v1.17.2 - Draft Security Fix, Safari Push & Plugin Tag Updates

[rathlinus]

1.17.2 (2026-10-24)

1.17.2 fixes a cross-site scripting hole in re-opened drafts and keeps Safari from dropping push subscriptions after pushes that had nothing new to show. Drafts written as a group identity now stay in the group's Drafts, and bulk delete, trash and move with several accounts on different servers act on the right server. Plugins can update and remove their own tags, format dates in the user's regional settings and put buttons beside a sidebar section's title. User-facing texts use the configured app name instead of "Bulwark".

Thank you for your donations:

• You? Become a sponsor!

One-time

• @bultester
• Anonymous
• Anonymous
• Anonymous

Monthly

• Anonymous
• @superspacehosting
• @naokton
• @yerTools
• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

• Composer: The quoted original and the signature in a re-opened draft are sanitized before they render. A draft written by another client, or by another member of a shared mailbox, could carry markup that ran script in the webmail when you opened it (GHSA-g35q-3gpc-x2rr, thanks @muhammad-zeeshan1337)

Features

• Plugins: Plugins can change the label, colour and visibility of the tags they added and remove them again with keywords.update and keywords.remove. Both need settings:write and never touch the user's own tags or another plugin's (feat: let plugins update and remove the tags they added #1333, thanks @HOLOEYE-JZ)
• Plugins: Plugin frames get the user's date locale, 12/24-hour setting, time zone and first day of the week, and can format with api.i18n.formatDate and api.i18n.formatTime, without asking for settings:read (feat: mirror regional presentation settings to plugin sandboxes #1335, thanks @tobiasge)
• Plugins: A new sidebar-section-actions slot puts a plugin's buttons beside its sidebar section's title instead of in a row below it (feat(plugins): allow inline actions in collapsible sidebar headers #1317, thanks @LeonardNJU)
• Admin: A policy switch lists the Tags above the shared mailboxes in the sidebar, so they stay in sight when many shared mailboxes are expanded. It is off by default (feat: admin policy gate to list the Tags above the shared mailboxes #1334, thanks @HOLOEYE-JZ)
• Branding: Default apps in Settings, the "Open Bulwark" notification, the rate-limit banner, the plugin connect dialog and the connector page use the configured APP_NAME, and the settings search finds them by it (Some user-facing strings still say "Bulwark" when APP_NAME is set #1314, thanks @ghozty)

Fixes

• Push: Every push ends with a notification, also one that brings nothing new (a redelivery, mail already read or already announced), and a slow preview gives way to the generic notification after 10 seconds. Safari treats a push without a notification as silent and drops the subscription after three (Service worker can handle a push without showing a notification — Safari removes the subscription after three #1322, thanks @oguzyilmaznet)
• Mail: A draft written as a group identity is saved in the group account's Drafts, where its Sent copy also goes, instead of in your own ([Bug]: Sent copy inconsistently/never lands in shared mailbox's own Sent folder when sending as a Group identity #1090, thanks @hildebrandttk)
• Mail: A sub-address of your own address (you+tag@) sends from your account, even when a shared catch-all account has a wildcard identity for the domain
• Mail: Bulk delete, trash and move send each message through the login that owns it. With accounts on two servers that use the same account id, they went through the first login and could hit an unselected message on the other server (fix: route bulk delete and trash by authenticated client #1307, fix: route bulk move by authenticated client #1326, thanks @VasilisNtovolos)
• Mail: Dragging several messages out as a ZIP fails with a message when one of them can't be fetched, instead of leaving it out, and the same selection can be tried again (fix: reject incomplete email ZIP exports and allow retry #1306, thanks @VasilisNtovolos)
• Tasks: A task alert relative to the start fires from the task's start instead of its due date. A task without a start still counts from its due date (Task alerts ignore relativeTo: "start" and always fire relative to due #1328, thanks @ClapsAndJiggles)
• Plugins: Plugins installed by the admin are listed in browsers that can't cache their code, such as some private windows ([Bug]: Plugin availability and user settings differ across browsers despite Settings Sync #1327, thanks @ovizii)
• i18n: The Ukrainian "Forward" and "Move to" are translated as the actions, not as "ahead" and "go to" (fix(i18n): correct Ukrainian "forward" and "move to" translations #1311, thanks @vladonv)

---

This discussion was created from the release v1.17.2 - Draft Security Fix, Safari Push & Plugin Tag Updates.