. Where a server cannot do it the setting says so rather than appearing to work, and where an administrator has turned it off the setting is hidden. Asked for by @DanClarke-io (#148)
• A show/passphrase toggle on both login screens. Hidden by default, and it cannot submit the form or reveal anything before the page has finished loading. Asked for by @goddies (#131)
• A Material theme, modelled on Material Design 3, in light and dark, with no web fonts fetched. Thanks to @DanClarke-io (#151)
• MailClient::MessageListByTuples(), a supported way for a plugin to hand the core a page of [folder, uid] pairs and have it fetched and rendered, for search backed by an external index or a conversation ordering. The caller's order is kept across folders, repeats collapse, and pairs that could not be read are reported back. Asked for by @remmmi (#140)

Changed

• The login-o365 documentation no longer offers the two redirect URI forms as equal alternatives. Microsoft permits a query parameter in a redirect URI only for work and school registrations, so a personal Outlook account must use the path form, which is the extension's default. Raised in #114
• Translations updated for Polish and Russian

Worth taking if you run 4.4.2: opening Drafts could fail outright on PHP 8.4, the Debian package pulled in a second PHP, and logging out did not end the session.

Security

• Logging out left the server-side session alive. Logout() asked the browser to drop two cookies and nothing else: the StorageType::SESSION record that getMainAccountFromToken() actually checks stayed where it was, and the clear of the SESSION_TOKEN cookie had been commented out. Anyone holding a copy of the cookies from before the logout kept full mailbox access without the password, and since FileStorage::Get() touches the file on every read, a session being replayed never aged into the three hour sweep either. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-gc87-g2gf-xj6q)
• Backup restore ran without an admin session. JsonAdminRestoreData asked only whether the request had reached the admin panel, which is true for anyone able to load it, and the core rule requiring a login for Admin* actions did not cover it: a plugin action is dispatched as PluginJsonAdminRestoreData, so the test on the name starting with Admin never matched. The restore now demands an admin login, ignores the client's Content-Type, and will only write to the four directories and the one contacts database a backup legitimately contains, refusing the archive outright if it holds anything else. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-5r45-3mqm-hcvg)
• The IMAP sequence-set range pattern had no end anchor, so a value merely starting like a range was passed through whole and anything following it was read as more of the IMAP command. Nothing in the tree feeds it anything but server-derived integers, so this was a sharp edge rather than a hole, but it is the single place every FETCH, STORE and COPY sequence is built. Found while answering @remmmi (#140)

Fixed

• Opening Drafts could report "unknown error" and show nothing, on PHP 8.4. A draft holds whatever was typed, so an address can have no domain at all, and idn_to_utf8('') throws a ValueError on 8.4 where older versions returned false. That happened while the message list was being serialised, so the whole response failed rather than one address. Reported by @daniu-de (#122)
• The Debian package pulled in a second PHP. 4.4.2 added a versioned php-fpm (>= 2:8.2~) dependency, which no unversioned Provides can satisfy, so an existing working php8.3-fpm stopped counting and apt installed 8.4 beside it. The constraints are gone, as they were in 4.4.1; the 8.2 floor is still enforced at startup by Integrity::phpVersion(). Reported by @lvarnava (#134)
• The package is now called tachyon-webmail. Debian already ships an unrelated tachyon in bookworm/main, a parallel ray tracer. Reported by @lvarnava (#135)
• A fresh install could log that it had created the admin password and where to read it, and that password was then refused. It was written to admin_password.txt before the hash was stored, and Config::Save() returns a bool that nothing looked at, so wherever application.ini could not be written the file existed and held a password that had never been stored anywhere. Saved first now, and the file is written only if that worked. Reported by @jon4156 (#133)
• The ics-viewer fix listed in 4.4.2 reached releases but not git checkouts: #127 widened the match in message.js and left message.min.js, the file the plugin actually loads, untouched. Release packaging runs terser over every plugin, which is how this turned up
• In the Nextcloud file picker, the "Select folder" footer showed where it means nothing. It used the hidden binding, which any author rule carrying a display beats, and is now bound on visible. The button is also relabelled to the already-translated save string. Reported by @lvarnava (#117)

Added

• The Back button now closes an open message, and a message has its own link. The route has always understood #/mailbox/<folder>/m<uid>, so a pasted link worked, but nothing ever wrote such a hash. Opening a message now pushes a history entry, arrow keys replace it rather than leaving one per message, and the preview pane filling itself at folder load writes nothing. Idea from @remmmi (#141)
• Back out of the last of the client's own history entries and you are asked before you leave, rather than simply landing wherever you were before
• The Nextcloud folder picker opens on the folder used last, with each level on the way down opened, so a nested folder is reached rather than only a top level one. Asked for by @lvarnava (#117)

Changed

• The date format setting now previews with a date whose parts cannot be confused for one another. Thanks to Antonios Vamporakis (#137)
• Translations updated for Polish and French, and plugin strings for Polish, French and Russian

A release worth taking promptly: 4.4.0 and 4.4.1 could make login impossible on a host without the sodium extension.

