Skip to content

v0.2.0

Choose a tag to compare

View all tags
@csitte csitte released this 02 Aug 16:29
v0.2.0
57fc973

Security & audit release

🔒 Security

  • --http is secure-by-default. Binds to 127.0.0.1 (not every interface) and refuses to start without MAILWARDEN_TOKEN (opt out via MAILWARDEN_ALLOW_NO_TOKEN=1). Adds a Host-header allowlist (DNS-rebinding defense) on loopback and a 1 MB request-body cap.
    • Breaking: existing --http users must set MAILWARDEN_TOKEN, or opt out explicitly.
    • New env vars: MAILWARDEN_HOST, MAILWARDEN_ALLOW_NO_TOKEN, MAILWARDEN_ALLOWED_HOSTS.

🐛 Fixed

  • Dead/revoked refresh token (invalid_grant, e.g. a Testing consent screen's 7-day expiry) now surfaces as "Run mailwarden --auth" instead of a cryptic OAuth error.

⚡ Changed

  • One OAuth token refresh per process, not per tool call — the authenticated client is cached for the process lifetime.
  • bulk_modify reports capped when more messages match than maxMessages, so callers can raise the cap or re-run instead of silently missing mail.

Full notes in the CHANGELOG.

🤖 Generated with Claude Code

Assets 2
Loading