Skip to content

v1.13.4

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Aug 01:38
· 2 commits to main since this release
v1.13.4
457f7d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.13.4 — Regional JMAP endpoint support

Fixes connection failures for accounts whose Fastmail session discovery returns region-pinned endpoints (e.g. phl.api.fastmail.com for the API/upload host and phl-www.fastmailusercontent.com for downloads). The bearer-token host allowlist previously accepted only the two bare hostnames, so any account served from a regional endpoint was rejected before it could connect.

What changed

  • The allowlist now matches host shapes rather than a fixed pair of names: api.fastmail.com and www.fastmailusercontent.com, each with an optional single regional label (dotted on the API host, hyphenated on the user-content host). Thanks to @JonathanGodley (#106).
  • The patterns are anchored end-to-end and the region label excludes ., so exactly one label may precede the fixed suffix — spoofs like evil.phl.api.fastmail.com or phl.api.fastmail.com.attacker.com still reject. HTTPS remains mandatory, and FASTMAIL_ALLOW_UNSAFE_BASE_URL=true is still the only way to widen the host check (for self-hosted JMAP).

No configuration change is needed — regional endpoints are accepted automatically. Self-hosted setups are unaffected.

This is an unofficial community project, not affiliated with, endorsed by, or supported by Fastmail.

Full Changelog: v1.13.3...v1.13.4

Contributors

JonathanGodley
Assets 3
Loading