Fixed

• Upgrading to 4.4.0 could make login impossible on a host without the sodium extension, with Folders error: HTTP Token mismatch after every attempt. openssl_get_cipher_methods() lists ciphers the provider will not actually use, and on OpenSSL 3 that includes aes-256-cbc-hmac-sha1, which is the shipped default. Encryption fell back to xxtea, correctly, but the hardening added in 4.4.0 then refused xxtea whenever openssl_decrypt() merely existed, so the server rejected the tokens it had just minted and no session could be established. The cipher is now tried rather than looked up, a working one is used when the configured one is not, and the refusal asks whether openssl can really be used. Affected installs are signed out once and move to proper encryption. Reported by @realsimix (#121)
• Save in Nextcloud selected a folder, turned its spinner and wrote nothing. The plugin called \OCP\Files::getStorage(), which Nextcloud deprecated in 14 and has since removed, so the call threw and the save failed silently. The same call was in the "Save as .eml" path. Reported by @BlackIkeEagle (#116)
• The Nextcloud file picker put a select button on every folder row and floated its checkboxes out of line. Folders now carry a radio confirmed from the footer, file names are clickable labels, and the rows line up. Reported by @lvarnava (#117)
• A plugin updated to a build-numbered version kept reporting the version before it and offered the same update for ever. The release-time bump wrote the new version into packages.json but packaged an index.php still declaring the old one, and the admin panel reads the installed version from that constant. Reported by @ivnmad (#119)
• Several callers passed HTTP headers as an associative array, which reached curl as bare values and were sent malformed and dropped: the integrity check, the breach lookup, which therefore travelled without its API key, and the CardDAV upload path, which answered 403 supported-address-data. Thanks to @FathiBenNasr (#124)
• Only the first data-* attribute was stripped from a composed message, because removing an attribute while iterating a live DOMNamedNodeMap ends the iteration. The rest went out in sent mail and saved drafts. Thanks to @FathiBenNasr (#126)
• An empty contact list on either side of a CardDAV sync deleted everything on the other. An empty list is more often a fault than an intent, so deletions in that direction are now skipped and logged. Thanks to @FathiBenNasr (#125)
• The ics-viewer panel never appeared on invitations from Evolution or Exchange, which put the calendar part inline and repeat it as application/ics rather than attaching text/calendar. Thanks to @FathiBenNasr (#127)

Security

• The two-factor-auth plugin keeps its TOTP secret sealed rather than in clear, and backup codes only as hashes. A code from an already-accepted 30 second step is refused, and five failures in fifteen minutes lock that account's second factor for fifteen. Existing enrolments and printed backup codes carry over untouched. Thanks to @FathiBenNasr (#128)
• The avatars plugin answered without a session and fetched a URL chosen by whoever asked, with the SSRF gate switched off, then cached the result under any address. Only instances with bimi or favicon enabled were affected; both default to off

Changed

• The Debian package gains a signed tachyon_<version>-1_all.changes file for importing into reprepro or aptly, declares php-xml, without which a clean Debian 13 install fails the integrity check, and requires PHP 8.2 or later. php-openssl, php-exif and php-sodium are dropped, none of them being real packages on Debian. Thanks to @dionysius (#129)
• The two-factor secret is now tied to APP_SALT. Lose or regenerate SALT.php, by restoring a backup without it for instance, and every user loses their second factor with no way back but an administrator clearing their record. Before this the secret was stored in clear and survived such a change. Back up SALT.php with the data directory

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published

Added

• OAuth2 for additional accounts, not only the one you log in with. A Gmail, Office 365 or generic OAuth2 account can be added from Settings, Accounts without an app password, and so without turning on 2-step verification to obtain one (#90)
• The generic OAuth2 plugin is now genuinely generic. Its endpoints, scopes, userinfo URL and the domains it answers for are configuration, so it serves any provider that does RFC 7628 and can say which address was authorized
• Swipe sideways on a phone to reach the next or previous message. The list is hidden while a message is open, so reading a run of mail otherwise meant closing each one and finding your place again. The message follows your finger, and a chevron appears once the gesture has gone far enough to act on (#102)
• Delivery receipts carry an envelope id, so a notification arriving days later can be tied to the message that caused it (#96)

Fixed

• Encrypting a message without also signing it broke both send and save, with TypeError: e.findIndex is not a function and nothing sent or saved. Choosing the crypto method in 4.2.4 started treating a value as a list that collapses to false when the feature is off, and for a draft regardless. Inherited from SnappyMail, where nothing ever did more than read its length (#103)
• S/MIME messages would not decrypt on Exchange. The MIME headers openssl needs were read from BODY[<part>.MIME], which Exchange answers with NIL, correctly: the message is not multipart, so there is no part-level header and the Content-Type is the message's own. The body reached openssl as a bare base64 blob with nothing reporting why. Diagnosed from an IMAP trace supplied by @reaisinc (#92)
• View original, Download original and attachment downloads failed in the installed app. Running as a PWA, a link opened in a tab lands in the browser, a separate context, so the request goes out cross-site and without the session cookie that identifies the account. The content is now fetched inside the app and handed over as a blob; an ordinary browser tab still streams from the server as before (#81)
• Delivery receipts asked for success and failure but never delay. Many servers decline success notifications as backscatter protection while honouring delay, so a queued or retried message reported nothing at all (#96)
• Requesting a delivery receipt did nothing on a domain set to use php mail(), which cannot pass the SMTP parameters one needs. The request was discarded in silence. The admin panel now says what the setting costs, beside the setting (#96)
• The Office 365 add-account flow could not work on a default install. Its signed state carried a CSRF token compared against the session's, and that value comes from a cookie the cross-site redirect withholds, so a fresh one was minted and the comparison could never match. This guarded its plain login too (#90)
• The Gmail plugin's token refresh wrote the new expiry to an undefined variable, so every IMAP, SMTP and Sieve connection refreshed the token again for the life of the session

Changed

• Release tarballs carry real timestamps. PharData gave every entry an mtime of 1970, so an install deployed from the tarball served Last-Modified: Thu, 01 Jan 1970 for every asset, leaving browsers nothing to revalidate against and letting a bad cached copy outlive a reinstall. The zip was never affected
• Russian and Chinese are more complete, thanks to @lvarnava and @dreamawake

Added

• Delivery receipts carry an envelope id, so a notification that turns up days later can be matched to the message that caused it (#96)

Fixed

• Requesting a delivery receipt did nothing whatsoever on a domain set to use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so the request was discarded in silence, with the tick box in the compose window doing precisely nothing. The admin panel now says what the setting costs beside the setting itself, and both places a request used to be dropped without a word are logged. Found by @lvarnava, who noticed the one domain it worked on was the one with the box unticked (#96)
• Delivery receipts asked for success and failure but never delay. Plenty of servers decline to send success notifications as backscatter protection while still honouring delay, so a message that was queued or retried reported nothing at all to the sender (#96)
• Placeholder text was invisible on Xv, Linen and Squares. The rule meant to colour it was written with one colon rather than two, so it matched nothing and had never applied on any theme. Those three are also the only ones pairing a light wallpaper with a translucent black login box, which composited to mid grey; their own labels sat at 3.86:1, below the readable threshold, which nobody had reported (#94)
• The messages per page limit now caps the default, rather than the larger of the two setting the ceiling. A default above the limit was handing every new user a number their own settings screen would refuse the moment they opened it (#73)
• PDF attachments lost their preview link and the eye badge added in 4.0.5. The check read navigator.mimeTypes, a deprecated API that browsers now populate only while the built-in PDF viewer is enabled, so it came back empty on anything current. It asks navigator.pdfViewerEnabled instead

