v0.24.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.24.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.24.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.24.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.24.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• feat(sync): make the delegated PIM rails actually fill (completes #68) by @Heiko-W in #75
• feat(web): show delegated and group calendars and address books in their rails by @sequico in #68
• chore(release): v0.24.0 by @Heiko-W in #76

New Contributors

• @sequico made their first contribution in #68

Full Changelog: v0.23.0...v0.24.0

v0.23.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.23.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.23.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.23.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.23.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• docs: Befundbericht aus dem Code-Review vom 01.09.2026 by @Heiko-W in #55
• fix(web,sync): Entwuerfe gehen verloren, bleiben als Leichen liegen oder wechseln das Konto by @Heiko-W in #56
• fix(web,sync): Termine wechseln die Zeitzone, Occurrences frieren ein, der Wartungspass loescht den offenen Monat by @Heiko-W in #57
• fix(web,jmap): Liste laedt nach einem Ordnerwechsel nichts mehr nach, Anhaenge scheitern lautlos by @Heiko-W in #58
• fix(sync,web): Outbox-Fehlerpfade treffen die falsche Zeile, Wiederholen tut nichts, ein zweiter Tab uebernimmt mitten im Senden by @Heiko-W in #59
• fix(web): OAuth-Rueckkehr verliert den Ort, zwei Tabs loeschen sich das Token, Escape meldet ab by @Heiko-W in #60
• fix(web): Namenskorrektur wirft Kontaktfelder weg, Vorschau zeigt die falsche Datei, Listen rechnen zu viel by @Heiko-W in #61
• fix(mail-html,jscontact,jmap): Regex friert den Tab ein, Sprungmarken oeffnen die App, Kontaktfelder gehen beim Import verloren by @Heiko-W in #62
• fix(web): Vollbild per Tastatur war nie erreichbar, Escape schliesst den falschen Layer, ein verdeckter Tab meldet doppelt by @Heiko-W in #63
• fix(web,jmap): Plus-Adressen werden rot, IME-Eingaben zu Empfaengern, ein Fehl-Chip sperrt das Senden by @Heiko-W in #64
• fix(docs,ci,e2e,mail-html): Tote Anmeldung in den Proxy-Rezepten, verschwundene Tests, nicht vergleichbare Release-Archive by @Heiko-W in #65
• fix(web,sync,jscontact,docs): Die Nebenbefunde aus der Abarbeitung, und der Abschlussvermerk zum Review by @Heiko-W in #66
• fix(web): the three open compose side findings (N-01 … N-03) by @Heiko-W in #69
• fix(web): the remaining side findings, and the R-27 decision (N-04 … N-10) by @Heiko-W in #70
• feat(web): opened offline, the app opens the mailbox (FR-OFF-01) by @Heiko-W in #71
• feat(web): "Select all 300" reaches the folder, not just the window (FR-LST-04) by @Heiko-W in #72
• fix(e2e): the focus sweep never started at the top, because body.focus() moves nothing by @Heiko-W in #74
• chore(release): v0.23.0 by @Heiko-W in #73

Full Changelog: v0.22.0...v0.23.0

v0.22.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.22.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.22.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.22.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.22.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• docs: die Produktivinstanz wird nicht mehr beim Namen genannt by @Heiko-W in #53
• Security- und Code-Review: alle 40 Befunde abgearbeitet (v0.22.0) by @Heiko-W in #54

Full Changelog: v0.21.0...v0.22.0

v0.21.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.21.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.21.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.21.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.21.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• feat(web): zwölf weitere Sprachen — und die Prüfung, die sie tragfähig macht by @Heiko-W in #51
• chore(release): v0.21.0 by @Heiko-W in #52

Full Changelog: v0.20.0...v0.21.0

v0.20.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.20.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.20.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.20.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.20.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• docs: die B-Liste gegen den heutigen Code nachgezogen by @Heiko-W in #45
• Die §13-Liste abgearbeitet: zehn Bxx gefixt, drei akzeptiert, einer bleibt offen by @Heiko-W in #46
• chore(release): v0.20.0 by @Heiko-W in #47
• fix(ci): WebKit braucht Systempakete, und der Fokus-Sweep braucht keinen Zählerstand by @Heiko-W in #48
• fix(e2e): der B25-Einfügetest wartet auf den Editor, statt ihn zu verpassen by @Heiko-W in #49

Full Changelog: v0.19.0...v0.20.0

v0.19.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.19.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.19.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.19.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.19.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• Apple HIG: 39 Befunde für Desktop, Tablet und Telefon — erhoben, gegengeprüft, abgearbeitet by @Heiko-W in #43
• chore(release): v0.19.0 by @Heiko-W in #44

Full Changelog: v0.18.0...v0.19.0

v0.18.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.18.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.18.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.18.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.18.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• feat(web): the folder rail reads as account groups — and B59's flake was two test defects by @Heiko-W in #41
• chore(release): v0.18.0 by @Heiko-W in #42

Full Changelog: v0.17.0...v0.18.0

v0.17.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.17.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.17.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.17.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.17.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• fix(sync): a folder shows the folder, not the last 30 days of it by @Heiko-W in #36
• fix: the E2E flakes, and the two product defects hiding behind them by @Heiko-W in #37
• fix: B56 (a grant that never reads back) and B55 (one method call per request) by @Heiko-W in #39
• chore(release): v0.17.0 by @Heiko-W in #40

Full Changelog: v0.16.0...v0.17.0

v0.16.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.16.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.16.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.16.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.16.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• v0.16.0 — was Safari gefunden hat, plus das Vorabladen by @Heiko-W in #35

Full Changelog: v0.15.0...v0.16.0

v0.15.0

Deploying

Three supported paths — see docs/deployment.md. The short
version: use waxwing-stalwart-v0.15.0.zip for a Stalwart
Application (recommended, same-origin, no CORS), and
waxwing-web-v0.15.0.tar.gz behind your own web server.

Verify what you downloaded before deploying it. The two checks answer different
questions and the second is the stronger one:

# Did the file survive the network and the hoster intact?
# (--ignore-missing: SHA256SUMS lists all three artefacts, you downloaded one.)
sha256sum -c SHA256SUMS --ignore-missing

# Was it built by this repository's release workflow, from THIS TAG?
# (SHA256SUMS cannot answer that: anyone who can replace the zip can regenerate it.
#  --source-ref is required: without it a build from any branch of this repository
#  passes too, and this workflow makes those deliberately as rehearsals.)
gh attestation verify waxwing-stalwart-v0.15.0.zip \
  --repo Heiko-W/waxwing \
  --source-ref refs/tags/v0.15.0

Configuration lives in config.json next to index.html and needs no rebuild —
docs/configuration.md is the reference.

What's Changed

• feat(web): redesign the logo as a constructed single-contour mark by @Heiko-W in #31
• fix(web): the 58 findings from the 2026-08-21 UI walkthrough by @Heiko-W in #32
• fix: die 67 Befunde der JMAP-Lückenanalyse by @Heiko-W in #34
• docs: JMAP-Lückenanalyse — was Stalwart anbietet und Waxwing noch nicht nutzt by @Heiko-W in #33

Full Changelog: v0.14.0...v0.15.0