neomutt / neomutt

📖 Notes

In the rush to create last week's security release, a bug crept in unnoticed.
Sorry.

❤️ Thanks

Many thanks to our regular contributors:

• Pietro Cerutti (@gahr)
• Valeri Sergeev (@vpub)
• Reto Brunner (@reto)

🐞 Bug Fixes

• Fix crash when saving an alias

🏴 Translations

• 🇷🇺 70% Russian

⚙️ Code

• Remove redundant function call

📖 Notes

In addition to the usual share of bug fixes and enhancements, this release
fixes a security vulnerability whereas an early error in communicating with
an IMAP server was not properly detected as fatal, resulting in a potential
for sensitive information (user, pass) being sent over an untrusted channel.

CVE-2020-28896

Thanks to Gabriel Salles-Loustau for spotting the problem.

❤️ Thanks

Many thanks to our new contributor:

• Björn Ketelaars (@bket)

and our regular contributors:

• наб (@nabijaczleweli)
• Matthew Hughes (@matthewhughes934)
• Austin Ray (@Austin-Ray)
• Romeu Vieira (@RomeuG)
• Marius Gedminas (@mgedmin)
• Reto Brunner (@reto)
• Jakub Jindra (@jindraj)
• Yousef Akbar (@yousefakbar)
• ftilde (@ftilde)
• Pietro Cerutti (@gahr)

🔒 Security

• imap: close connection on all failures

🎁 Features

• alias: add function to Alias/Query dialogs
• config: add validators for {imap,smtp,pop}_authenticators
• config: warn when signature file is missing or not readable
• smtp: support for native SMTP LOGIN auth mech
• notmuch: show originating folder in index

🐞 Bug Fixes

• sidebar: prevent the divider colour bleeding out
• sidebar: fix <sidebar-{next,prev}-new>
• notmuch: fix query for current email
• restore shutdown-hook functionality
• crash in reply-to
• user-after-free in folder-hook
• fix some leaks
• fix application of limits to modified mailboxes
• write Date header when postponing

🏴 Translations

• 🇱🇹 100% Lithuanian
• 🇨🇿 100% Czech
• 🇹🇷 70% Turkish

📚 Docs

• Document that $sort_alias affects the query menu

🏗️ Build

• improve ASAN flags
• add SASL and S/MIME to --everything
• fix contrib (un)install

⚙️ Code

• my_hdr compose screen notifications
• add contracts to the MXAPI
• maildir refactoring
• further reduce the use of global variables

♻️ Upstream

• Add $count_alternatives to count attachments inside alternatives

📖 Notes

It's been a busy month for NeoMutt with five new contributors.
They've been fixing things and adding new features.

If you'd like to help, come say "Hello!" in our IRC channel, or email me.
There are plenty of simple jobs to get started on, and mentoring is available.

• #neomutt on irc.freenode.net (or https://webchat.freenode.net/?channel=#neomutt)
• Richard Russon (@flatcap) <rich@flatcap.org>

This release sees some more modernisations.

• Compose: can now display user-defined headers (see my_hdr).

• Address Book / Query: can now be searched using patterns:

  • ~f Alias (from)
  • ~t Address (to)
  • ~c Comment

• Config: String Lists now support += and -= to add/remove items.
  Strings now support += for concatenation.

❤️ Thanks

Many thanks to our new contributors:

• Matthew Hughes (@matthewhughes934)
• Romeu Vieira (@RomeuG)
• Louis Brauer (@louis77)
• Aditya De Saha (@adityadesaha)
• Reto Brunner (@reto)

and our regular contributors:

• Pietro Cerutti (@gahr)
• Jakub Jindra (@jindraj)
• Marius Gedminas (@mgedmin)
• наб (@nabijaczleweli)
• Yousef Akbar (@yousefakbar)
• Martin Mitáš (@mity)

🎁 Features

• Compose: display user-defined headers
• Address Book / Query: live sorting
• Address Book / Query: patterns for searching
• Config: Add '+=' and '-=' operators for String Lists
• Config: Add '+=' operator for Strings
• Allow postfix query ':setenv NAME?' for env vars

🐞 Bug Fixes

• Fix crash when searching with invalid regexes
• Compose: Prevent infinite loop of send2-hooks
• Fix sidebar on new/removed mailboxes
• Restore indentation for named mailboxes
• Prevent half-parsing an alias
• Remove folder creation prompt for POP path
• Show error if $message_cachedir doesn't point to a valid directory
• Fix tracking LastDir in case of IMAP paths with Unicode characters
• Make sure all mail gets applied the index limit
• Add warnings to -Q query CLI option
• Fix index tracking functionality