Changed

• The README credits Weblate and charts progress per language, as the Libre plan asks
• CONTRIBUTING opens with translating, the one kind of contribution that needs none of the toolchain, and its release switches, gulp advice and debug config keys match the code again
• SECURITY.md listed 3.x as the supported line and asked for encrypted email without giving either an address or a key, so there was no way to report a vulnerability privately. Private reporting is enabled on the repository and the policy points at it
• Seven dead files left over from SnappyMail and RainLoop are gone from the repository root, along with a roadmap that finished months ago
• Release assets upload with gh, and packages.json is no longer re-committed when only the signatures moved
• Russian and Danish are substantially more complete, thanks to @lvarnava and @BrainDeLook

Added

• A Calendar button on the folder panel, beside the Contacts one that was already there (#75)
• Messages per page is now two admin settings rather than one: a default, and a separate limit on what a user may choose. Both are on the General tab instead of only in the config file (#73)

Fixed

• A long webmail title broke two-factor enrolment outright. The title is the QR code's issuer and appears in it twice, and percent-encoding turns one Cyrillic character into six bytes, so a 60 character title came to 744 bytes against the 213 a QR code of that size holds. The title is shortened now rather than the code failing, and the failure it used to produce named neither the real input nor the real limit (#80)
• The settings input capped messages per page at 50 while the save clamped at 100 and the admin could configure anything, so a site set higher could not be matched from the settings screen (#73)
• A still-enabled SnappyMail could leave the Nextcloud session holding a user id but no passphrase, so auto-login found nothing to send and presented an empty password field with nothing to explain it (#72)
• The General and Config admin tabs edit the same keys, and General never re-read them, so a value changed on Config still showed the old number and saving put it back
• Search filters were not applied on a fresh login, because the settings lookup needed a session that imap.after-login runs before. Thanks to @wojt-janowski
• Weblate's safe-html autofix had escaped & to & inside translated strings. Those render as text, not HTML, so eight languages were displaying the entity. A CI check now fails on it rather than leaving it to review

Changed

• Russian is substantially more complete, thanks to @lvarnava and @BrainDeLook

Fixed

• The SnappyMail logo was still shipping in nine places, including desktop notifications, the admin About tab and both the Nextcloud and ownCloud integrations. Its Braille dots read SNAPPY (#51)
• Search filters were shared by every account on the install, so a rule filing mail into a folder that exists in one mailbox ran against all of them. Because the rules run during login, the resulting failure was reported as a failed login. Filters are now per address, and an existing list stays with the account that created it
• Deleting a search filter appeared to do nothing while actually deleting it
• Search filters moved messages out of INBOX even when they were found elsewhere
• Editing an account at an internationalised domain failed with "Unknown error". The account list is sent to the client in unicode while accounts are stored under the ASCII form, and the address was not converted back on the way in, so the lookup found nothing
• A sender with no avatar answered 404, which logged a console error for most of a normal message list, and was the one response carrying no cache headers, so every render asked again and redid the lookups behind it

Added

• Add an invitation to a calendar from the message it arrived in. Handles files holding several events, and recurring series with moved occurrences
• Import a whole .ics file into a calendar
• A date picker in place of the native one, which rendered in the browser's locale and ignored everything Tachyon asked of it, plus a date format setting that follows the interface language by default
• Week numbers and first day of the week are user settings
• Release artifacts are signed, and the public key ships alongside them

Changed

• Seven designs that shipped as a light theme and a dark theme are now one theme each, switched with the light/dark toggle: Stripes, Love, Snow, Blurred, Squares, Wood, and Shine (formerly DarkShine and NightShine). A saved theme migrates on its own, and an account on a dark build lands on the merged theme already in dark mode
• Default, Linen, A, Xv and Clear gained a dark mode; Magnetic gained a light one. All 16 themes now answer the toggle

Fixed

• The admin panel's update button downloaded the cPanel package rather than the webmail one, so updating always failed
• Image whitelist entries were being overwritten by whichever session wrote last, rather than expiring as it appeared
• The Contacts menu opened partly off screen on phones (#50)
• The calendar grid was dark grey on light themes and white on some dark ones
• The event editor honours a 24-hour clock, keeps its fields inside the dialog, and moving the start past the end carries the end with it
• Nextcloud translation catalogues registered under the old app id, so none of them loaded
• fail2ban filters, AUR package metadata and release signing still described SnappyMail

The last three of the back-button regressions, two of which only show on a large mailbox or on a phone. Plus the end of the admin password error on Docker upgrades, calendars that could never be removed, and a way to log logins on their own.

Worth taking if your inbox holds more than 10,000 messages, because no conversation could be opened in one at all.

