v1.2.1

Convomail 1.2.1 fixes bulk actions from the reading pane and the keyboard. No database change.

Fixed

• Bulk delete removed only the first email. With a message open and several rows ticked, Delete in the reading pane and the # / Delete keys moved only the open message to Trash and cleared the other ticks without a word. They now move the open message and the ticked rows together, after the usual confirmation.
• The same for the other actions. Archive, Spam / Not spam, Flag, Mark as unread and Move to in the reading pane, and the e, s and u keys, also act on the open message and the ticked rows. Log still applies to the open message only.
• Next message after a bulk action. The reading pane opens the next row that stays, not one that is being removed.
• Shortcuts right after ticking. They now work while focus is on a row's checkbox, and with ticked rows and no open message.

The buttons above the list work as before: they act on the ticked rows, or on the open message when none is ticked.

Upgrading from 1.2.0

Deploy the new zip. No database change, no new setting.

v1.2.0

Convomail 1.2.0 adds Spam and Not spam buttons, and lists that keep each email in the order it arrived. No database change.

New

• Spam and Not spam. A Spam button in the reading pane and the list toolbar (or the ! key) moves an email to its mailbox's Junk folder, created if the mailbox has none. In the Junk folder the button becomes Not spam and moves the email back to the Inbox.
  • Works in the Combined Inbox too: each email goes to its own mailbox's Junk folder.
  • The email is also tagged $Junk or $NotJunk, as Thunderbird does, for mail servers that learn from those tags.
  • Whether the server's filter learns depends on the provider. Gmail treats a move into its Spam folder as a report (and gets no tags). Fastmail trains on filing into Spam. A self-hosted Dovecot server learns only when its admin has set that up (IMAPSieve with rspamd or SpamAssassin). Microsoft 365 takes the move but doesn't count it as a report the way Outlook's Report button does.

Changed

• Lists in arrival order. Folders, search results, the top-bar shortlist and the Combined Inbox are ordered by when the server received each email, instead of by the number the server gives it in the folder. An email moved back (Not spam, or back from Archive) now returns to its place instead of jumping to the top.

Fixed

• The Mailbox icon in the top menu showed Dolibarr's generic placeholder, faded. It is now an envelope, as bright as the other menu icons.

Upgrading from 1.1.x

Deploy the new zip. No database change, no new setting. The first time a large folder is opened after the upgrade takes a moment longer while Convomail reads the arrival times; after that only new emails are read.

v1.1.0

Convomail 1.1.0 adds unread emails in the top bar, a Combined Inbox for people who work in several mailboxes, and open tracking that no longer counts your own team's views. One database column is added, by itself.

New

• Unread emails in the top bar. An envelope next to the bookmarks shows how many unread emails you have from Dolibarr contacts and third parties (or all of them, or nothing: each user chooses, and which mailboxes it counts). A click lists the newest, each opening straight in the mailbox, and Mark all as read clears what was counted, on the mail server itself. Emails from contacts are also marked in the message list. An admin can turn the indicator off in Convomail setup.
• Combined Inbox. Tick two or more mailboxes (your own and shared ones) in your Mail accounts tab, and Combined Inbox appears at the top of the mailbox picker: their Inboxes in one list, newest first, each email labelled with its mailbox.
  • Everything happens in the email's own mailbox: open, read and unread, flag, archive, delete, move and drag (moves stay within a mailbox, with a note for the others), and the reading pane with its tools.
  • Reply and Forward go out from the mailbox the email arrived in.
  • New-mail checks, search and Mark all as read cover every mailbox; one that can't be reached says so while the others load.
  • Paging carries on per mailbox, and the list is kept a minute per user so moving through pages is quick.

Open tracking

• Your own views are not counted. The tracking image is removed from incoming mail and from quotes, so reading a customer's reply that quotes your email no longer counts as their open. Loads from a browser signed in to your Dolibarr, from your users' recent sign-in addresses, from the server, or from networks you list in the new Your networks setting are your team's.
• Who loaded it. Each open is labelled: the recipient's mail app directly, Gmail's or Yahoo's image proxy, or Apple Mail Privacy Protection (which loads images whether or not anyone reads). Security scanners are not counted. The message and the event card show the breakdown ("Opened 3 times … (2 direct, 1 by Apple Mail Privacy Protection) — not counted: 1 by your team"), and the tooltip the latest loads.
• Addresses are only compared while the image loads; they are never stored.

