v1.16.0 - Simpler Settings, @Mention Chips & Marketplace Rollback

[rathlinus]

1.16.0 (2026-10-19)

1.16.0 regroups the settings into fewer pages with an Advanced switch for the power-user options, shows the message list as columns on request, turns @mentions into contact chips, and opens the company directory in contacts and the composer. The marketplace can install any version of an extension and roll back to a replaced one, admins get policies for the colour mode, archiving and the provider sign-out, and the Estonian locale arrives. A security audit of the whole app fixed cross-account actions on repeated message ids and about thirty smaller findings.

Thank you for your donations:

• You? Become a sponsor!

One-time

• @bultester
• Anonymous
• Anonymous
• Anonymous

Monthly

• @superspacehosting
• @naokton
• @yerTools
• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

• Mail: Delete, move and drag in merged views and cross-account search act on the clicked message. When two accounts had messages with the same id, the action could hit the other account's message, which also made sent mail vanish from the Sent folder ([Bug]: Sent messages sometimes disappear from the Sent folder #857, GHSA-8x23-qw3w-mhrx, thanks @FeliceBalsamo and @knittingcode)
• Mail: HTML attachments preview as sanitised text in a locked frame. The preview used to open the sender's HTML as a same-origin document that could run script in the webmail origin
• Mail: A crafted style attribute, read-receipt header, mail body or subject no longer freezes the reader or the message list
• Mail: Only an SPF or DKIM pass aligned with the From domain counts as sender verification, and oversized winmail.dat and embedded message parts stay attachments instead of being decoded on open
• Mail: Attachment names show without directional override characters, and imported and synced HTML templates are sanitised before the composer previews them
• Login: The login page asks before handing a sign-in to the mobile app, and only hands it to the app's own callback link
• Login: Failed sign-ins are capped per client at 5 in 15 minutes, and the client address is forwarded to the mail server as X-Forwarded-For so the server's own limits hit the client instead of the webmail. Add the webmail to Stalwart's server.proxy.trusted-networks for that to take effect
• Login: Synced settings are keyed on the account a token login resolves to, not on the claimed name, so two users can no longer share a settings blob
• Admin: OAuth client secrets and the session secret stay out of the admin audit log, the config API and dashboard writes
• Admin: OAuth discovery no longer follows a redirect to another host, the extension directory URL cannot point at a private address, a directory keyring older than the newest one seen is refused, marketplace versions are validated and a silent downgrade on update is refused, and the installer writes its env file readable by its owner only
• Plugins: Plugin POSTs stay off the plugin proxy, secrets, agenda, ical and translate routes, only a plugin known to the server can connect and use credentials, plugin-authored HTML drops remote images, and a plugin frame that navigated to another document gets no more host messages
• Server: TLS responses carry HSTS and the X-Powered-By header is gone. Upstream mail server requests get a deadline, CalDAV discovery probes and concurrent favicon fetches are bounded, and calendar feeds, synced settings blobs and the settings route have size caps