Fixed

• No thread could be opened in a folder holding more than message_list_limit messages, 10,000 by default, which showed as the full folder under a "Back to message list" button. That branch answers with the most recent slice rather than working out the whole uid list, and says in its own comment that it does not use THREAD; a request naming one thread fell into it and got the unthreaded folder back, with the thread uid still echoed in the response. It could not escape either, because the one thing that lifts the limit is a cached uid lookup that is itself skipped whenever a thread is named. A mailbox growing past 10,000 messages was enough to turn this on, which is why it had worked for years and why the IMAP server was never at fault. Reported by @floppybl (#156)
• The whole folder sat on screen, with no spinner, while a thread loaded. The test that drops the messages on screen when they no longer answer the request compares the folder, the search and the offset. Entering a conversation changes none of those from page 1, so nothing was dropped and the old list stayed there until the thread arrived. On a large mailbox that is indistinguishable from the thread never loading. From page 2 or later it did clear, because the offset moved, which is what made it look intermittent (#156)
• Moving to the next message across a page boundary flashed the next page's list, on mobile, where the list and the message are separate views rather than side by side. Crossing a boundary calls gotoPage(), which writes an address with no message in it, and the back-button work in 4.4.3 taught the route to read that as "close the message". The route now leaves the open message alone for the one dispatch where a selection is already pending. Reported by @lvarnava (#157)
• A Docker upgrade reported an admin password failure on every restart, on an installation where nothing was wrong and nothing needed doing. The entrypoint treated a missing admin_password.txt as a failure without asking whether a password was already configured, and on an existing installation that file is legitimately absent: it is written once, on the first run, and an administrator who read it and deleted it, which is the sensible thing to do with a password in clear, ends up in the same position as one who set their own. Three cases now, and only the last of them can fail. Reported by @jon4156 (#158)
• A CalDAV calendar could not be removed once it had been seen. The code that stores a discovered calendar only ever inserted or updated it, and nothing anywhere deleted one, so moving the URL from a single public collection to the DAV root left the old collection sitting next to the new ones for ever. A sync now reconciles what is stored against what discovery returned. A calendar missing from the listing is hidden at once, and its events are removed only after a second sync confirms it, because a PROPFIND answers per collection and one the server refuses while answering for the others is indistinguishable from one the user deleted. Clearing the URL, or setting sync to No, removes them all on save. Reported by @Quiwy (#164)

Changed

• A login can now be logged without logging every request. A successful login wrote nothing to the main log at all, so it could only be seen at level 6, among the per-request traffic; it is a notice now, at level 5. A failed login went only to the fail2ban file and to LOG_AUTHPRIV, both off by default, so the ordinary log could not tell a failure from no attempt at all; it is a warning, which is visible at the default level of 4. Both carry the ip and the login through the same substitutions the fail2ban format already uses, so nothing new is exposed and no password goes near them. Worth knowing before upgrading: an installation with logging enabled therefore starts recording the client ip and the login for failed attempts. Asked for by @dionysius (#163)
• The syslog driver sent everything at LOG_INFO. It pinned its own level in the constructor, so an error and a debug line arrived at the same priority and filtering by priority did nothing at all. Driver::Write had the severity the whole time and dropped it before handing the message over; the driver signature now carries it through to syslog(). Found in #163
• Translations updated for French and Polish

Five releases in two days, and three of them to clean up after one change of mine. Sorry. Writing the open message into the address bar, added in 4.4.3 so that Back works and a message can be linked, reset a different piece of the mailbox on every click, and each one surfaced as its own bug. Everything the address bar carries is now read and applied in one place, and the rest of the links that write it have been gone through rather than waited on.

If you are on 4.4.3, 4.4.4 or 4.4.5, take this one.

Fixed

• Opening a message from page 2 or later jumped back to page 1, after which the previous and next arrows walked a list that no longer held the open message and appeared to do nothing. A message link has nowhere to record the page, so the route reported page one for every one of them and the list was reloaded at the top. Reported by @lvarnava (#157)
• Opening a message from a search threw the search away and reloaded the whole folder behind it. The link dropped the search, which the route has always been able to carry after the uid. Found while fixing #157, not reported
• Clicking the conversation count showed the whole list, and Back to list stayed in the thread. The test that stops every message click refetching the list compared the folder, page and search, and the thread uid is none of those: it travels inside the folder part, so entering or leaving a thread changed nothing it looked at and the reload was skipped in both directions. Reported by @floppybl (#156)
• Reloading the browser while reading a message inside a thread came back with the whole folder behind it. The thread uid was applied only when the address bar held no message. Found by going through the remaining links rather than from a report

Take this one if you run 4.4.3 or 4.4.4 and any of your folders has a space, an accent or a nested path: opening a message showed nothing at all.

Fixed

• A message opened to an empty body, in any folder whose name is not plain ASCII. The fix for #153 in 4.4.4 put the correct folder hash into the address bar, and then the route handler took that hash for a folder name: it compared it against the open message's full name, which never matches, built a replacement message naming a folder that does not exist, and the request for it was dropped without a word. So the body loaded and was immediately replaced by nothing. Both the comparison and the new message now use the folder's full name, which the route handler has already resolved. Diagnosed, down to the line, by @remmmi (#155)
• Installing the Debian package over an older tachyon package stopped on a file conflict. The rename in 4.4.3 left tachyon-webmail owning the same paths without declaring that it replaces them, so apt install ./tachyon-webmail_*.deb aborted unless the old package was removed first, which broke unattended installs. A versioned Replaces hands the files over. There is deliberately no Breaks: Debian's unrelated tachyon ray tracer also satisfies << 4.4.3~, and apt would have offered to remove it. Diagnosed and tested, including against python-apt, by @ZaphodB (#154)
• Asking for a message in a folder that cannot be resolved now says so in the browser console, with [debug] javascript = On. It returned false in silence before, which is how the two bugs above stayed invisible while the message view simply sat empty

Changed

• Installing the Debian package now warns, once, while an older tachyon package is still installed. Replaces hands over the shared files but does not remove that package, and what stays behind is a complete older copy of the application under /usr/share/tachyon, missing the security fixes from 4.4.0 through 4.4.3. Run apt remove tachyon to clear it

Take this one if you run 4.4.3: clicking a message could fill the search box and open nothing, for anyone whose folders are not named in plain ASCII.

