Skip to content

Releases: Busnes-app/KyPost-Server

Release list

v0.4.3.1

v0.4.3.1 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 15:48
v0.4.3.1
ba79960
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Full Changelog: v0.4.3...v0.4.3.1

Contributors

Yoshiofthewire
Assets 2
Loading

v0.4.3

v0.4.3

Choose a tag to compare

View all tags
@Yoshiofthewire Yoshiofthewire released this 24 Oct 00:42
v0.4.3
006ec76
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • GET /api/pgp/bootstrap returns accountAddresses: the account's sending
    address, then its verified send-as aliases. Clients use it to leave the
    account's own addresses out of Reply All when the IMAP login is not an email
    address (#452). suggestedUserIDs is unchanged.

  • AI agent access over MCP at /mcp (Streamable HTTP, bearer token). Users
    create tokens under Security → AI agents (GET/POST /api/agent-tokens,
    PUT/DELETE /api/agent-tokens/{id}; create and widen need step-up) with
    Read only or Read and organize access. Tools search, list and read mail and
    threads, list folders and labels, apply and remove labels, move, archive and
    save drafts; nothing sends or deletes. Encrypted mail is metadata only. The
    agent skill is served at /agent/skills/kypost/SKILL.md. Tokens unused for
    90 days, and all tokens on a sealed-backup restore, are revoked. /mcp
    refuses any request with an Origin and sends no CORS headers; token
    changes need the session, its CSRF token and KyPost's own origin.

  • KYPOST_DISABLE_AI_SORTING=true turns off automatic labels instance-wide
    and keeps the bundled Ollama and its model pull from starting. Filter rules
    still run, and other new mail gets the fallback label.

  • Docker build arg INSTALL_OLLAMA=false builds the image without Ollama.

  • KyCalendar pairing (KYPOST_KYCALENDAR_URL, KYPOST_KYCALENDAR_SECRET_FILE,
    KYPOST_KYCALENDAR_ALLOW_PRIVATE; off by default). With a user's opt-in
    (Settings → Mail → KyCalendar), KyCalendar sends invitations, cancellations
    and replies from their own mailbox through the signed
    POST /api/calendar/itip/send, and receives the DKIM-aligned invitations
    that arrive there. New POST /api/calendar/rsvp answers an invitation
    through KyCalendar from the server-side copy; clients fall back to
    calendarReply when it answers kycalendar_off. Contract:
    docs/KYCALENDAR.md.

Fixed

  • Built with Go 1.27.3, which distrusts compromised intermediate certificates
    in crypto/x509 (GO-2026-6809). Outbound SMTP over TLS verified server
    certificates with the affected code.

  • Remove the pre-launch README’s obsolete Busnes-app owner-move upgrade section.

  • Correct the PGP documentation: server-protected key custody is retired, not
    a selectable mode. Describe the retained legacy migration path and distinguish
    it from client-sealed recovery and pickup copies. No key-handling code changes.
    SECURITY.md and CONTRIBUTING.md now say the same, and name the legacy
    master key by its real file, pgp-private-key.key.

  • Server → Backup no longer renders a blank page before the first local copy:
    the status API answered localCopies: null for an empty or missing
    KYPOST_BACKUP_DIR and now answers []; the page also tolerates null.

  • A failed Save Draft is shown as Draft not saved: … instead of
    Send failed: ….

  • Launch-video bugs:

    • The phone-layout mailbox nav no longer repeats folders. It hid rows by
      exact name only, so "Sent Items" and the Scheduled heading showed beside
      the quick nav. It now uses the server's special-use role and the usual
      alias names, and its Drafts/Junk/Sent/Trash links open the account's
      real folders.
    • A keyless account's forced first-login password change no longer warns
      that PGP recovery status is unavailable.
    • Security → Encryption asks for the account password in a masked page
      dialog instead of the browser's clear-text window.prompt.
    • The read and compose PGP unlock dialogs no longer share the input id
      pgp-unlock-password.
    • GET /api/imap/config and the admin per-user IMAP config no longer return
      the server's on-disk path and keyPath, and Mail settings no longer
      show them.
    • With automatic labels off, mail that already carries one of the account's
      labels keeps it instead of also getting the fallback label.
    • The classifier warm-up no longer pulls a model Ollama already has. The
      pull wrote into the models directory, so a pre-populated cache the
      container could not write failed every warm-up and stalled
      classification.

Changes

  • Dependabot updates now ship on their own: once a day, if any merged, a
    v0.4.3.N release and image are published and :stable follows it. The
    version lives in backend/internal/appversion/VERSION alone; release images
    report the full four-part version, source builds the three-part line.

  • Admin → Single Sign-On: the KySignOn Preset button no longer fills in a
    specific issuer address. It still enables SSO, sets the client ID to
    kypost and turns on auto-provisioning; enter your own KySignOn issuer URL.
    The issuer placeholder is now https://auth.example.com.

  • Docs: the README quick start pulls the published image instead of building
    from source, and names the Ollama memory cap (KYPOST_MEM_LIMIT, now in
    docs/CONFIGURATION.md). docs/Reverse_Proxy_Networking.md covers starting
    KyPost when KyIdentity or KyNotes already created kypost-net.
    docs/INSTALLER_SETUP.md points to secret file references and the directory
    webhook needed for offboarding.