🔧 Changed Config

• Add $compose_show_user_headers (yes)

🏴 Translations

• 🇨🇿 100% Czech
• 🇱🇹 100% Lithuanian
• Split up usage strings

🏗️ Build

• Run shellcheck on hcachever.sh
• Add the Address Sanitizer
• Move compose files to lib under compose/
• Move address config into libaddress
• Update to latest acutest - fixes a memory leak in the unit tests

⚙️ Code

• Implement ARRAY API
• Deglobalised the Config Sort functions
• Refactor the Sidebar to be Event-Driven
• Refactor the Color Event
• Refactor the Commands list
• Make ctx_update_tables private
• Reduce the scope/deps of some Validator functions
• Use the Email's IMAP UID instead of an increasing number as index
• debug: log window focus

📖 Notes

This is a Bug-Fix Release.

See last week's Release Notes for other recent changes.

• Sidebar users are urged to use %D in their $sidebar_format if they use named-mailboxes
  This will show the Descriptive name, rather than the mailbox path or Notmuch query.
  e.g. set sidebar_format = "%D%* %n"

❤️ Thanks

Many thanks to our regular contributors:

• Austin Ray (@Austin-Ray)
• Marius Gedminas (@mgedmin)
• наб (@nabijaczleweli)

🐞 Bug Fixes

• fix maildir flag generation
• fix query notmuch if file is missing
• notmuch: don't abort sync on error
• fix type checking for send config variables

🔧 Changed Config

• $sidebar_format - Use %D rather than %B for named mailboxes

🏴 Translations

• 🇱🇹 96% Lithuanian
• 🇵🇱 90% Polish

📖 Notes

• Add one-liner docs to config items
  See: neomutt -O -Q smart_wrap

• Remove the built-in editor
  A large unused and unusable feature

❤️ Thanks

Many thanks to our new contributors:

• Tim Biermann (@TimB87)
• Yousef Akbar (@yousefakbar)
• Mateusz Okulus (@mokulus)

and our regular contributors:

• Pietro Cerutti (@gahr)
• Austin Ray (@Austin-Ray)
• наб (@nabijaczleweli)
• Adán Somoza (@DarkAdin)
• Jakub Jindra (@jindraj)

🔒 Security

• Add mitigation against DoS from thousands of parts

🎁 Features

• Allow index-style searching in postpone menu
• Open NeoMutt using a mailbox name
• Add cd command to change the current working directory
• Add tab-completion menu for patterns
• Allow renaming existing mailboxes
• Check for missing attachments in alternative parts
• Add one-liner docs to config items

🐞 Bug Fixes

• Fix logic in checking an empty From address
• Fix Imap crash in cmd_parse_expunge()
• Fix setting attributes with S-Lang
• Fix: redrawing of $pager_index_lines
• Fix progress percentage for syncing large mboxes
• Fix sidebar drawing in presence of indentation + named mailboxes
• Fix retrieval of drafts when "postponed" is not in the mailboxes list
• Do not add comments to address group terminators
• Fix alias sorting for degenerate addresses
• Fix attaching emails
• Create directories for nonexistent file hcache case
• Avoid creating mailboxes for failed subscribes
• Fix crash if rejecting cert

🔧 Changed Config

• Add $copy_decode_weed, $pipe_decode_weed, $print_decode_weed
• Change default of $crypt_protected_headers_subject to "..."
• Add default keybindings to history-up/down

🏴 Translations

• 🇨🇿 100% Czech
• 🇪🇸 100% Spanish

🏗️ Build

• Allow building against Lua 5.4
• Fix when sqlite3.h is missing

📚 Docs

• Add a brief section on stty to the manual
• Update section "Terminal Keybindings" in the manual
• Clarify PGP Pseudo-header S<id> duration

⚙️ Code

• Clean up String API
• Make the Sidebar more independent
• De-centralise the Config Variables
• Refactor dialogs
• Refactor: Help Bar generation
• Make more APIs Context-free
• Adjust the edata use in Maildir and Notmuch
• Window refactoring
• Convert libsend to use Config functions
• Refactor notifications to reduce noise
• Convert Keymaps to use STAILQ
• Track currently selected email by msgid
• Config: no backing global variable
• Add events for key binding

♻️ Upstream

• Fix imap postponed mailbox use-after-free error
• Speed up thread sort when many long threads exist
• Fix ~v tagging when switching to non-threaded sorting
• Add message/global to the list of known "message" types
• Print progress meter when copying/saving tagged messages
• Remove ansi formatting from autoview generated quoted replies
• Change postpone mode to write Date header too
• Unstuff format=flowed

📖 Notes

This release fixes a few bugs and clears up how network tunnels are treated.

