v1.6.0
What's New in v1.6.0
New Features
-
Admin-controlled mail server connection policy — Admins can now configure allowed connection types for self-hosted IMAP servers from Settings → Security. Three independent flags control whether private/local IP hosts, insecure TLS (self-signed certificates), and non-standard ports are permitted. Previously these were env-var-only and applied globally. (#144)
-
Recent and Favorites in the message detail move picker — The move-to-folder picker in the message reading pane (desktop dropdown and mobile bottom sheet) now shows Recent and Favorites sections above the full folder list, matching the behavior already present in the right-click context menu. (#149)
Bug Fixes
- Fixed drag-to-folder moving only the dragged message when multiple messages were selected — all selected messages now move together with the correct count shown in the undo toast. (#130)
- Fixed compose window drag jumping, lagging, and dropping on mouseup when the cursor left the drag handle area. (#131)
- Fixed lock screen sign-in restoring the previously open message after unlocking; signing out correctly clears the saved state. (#139)
- Fixed links with bare domains in email bodies (e.g.
http://example.com) incorrectly opening a new MailFlow tab instead of the external site. (#benchmade) - Fixed port whitelist being enforced when
ALLOW_PRIVATE_IMAP_HOSTS=true, breaking local IMAP bridge setups on non-standard ports. (#126) - Clarified in the rules UI that body-match rules are skipped at arrival time when the message body has not yet been fetched; they do not apply retroactively.
Security
- Upgraded Vite 5 → 8 (replaces esbuild with rolldown), resolving two high-severity CVEs: GHSA-67mh-4wv8-2f99 and GHSA-gv7w-rqvm-qjhr. (#158)
Upgrading from v1.5.x
If any accounts were configured with Skip TLS verification (e.g. for a self-signed certificate on a local IMAP server), those accounts will stop syncing after upgrading. Before or immediately after deploying, an admin must enable Allow insecure TLS in Settings → Security → Mail Server Connection Policy.