Releases: s1t5/mail-archiver
Releases · s1t5/mail-archiver
Release list
2607.5
⚙️ Improvements
- Last Sync Display During Full Sync - Account lists, dashboard, and account details/edit pages now show a localized "Synchronization running…" badge (with spinner) instead of the misleading 1970-01-01 epoch timestamp while a full sync is in progress. A "Synchronization pending…" badge is shown when the epoch is set but no sync job is currently running.
🐛 Bug Fixes
- Account Actions Dropdown Clipping - On the Mail Accounts desktop table, the kebab actions menu was clipped by the container and only reachable by scrolling inside the table. The container now allows vertical overflow on desktop so the menu is fully visible.
2607.4
✨ New Features
- MCP Server - Optional Model Context Protocol server (Streamable HTTP transport at
/mcp) that can exposes the archived mail to AI agents via the toolslist_accounts,list_folders,search_emails,get_emailandget_attachment. See MCP. - Calendar/Meeting Invitations - iCalendar (
text/calendar) parts from meeting invites are now preserved as.icsattachments and rendered as a readable plain-text summary (start, end, location, organizer, attendees, description). - Acknowledge Sync Failures - New "Acknowledge Failures" button on the Jobs page for completed sync jobs with failed emails. .
⚙️ Improvements
- Retention Deletion Logging - Server-side (IMAP/M365) and local retention deletions are now recorded in the AccessLogs page as a new
Retentionlog category. - SQL Injection Hardening in Email Search -
EmailCoreService.SearchEmailsAsyncnow canonicalizessortBy/sortOrdercentrally (any unknown value falls back to the defaults) and parametrizesLIMIT/OFFSETinstead of interpolating integers.
🐛 Bug Fixes
- Client-Side Date Guard for Email Deletion - The IMAP and M365 retention deletion now re-verifies the message date client-side before deleting from the live mailbox, regardless of the server-side date filter. Protects against IMAP servers with non-compliant
SENTBEFOREimplementations. - Retention deletes mails with malformed Message-ID headers - Mails with non-standard
Message-IDheaders (e.g. doubled closing angle bracket<id@host>>) are now correctly matched against the archive byDelete After Daysretention, instead of being silently skipped as "not archived".
2607.3
✨ New Features
- Read-only REST API (v1) - Optional, off-by-default REST API under
/api/v1for programmatic access to the archive (reporting, e-discovery, monitoring, AI agents) without exposing mailbox credentials or talking to the mail provider. See documentation here. Thanks to @kipp-ing for the PR!
⚙️ Improvements
- Search Loading Indicator - Search submit button shows a spinner and is disabled while the search request is in flight
- Dashboard Storage Label - Renamed the dashboard storage tile label to "Database size" to clarify it shows the database size, not mailbox storage
🐛 Bug Fixes
- Dark Mode Flash on Page Navigation - Theme is now applied synchronously via a blocking inline script in the
<head>before stylesheets load, eliminating the brief light-mode flash during page transitions - Zero-Grant Access Control - Closed cross-account bypass for users with no mailbox grants in EmailsController and EmailCoreService - M365 Graph Raw Headers - Populate RawHeaders for M365/Graph-synced mail via internetMessageHeaders,
- Dashboard Chart Dark Mode - Charts (monthly bar + top senders doughnut) now adapt text, grid, legend and tooltip colors to the active theme and update live when toggling dark mode
- Dashboard & Export Timezone - Fixed recent-emails timestamps on the dashboard being shifted by the configured display timezone offset (shown as UTC by the JS converter) and single-EML export emitting a wrong
Date:header; both now use the stored display-timezone value consistently with the emails index/details pages
Contributors
kipp-ing
Assets 2
2607.2
✨ New Features
- Per-Account Sync Scheduling - The sync interval can now be configured per mail account from the frontend (Create/Edit).
- CSV Bulk Import for IMAP Accounts - Import hundreds of IMAP mailboxes at once.
- Configurable Email Deletion Lock - A new
DeletionPolicy:DeletionAllowedsetting controls whether archived emails may be deleted. See documentation here. - Display Names Preservation - Sender and recipient display names (e.g. "Max Mustermann") are now stored alongside email addresses and faithfully restored during IMAP/Graph restore and EML export. Previously, only the bare email addresses were kept.
- Concurrent Sync Jobs - The number of account syncs running in parallel within one poll cycle is now configurable. See documentation here.
⚙️ Improvements
- Import Pages UX Harmonization - Unified visual structure across MBOX, EML, and CSV import pages.
