Skip to content

OpenMail v0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Aug 11:35
· 34 commits to main since this release
v0.3.0
f61abea

OpenMail v0.3.0

Image (Docker Hub)

docker pull ianshaw027/openmail:v0.3.0
docker pull ianshaw027/openmail:latest

Run

docker pull ianshaw027/openmail:v0.3.0
docker run -d --name openmail -p 8000:8000 \
  -e OPENMAIL_MASTER_KEY="$(openssl rand -base64 32)" \
  -v openmail-data:/data \
  ianshaw027/openmail:v0.3.0

Or with compose from this repo: docker compose pull && docker compose up -d

/api/health reports version: 0.3.0.

Changelog

Security

  • Device HMAC body binding (X-Device-Body-Sha256); mutating methods (POST/PUT/PATCH/DELETE) require body hash
  • Transfer routes require registered vault device; status limited to host/guest/claim-token; HTTP-level auth tests
  • Cloud account quota floored on live COUNT(accounts) + conditional UPDATE; IntegrityError reconcile
  • Poll quota durable in DB with per-device serialization (SQLite BEGIN IMMEDIATE when available)
  • Fetch lease token-owned DB lock with expiry, post-lease min-interval recheck, retry_after on contention
  • Client-sealed accounts reject accidental server-side credential unseal (require _om_unwrap_sealed or client_sealed)
  • HttpApi streamed response body limit (no full buffer before cap); IMAP BEFORE candidate budget
  • Unique (owner, email) migrate fail-closed with duplicate-key diagnostics

Added

  • Durable device_poll_events / poll quota state; cloud device_quota_state
  • Fetch lock lease_token; code-API cache TTL config
  • Docs: security & cache review (docs/18-security-and-cache-review.md)
  • Frontend: provider capability helpers, account UI meta utilities

Changed

  • Credential PATCH deep-merge (empty string clears a key; partial patch no longer wipes blob)
  • mailCache keys include IMAP UIDVALIDITY; upgrade path drops legacy same-folder keys
  • Transfer status no longer enumerable by arbitrary registered devices

Fixed

  • Concurrent cloud create / poll quota races under multi-worker
  • Permanent fetch in-flight after worker crash (lease expiry)
  • Transfer anonymous create / unauthenticated status
Assets 2
Loading