❤️ Thanks

Many thanks to our regular contributors:

• Pietro Cerutti (@gahr)
• Marius Gedminas (@mgedmin)
• Scott Kostyshak (@scottkosty)
• наб (@nabijaczleweli)

🐞 Bug Fixes

• Avoid opening the same hcache file twice
• Re-open Mailbox after folder-hook
• Fix the matching of the spoolfile Mailbox
• Fix link-thread to link all tagged emails

🔧 Changed Config

• Add $tunnel_is_secure config, defaulting to true

♻️ Upstream

• Don't check IMAP PREAUTH encryption if $tunnel is in use
• Add recommendation to use $ssl_force_tls

📖 Notes

This release of NeoMutt includes important security fixes.

Besides lots of bug-fixes, there are some small new features.

• Config supports '+=' and '-=' for numeric types
  There are more changes to come, to make the config more flexible.

• Address book / Query menus support comments
  Any text after a # will be shown in the menu (and can be searched).
  When saving an alias, you will be prompted for an optional comment.

❤️ Thanks

Many thanks to our new white hat friends at Münster University of Applied Sciences:

• Damian Poddebniak (@duesee)
• Fabian Ising (@Murgeye)

Many thanks to our new contributors:

• Lucas Bourneuf (@Aluriak)
• Thomas Sanchez (@daedric)
• наб (@nabijaczleweli)
• Alexey Vishnyakov (@SweetVishnya)
• Deng Xiyue (@manphiz)

and our regular contributors:

• Jakub Jindra (@jindraj)
• zsugabubus (@zsugabubus)
• Marius Gedminas (@mgedmin)
• Pietro Cerutti (@gahr)
• Doron Behar (@doronbehar)
• Federico Kircheis (@fekir)
• Martin Mitáš (@mity)

🔒 Security

• Abort GnuTLS certificate check if a cert in the chain is rejected
• TLS: clear data after a starttls acknowledgement
• Prevent possible IMAP MITM via PREAUTH response

🎁 Features

• add config operations +=/-= for number,long
• Address book has a comment field
• Query menu has a comment field

✨ Contrib

• sample.neomuttrc-starter: Do not echo prompted password

🐞 Bug Fixes

• make "news://" and "nntp://" schemes interchangeable
• Fix CRLF to LF conversion in base64 decoding
• Double comma in query
• compose: fix redraw after history
• Crash inside empty query menu
• mmdf: fix creating new mailbox
• mh: fix creating new mailbox
• mbox: error out when an mbox/mmdf is a pipe
• Fix list-reply by correct parsing of List-Post headers
• Decode references according to RFC2047
• fix tagged message count
• hcache: fix keylen not being considered when building the full key
• sidebar: fix path comparison
• Don't mess with the original pattern when running IMAP searches
• Handle IMAP "NO" resps by issuing a msg instead of failing badly
• imap: use the connection delimiter if provided
• Memory leaks

🔧 Changed Config

• $alias_format default changed to include %c comment
• $query_format default changed to include %e extra info

🏴 Translations

• 🇱🇹 100% Lithuanian
• 🇫🇷 84% French
• Log the translation in use

📚 Docs

• Add missing commands unbind, unmacro to man pages

🏗️ Build

• Check size of long using LONG_MAX instead of __WORDSIZE
• Allow ./configure to not record cflags
• fix out-of-tree build
• Avoid locating gdbm symbols in qdbm library

⚙️ Code

• Refactor unsafe TAILQ returns
• add window notifications
• flip negative ifs
• Update to latest acutest.h
• test: add store tests
• test: add compression tests
• graphviz: email
• make more opcode info available
• refactor: main_change_folder()
• refactor: mutt_mailbox_next()
• refactor: generate_body()
• compress: add {min,max}_level to ComprOps
• emphasise empty loops: "// do nothing"
• prex: convert is_from() to use regex
• Refactor IMAP's search routines

📖 Notes

This is a Bug-Fix Release.

Last release, I introduced a last-minute "fix" to the Sidebar, which caused problems for some of you.
Sorry about that.

❤️ Thanks

Many thanks to our regular contributors:

• Austin Ray (@Austin-Ray)
• Pietro Cerutti (@gahr)
• Marius Gedminas (@mgedmin)
• Alvaro Herrera (@alvherre)
• zsugabubus (@zsugabubus)

🐞 Bug Fixes

• Make sure buffers are initialized on error
• fix(sidebar): use abbreviated path if possible

🏴 Translations

• 🇱🇹 100% Lithuanian

📚 Docs

• make header cache config more explicit