Fixed

• Clicking a message filled the search box and showed nothing, on 4.4.3 only. Message links name a folder by a URL-safe hash of its full name, because a full name may hold the hierarchy delimiter and anything else; the click path passed the full name instead, so a folder like Lists/dev produced extra path segments, no route matched it, and the tail was read as page and search. A folder named only [a-z0-9._-] hashes to itself, which is why INBOX behaved normally and this reached release: Dovecot's default . delimiter is in that class, Mailcow's / is not. Two older instances of the same mistake go with it, in the folder jumped to when a message is not in the current list, which is also how "select next after delete" moves, and in the notification for several new messages. Reported by @codiflow (#153)
• The admin Contacts connection test reported plain success while contacts were switched off, so a green result said less than it appeared to and sent an administrator hunting for the fault elsewhere. It now has three outcomes: the database failing, the database answering while the feature is off, and both together. Found through #145

Added

• A line or two of the message body under the subject in the list, off by default, with a setting under General for one line or two. The text comes from the IMAP server over PREVIEW (RFC 8970), which means no extra fetching and no HTML to strip, since the server is required to hand over plain text. Where a server cannot do it the setting says so rather than appearing to work, and where an administrator has turned it off the setting is hidden. Asked for by @DanClarke-io (#148)
• A show/passphrase toggle on both login screens. Hidden by default, and it cannot submit the form or reveal anything before the page has finished loading. Asked for by @goddies (#131)
• A Material theme, modelled on Material Design 3, in light and dark, with no web fonts fetched. Thanks to @DanClarke-io (#151)
• MailClient::MessageListByTuples(), a supported way for a plugin to hand the core a page of [folder, uid] pairs and have it fetched and rendered, for search backed by an external index or a conversation ordering. The caller's order is kept across folders, repeats collapse, and pairs that could not be read are reported back. Asked for by @remmmi (#140)

Changed

• The login-o365 documentation no longer offers the two redirect URI forms as equal alternatives. Microsoft permits a query parameter in a redirect URI only for work and school registrations, so a personal Outlook account must use the path form, which is the extension's default. Raised in #114
• Translations updated for Polish and Russian

Worth taking if you run 4.4.2: opening Drafts could fail outright on PHP 8.4, the Debian package pulled in a second PHP, and logging out did not end the session.

Security

• Logging out left the server-side session alive. Logout() asked the browser to drop two cookies and nothing else: the StorageType::SESSION record that getMainAccountFromToken() actually checks stayed where it was, and the clear of the SESSION_TOKEN cookie had been commented out. Anyone holding a copy of the cookies from before the logout kept full mailbox access without the password, and since FileStorage::Get() touches the file on every read, a session being replayed never aged into the three hour sweep either. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-gc87-g2gf-xj6q)
• Backup restore ran without an admin session. JsonAdminRestoreData asked only whether the request had reached the admin panel, which is true for anyone able to load it, and the core rule requiring a login for Admin* actions did not cover it: a plugin action is dispatched as PluginJsonAdminRestoreData, so the test on the name starting with Admin never matched. The restore now demands an admin login, ignores the client's Content-Type, and will only write to the four directories and the one contacts database a backup legitimately contains, refusing the archive outright if it holds anything else. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-5r45-3mqm-hcvg)
• The IMAP sequence-set range pattern had no end anchor, so a value merely starting like a range was passed through whole and anything following it was read as more of the IMAP command. Nothing in the tree feeds it anything but server-derived integers, so this was a sharp edge rather than a hole, but it is the single place every FETCH, STORE and COPY sequence is built. Found while answering @remmmi (#140)

Fixed

• Opening Drafts could report "unknown error" and show nothing, on PHP 8.4. A draft holds whatever was typed, so an address can have no domain at all, and idn_to_utf8('') throws a ValueError on 8.4 where older versions returned false. That happened while the message list was being serialised, so the whole response failed rather than one address. Reported by @daniu-de (#122)
• The Debian package pulled in a second PHP. 4.4.2 added a versioned php-fpm (>= 2:8.2~) dependency, which no unversioned Provides can satisfy, so an existing working php8.3-fpm stopped counting and apt installed 8.4 beside it. The constraints are gone, as they were in 4.4.1; the 8.2 floor is still enforced at startup by Integrity::phpVersion(). Reported by @lvarnava (#134)
• The package is now called tachyon-webmail. Debian already ships an unrelated tachyon in bookworm/main, a parallel ray tracer. Reported by @lvarnava (#135)
• A fresh install could log that it had created the admin password and where to read it, and that password was then refused. It was written to admin_password.txt before the hash was stored, and Config::Save() returns a bool that nothing looked at, so wherever application.ini could not be written the file existed and held a password that had never been stored anywhere. Saved first now, and the file is written only if that worked. Reported by @jon4156 (#133)
• The ics-viewer fix listed in 4.4.2 reached releases but not git checkouts: #127 widened the match in message.js and left message.min.js, the file the plugin actually loads, untouched. Release packaging runs terser over every plugin, which is how this turned up
• In the Nextcloud file picker, the "Select folder" footer showed where it means nothing. It used the hidden binding, which any author rule carrying a display beats, and is now bound on visible. The button is also relabelled to the already-translated save string. Reported by @lvarnava (#117)

Added

• The Back button now closes an open message, and a message has its own link. The route has always understood #/mailbox/<folder>/m<uid>, so a pasted link worked, but nothing ever wrote such a hash. Opening a message now pushes a history entry, arrow keys replace it rather than leaving one per message, and the preview pane filling itself at folder load writes nothing. Idea from @remmmi (#141)
• Back out of the last of the client's own history entries and you are asked before you leave, rather than simply landing wherever you were before
• The Nextcloud folder picker opens on the folder used last, with each level on the way down opened, so a nested folder is reached rather than only a top level one. Asked for by @lvarnava (#117)

Changed

• The date format setting now previews with a date whose parts cannot be confused for one another. Thanks to Antonios Vamporakis (#137)
• Translations updated for Polish and French, and plugin strings for Polish, French and Russian

A release worth taking promptly: 4.4.0 and 4.4.1 could make login impossible on a host without the sodium extension.

