Alps v1.1.0

Alps v1.1.0 is the first release since v1 in May 2026, and it collects 466 merged pull requests. It brings new mail, calendar and contacts features, eleven more interface languages with right-to-left support, sturdier clustering and sign-in, and many fixes. Most of the fixes were found in review and in browser tests run against a real mail server.

The attached zips hold one static binary each, for Linux and FreeBSD on amd64, with the web interface embedded. alps -version reports v1.1.0, and SHA256SUMS lists the zips' checksums.

Upgrade notes

Read these before upgrading a running installation.

• Clusters: upgrade every node together. Security-key records are now kept as versioned IMAP METADATA, so that recovery codes work on any node (#658). Older binaries cannot read the new format. Drain and upgrade together all instances that serve the same accounts. Existing records are migrated on first use. See docs/WEBAUTHN_COORDINATION.md.
• Clusters need a key. [cluster] refuses to start without secret_key, unless allow_insecure = true (#27). bind must be an IP address, optionally with a port (#941).
• ManageSieve uses TLS. Credentials are sent only over TLS, and a server that offers no STARTTLS is refused. For a trusted local server without TLS, use the managesieve+insecure:// scheme (#20). ManageSieve endpoints are no longer discovered through SRV records, so configure one (#780). Filters appear only when an endpoint is configured (#808).
• Logging. If a [logging] section sets no output, logs now go to stdout, as they do without the section. Before, they went to stderr (#818). SIGHUP now reopens the log file instead of stopping alps (#576), and the shipped service files say so (#777, #778, #803).
• Stricter start-up. alps now warns about unknown configuration keys (#821). It refuses to start with CalDAV or CardDAV URLs that are not http or https (#792), or with malformed multi-provider routing (#915, #923, #931, #939).
• Behind a reverse proxy, list the proxy in [server] trusted_proxies. alps then reads X-Forwarded-* from it for the client address, the origin the CSRF check expects, and whether cookies are marked Secure. trusted_origins adds origins the CSRF check accepts (#12, #23, #37).
• The Password page appears only when a password-change backend, an HTTP endpoint or a command, is configured (#855).
• Session caps. A negative max_sessions or max_sessions_per_user turns that cap off; 0 keeps the default (#814).
• Search across all folders needs an IMAP server with MULTISEARCH. Without it the search is refused, instead of returning only Inbox results (#816).
• The composer's attachment budget follows the server's advertised APPENDLIMIT and SMTP SIZE when they are smaller than max_attachment_mib (#947).
• Dependencies. alps now builds on Migadu's hard forks, github.com/migadu/go-imap v1.2.3 and github.com/migadu/go-webdav v1.0.0 (#662, #870).

What's new

Mail

• New mail appears as the server announces it, through IMAP IDLE and, where the server supports it, NOTIFY for every subscribed folder (#412, #463, #558).
• Message previews under the subject (#680). Links and addresses in plain-text mail are clickable, and mailto: opens the composer (#589).
• Share a folder with colleagues over IMAP ACL, and see the folders others share with you (#643).
• Send from other addresses, with a From picker in the composer (#617).
• Storage used, in the account menu, with a warning when the mailbox is nearly full (#628).
• Warnings for sender addresses that mix alphabets, drag to file, and a More row in the toolbar (#104).
• "Select all" covers the whole folder, not just the page on screen (#63). Folders whose names contain "/" open, and special folders are recognised at any level (#13, #140, #141, #927).

Composer

• Drafts keep their Bcc, embedded images and attachments. An untouched reply or forward is not saved as a draft. Open windows survive a reload and a return to the sign-in screen (#292, #296, #435, #436, #470).
• Uploads show their progress, and eight at once all finish (#112). The attachment tray grows the window instead of covering the body, and totals the size against the budget (#575).
• Switching between plain text and HTML keeps the text, the quote and the signature (#11, #152, #509).

Calendar, tasks and contacts

• Calendar invitations and tasks (#52, #352). The first day of the week is configurable (#69), and the chosen time format applies throughout (#634).
• Users can set up CalDAV and CardDAV connections of their own in Settings, with separate credentials or a personal server (#688).
• Contacts with several email addresses and phone numbers (#67), and birthdays without a year (#163, #319, #320). Saving a contact keeps every field as the server stored it (#354, #355, #385).