Features

• Settings: The settings are regrouped into Account, Security, Notifications, General and Appearance, the mail pages Message list, Reading, Composing, Folders & tags, Filters and Out of office, then Calendar, Contacts, Files and Add-ons with the plugin pages under it, and Backup & reset. Every page has a jump row to its sections, settings links can name a section, and old settings links keep working
• Settings: An Advanced switch hides power-user settings until turned on. Search results and section links that point at a hidden setting turn it on
• Settings: Themes show as one row with a Show all button, and the settings search box looks like the mail search box
• UI: The message list can show as columns with one-line conversation rows ([Feature]: Add “Reading Pane at Bottom” layout option (Zimbra‑style) #262, thanks @fdisamuel)
• Composer: Typing @ offers contacts and adds the picked one as a recipient. Mentions become chips with a contact card on hover, in the composer and in received mail
• Contacts: The company directory can be browsed in contacts and the composer ([Feature]: Browsable Company Directory and recipient picker using existing JMAP Principals support #1253, thanks @diegonix)
• Mail: "Remove from this folder" takes a message out of just the open folder when it is in several ([Feature]: "Remove from this folder" action for emails in multiple folders #615, thanks @arnauda-gh)
• Mail: n jumps to the next unread message ([Feature]: Jump to next unread mail #514, thanks @muelli)
• Mail: Shift+arrow keys extend the selection ([Feature]: Selecting emails by shift+arrow key #992, thanks @IntExCZ), and while selecting, a click anywhere on a row ticks it ([Feature]: in select mode, make the entire line a selection box #1014, thanks @mmomjian)
• Mail: Search results from all folders show the folder ([Feature]: Show the folder in Search mode (like in Unified all mails view) #1172, thanks @PoltoS)
• Mail: Your own folders are listed in a separate section of the sidebar ([Feature]: Add a dedicated “Your Folders” section in the sidebar #1205, thanks @roedy-dev)
• Mail: The counter can be set per folder, e.g. keep the Drafts count with totals off ([Feature]: Allow granular folder counter configuration (e.g., keep Drafts counter visible while hiding others) #982, thanks @mbjboon-netizen)
• Mail: The account dot in the unified view can be hidden ([Feature]: disable green dot next to email #912, thanks @mmomjian)
• Mail: Sender icons are refreshed when they changed on the sender's website ([Feature]: Ability to reset favicon (avatar) #960, thanks @IntExCZ)
• Composer: Message priority can be set in the composer ([Feature]: set message priority / importance in the composer #970, thanks @douwezijlstra-frl)
• Composer: Templates get numeric date, day, month and year placeholders ([Feature]: Seperate placeholders for day, month and year #1284, thanks @Yahatix)
• Accounts: When the admin turns on "Account List Backup: Passwords", saving the account list offers to include the passwords of accounts signed in with a plain password, encrypted in the browser. Restoring signs those accounts in in the background (feat: optionally keep mailbox passwords in the account list backup #1247, thanks @lucamzanon)
• Admin: The theme policy can set and lock the colour mode ([Feature]: Lock or default the light/dark/system mode via policy #1280, thanks @chodid)
• Admin: A configured logout URL ends the provider session for providers whose discovery has no end_session_endpoint ([Feature]: Configurable end-session URL for providers whose discovery has no end_session_endpoint #1279, thanks @chodid)
• Admin: A policy gate turns archiving off ([Feature]: Admin policy gate to turn off archiving #1257, feat: admin policy gate to turn off archiving #1257 #1258, thanks @HOLOEYE-JZ)
• Admin: The admin panel asks before leaving with unsaved changes ([Feature]: Notify user of unsaved changes in admin panel before they navigate away #1255, thanks @passibe15)
• Admin: The version is hidden from the connector probe when the login page hides it ([Feature]: Do not expose version information on login dialogs #896, thanks @x86dev)
• Marketplace: Any version of an extension can be installed. The detail page lists every version, previews the picked one and warns about withdrawn versions, advisories, deprecations and suspensions, the listing can be sorted and filtered to installed extensions with an updates strip, and an install link can name the version to offer
• Marketplace: Replaced plugin and theme versions are kept and can be rolled back to
• Plugins: The UI kit gets a Combobox (feat(plugins): add Combobox component to UI kit with host floating dropdown portal #1251, thanks @tobiasge)
• Translations: Estonian is a new locale, including the company directory and the strings added since (feat: add Estonian (et) locale #1254, thanks @raudraido)
• Demo: The demo follows one persona with a work account, a personal account and a shared Support mailbox, with real headers, an invitation, mentions, tags, templates and files

Changes

• Marketplace: The marketplace talks to the extension directory's v2 API only. A self-hosted directory older than 2026-10-14 no longer works with it
• Plugins: A user credential now exists only for a registry plugin or an admin-approved upload whose manifest declares it. Approvals made before this version need a fresh approval request before the plugin can use credentials
• UI: The whole app uses the theme's sans font ([Bug]: typography.fontSans has no effect – body does not use --font-sans #1278, thanks @chodid)
• UI: The app switcher uses simpler calendar, contacts and files icons, and the calendar, contacts, files and settings sidebar headers have the mail header's height
• Performance: Starting a search no longer re-renders every row

