v2.78.0

2.78.0 (2026-08-12)

Features

• accounts: pin an account to an expected email identity (a64bb60), closes #626
• admin-ui: keep the access-token banner in view and make the reference nav usable on a phone (a4bb55f)
• admin: mark the operation being read in the API reference sidebar (700eab7)

Bug Fixes

• accounts: let a wrong-account setup be retried instead of bouncing it back (4cd6ac4)
• accounts: remove the messages an account had queued when it is deleted (ba6897f)
• auth: replace unmaintained speakeasy and base32.js with in-house implementations (9abaaaa)
• bounces: read every block of a delivery-status body (a99878e)
• bounces: report every delivery-status field and describe one recipient (71300c3)
• deps: replace deprecated msgpack5 with @msgpack/msgpack behind a compatibility wrapper (9c40ebc)
• deps: replace stagnant xml2js with fast-xml-parser in IMAP settings autodetection (bfd6ec5)
• deps: update dependencies (libmime 5.4.2, nodemailer 9.0.5, imapflow 1.6.6) (abd8034)
• deps: update email-text-tools and email-ai-tools to pull in patched dompurify (GHSA-55q2-fjhq-7xh7) (148130f)
• deps: update imapflow to 1.7.0, certs to 1.0.17, templates to 2.0.2 (cafae8c)
• deps: update our own packages so the tree carries one copy of each (4a6e79f)
• oauth2: fall back to stored credentials when useAuthServer is set but no auth server is configured (cd460b0)
• webhooks: bind the egress check to the address actually connected to (#631) (2d68b37)

Performance Improvements

• accounts: unlink the account keys instead of deleting them inline (ec11210)