1.1.0

Contacts

An address book, shown when Davis is configured.

• Browse and filter your address books, or pick one
• Create, edit and delete contacts, with undo; pictures with a crop
• Download a contact, a book or everything as .vcf; import .vcf files
• Possible duplicates pointed out on a card, and merged
• From mail: a known sender opens their card, an unknown one can be added

The Davis app key now also writes to the address books. The contacts copy is rebuilt on first use after the upgrade.

Full Changelog: v1.0.7...v1.1.0

1.0.7

What's new

• Messages: moving or deleting a conversation now takes all its messages, not just the latest one
• Contacts: pictures from your Davis address book now reach the avatars; the cards are read again once after this update so existing contacts get theirs
• Contacts: pictures written the vCard 2.1 way (PHOTO;JPEG;ENCODING=BASE64:) are understood too

Full Changelog: v1.0.6...v1.0.7

1.0.6

What's new

• Reading: links in a message open in a new tab; a site that refuses to be framed no longer leaves the message blank
• Reading: a forwarded mail whose quote is collapsed stays dark in dark mode, and the default link blue of Gmail, Outlook and Word no longer forces a white sheet
• Messages: drag a message, or a selection, onto a folder to move it; conversations move as a whole, and a closed folder opens while you hover it
• Shortcuts: Backspace and Delete delete a message, # is gone
• Settings: the version number shows at the bottom, with a link to the release notes
• Contacts: people in your Davis address book are shown under the name on their card, with their picture on the avatar and a small badge marking them as known
• API: GET /api/contacts/lookup and GET /api/contacts/photo back the above; a migration adds the picture to the contact cache

Full Changelog: v1.0.5...v1.0.6

v1.0.5

What's new

• Attachments: an icon per file type, full file names instead of names cut at a fixed width, and a small thumbnail for images
• Attachments: PDFs open in the browser from the preview button instead of being downloaded
• Attachments: names sent in the RFC 2231 form (long accented names from Thunderbird and others) no longer show as part-N
• Reading: HTML mails that declare another charset in a <meta> tag (typically Outlook replies) no longer show é instead of accents
• The image now ships PHP's gd extension, used for the thumbnails

Full Changelog: v1.0.4...v1.0.5

v1.0.4

What's new

• Security: the image runs PHP 8.4.27, which fixes the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)
• Inline styles with quoted values (e.g. font-family: "Arial") or a + in calc() were double-encoded and ignored by browsers
• Contacts: an empty or malformed CardDAV answer now reads as "Davis unavailable" instead of crashing
• Compose: the SMTP transport is built through Symfony's public API, no more reliance on an internal class
• Static analysis: Psalm 7 joins PHPStan in CI, and the code it flagged was cleaned up

Full Changelog: v1.0.3...v1.0.4

v1.0.3

What's new

• Mobile: pull to refresh reworked: smooth, no more Safari page reload on top of it, and it can't get stuck (also with a second finger)
• Mobile: smooth swipe actions on messages, with an animated slide-out
• Mobile: no more zoom when focusing a field (e.g. To), and no pinch zoom
• Compose: tapping To / Cc / Bcc focuses the field
• Move to: long folder lists scroll instead of running off the screen
• Archive works on accounts without an Archive folder: it's created on first use

Full Changelog: v1.0.2...v1.0.3

v1.0.2

What's new

• Docker: the image now includes timezone data, so the TZ environment variable is honoured (it previously fell back to UTC)
• Folders: accented and non-ASCII mailbox names are displayed correctly
• Message list: HTML entities ( , …) and invisible padding characters no longer show in excerpts
• Mobile: smoother pull to refresh, with no leftover bar or stray border

Full Changelog: v1.0.1...v1.0.2

v1.0.1

What's new

• Folders can now be collapsed
• Fixed the background colour of the message view

⚠️ Configuration change: TLS modes are now explicit

IMAP_ENCRYPTION and SMTP_ENCRYPTION now take false, ssl, tls or starttls:

• tls now means implicit TLS (usually port 993 for IMAP, 465 for SMTP). It used to mean STARTTLS.
• starttls is the new value for STARTTLS (usually port 143 for IMAP, 587 for SMTP).
• The default for SMTP_ENCRYPTION is now starttls (was tls), so the default behaviour is unchanged.

If you set IMAP_ENCRYPTION=tls or SMTP_ENCRYPTION=tls to get STARTTLS, change it to starttls.

Full Changelog: v1.0.0...v1.0.1

v1.0.0

First stable release: Postel is a simple, self-hosted webmail for a Dovecot mail server, behind your single sign-on (Authelia, for instance). It logs in with a Dovecot master user, so it never handles anyone's mail password.

What's in it

• Folders, conversations, search across folders with filters, and bulk actions with undo
• A composer with drafts, attachments and undo send
• Recipient suggestions from your Davis address books, with a Davis 5.6 app key (optional)
• Light and dark mode, nine accent colours, English and French, from a large screen down to a phone

How to install

See the README. The image is ghcr.io/tchapi/postel:1.0.0, for amd64 and arm64.