Fixes

• Mail: Push notifications can be enabled for an account with access to a shared folder ([Bug]: Cant enable push notifications for account with access to a shared folder #1050, thanks @magnetic6)
• Mail: The list shows the mail's own date and keeps it on .eml import (Bug: Mailbox messages use file creation timestamps instead of mail header timestamps #891, thanks @johnnyq)
• Mail: PGP and S/MIME messages inside conversations are decrypted ([Bug]: PWA, no way to open threaded PGP encrypted email #902, thanks @rajil)
• Mail: Attachments preview in the installed app instead of opening a blank window (Attachment preview fails in installed (standalone PWA) app — window.open(blob:) doesn't work in standalone display mode #865, thanks @navidrast)
• Mail: Message previews drop plain-text emphasis markers ([Bug]: Markdown not rendered in snippet #1260, thanks @mmomjian)
• Mail: Today's and yesterday's mail are told apart by the time zone setting in the list and the sender line ([Bug]: Email relative date (yesterday) is not timezone normalized #1259, fix: count calendar days in the time zone for the relative date #1262, thanks @mmomjian and @balabommablock-cpu)
• Mail: The category tab filter is kept when the mailbox refreshes, and the whole folder comes back after a restart when a category tab was open ([Bug]: Category tab filter is dropped when the current mailbox refreshes #1264, fix: keep the category tab filter when the mailbox refreshes #1265, thanks @alyyousuf7)
• Mail: Shared folders from other servers are kept when they reuse an account id, and a shared folder reachable through two logins is listed once in cross views (fix: list a shared folder reachable through two logins only once in c… #1108, thanks @hildebrandttk)
• Mail: Renaming a tag follows it into the filter rules that name it, and keeps vacation forwarding and plugin vetoes while doing so (fix: renaming a tag leaves filter rules tagging under the old id #854, thanks @dev-hive-kazniisa)
• Mail: Bulk archive across accounts is routed by the owning account, and Archive is only created where the account allows it (fix: route bulk archive by owning account #1178, thanks @VasilisNtovolos)
• Mail: Conversation blobs are fetched from the message they belong to, and file previews stay open in development Strict Mode (fix: route conversation blobs by originating message #1287, fix: keep file previews open during Strict Mode replay #1288, thanks @VasilisNtovolos)
• Mail: A shared conversation is marked read on the owner account, and the mark-as-read delay is followed when expanding a conversation or opening a Pro folder row (fix: mark shared conversations read on the owner account, and follow markAsReadDelay when expanding a conversation #1272, thanks @Peterka35)
• Mail: The reader's Move, Tag and Rules flyouts open on the side with room ([Bug]: Reader More-menu Rules flyout always opens left and is clipped at the reading pane's edge #1261, thanks @beja19)
• Mail: Vacation filter rules are skipped on shared accounts without Sieve ([Bug]: Vacation settings call SieveScript/get on shared accounts that don't support Sieve #1263, thanks @somus)
• Mail: Nextcloud filter markers inside rule text are ignored
• Composer: A reply to a message from another connected account is sent from that account to the right recipient ([Bug]: mailtread reply foes to wrong recepient #703, fix: reply to a message from another connected account goes to that account #1270, thanks @jesperordrup and @vixh)
• Composer: Replies whose From is picked after the composer opens are signed ([Bug]: replying to an email does not insert the signature #842, thanks @mmomjian)
• Composer: A contact group whose member is not an address is no longer sent ([Bug]: Composer commits and sends an unvalidated recipient, producing a malformed To header #795, thanks @brambuijs)
• Composer: Your own address stays out of reply-all before your identities have loaded ([Bug]: Reply-all keeps the user's own address when identities haven't hydrated yet #803, thanks @lucletoffe)
• Composer: Sent mail keeps blank lines instead of collapsing them ([Bug]: Empty paragraph tags (<p dir="auto"></p>) stripping white space (height: 0px) in external mail clients and Sent folder #1015, thanks @mbjboon-netizen)
• Composer: Inline images in replies and forwards are attached once (fix(email-composer): normalize bracketed content-ids for inline reply/forward images #1125, thanks @guisea)
• Composer: The quote containment styles stay in the editor and out of the sent mail, and a quoted original can no longer paint over the composer
• Composer: The composer opens when the mail client can't report directory support
• Composer: A click on a mention chip opens the contact card instead of the mailto handler in Firefox
• Calendar: Zero-length events end at their start instead of midnight ([Bug]: calendar share (ics) with item of 0 minutes not accepted and shown not correctly #837, thanks @Flying-Bas)
• Calendar: Invitation times show in your time zone ([Bug]: Invitation banner ignores event timeZone and shows organizer's wall-clock time without zone #1252, thanks @TomekCodeWave)
• Calendar: Answering an invite sent to a non-primary identity works ([Bug]: RSVP fails with "Could not complete that calendar action" when the invite was sent to a non-primary identity #1283, thanks @taranasus)
• Calendar: The visible range is refetched after creating a recurring event (fix(calendar): refetch visible range after creating recurring event #1268, thanks @sanitz)
• Calendar: Month view day columns align with the header (fix(calendar): align month view day columns with the header #1286, thanks @tobiasge)
• Tasks: An all-day task's due and start are sent as a LocalDateTime (fix(tasks): send an all-day task's due and start as a LocalDateTime #1256, thanks @sanitz)
• Notifications: Push notifications stay silent when the notification sound is off ([Bug]: Push notifications play a sound even when “Notification sound” is off #1289, thanks @chreds)
• Admin: The admin panel loads when the config is read-only, policy defaults are applied to user settings, and OAuth auto-setup is refused before touching Stalwart when the config is read-only ([Bug]: policy.json "defaults" are never applied to user settings #1248, [Bug]: Admin panel reports "Internal server error" when the config is read-only (ADMIN_CONFIG_READONLY) #1249, [Bug]: "Auto-configure OAuth" writes the OAuth client to Stalwart before the read-only check #1250, thanks @chodid)
• Accounts: Restored sign-ins are remembered only when the restoring account is remembered, and contact and calendar data that arrives after switching accounts is dropped instead of landing in the other account
• Plugins: api.email.get reads a listed message of a shared account and no longer reads mail of other connected logins ([Bug]: api.email.get can't find messages in shared accounts #1273, fix: let api.email.get read a listed message of a shared account #1274, thanks @alyyousuf7)
• Plugins: A plugin slot's callbacks keep working when its props change while it loads (Sandbox slot initialization race invalidates initial callbacks before boot (unknown callback) #1266, thanks @dedoitalia)
• Plugins: Plugin dropdown messages are checked before the host draws them
• Lite: Demo portraits load from the mount prefix so a bundle under a subpath stays self-contained, and the dev server stays inside its export directory
• Translations: German strings that still showed in English (fix: translate the German strings that still showed in English #1285, thanks @dealerweb), contact field types and more French strings

---

This discussion was created from the release v1.16.0 - Simpler Settings, @Mention Chips & Marketplace Rollback.