Also

• Tested on Dolibarr 24 (and 23, 20).
• The module now names its author (Zach Melo) in Dolibarr's module list.

Upgrading from 1.0.x

Deploy the new zip and open any Convomail page: it adds the open_detail column (sql/update_1.1.0.sql) by itself. The top-bar indicator is on after the upgrade; each user's Combined Inbox starts with their own mailboxes. With open tracking on, opens recorded before 1.1.0 keep their count, without a breakdown.

v1.0.0 — Security release

Convomail 1.0.0 is a security release: the fixes from an external code audit (2026-10-26), with no new features. No database change.

Security fixes

• Sending: the account's SMTP settings, put in memory for one email, are now restored whatever happens during the send (an error or an exception in the mail library or a trigger).
• Mail-server check (when Allowed mail servers is empty, servers must be on the public internet):
  • both IPv4 and IPv6 addresses of the server name are checked (before, IPv4 only);
  • more non-public ranges are refused: shared address space (100.64.0.0/10), benchmark and documentation ranges, multicast, IPv6 link-local and unique-local, and IPv4 addresses inside IPv6;
  • the check now runs before every connection to the mailbox, not only when the account is saved and before sending.
• Multi-company: reads of a single third party, contact or agenda event now stay within the entities the user may see.
• Hardening: page URLs are escaped where printed; files are written and deleted through Dolibarr's file functions.
• Debug endpoint: the free SQL query mode of ajax/debug.php (admins, with Debug mode on) is removed. It could read every secret in the database (SMTP passwords, API keys, sign-in tokens) and, depending on the database rights, files on the server. The other diagnostics stay. A hardened copy for development lives on the debug-tools branch, which is never released.

Upgrading

Replace the module folder. No database change, no new setting.

If Allowed mail servers is empty and an account's server resolves to a private or reserved address (now also over IPv6, and checked at every connection), that account stops connecting: add its host to Allowed mail servers in Convomail setup.

v0.18.0 — Attachments and drag and drop in compose, supplier by VAT number

Attaching files in compose

• Attach files… replaces the bare file field: each file shows as a chip with its size and a × to remove it, and picking again adds to the list instead of replacing it.
• A warning shows when the files together are over what the server accepts (PHP's upload limits and Dolibarr's Max size of uploaded files).
• Drag and drop: drag files from your computer onto the compose page; an overlay says what the drop will do. Images dropped on the message text go in the text where you drop them (up to 2 MB each); other files, and anything dropped elsewhere on the page, are attached. A file dropped by mistake never makes the browser leave the page.

Third parties in the "From this email" panels

• A chosen third party (recognised from the sender, filled from an invoice, or picked) now shows as Dolibarr's own link, with its icon, opening its card in a new tab, and a pen to pick another. Before, it looked like a name typed in a text box.

Reading supplier invoices

• Fill from the invoice and Read with AI now select the supplier when no supplier was recognised from the sender and the invoice's VAT number matches exactly one supplier in Dolibarr. The field is marked VAT number, and a warning shows when the email does not come from one of that supplier's addresses (or their domain), a sign of a forged invoice. A VAT number shared by several third parties, or held by one that is not a supplier, only gives a note.
• While they read (the AI can take up to a minute), the panel stays on screen with a progress line and the seconds elapsed; if the server does not answer, the form comes back as it was with the error.

Upgrading

Replace the module folder. No database change, no new setting.

v0.17.0 — Read with AI, new mail, attachments on reply

Read with AI

For supplier invoice PDFs that carry no e-invoice data. Off by default: Convomail setup › Create › Supplier › Invoice › Read with AI. Needs Fill from the invoice (0.16.0) on and Dolibarr's AI module set up.

• When Fill from the invoice finds no e-invoice data but the PDF has text, the panel offers Read with AI. Nothing is sent before the click.
• Bank details (IBAN, BIC, account numbers), email addresses and phone numbers are removed from the text before it leaves your server. If you turned on the AI module's own privacy redaction, it masks the text too (on Dolibarr 24.0 it also hides amounts, so the AI fills little).
• The answer is checked field by field (formats, dates, currency, your country's VAT rates, totals). Accepted values fill the panel, marked AI, for you to check. AI can misread.
• Uses the AI module's document parsing (its own model setting from Dolibarr 25) and its request log if you turned that on. Each click is one request to your AI service; a reading is kept a week.

