JMAPJolt-v0.22

Security & privacy

• New HTML sanitizer — The email sanitizer is now a jsoup parser-based allowlist instead of a regex chain: markup is parsed and rebuilt from permitted elements and attributes, so a malformed tag can no longer smuggle a handler past a pattern
• Blocked remote content stays blocked — With image loading off, the WebView now refuses every sub-resource request, not just images: CSS, fonts and media can no longer phone home and act as read receipts
• Favicons never touch the sender — Sender icons are fetched only through the DuckDuckGo proxy. The parallel direct request to https://<sender-domain>/favicon.ico is gone: it handed the sender your IP address and confirmed the address was live the moment a message appeared in the list
• Unauthenticated push is never rendered — A push payload that fails WebPush decryption no longer produces a notification; the app syncs and shows what the server actually confirms
• Release logs carry nothing sensitive — Debug, verbose and info logging is stripped from release builds, and the warnings and errors that do ship log only a host or a masked domain, never a push endpoint, session URL or full account address
• Attachment cache expires — Files staged for sharing or opening in another app are cleaned up instead of sitting in the cache directory indefinitely
• Server URL handling — A bare or non-HTTP scheme entered at login is rejected instead of being coerced into a request; credentials still travel only to same-origin HTTPS

Mail list & reading

• Cleaner previews — Body previews strip stylesheets and layout junk, so a message that opens with a <style> block no longer previews as CSS
• Full-bleed favicons — Sender icons fill the whole avatar circle instead of floating inside a padded ring, and decode at a resolution that stays sharp
• Configurable mark-as-read delay — Instant through 60 seconds, or a custom value
• Undo — Archive, spam and trash can be undone, from both the swipe and the detail view
• Accurate new-mail notifications — Only genuinely new mail notifies; a message moved back into the inbox no longer announces itself as new

Compose & drafts

• Drafts survive a background sync — Body, recipients, Cc, Bcc and attachments are preserved across a sync and a re-edit
• Draft identity — A locally created draft reconciles with its server id after saving, so reopening it loads the real body and attachments

Sync & push

• Foreground-service timeout — When the dataSync foreground budget runs out, the SSE service stops cleanly and falls back to the periodic worker instead of being killed
• No duplicate polling — The periodic worker is cancelled once SSE connects, and re-enabled after repeated SSE failures

Folders & selection

• Folder rename — Renames now propagate correctly over JMAP
• Bulk spam toggle — Mark or unmark spam for a whole selection
• Smarter swipes — Archive and spam swipes are disabled on an email already in that folder

Accessibility & UI

• Screen reader support — Every icon carries a label
• Touch targets — Interactive elements meet the 48dp minimum
• Reduced motion — Animations respect the system setting
• Type scale — Text sizes moved into dimens, so the app scales consistently
• Contextual empty states — Each folder explains its own emptiness
• Haptics — A tick on a committed swipe and on entering or leaving selection mode
• Theme tokens everywhere — Colors come from one semantic token set; hardcoded hex is gone from the layouts, the email detail WebView and the in-code dialogs, so all four themes (Legacy, Snow, OLED, Iris) stay consistent
• Swipe surfaces — Grey no longer leaks through behind the detail and row swipe backgrounds

Performance

• Faster infinite scroll — The mail list asks the server for the next page by position and appends it, instead of re-querying the folder from zero with a bigger limit. Reaching page five used to re-download the four pages already on screen
• Lighter list queries — List rows no longer pull message bodies; the body is fetched when an email is opened
• Cheaper cache writes — Starring or archiving one message used to rewrite every cached folder, full bodies included. Only the folders that actually changed are written now, and a burst of swipes is coalesced into a single write
• Faster cold start — The one-off WebView cache purge no longer starts Chromium on every launch, encrypted preferences warm up off the main thread, and the encrypted cache database is built off the main thread
• Smoother list updates — When the contact photo index lands, only the visible rows are repainted instead of the entire list

Under the hood

• One HTTP stack — Mail, SSE, calendars, contacts and favicons share a single OkHttp client with explicit timeouts and one connection pool, replacing four separate clients and two raw HttpURLConnection call sites
• Unit tests — 78 JVM tests now cover the HTML sanitizer, WebPush decryption, server URL trust and normalization, quote collapsing, preview cleanup and domain parsing
• Smaller source files — The largest files were split along feature lines, with no behavior change