Settings, filters and auto-reply

• Settings opens as a window over the page it was opened from (#433), and unsaved Filters and Auto-reply edits are kept or asked about (#466).
• Auto-reply, kept beside the filters (#139). The Sieve server validates filters before they are saved (#842), and a script edited by hand reopens in the raw editor (#654).

Languages, themes and accessibility

• Right-to-left layout, and eleven more interface languages: Arabic, Danish, Hindi, Indonesian, Japanese, Korean, Brazilian Portuguese, Russian, Turkish, and Simplified and Traditional Chinese. Portuguese is now European Portuguese. The language, time and date formats follow the browser (#608, #609, #616, #620).
• Fields and dialogs are named for screen readers. The sidebars, Settings and the calendar work from the keyboard, focus stays visible, and the page can be pinch-zoomed on Android (#157, #205, #207, #362, #516, #623, #633, #667).
• Dark themes reach date pickers, form controls and scrollbars (#659, #668). New: the Migadu theme, and server branding for the default theme and the login logo (#210, #228, #465).

Sign-in and security keys

• Recovery codes sign in when the security key is not at hand, in clusters too (#657, #658).
• "Keep me signed in" holds whenever the session is issued again (#596).
• Passwords can be changed through a command on the alps host, for mail servers without an HTTP API (#652, #653).
• Sign-in rate limits are shared across a cluster, and count only refused credentials (#578, #579, #582, #583).

Operations

• Multi-provider domain routing, with the IMAP and Maildir providers behind one provider interface (#65).
• Clusters heal network splits, accept peers given by host name, and advertise a reachable address when bound to 0.0.0.0 or :: (#27, #940, #954, #959, #962). With Let's Encrypt, the cluster leader issues the certificates (#33, #34).
• Logging records sign-ins and requests (#109). The configured logging also covers the cluster, TLS and protocol traces (#827, #877), and syslog keeps each line's severity (#944).
• Shutdown waits for sessions and plugins, and ignores a second signal while it runs (#773, #815, #822, #960).
• The Maildir provider gains the webmail's search grammar, date ordering, folder renames that take their subfolders, and confinement to the user's maildir (#535, #826, #833, #835).
• New documentation: cluster, filters, GPG, localization, mail server, operations, browser tests, and security-key coordination (#689, #956).
• make test-frontend runs the frontend unit tests and make test-e2e the browser tests, and make test-all runs them with the Go tests (#964).

Performance

• Fewer IMAP round trips. Each action sends only the commands it needs, flags are synced through CONDSTORE, parts are fetched as BINARY, and threading is cached. Background work runs on a second connection, and polling is spread out and backs off (#173, #174, #178, #556, #557, #559, #560).
• The browser caches built assets and receives them compressed (#170), and plugin pages load when first shown (#290).

Hardening

Protections added throughout, among them:

• Mail HTML in the print view is sandboxed, and quoted text is parsed without being run (#15, #24).
• The image proxy and BIMI refuse private and reserved addresses and unsafe SVG. All outbound clients share the same address restrictions (#16, #875).
• Security headers and the content security policy apply to every response, and scripts and frames load from alps alone (#17, #670).
• The rate limiter takes forwarded client addresses only from trusted proxies (#18).
• GPG never sends attachments in the clear beside an encrypted message, and never stores the unlocked key (#19).
• Sessions and their uploads are torn down completely (#21, #22, #505), and a password change first checks the current password (#25).

Thanks

Thanks to @thebondo for the provider abstraction that multi-provider routing stands on, and to @swerter, @lemourin, @mkj and @DimitrijeDimitrijevic for their fixes. Alps has received funding from the NGI Zero Commons Fund, managed by NLnet.

Full changelog: v1...v1.1.0

First public relase of Alps

First release of the long overdue Alps webmail. At Migadu, we've never prioritized webmail as we consider webmail to be a poor replacement for a standalone email clients. However we've been proven otherwise by our users and great Email Room at FOSDEM. With additional push from NLNET, we've given a fresh new eyes to the project.

We've moved to an API based architecture with a SPA backend based on web components and Lit, a very simple and maintainable setup, built for rapid development.

This release includes all expected features of a modern webmail, including a revamped plugin system.

• We've moved to a pluggable provider architecture meaning Alps is not stuck to IMAP only. Included providers: IMAP and Maildir (experimental)
• Included plugins: CardDAV, CalDAV, ManageSieve with an UI composer, simple GPG.
• Base system has been extended with WebAuthn and Account Switching

Going forward, this Github repo will be the primary repo for Alps development.