This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Affected surfaces
Summary
AI summaryBroad release touches 2026-07-22, https://github.com/sponsors/bulwarkmail, https://github.com/schnz, and https://github.com/BryanBerger98.
Full changelog
Changelog
1.7.8 (2026-07-22)
Thank you for your donations:
- You? Become a sponsor!
One-time
Monthly
- @proxforge
- @spss20
- @elgringoYan
- @pauladams8
- @djpriest
- @umakers
- @zplizzi
- @jeremiah
- @Theoretisch1337
- @svandive
- @HiltMundell
Features
- Unified Mailbox: Account-bounded Unified Mailbox with opt-in cross-account aggregation (#509)
- Unified Mailbox: Search in the unified views
- Unified Mailbox: Live unified/All-Mail counters for shared and group accounts
- Mail: Message-list category tabs
- Mail: Drag-and-drop reorder for all folders
- Mail: Collapse quoted reply text behind a "..." toggle (#480)
- Mail: Bulk Not-Spam action in the junk selection toolbar
- Mail: Unread count badge on the favicon
- Mail: Message spacing setting (auto/always/edge-to-edge)
- Mail: Open external links in a new tab (safely)
- Mail: Strip external
url()/@importfrom<style>blocks in the sanitizer (#457) - Composer: Text color picker in the composer toolbar
- Composer: Contact groups as single expandable recipient chips
- Composer: Drag-to-reorder To/Cc/Bcc recipient chips (#593)
- Composer: Auto-detect paragraph text direction by default
- Templates: HTML template support
- Vacation: HTML body support in the vacation responder
- Send: 'Send now' action on the send-delay toast
- Accounts: Remove a specific account from the switcher
- Settings: "Refresh cached data" recovery action
- i18n: Full Arabic (ar) translation with RTL support
- Login:
LOGIN_SHOW_TOTPandLOGIN_SHOW_VERSIONconfig flags (#520) - Docker:
NEXT_PUBLIC_LOCALE_PREFIXbuild argument - Plugins:
ui.rerenderFetchedEmailsmethod (#668) - Plugins:
onEmailsFetchedandonSearchResultshooks andgetSomeEmailsJMAP method - Plugins:
onRecipientChipsChangehook - Plugins:
webauthn.getOrCreateAPI method - Plugins: Download files generated by a plugin (with
ui:download-fileconsent permission) - Plugins: Submit mail without moving to a mailbox and import-to-mailbox APIs
Fixes
- Mail: Render the email body on DOM parse instead of iframe load (#635)
- Mail: Keep sidebar tag counts in step with read/unread changes
- Mail: Enable thread expansion in the focused list
- Mail: Show the quote bar in email replies
- Mail: Honor part-type fallback when quoting replies (#649)
- Mail: Detect typing inside the quoted-HTML shadow island (#654)
- Mail: Keep
target/relon links in plain-text message bodies and open signature links in a new tab - Accounts: Eliminate the full-screen flash when switching accounts (including cached accounts)
- Accounts: Recognize canonicalized login usernames in the account-switch guard
- Auth: Guard account switch against slot→token desync and basic-auth identity mismatches
- Auth: End refresh loops on sign-out and back off failed retries
- OAuth: Harden OIDC discovery (timeout, retry, serve-stale)
- JMAP: Preserve POST across redirects in the Stalwart JMAP passthrough (#627)
- JMAP: File the post-send message with a full
mailboxIdsreplacement - JMAP: Generate the Message-ID client-side using the sender's domain
- Identity: Sync the default sender identity per account (#507)
- Attachments: Download/view attachments on cross-account All-Mail messages
- Shared folders: Route batch actions to the owner account
- Templates: Insert a mail template at the caret in replies instead of prepending (#539)
- Templates: Keep the signature when inserting a template (#621)
- Templates: Hide template buttons when templates are disabled
- Calendar: Honor "Show time in month view" on mobile instead of forcing dots (#666)
- Calendar: Classify self-organized imported events as editable
- Contacts: Assign a UID to contact cards on creation (#644)
- Spam: Stop HELO
spf=nonefrom downgrading a MAIL FROMspf=pass(#650) - Drafts: Label the close-dialog draft button with the generic Save
- RTL: Flip JS-positioned popovers and anchor floating menus with logical start/end
- RTL: Isolate Latin address text from RTL bidi reordering and force LTR identity options
- i18n: Register Arabic messages in the client IntlProvider
- i18n: Fix the Hebrew Drafts folder label
- i18n: Add missing translation keys across 22 locales
- Deps: Bump
dompurifyto 3.4.12 andnext-intlto 4.13.3
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About webmail
Webmail built for the 21st Century. A modern, self-hosted email client for Stalwart Mail Server powered by the JMAP protocol. Email, calendar, contacts and files. Fast, private, and open source.
Related context
Earlier breaking changes
- v1.7.0 Server‑managed plugin bundles must be Ed25519‑signed and admin‑approved before loading.
- v1.7.0 Bundle hash is now full SHA-256; legacy hashes auto-migrated.
- v1.7.0 Server-managed bundles require Ed25519 signature verification.
- v1.7.0 Plugins run in sandboxed iframe with postMessage RPC bridge.
Beta — feedback welcome: [email protected]