Sandesh 0.3.0

Added

• g shortcuts for every page: g o Overview, g r Traces, g l Logs, g c API Console,
  g w Webhooks, g e Import/Export, g h Setup Guide, g b Workspaces & DB, g , Settings.

Changed

• The web console is restyled: a dark-first palette with a light theme, grouped navigation
  that collapses to an icon rail between 768px and 1280px, an Overview with a copyable SMTP
  snippet and stat tiles, sender avatars in the message list, and an inspector with a single
  action toolbar.

Fixed

• A concurrent IMAP MOVE or COPY racing an expunge could leave a message in two mailboxes.
• A webhook endpoint that sent its headers but never finished its body stalled every delivery.
• An event-stream resume with an out-of-range sequence number could crash the server.
• Switching workspace during a request could file an account under the wrong workspace.
• With the message list focused, Ctrl/⌘+K also jumped to another message.
• The search icon overlapped its placeholder text, and moving several messages at once
  opened an unstyled popover.

Install

• Container: docker run -d -p 1025:1025 -p 1080:1080 -p 1143:1143 -p 1110:1110 -v sandesh-data:/data ghcr.io/heliconiaio/sandesh:0.3.0
• Binaries and packages: below. Verify with sha256sum -c SHA256SUMS --ignore-missing
  and gh attestation verify <file> -R HeliconiaIO/Sandesh.

What's Changed

• feat(web): Devtools Precision redesign and a glass project website by @hspl-hanak in #6
• feat(web): modern dev-tool restyle of the shell, mailbox and inspector by @hspl-nishe in #7
• fix: storage and workspace races, webhook stall, replay overflow; add page shortcuts by @hspl-hanak in #8
• release: v0.3.0 by @BhaveshHeliconia in #9

New Contributors

• @hspl-nishe made their first contribution in #7

Full Changelog: v0.2.0...v0.3.0

Sandesh 0.2.0

Added

• Releases now include a signed SLSA provenance file (sandesh-<version>.intoto.jsonl)
  next to the binaries, verifiable without GitHub's attestation API.
• SANDESH_MAX_MESSAGE_SIZE sets the largest message SMTP accepts and IMAP APPEND
  takes. It was fixed at 25 MiB with no way to raise it.

Changed

• The message list shows the From: header as the sender, display name included.
  It showed the SMTP envelope sender, usually a bounce address with no name. The
  envelope is still available from GET /messages/{id}/delivery.
• A non-ASCII address in MAIL FROM or RCPT TO is refused with 553 5.6.7,
  saying SMTPUTF8 is not supported, instead of 500 Unrecognised command.
• Minimum supported Rust is now 1.98 (was 1.94), required by mail-parser 1.0.

Fixed

• POP3 CAPA announced IMPLEMENTATION Sandesh 0.1.0 whatever the version, and the
  desktop app's version was set separately from the rest. Both now come from Cargo.toml.
• Some malformed nested multipart messages (for example a multipart/digest or
  multipart/report with broken inner parts) were stored as unparsed, with no MIME
  tree. Upgrading mail-parser from 0.11 to 1.0 lets them parse.
• The search index no longer indexes attachments' binary content. PDFs, images
  and archives were indexed as text, making the index about four times the size of
  the mail it covered (4.1 GB of a 5.2 GB database at 100,000 messages; 432 MB
  after this fix). On first start after upgrading, the index is rebuilt in the
  background (about 100 s for 100,000 messages); search is correct but slower until
  it finishes. The database file does not shrink, but the freed space is reused.
• The message list reads one page, not the whole mailbox. Each page loaded and
  sorted every message, taking 2.6 s and about 170 MB at 100,000 messages; it now
  takes about 100 ms.
• Paging through GET /search returned the first page again as the second.
• A display name containing a comma, such as "Doe, Jane" <jane@example.test>, was
  split into two recipients, one of them a bogus Doe.
• A received HTML email containing </ followed by a non-ASCII character made
  GET /messages/{id}/links fail.

Install

• Container: docker run -d -p 1025:1025 -p 1080:1080 -p 1143:1143 -p 1110:1110 -v sandesh-data:/data ghcr.io/heliconiaio/sandesh:0.2.0
• Binaries and packages: below. Verify with sha256sum -c SHA256SUMS --ignore-missing
  and gh attestation verify <file> -R HeliconiaIO/Sandesh.

What's Changed

• deps: upgrade mail-parser to 1.0, fixing nested-multipart panics by @hspl-hanak in #1
• chore: refresh stale lockfiles, watch them nightly, attach release provenance by @hspl-hanak in #2
• chore: record accepted advisories for osv-scanner, check the glibc target by @hspl-hanak in #3
• fix: hardening from fuzzing, real-client and 100k-message load testing by @hspl-hanak in #4
• release: v0.2.0 by @BhaveshHeliconia in #5

New Contributors

• @hspl-hanak made their first contribution in #1
• @BhaveshHeliconia made their first contribution in #5

Full Changelog: v0.1.0...v0.2.0

Sandesh 0.1.0

The first public release.

Added

• SMTP server that captures the mail your application sends. It never relays mail onward.
  Supports STARTTLS, AUTH, BDAT/CHUNKING and configurable fault injection.
• IMAP4rev2 server (RFC 9051) with folders, flags, UIDs, SEARCH, FETCH and IDLE. Tested
  against real clients, including a full mbsync sync.
• POP3 server (RFC 1939, 2449, 2595, 5034).
• One shared mail store for all three protocols, on SQLite. The original message bytes are
  kept exactly as received.
• REST API and WebSocket events under /api/v1, described by an OpenAPI contract.
• Web console with a message inspector (headers, MIME tree, HTML and text bodies,
  attachments, raw source), full-text search, a composer and reply, multiple workspaces, and an
  API console that can call every documented endpoint.
• Diagnostics: protocol transcripts, a delivery record for every transaction, a Received:
  hop timeline, DKIM/SPF/DMARC header parsing (displayed, not verified), Prometheus /metrics
  and a live log stream.
• Mail-testing tools: fault injection, signed webhooks (HMAC-SHA256), message rules, replay
  with bulk import and export, and link and image extraction.
• Optional authentication and TLS: an API token, account credentials hashed with Argon2id,
  and STARTTLS or implicit TLS.
• Distribution: static binaries for Linux (x86_64, arm64), macOS (Intel, Apple Silicon) and
  Windows; a FROM scratch container image; .deb and .rpm packages; a Tauri desktop app for
  Linux.
• Open-source project files: Apache-2.0 LICENSE and NOTICE, third-party licence texts in
  every artifact, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md and CREDITS.md.

Security

• Every listener binds to loopback by default.
• unsafe code is forbidden. The MIME, SMTP, IMAP, POP3 and search parsers are fuzzed nightly.
• A malformed multipart/report message no longer crashes the server. Fuzzing found a panic in
  the mail-parser dependency; Sandesh now stores such a message as unparseable instead.
• Dependencies are checked against RustSec and npm advisories and a licence allowlist in CI.

Install

• Container: docker run -d -p 1025:1025 -p 1080:1080 -p 1143:1143 -p 1110:1110 -v sandesh-data:/data ghcr.io/heliconiaio/sandesh:0.1.0
• Binaries and packages: below. Verify with sha256sum -c SHA256SUMS --ignore-missing
  and gh attestation verify <file> -R HeliconiaIO/Sandesh.

Full Changelog: https://github.com/HeliconiaIO/Sandesh/commits/v0.1.0