Fixed

• Upgrading to 4.4.0 could make login impossible on a host without the sodium extension, with Folders error: HTTP Token mismatch after every attempt. openssl_get_cipher_methods() lists ciphers the provider will not actually use, and on OpenSSL 3 that includes aes-256-cbc-hmac-sha1, which is the shipped default. Encryption fell back to xxtea, correctly, but the hardening added in 4.4.0 then refused xxtea whenever openssl_decrypt() merely existed, so the server rejected the tokens it had just minted and no session could be established. The cipher is now tried rather than looked up, a working one is used when the configured one is not, and the refusal asks whether openssl can really be used. Affected installs are signed out once and move to proper encryption. Reported by @realsimix (#121)
• Save in Nextcloud selected a folder, turned its spinner and wrote nothing. The plugin called \OCP\Files::getStorage(), which Nextcloud deprecated in 14 and has since removed, so the call threw and the save failed silently. The same call was in the "Save as .eml" path. Reported by @BlackIkeEagle (#116)
• The Nextcloud file picker put a select button on every folder row and floated its checkboxes out of line. Folders now carry a radio confirmed from the footer, file names are clickable labels, and the rows line up. Reported by @lvarnava (#117)
• A plugin updated to a build-numbered version kept reporting the version before it and offered the same update for ever. The release-time bump wrote the new version into packages.json but packaged an index.php still declaring the old one, and the admin panel reads the installed version from that constant. Reported by @ivnmad (#119)
• Several callers passed HTTP headers as an associative array, which reached curl as bare values and were sent malformed and dropped: the integrity check, the breach lookup, which therefore travelled without its API key, and the CardDAV upload path, which answered 403 supported-address-data. Thanks to @FathiBenNasr (#124)
• Only the first data-* attribute was stripped from a composed message, because removing an attribute while iterating a live DOMNamedNodeMap ends the iteration. The rest went out in sent mail and saved drafts. Thanks to @FathiBenNasr (#126)
• An empty contact list on either side of a CardDAV sync deleted everything on the other. An empty list is more often a fault than an intent, so deletions in that direction are now skipped and logged. Thanks to @FathiBenNasr (#125)
• The ics-viewer panel never appeared on invitations from Evolution or Exchange, which put the calendar part inline and repeat it as application/ics rather than attaching text/calendar. Thanks to @FathiBenNasr (#127)

Security

• The two-factor-auth plugin keeps its TOTP secret sealed rather than in clear, and backup codes only as hashes. A code from an already-accepted 30 second step is refused, and five failures in fifteen minutes lock that account's second factor for fifteen. Existing enrolments and printed backup codes carry over untouched. Thanks to @FathiBenNasr (#128)
• The avatars plugin answered without a session and fetched a URL chosen by whoever asked, with the SSRF gate switched off, then cached the result under any address. Only instances with bimi or favicon enabled were affected; both default to off

Changed

• The Debian package gains a signed tachyon_<version>-1_all.changes file for importing into reprepro or aptly, declares php-xml, without which a clean Debian 13 install fails the integrity check, and requires PHP 8.2 or later. php-openssl, php-exif and php-sodium are dropped, none of them being real packages on Debian. Thanks to @dionysius (#129)
• The two-factor secret is now tied to APP_SALT. Lose or regenerate SALT.php, by restoring a backup without it for instance, and every user loses their second factor with no way back but an administrator clearing their record. Before this the secret was stored in clear and survived such a change. Back up SALT.php with the data directory

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published

Added

• OAuth2 for additional accounts, not only the one you log in with. A Gmail, Office 365 or generic OAuth2 account can be added from Settings, Accounts without an app password, and so without turning on 2-step verification to obtain one (#90)
• The generic OAuth2 plugin is now genuinely generic. Its endpoints, scopes, userinfo URL and the domains it answers for are configuration, so it serves any provider that does RFC 7628 and can say which address was authorized
• Swipe sideways on a phone to reach the next or previous message. The list is hidden while a message is open, so reading a run of mail otherwise meant closing each one and finding your place again. The message follows your finger, and a chevron appears once the gesture has gone far enough to act on (#102)
• Delivery receipts carry an envelope id, so a notification arriving days later can be tied to the message that caused it (#96)

Fixed

• Encrypting a message without also signing it broke both send and save, with TypeError: e.findIndex is not a function and nothing sent or saved. Choosing the crypto method in 4.2.4 started treating a value as a list that collapses to false when the feature is off, and for a draft regardless. Inherited from SnappyMail, where nothing ever did more than read its length (#103)
• S/MIME messages would not decrypt on Exchange. The MIME headers openssl needs were read from BODY[<part>.MIME], which Exchange answers with NIL, correctly: the message is not multipart, so there is no part-level header and the Content-Type is the message's own. The body reached openssl as a bare base64 blob with nothing reporting why. Diagnosed from an IMAP trace supplied by @reaisinc (#92)
• View original, Download original and attachment downloads failed in the installed app. Running as a PWA, a link opened in a tab lands in the browser, a separate context, so the request goes out cross-site and without the session cookie that identifies the account. The content is now fetched inside the app and handed over as a blob; an ordinary browser tab still streams from the server as before (#81)
• Delivery receipts asked for success and failure but never delay. Many servers decline success notifications as backscatter protection while honouring delay, so a queued or retried message reported nothing at all (#96)
• Requesting a delivery receipt did nothing on a domain set to use php mail(), which cannot pass the SMTP parameters one needs. The request was discarded in silence. The admin panel now says what the setting costs, beside the setting (#96)
• The Office 365 add-account flow could not work on a default install. Its signed state carried a CSRF token compared against the session's, and that value comes from a cookie the cross-site redirect withholds, so a fresh one was minted and the comparison could never match. This guarded its plain login too (#90)
• The Gmail plugin's token refresh wrote the new expiry to an undefined variable, so every IMAP, SMTP and Sieve connection refreshed the token again for the life of the session

Changed

• Release tarballs carry real timestamps. PharData gave every entry an mtime of 1970, so an install deployed from the tarball served Last-Modified: Thu, 01 Jan 1970 for every asset, leaving browsers nothing to revalidate against and letting a bad cached copy outlive a reinstall. The zip was never affected
• Russian and Chinese are more complete, thanks to @lvarnava and @dreamawake

Added

• Delivery receipts carry an envelope id, so a notification that turns up days later can be matched to the message that caused it (#96)