New mail in an open mailbox

• The mailbox checks for new mail every minute while its tab is visible (setup: Check for new mail, 30 s to 5 min, or never). One quick status request each time; nothing is downloaded or marked read.
• On the first page of a folder, new messages slide in at the top; unread counts and the tab title follow.
• When that would disturb you (another page, a search, ticked messages), a bar above the list says how many arrived, with Show.
• If checking fails three times in a row, it stops and the bar says why, with Retry. An ended session or a folder recreated on the server offers Reload.

Attachments and images on reply and forward

• Reply and Reply all list the original message's attachments, unticked: tick those to send back.
• Forward lists them ticked, and keeps the images shown in the text (a logo, a pasted screenshot) in place, sent embedded. They are listed too, under Images in the text; one too large for the text (over 1 MB) or an SVG goes as an attachment instead of being lost.
• An image a message attaches without showing it in the text (some mail apps send photos that way) is now listed with the attachments.

Upgrading

Replace the module folder. No database change. Read with AI starts off; Check for new mail starts at every minute (choose Never in Convomail setup to keep the mailbox as it was).

v0.16.0 — Fill from the invoice

Fill from the invoice

A new setting, off by default: Convomail setup › Create › Supplier › Invoice › Fill from the invoice.

When an admin turns it on, the supplier invoice panel ("From this email" › Create › Supplier › Invoice) shows a Fill from the invoice button when the email has an XML or PDF attachment. Clicked, it reads the e-invoice data:

• a UBL or CII XML file attached to the email;
• Factur-X, ZUGFeRD or XRechnung data inside the PDF.

It fills the supplier's invoice number, the invoice date, the due date, and one amount line per VAT rate. Each filled field shows where it came from (Factur-X, e-invoice…) so you can check it before creating.

• Nothing is read until you click, and nothing leaves your server.
• The supplier is never taken from the document. The one recognised from the sender stays, with a warning when its VAT number differs from the invoice's. With no supplier recognised, the panel names the seller for you to pick.
• Credit notes and invoices in another currency are not filled.
• A scanned or plain PDF has no such data: type it in as before.

The panel also takes up to 10 amount lines and a due date when typing an invoice in by hand.

Upgrading

Replace the module folder. No database change; the new setting starts off.

v0.15.1 — Works on Dolibarr 20 and 21

Works on Dolibarr 20 and 21

Convomail declares Dolibarr 20 or later. Until now it had only been tested on 23. Checked on Dolibarr 20.0.4, with these fixes:

• File attachments, Link to record, Create, and copying attachments when logging crashed on Dolibarr 20 and 21. They used a core function added in Dolibarr 22. They now work, with the same checks: no executables or scripts, no SVG, antivirus, and no JavaScript in PDFs.
• Compose crashed on Dolibarr 20 and 21 when the AI module was on. The AI writing tools need Dolibarr 22 or later; older versions now simply don't show them.
• Mailbox notices ("2 files filed on …") showed HTML tags on Dolibarr 20. They are now plain text everywhere.

Docs

The README and docs now cover 0.13 to 0.15:

• From an email: file, link and create;
• open status in the mailbox;
• the phone layout;
• requirements and upgrade notes.

Upgrading

Replace the module folder.

v0.15.0 — Open status in the mailbox

See if a sent email was opened, right in the mailbox

For emails sent with Track when opened:

• Mailbox rows show an eye when the email was opened, with the count if it was opened more than once. A crossed-out eye means it hasn't been opened yet. Hover the icon to see how many times and when (first and last open).
• The open message has a line saying, for example, "Opened 3 times, first on …, last on …", or "Not opened yet".
• The conversation panel shows the same eye next to your sent messages, so after replying you can see whether your reply was opened.

You no longer have to open the agenda event to find out. Emails sent without tracking show nothing.

Opens are approximate:

• mail apps that block images don't report them;
• Apple Mail and some security scanners load images without anyone reading.

Nothing shows while open tracking is switched off in setup.

Upgrading

Replace the module folder.

v0.14.1 — Check records before linking

Check a record before you link to it

• Suggested records in the Link to record and File attachments panels now open in a new tab, so you can make sure it is the right record first. The record the email is already linked to opens the same way.
• Picked records in the search box get an open icon next to the box. So does the customer or supplier pre-selected in a Create panel.

The panel stays as it was while you look. Clicking a record's name does not select it: you still choose with the radio button.

Upgrading

Replace the module folder.