- Sync Jobs Progress/Status Tooltips - The Progress and Status column headers in the Sync Jobs table now show an explanatory tooltip (via a "?" icon) describing how progress is calculated (per completed folders) and what each status code means.
- Removed legacy CSV/JSON export formats - The UI only offered EML/MBox export; the unused CSV/JSON export code paths have been removed for maintainability.
- IMAP Restore now restores Bcc recipients - Previously only From/To/Cc were restored via IMAP; Bcc addresses (with display names) are now included.
🐛 Bug Fixes
- External Email Images Blocked by CSP - The Content-Security-Policy header on the email view iframe blocked all remote (http/https) images unconditionally, ignoring the
View:BlockExternalResourcessetting. - Updates MS Graph Memory Management - Memory grew steadily during M365 syncs because only Gen-0 GCs ran while large bodies/attachments accumulated as uncollected Large Object Heap garbage; per-page GCs are now background Gen-2 collections. Duplicates are now detected before the per-message detail fetch, avoiding needless body downloads in the 12h overlap window.
- MSA Sync Authentication Failure - Personal Microsoft accounts could fail to sync with "Authentication failed" despite successful authorization when the entered email address was a secondary alias of the mailbox. The actually authorized login name is now extracted from the OAuth id_token.
- MSA Account Status on Details Page - Account Details page always showed "Not yet authorized" for MSA accounts because the controller action did not map OAuth fields.
- Mail Accounts Table Overflow - On narrow desktop browser windows the accounts table overflowed its container.
2607.1
✨ New Features
- New Project Website - The Mail Archiver now has a new dedicated project website at mail-archiver.org
- Support for personal Microsoft Accounts Added - Adds OAuth2 IMAP support for personal Microsoft accounts (Outlook.com / M365 Family / Hotmail). Thanks to @XtraLarge !
- Per-Account Storage Display - Shows database storage usage per account in the Dashboard "Account Overview" table and the MailAccounts "Show All" table.
⚙️ Improvements
- Mail Account Create / Edit / Details UX - Restructured all three pages into visual sections with headers and icons
- Folder Exclusion Toggle - Folder badges on the Edit page are now toggleable (click to add, click again to remove) and use semicolon separators matching the server-side parser.
- User Create / Edit UX - Restructured both pages into visual sections with headers and icons
- Dashboard Visual Polish - Modern gradient stat cards with count-up animation on load
- UI Table Harmonization - Unified table styling across Emails, MailAccounts, Users, Jobs, and Logs index pages
🐛 Bug Fixes
- Localized Strings Encoding in JavaScript - Localized strings (e.g. French "Tâche d'arrière-plan") were HTML-encoded by Razor when emitted inside
<script>blocks, causing entities like'to appear verbatim in the UI. - Stored XSS via Email HTML Body - Replaced the bypassable regex-based HTML sanitizer in the email viewer with an allowlist-based sanitizer (Ganss.HtmlSanitizer).
- IDOR on Email Deletion -
Emails/DeleteandEmails/DeleteSelectedpreviously only required the SelfManager role, allowing a SelfManager to delete emails belonging to accounts they are not authorized for by guessing/enumerating email IDs. - 2FA Session Fixation - The ASP.NET Core session was not regenerated after successful password verification, enabling a session-fixation attack (CWE-384) where an attacker who planted a session cookie pre-login could inherit the post-2FA authenticated state.
Contributors
XtraLarge
Assets 2
2606.5
🐛 Bug Fixes
-
Search results no longer miss valid matches - Searches using field prefixes like
to:,from:,subject:, orbody:could incorrectly exclude matching emails. This is now fixed; those searches reliably find all relevant messages again. -
Switching to Selection Mode no longer changes your folder - Previously, enabling Selection Mode (or changing the page size / running a search) could silently reset the active folder, risking accidental bulk deletions across folders. Your selected folder, sort order, and page are now correctly retained.
-
Search filters are kept when switching accounts or folders - If you had typed a search term or set a filter but hadn't submitted it yet, switching accounts or clicking a folder would discard it. Those entered values are now preserved when you navigate.
-
Tenant import only shows archivable mailboxes - Guest accounts and users without an active Exchange Online license are now automatically excluded from tenant import and Tenant Management. Only mailboxes that can actually be archived are listed.
-
Dark mode fix for Tenant Mailboxes card - The "Tenant mailboxes" card on the account creation page now correctly follows dark mode instead of staying light.
2606.4
✨ New Features
- Search & Pagination for Email Accounts & Users - Client-side filter plus paginated display at 50 items per page on MailAccounts and Users index pages.
