webmail

v1.7.6 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 28d Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

calendar contacts email email-client jmap mail

+4 more

nextjs self-hosted typescript webmail

Affected surfaces

breaking_upgrade crypto_tls

Summary

AI summary

Broad release touches Breaking Changes, 1.7.6, 2026-06-28, and https://github.com/sponsors/bulwarkmail.

Full changelog

1.7.6 (2026-06-28)

Breaking Changes

S/MIME: The built-in S/MIME implementation has been removed from core and re-delivered through the new generic crypto plugin hooks (privileged same-origin plugin tier). S/MIME signing, encryption, decryption, certificate management, and the related settings UI now live in a plugin rather than the main app. Deployments that relied on built-in S/MIME must install the S/MIME crypto plugin to retain those features.

Thank you for your donations:

You? Become a sponsor!

One-time

Anonymous

Monthly

Features

Plugins: Privileged same-origin plugin tier with a crypto API surface
Plugins: Plugin hooks for email details, headers, and source
Mail: Option to hide the total message count on folders (#498)

Fixes

Mail: Hide the server scheduled folder when the virtual one is shown (#495)
Mail: Stop the unified mailbox from mutating client-returned email objects
Composer: HTML-escape sender and subject in the reply/forward quote header (#482)
Calendar: Send calendar invites by setting organizerCalendarAddress
Identity: Sync the default identity (preferredPrimaryId) to server settings (#507)
Auth: Support MFA login via the structured auth endpoint
Admin: Show all built-in themes in the admin theme controls (#496)
i18n: Add missing translation keys across 19 locales

Breaking Changes

S/MIME implementation removed from core; requires installation of the S/MIME crypto plugin via privileged same-origin plugin tier.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track webmail

Get notified when new releases ship.

About webmail

Webmail built for the 21st Century. A modern, self-hosted email client for Stalwart Mail Server powered by the JMAP protocol. Email, calendar, contacts and files. Fast, private, and open source.

All releases →

Related context

Related tools

Earlier breaking changes

v1.7.0 Server‑managed plugin bundles must be Ed25519‑signed and admin‑approved before loading.
v1.7.0 Bundle hash is now full SHA-256; legacy hashes auto-migrated.
v1.7.0 Server-managed bundles require Ed25519 signature verification.
v1.7.0 Plugins run in sandboxed iframe with postMessage RPC bridge.