webmail

v1.7.5 Feature

This release adds 5 notable features for engineering teams evaluating rollout.

Published 1mo Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

calendar contacts email email-client jmap mail

+4 more

nextjs self-hosted typescript webmail

Affected surfaces

auth

Summary

AI summary

Broad release touches 2026-06-24, https://github.com/sponsors/bulwarkmail, https://github.com/pauladams8, and https://github.com/djpriest.

Full changelog

1.7.5 (2026-06-24)

Thank you for your donations:

You? Become a sponsor!

One-time

Anonymous

Monthly

Features

Mail: Cross-account "All accounts" views with full group/shared-account support
Mail: Per-account "All Mail" folder selection
Mail: "Download all" button to bundle attachments into a zip (#466)
Mail: Return to the list after deleting or marking the open message unread — configurable (default on)
Mail: Collapse-all-threads action in thread-list selection
Calendar: Option to disable the calendar
Composer: Send-now button on scheduled/delayed messages
Composer: Email a contact or group via the in-app composer
Composer: Split a pasted address list into recipient chips
Contacts: "New address book" creation UI (#415)
OAuth: OAUTH_AUTHORIZE_URL to override the authorize endpoint
i18n: Farsi (fa) locale — complete (2654 strings)
i18n: Romanian (ro) locale

Fixes

Composer: Keep HTML signature styling in the editor and on send
Composer: Guard Send against double-submit
Composer: Strip display names from the EmailSubmission envelope addresses
Calendar: Disable iMIP scheduling on calendar import (#411)
Mail: Localize special-folder names by JMAP role (#404)
Mail: Block remaining email tracking vectors (#457)
Mail: Route counter and unread updates to the email's own account in aggregate views
Mail: Fix blank space in plain-text emails
Mail: Fix toolbar re-render when opening emails
Mail: Truncate long subjects so they don't overlap the timestamp
Mail: Strip reply/forward prefixes followed by a full-width colon
Mail: Add breathing room between the unread dot and the avatar
Mail: Isolate per-account state snapshots from leakage and mutation
Mail: Cap filename tokens at the full 200-char limit
Spam: Fetch mailboxes with accountId in markAsSpam
Filters: Load mailboxes when opened directly (#485)
Settings: Surface server errors on password change and TOTP toggle
Send now: Gate the toolbar label and translate send_now across locales
Directory: Fix fetching display names
Push: Reap only relay-confirmed-dead leftover subscriptions
i18n: Add the missing fa locale to the client IntlProvider messages map
i18n: Add missing translation keys across 19 locales

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track webmail

Get notified when new releases ship.

About webmail

Webmail built for the 21st Century. A modern, self-hosted email client for Stalwart Mail Server powered by the JMAP protocol. Email, calendar, contacts and files. Fast, private, and open source.

All releases →

Related context

Related tools

Earlier breaking changes

v1.7.0 Server‑managed plugin bundles must be Ed25519‑signed and admin‑approved before loading.
v1.7.0 Bundle hash is now full SHA-256; legacy hashes auto-migrated.
v1.7.0 Server-managed bundles require Ed25519 signature verification.
v1.7.0 Plugins run in sandboxed iframe with postMessage RPC bridge.