Fixed

• Requesting a delivery receipt did nothing whatsoever on a domain set to use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so the request was discarded in silence, with the tick box in the compose window doing precisely nothing. The admin panel now says what the setting costs beside the setting itself, and both places a request used to be dropped without a word are logged. Found by @lvarnava, who noticed the one domain it worked on was the one with the box unticked (#96)
• Delivery receipts asked for success and failure but never delay. Plenty of servers decline to send success notifications as backscatter protection while still honouring delay, so a message that was queued or retried reported nothing at all to the sender (#96)
• Placeholder text was invisible on Xv, Linen and Squares. The rule meant to colour it was written with one colon rather than two, so it matched nothing and had never applied on any theme. Those three are also the only ones pairing a light wallpaper with a translucent black login box, which composited to mid grey; their own labels sat at 3.86:1, below the readable threshold, which nobody had reported (#94)
• The messages per page limit now caps the default, rather than the larger of the two setting the ceiling. A default above the limit was handing every new user a number their own settings screen would refuse the moment they opened it (#73)
• PDF attachments lost their preview link and the eye badge added in 4.0.5. The check read navigator.mimeTypes, a deprecated API that browsers now populate only while the built-in PDF viewer is enabled, so it came back empty on anything current. It asks navigator.pdfViewerEnabled instead

Changed

• The README credits Weblate and charts progress per language, as the Libre plan asks
• CONTRIBUTING opens with translating, the one kind of contribution that needs none of the toolchain, and its release switches, gulp advice and debug config keys match the code again
• SECURITY.md listed 3.x as the supported line and asked for encrypted email without giving either an address or a key, so there was no way to report a vulnerability privately. Private reporting is enabled on the repository and the policy points at it
• Seven dead files left over from SnappyMail and RainLoop are gone from the repository root, along with a roadmap that finished months ago
• Release assets upload with gh, and packages.json is no longer re-committed when only the signatures moved
• Russian and Danish are substantially more complete, thanks to @lvarnava and @BrainDeLook

Added

• A Calendar button on the folder panel, beside the Contacts one that was already there (#75)
• Messages per page is now two admin settings rather than one: a default, and a separate limit on what a user may choose. Both are on the General tab instead of only in the config file (#73)

Fixed

• A long webmail title broke two-factor enrolment outright. The title is the QR code's issuer and appears in it twice, and percent-encoding turns one Cyrillic character into six bytes, so a 60 character title came to 744 bytes against the 213 a QR code of that size holds. The title is shortened now rather than the code failing, and the failure it used to produce named neither the real input nor the real limit (#80)
• The settings input capped messages per page at 50 while the save clamped at 100 and the admin could configure anything, so a site set higher could not be matched from the settings screen (#73)
• A still-enabled SnappyMail could leave the Nextcloud session holding a user id but no passphrase, so auto-login found nothing to send and presented an empty password field with nothing to explain it (#72)
• The General and Config admin tabs edit the same keys, and General never re-read them, so a value changed on Config still showed the old number and saving put it back
• Search filters were not applied on a fresh login, because the settings lookup needed a session that imap.after-login runs before. Thanks to @wojt-janowski
• Weblate's safe-html autofix had escaped & to & inside translated strings. Those render as text, not HTML, so eight languages were displaying the entity. A CI check now fails on it rather than leaving it to review

Changed

• Russian is substantially more complete, thanks to @lvarnava and @BrainDeLook

Fixed

• The SnappyMail logo was still shipping in nine places, including desktop notifications, the admin About tab and both the Nextcloud and ownCloud integrations. Its Braille dots read SNAPPY (#51)
• Search filters were shared by every account on the install, so a rule filing mail into a folder that exists in one mailbox ran against all of them. Because the rules run during login, the resulting failure was reported as a failed login. Filters are now per address, and an existing list stays with the account that created it
• Deleting a search filter appeared to do nothing while actually deleting it
• Search filters moved messages out of INBOX even when they were found elsewhere
• Editing an account at an internationalised domain failed with "Unknown error". The account list is sent to the client in unicode while accounts are stored under the ASCII form, and the address was not converted back on the way in, so the lookup found nothing
• A sender with no avatar answered 404, which logged a console error for most of a normal message list, and was the one response carrying no cache headers, so every render asked again and redid the lookups behind it

Added

• Add an invitation to a calendar from the message it arrived in. Handles files holding several events, and recurring series with moved occurrences
• Import a whole .ics file into a calendar
• A date picker in place of the native one, which rendered in the browser's locale and ignored everything Tachyon asked of it, plus a date format setting that follows the interface language by default
• Week numbers and first day of the week are user settings
• Release artifacts are signed, and the public key ships alongside them

Changed

• Seven designs that shipped as a light theme and a dark theme are now one theme each, switched with the light/dark toggle: Stripes, Love, Snow, Blurred, Squares, Wood, and Shine (formerly DarkShine and NightShine). A saved theme migrates on its own, and an account on a dark build lands on the merged theme already in dark mode
• Default, Linen, A, Xv and Clear gained a dark mode; Magnetic gained a light one. All 16 themes now answer the toggle

Fixed

• The admin panel's update button downloaded the cPanel package rather than the webmail one, so updating always failed
• Image whitelist entries were being overwritten by whichever session wrote last, rather than expiring as it appeared
• The Contacts menu opened partly off screen on phones (#50)
• The calendar grid was dark grey on light themes and white on some dark ones
• The event editor honours a 24-hour clock, keeps its fields inside the dialog, and moving the start past the end carries the end with it
• Nextcloud translation catalogues registered under the old app id, so none of them loaded
• fail2ban filters, AUR package metadata and release signing still described SnappyMail

The last three of the back-button regressions, two of which only show on a large mailbox or on a phone. Plus the end of the admin password error on Docker upgrades, calendars that could never be removed, and a way to log logins on their own.

Worth taking if your inbox holds more than 10,000 messages, because no conversation could be opened in one at all.

