v0.17.1

In short

Security release: update both the add-on and the bridge. Files of a Thunderbird profile, or of an account's local
mail folder, kept outside the default locations could be attached to a message; they are now refused. A bridge
older than 0.17.1 does not apply this check: the add-on now recommends updating it (Claude Code plugin: update the
plugin; Claude Desktop: install the new .mcpb; elsewhere: replace mcp-bridge.cjs). No call that worked stops
working, except attaching files from those folders.

How to update

• Thunderbird add-on: it updates itself. To get this version now: Add-ons and Themes, gear menu, Check for Updates, then restart Thunderbird. For a first installation, see the README (commonpost-mcp-v0.17.1.xpi below).
• MCP bridge: it is installed in your MCP client and is never updated automatically. This release changes the bridge: update it in every MCP client that uses it.
  • Claude Desktop: download commonpost-mcp-v0.17.1.mcpb below and open it with Claude Desktop; if the file does not open there (Windows), use Settings > Extensions > Advanced settings > Install Extension.
  • Claude Code with the plugin: /plugin marketplace update commonpost (or turn on auto-update for the marketplace in /plugin), then /reload-plugins. The plugin always carries the bridge of the release.
  • Other clients (Claude Code without the plugin, Cursor, VS Code, ...): download mcp-bridge.cjs below and put it in place of your copy, then restart the client or reconnect the server (/mcp in Claude Code). The path of your copy is in the MCP configuration of the client (Claude Code: claude mcp get <server name>).
  • Not sure which bridges you have? The options page of the add-on (section Bridge) lists the bridges that connected, each with its version and "Up to date", "Newer version available" or "Update recommended". Claude Desktop and another client on the same computer are two bridges, updated separately.

The .sigstore.json files are provenance attestations, not something to install.

All changes

Security

• Attachments: the add-on lists the folders of the running Thunderbird profile, of every other profile Thunderbird
  knows and of every account's local mail folder, wherever they are, in the connection file; the bridge refuses a
  path attachment under any of them (by the path given, its real path, and the folder's identity, so a link or a
  second mount of the same folder is refused too). The bridge now finds Thunderbird before it accepts a path
  attachment, and checks again if a request ends up going to another Thunderbird than the one it was checked
  against. The add-on applies a similar check, by path and real path, to path attachments it receives directly. Not covered: the account
  folders of profiles other than the running one, a mail store at the root of a drive, and a folder the bridge
  sees under another path (a bridge under WSL or in a container). See "Attachments refused" in the README.

Changed

• Bridge 0.17.1. The add-on recommends it (MIN_BRIDGE_VERSION 0.17.1); older bridges keep working.
• The connection file is written in ASCII (non-ASCII characters escaped), so a path with accents reads back the same.