What's Changed

  • chore(deps): bump pinned Ollama to 0.40.4 by @github-actions[bot] in #424
  • docs: lead the README with what KyPost is, move the TLS note out by @Yoshiofthewire in #427
  • docs: add a manual image verification procedure by @Yoshiofthewire in #426
  • chore(deps): bump pinned Ollama to 0.40.5 by @github-actions[bot] in #428
  • feat: add KYPOST_DISABLE_AI_SORTING and INSTALL_OLLAMA build arg by @Yoshiofthewire in #429
  • feat: KyCalendar invitation mail (send, inbound, RSVP) by @Yoshiofthewire in #430
  • fix: blank Backup page and draft-save error label; install docs from a test run by @Yoshiofthewire in #431
  • Polish KyPost interface while preserving controls and settings by @Yoshiofthewire in #432
  • docs: clarify standalone installation and test coverage by @Yoshiofthewire in #433
  • Make KyPost own shared suite network bootstrap by @Yoshiofthewire in #434
  • Shorten KyPost README and correct retired PGP documentation by @Yoshiofthewire in #435
  • feat(mcp): add AI agent access to mail over MCP by @Yoshiofthewire in #437
  • docs: stop offering retired server-protected PGP custody by @Yoshiofthewire in #438
  • Remove the founder's personal urlxl hostnames from SSO config and tests by @Yoshiofthewire in #439
  • Bootstrap: return accountAddresses for Reply All (#452) by @Yoshiofthewire in #453
  • Build with Go 1.27.3 (GO-2026-6809) by @Yoshiofthewire in #455
  • Fix KyPost-Server bugs found while filming the launch videos by @Yoshiofthewire in #454
  • chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 in /backend in the go group across 1 directory by @dependabot[bot] in #441
  • ci: read the rspamd image pin from docker-compose.rspamd.yml by @Yoshiofthewire in #457
  • Change relay URLs in .env.example by @Yoshiofthewire in #458
  • chore(deps): Bump the npm-build group across 1 directory with 3 updates by @dependabot[bot] in #442
  • fix(backend): log a serve error that arrives after shutdown by @Yoshiofthewire in #462
  • chore(ci): Bump github.com/golangci/golangci-lint/v2 from 2.14.0 to 2.15.0 in /tools in the tools group across 1 directory by @dependabot[bot] in #445
  • chore(deps): Bump the npm-runtime group across 1 directory with 2 updates by @dependabot[bot] in #443
  • chore(deps): Bump the npm-lint group across 1 directory with 2 updates by @dependabot[bot] in #447
  • chore(deps): Bump the relay group across 2 directories with 2 updates by @dependabot[bot] in #460
  • chore(ci): Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 in the actions group across 1 directory by @dependabot[bot] in #448
  • chore(deps): bump rspamd/rspamd from 4.2.0 to 4.2.2 by @Yoshiofthewire in #463
  • chore(deps): bump pinned Ollama to 0.40.7 by @github-actions[bot] in #436
  • Bump Node to 26.12.1 (CVE-2026-111497) by @Yoshiofthewire in #464
  • Release Dependabot changes daily as vX.Y.Z.N by @Yoshiofthewire in #465
  • deps(go-imap fork): x/net 0.61, x/text 0.43, x/sys 0.49 by @Yoshiofthewire in #466
  • release: v0.4.3 by @Yoshiofthewire in #467
  • docs(apns): name org.kysecurity.mail as the iOS bundle ID by @Yoshiofthewire in #468

Full Changelog: v0.4.2...v0.4.3

Contributors

Yoshiofthewire and dependabot
Loading

v0.4.2

v0.4.2

Choose a tag to compare

View all tags
@Yoshiofthewire Yoshiofthewire released this 16 Oct 16:59
v0.4.2
621b4d1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Read more

Contributors

Yoshiofthewire and dependabot
Loading

v0.3.0

v0.3.0

Choose a tag to compare

View all tags
@Yoshiofthewire Yoshiofthewire released this 25 Aug 16:12
v0.3.0
3c65a31
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first published release of KyPost-Server.

Everything before this was built from source. From this release on there is a
published image, an immutable version tag, and a documented upgrade path:

docker compose pull && docker compose up -d

or ./scripts/update-host.sh, which records the running image's digest, verifies
the new image's build attestation before switching, and restores the recorded
digest if the post-update health check fails.

The image is ghcr.io/busness-app/kypost-server:0.3.0, built and attested by
release-image.yml. :stable moves to it
only after that attestation has been published and verified.

Highlights

  • The pairing QR publishes a certificate pin. Pairing is the one call that
    carries the pairing token, the push endpoint and the WebPush keys together, and
    it previously sent all of it inside a trust-on-first-use window. Clients that
    do not understand the pin parameter are unaffected — it is optional and
    additive, and its absence means the same trust-on-first-use as before.
  • Servers self-register with the push relay. Set PUSH_RELAY_URL and the
    server mints its own per-server key on first start and persists it. No Firebase
    account, no Apple Developer account, and nothing to ask an operator for.
  • App Pull delivery bypasses the relay entirely, for anyone who would
    rather no notification metadata left their server.

See CHANGELOG.md for the full list, and
docs/PLATFORM_BASELINE.md for what a client must
implement to work against this server.

Upgrading

Schema changes are additive and applied on open, so starting 0.3.0 against an
existing state.db adds what it needs and changes nothing else. Rolling back the
container does not roll back the data — see the upgrade table in the changelog.

Loading