Fixed

• No thread could be opened in a folder holding more than message_list_limit messages, 10,000 by default, which showed as the full folder under a "Back to message list" button. That branch answers with the most recent slice rather than working out the whole uid list, and says in its own comment that it does not use THREAD; a request naming one thread fell into it and got the unthreaded folder back, with the thread uid still echoed in the response. It could not escape either, because the one thing that lifts the limit is a cached uid lookup that is itself skipped whenever a thread is named. A mailbox growing past 10,000 messages was enough to turn this on, which is why it had worked for years and why the IMAP server was never at fault. Reported by @floppybl (#156)
• The whole folder sat on screen, with no spinner, while a thread loaded. The test that drops the messages on screen when they no longer answer the request compares the folder, the search and the offset. Entering a conversation changes none of those from page 1, so nothing was dropped and the old list stayed there until the thread arrived. On a large mailbox that is indistinguishable from the thread never loading. From page 2 or later it did clear, because the offset moved, which is what made it look intermittent (#156)
• Moving to the next message across a page boundary flashed the next page's list, on mobile, where the list and the message are separate views rather than side by side. Crossing a boundary calls gotoPage(), which writes an address with no message in it, and the back-button work in 4.4.3 taught the route to read that as "close the message". The route now leaves the open message alone for the one dispatch where a selection is already pending. Reported by @lvarnava (#157)
• A Docker upgrade reported an admin password failure on every restart, on an installation where nothing was wrong and nothing needed doing. The entrypoint treated a missing admin_password.txt as a failure without asking whether a password was already configured, and on an existing installation that file is legitimately absent: it is written once, on the first run, and an administrator who read it and deleted it, which is the sensible thing to do with a password in clear, ends up in the same position as one who set their own. Three cases now, and only the last of them can fail. Reported by @jon4156 (#158)
• A CalDAV calendar could not be removed once it had been seen. The code that stores a discovered calendar only ever inserted or updated it, and nothing anywhere deleted one, so moving the URL from a single public collection to the DAV root left the old collection sitting next to the new ones for ever. A sync now reconciles what is stored against what discovery returned. A calendar missing from the listing is hidden at once, and its events are removed only after a second sync confirms it, because a PROPFIND answers per collection and one the server refuses while answering for the others is indistinguishable from one the user deleted. Clearing the URL, or setting sync to No, removes them all on save. Reported by @Quiwy (#164)

Changed

• A login can now be logged without logging every request. A successful login wrote nothing to the main log at all, so it could only be seen at level 6, among the per-request traffic; it is a notice now, at level 5. A failed login went only to the fail2ban file and to LOG_AUTHPRIV, both off by default, so the ordinary log could not tell a failure from no attempt at all; it is a warning, which is visible at the default level of 4. Both carry the ip and the login through the same substitutions the fail2ban format already uses, so nothing new is exposed and no password goes near them. Worth knowing before upgrading: an installation with logging enabled therefore starts recording the client ip and the login for failed attempts. Asked for by @dionysius (#163)
• The syslog driver sent everything at LOG_INFO. It pinned its own level in the constructor, so an error and a debug line arrived at the same priority and filtering by priority did nothing at all. Driver::Write had the severity the whole time and dropped it before handing the message over; the driver signature now carries it through to syslog(). Found in #163
• Translations updated for French and Polish

Five releases in two days, and three of them to clean up after one change of mine. Sorry. Writing the open message into the address bar, added in 4.4.3 so that Back works and a message can be linked, reset a different piece of the mailbox on every click, and each one surfaced as its own bug. Everything the address bar carries is now read and applied in one place, and the rest of the links that write it have been gone through rather than waited on.

If you are on 4.4.3, 4.4.4 or 4.4.5, take this one.

Fixed

• Opening a message from page 2 or later jumped back to page 1, after which the previous and next arrows walked a list that no longer held the open message and appeared to do nothing. A message link has nowhere to record the page, so the route reported page one for every one of them and the list was reloaded at the top. Reported by @lvarnava (#157)
• Opening a message from a search threw the search away and reloaded the whole folder behind it. The link dropped the search, which the route has always been able to carry after the uid. Found while fixing #157, not reported
• Clicking the conversation count showed the whole list, and Back to list stayed in the thread. The test that stops every message click refetching the list compared the folder, page and search, and the thread uid is none of those: it travels inside the folder part, so entering or leaving a thread changed nothing it looked at and the reload was skipped in both directions. Reported by @floppybl (#156)
• Reloading the browser while reading a message inside a thread came back with the whole folder behind it. The thread uid was applied only when the address bar held no message. Found by going through the remaining links rather than from a report

Take this one if you run 4.4.3 or 4.4.4 and any of your folders has a space, an accent or a nested path: opening a message showed nothing at all.

Fixed

• A message opened to an empty body, in any folder whose name is not plain ASCII. The fix for #153 in 4.4.4 put the correct folder hash into the address bar, and then the route handler took that hash for a folder name: it compared it against the open message's full name, which never matches, built a replacement message naming a folder that does not exist, and the request for it was dropped without a word. So the body loaded and was immediately replaced by nothing. Both the comparison and the new message now use the folder's full name, which the route handler has already resolved. Diagnosed, down to the line, by @remmmi (#155)
• Installing the Debian package over an older tachyon package stopped on a file conflict. The rename in 4.4.3 left tachyon-webmail owning the same paths without declaring that it replaces them, so apt install ./tachyon-webmail_*.deb aborted unless the old package was removed first, which broke unattended installs. A versioned Replaces hands the files over. There is deliberately no Breaks: Debian's unrelated tachyon ray tracer also satisfies << 4.4.3~, and apt would have offered to remove it. Diagnosed and tested, including against python-apt, by @ZaphodB (#154)
• Asking for a message in a folder that cannot be resolved now says so in the browser console, with [debug] javascript = On. It returned false in silence before, which is how the two bugs above stayed invisible while the message view simply sat empty

Changed

• Installing the Debian package now warns, once, while an older tachyon package is still installed. Replaces hands over the shared files but does not remove that package, and what stays behind is a complete older copy of the application under /usr/share/tachyon, missing the security fixes from 4.4.0 through 4.4.3. Run apt remove tachyon to clear it