Skip to content

v0.10.0

Latest
Latest

Choose a tag to compare

View all tags
@jbpenrath jbpenrath released this 29 Sep 13:14
· 34 commits to main since this release
v0.10.0
1824212
This commit was signed with the committer’s verified signature.
jbpenrath Jean-Baptiste PENRATH
SSH Key Fingerprint: G9WgnFOxT5CMLaq69cRHFyoZ1TeoJaPfBtBGf3i1+Rc
Verified
Learn about vigilant mode.

Added

  • Compose messages in floating windows: several drafts side by side,
    minimized or full-screen, restored after a reload and synced across tabs
  • Mobile UI for the native apps: bottom navigation bar, swipe actions on
    threads, pull-to-refresh, drawer, formatting toolbar above the keyboard,
    haptics
  • Publish mobile OTA bundles from Scalingo deploys
  • Persist the last active mailbox and select it on the next visit
  • Clean snippet of the latest message in the thread list
    (FEATURE_THREAD_SNIPPET, after backfill_thread_snippets) and on folded
    messages
  • Allow domain admins to export mailboxes #789
  • Provisioning endpoint listing the DNS records of all domains #780
  • ARC relay trust: arc inbound_auth mode and arc_verdict spam rule #763
  • Support internationalized email addresses (IDNA domains, ASCII-folded
    local parts) #785
  • Keep Gmail labels, Thunderbird read/starred flags and
    sent/archived/spam/trashed states through MBOX export and import
  • Setup guides for the authentication provider and the identity provider
  • IP allowlist for the Django admin URL in the frontend Caddy proxy
  • Smoke test for the frontend production image (make test-front-distroless)
  • IP allowlist for the Keycloak admin console and master realm in the Keycloak image (Caddy) #793
  • Smoke test for the Keycloak production image (make test-keycloak-image) #793

Changed

  • Migrate the frontend from Cunningham to the @gouvfr-lasuite/ui-components
    and @gouvfr-lasuite/ui-tokens packages
  • Upgrade Capacitor to 8.5 and adopt the iOS UIScene life cycle
  • Upgrade jmap-email to 0.3.0: an unparseable inbound message is abandoned
    instead of retried, a compose error on send returns a 400, a stored message
    the parser now refuses is flagged unreadable
  • Force-lowercase mailbox addresses #785
  • Route mailbox export tasks to the imports queue #805
  • Redirect to the inbox when switching mailbox
  • Thread a reply by its In-Reply-To even when its subject was rewritten #765
  • Exclude spam and trashed messages from folder stats by default
  • Stop fetching stats for the Sent folder
  • Page titles follow "Mailbox - Folder - App name"
  • Harden pymta with new settings and limits, and improve its env vars,
    documentation and logging #777 #783
  • Bump keycloak to 26.7.4 and Alpine to 3.24 in the Keycloak image #776 #784 #798
  • Bump Caddy to 2.11.4 and lprobe to v0.2.0 in the frontend image
  • Keycloak image: Keycloak listens on 127.0.0.1:8081, Caddy serves port 8080
  • Keycloak image: proxy headers are fixed to xforwarded from Caddy, which sends X-Forwarded-Proto https

Removed

  • The mta-out service: relay mode now needs an external MTA_OUT_RELAY_HOST #785
  • Scalingo buildpack for Keycloak (src/keycloak/buildpack, Procfile, system.properties)

Fixed

  • Fix a draft update / send race that could re-send an already delivered
    email, and keep the autosave out of the send window
  • Add the channel to messages sent through the submit API #794
  • Accept more valid SPF records by implementing the full RFC #782
  • Ignore whitespace in DKIM keys in the DNS check #778
  • Select IMAP folders whose unquoted name carried extra spaces, and stop
    retrying unselectable folders
  • Give nameless attachments the same name in the UI, downloads and drafts
  • Keep only BlockNote-supported colors in pasted content, drop unsupported
    blocks and embed external images again
  • Resize the mail iframe with a resize observer (Safari, width changes,
    lazy-loaded images)
  • Stretch the thread sender on a narrow thread panel
  • Fix file uploads outside a secure context (crypto.randomUUID fallback)
  • Fallback for avatar colors on browsers without color-mix() support
  • Mobile: send mutations through CapacitorHttp with an explicit Origin so
    an HTTPS backend's CSRF check accepts them
  • Grant view-realm to the Keycloak service account, needed by the 2FA toggle
  • Run make test-keycloak against a freshly imported Keycloak realm
  • List only assignable users and current assignees in the quick assign picker

Security

  • Turn the direct access grant off on the Keycloak rest-api client
  • Deny API actions that don't declare an access check by default
  • Check mailbox access for mailbox_id on message list and thread search
  • Rate-limit the image proxy, restrict it to ports 80 and 443 and mark its
    responses private
  • SSRF-check per-domain relays (internal ones need SSRF_ALLOWED_HOSTS)
  • Validate the MailDomain custom_settings schema
  • Restrict IMAP import ports (MESSAGES_IMPORT_IMAP_ALLOWED_PORTS)
  • Use only the Referer hostname in widget message subjects
  • Scope the DNS check endpoint through the admin queryset
  • Refuse MTA requests with a 401 instead of a 500 when MDA_API_SECRET is
    unset
  • Scope the flag endpoint draft cascade to editable messages and suspend
    personal API keys of deactivated users #804
  • Harden email parsing against hostile mail (forged sender, smuggled
    recipients, quadratic regexes) through jmap-email 0.3.0, and bound the
    reply-unquoting regexes
Assets 2
Loading