1.14.0

What's Changed

New features, improvements and fixes:

• Bulk CSV import of aliases
• Passkey login: remove required email field (usernameless/discoverable WebAuthn login)
• Add "Stay logged in" option to the login screen (extended session expiration)
• Wildcard Alias separator (Period . or Plus +)
• Require step-up (password/passkey) re-authentication for critical account actions
• Require current password confirmation on password change; support first-time password set for passkey-only users
• Alias filters & permanent delete ("Forget") for custom domains
• Add status filter dropdown to Wildcard aliases
• Add "Pin" feature for aliases
• Bulk actions for Aliases list
• Account page: two-column layout redesign
• Aliases list performance improvements
• Replies and sends from an alias lose all line breaks in the HTML body

Internal security audit 09/2026 fixes:

• Access keys default to never-expiring
• FinishAddPasskey trusts the ceremony session without cross-checking the caller's real session
• TOTP: secrets and backup codes stored in plaintext; backup codes generated with non-crypto RNG
• TOTP Secret Entropy Fix + Backup Code Strengthening
• ClearCookies Helper
• DeleteCredential wrong-table fix
• Constant-Time Secret/Hash Comparisons
• Constant-time PSK comparison fix
• Email Auth (DKIM/SPF/DMARC) Alignment Enforcement
• Alias list/count query hardening (defense-in-depth)
• PSK persisted in cleartext inside the mailserver container
• Docker images hardening
• app/nginx.conf missing security headers

Full Changelog: 1.13.2...1.14.0