⚙️ Improvements
- Search Performance for Frequent Search Terms - Restructured the search query with a
MATERIALIZEDCTE so that the GIN full-text index is used independently ofORDER BY ... LIMIT. - Phrase/Quoted & Field-Search Performance - Exact-phrase searches (
"anne 01") and field searches (subject:facture,from:jean) now use the GIN full-text index as a selective pre-filter before the authoritativePOSITIONsubstring verification. - Tenant Management naming - The default account name prefix in Tenant Management is now extracted from the source account instead of using the full source name, preventing double-suffixed names. Added a "Rename existing accounts" checkbox that applies the naming scheme to all M365 accounts sharing the same app registration.
🐛 Bug Fixes
- "word is too long to be indexed" warnings - Long tokens (>2047 characters, e.g. inline Base64/Hex) in the body are now split during import to avoid tsvector warnings and tokenization overhead. The untouched original remains available for UI/export.
- Tenant Manager skip-disabled toggle - Removed the "Skip disabled mailboxes" toggle from the Tenant Management page. Tenant Management now always skips disabled tenant users, consistent with the create-form default.
- Kebab menu clipped in mail accounts table - The overflow action menu on the desktop mail accounts table was cut off by the table-responsive/card container.
- Dark mode fixes for form controls - Input group addons and form-select dropdown carets now adapt to dark mode with matching background and high-contrast icon/caret colors.
2606.3
✨ New Features
- Tenant Management - Admins can manage all mailboxes of an M365 tenant from a dedicated page. Lists tenant mailboxes, marks already-imported ones, and lets admins add missing mailboxes using the source account's credentials with a configurable name prefix and retention settings. A guide can be found here.
⚙️ Improvements
- Preselected target mailbox on restore - When restoring one or more emails that all originate from the same source mailbox, the target mailbox (and, if all share the same source folder, the target folder) is now preselected in the restore dialog.
- Dark mode fixes for form controls - Input group addons and form-select dropdown carets now adapt to dark mode.
- Compact Mail Accounts action bar - Reduced the action column from seven wide icon-plus-text buttons to three compact icon buttons (Details, Edit, Sync) plus an overflow "More actions" menu that groups Export, Tenant Management, and Delete. The enable/disable state is now toggled directly in the status column via a switch instead of a separate button.
- Stable account sort order - The Mail Accounts index now sorts by name then ID, so toggling enable/disable no longer reshuffles the list after page reload.
🐛 Bug Fixes
- Hidden EmailAddress validation on tenant import - Switching to "Microsoft 365 (tenant)" on the Create page now disables and clears the email address field so an invalid value no longer fails server-side validation while the field is hidden.
- JavaScript-dependent provider selection on Create page - Added a
<noscript>fallback with a real bound provider select and tenant import checkbox, and made the hidden provider inputs initially disabled so the form remains usable without JavaScript.
2606.2
✨ New Features
- M365 Tenant Import: You can now create accounts for all mailboxes in an M365 tenant in a single batch operation. Thanks to @tilwegener for this new feature!
- Customizable OIDC Login Buttons: OIDC login buttons can now be configured with provider-specific labels. Thanks to @tilwegener for this new feature!
⚙️ Improvements
- Fixed User Edit Mass Assignment: The user edit form now binds a dedicated view model, preventing attackers from overwriting protected fields such as
IsAdmin,TwoFactorSecret, orOAuthRemoteUserId. - Updated GetM365Credentials Endpoint The
GetM365Credentialsnow only returns the client ID and tenant ID. - Fixed XSS in Email Reply Button: Email metadata used by the reply button is now passed to JavaScript as properly escaped JSON instead of unencoded
data-*attributes. - Hardened HTML Email Iframe Sandbox: Removed
allow-same-originfrom the email content iframe sandbox so that JavaScript in HTML emails cannot access the parent page. - Added Import File Extension Whitelist: MBox and EML uploads now validate file extensions; only
.mbox,.eml, and.zipfiles are accepted.
Contributors
tilwegener
Assets 2
2606.1
✨ New Features
- Attachment Deduplication to reduce the storage space needed for recurring attachments such as company logos in signatures (see documentation here)
- Added Local File Import Options, see documentation here.
- New Feature Splash Screen to display release notes to administrators after the update (can be disabled in the environment variables if unwanted, see setup documentation).
⚙️ Improvements
- Added information about failed exports (see issue #430).
🐛 Bug Fixes
- Fixed Header Preservation for bulk export.