Skip to content

webmail

v1.7.8 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

calendar contacts email email-client jmap mail
+4 more
nextjs self-hosted typescript webmail

Affected surfaces

auth deps

Summary

AI summary

Broad release touches 2026-07-22, https://github.com/sponsors/bulwarkmail, https://github.com/schnz, and https://github.com/BryanBerger98.

Full changelog

Changelog

1.7.8 (2026-07-22)

Thank you for your donations:

One-time

Monthly

Features

  • Unified Mailbox: Account-bounded Unified Mailbox with opt-in cross-account aggregation (#509)
  • Unified Mailbox: Search in the unified views
  • Unified Mailbox: Live unified/All-Mail counters for shared and group accounts
  • Mail: Message-list category tabs
  • Mail: Drag-and-drop reorder for all folders
  • Mail: Collapse quoted reply text behind a "..." toggle (#480)
  • Mail: Bulk Not-Spam action in the junk selection toolbar
  • Mail: Unread count badge on the favicon
  • Mail: Message spacing setting (auto/always/edge-to-edge)
  • Mail: Open external links in a new tab (safely)
  • Mail: Strip external url()/@import from <style> blocks in the sanitizer (#457)
  • Composer: Text color picker in the composer toolbar
  • Composer: Contact groups as single expandable recipient chips
  • Composer: Drag-to-reorder To/Cc/Bcc recipient chips (#593)
  • Composer: Auto-detect paragraph text direction by default
  • Templates: HTML template support
  • Vacation: HTML body support in the vacation responder
  • Send: 'Send now' action on the send-delay toast
  • Accounts: Remove a specific account from the switcher
  • Settings: "Refresh cached data" recovery action
  • i18n: Full Arabic (ar) translation with RTL support
  • Login: LOGIN_SHOW_TOTP and LOGIN_SHOW_VERSION config flags (#520)
  • Docker: NEXT_PUBLIC_LOCALE_PREFIX build argument
  • Plugins: ui.rerenderFetchedEmails method (#668)
  • Plugins: onEmailsFetched and onSearchResults hooks and getSomeEmails JMAP method
  • Plugins: onRecipientChipsChange hook
  • Plugins: webauthn.getOrCreate API method
  • Plugins: Download files generated by a plugin (with ui:download-file consent permission)
  • Plugins: Submit mail without moving to a mailbox and import-to-mailbox APIs

Fixes

  • Mail: Render the email body on DOM parse instead of iframe load (#635)
  • Mail: Keep sidebar tag counts in step with read/unread changes
  • Mail: Enable thread expansion in the focused list
  • Mail: Show the quote bar in email replies
  • Mail: Honor part-type fallback when quoting replies (#649)
  • Mail: Detect typing inside the quoted-HTML shadow island (#654)
  • Mail: Keep target/rel on links in plain-text message bodies and open signature links in a new tab
  • Accounts: Eliminate the full-screen flash when switching accounts (including cached accounts)
  • Accounts: Recognize canonicalized login usernames in the account-switch guard
  • Auth: Guard account switch against slot→token desync and basic-auth identity mismatches
  • Auth: End refresh loops on sign-out and back off failed retries
  • OAuth: Harden OIDC discovery (timeout, retry, serve-stale)
  • JMAP: Preserve POST across redirects in the Stalwart JMAP passthrough (#627)
  • JMAP: File the post-send message with a full mailboxIds replacement
  • JMAP: Generate the Message-ID client-side using the sender's domain
  • Identity: Sync the default sender identity per account (#507)
  • Attachments: Download/view attachments on cross-account All-Mail messages
  • Shared folders: Route batch actions to the owner account
  • Templates: Insert a mail template at the caret in replies instead of prepending (#539)
  • Templates: Keep the signature when inserting a template (#621)
  • Templates: Hide template buttons when templates are disabled
  • Calendar: Honor "Show time in month view" on mobile instead of forcing dots (#666)
  • Calendar: Classify self-organized imported events as editable
  • Contacts: Assign a UID to contact cards on creation (#644)
  • Spam: Stop HELO spf=none from downgrading a MAIL FROM spf=pass (#650)
  • Drafts: Label the close-dialog draft button with the generic Save
  • RTL: Flip JS-positioned popovers and anchor floating menus with logical start/end
  • RTL: Isolate Latin address text from RTL bidi reordering and force LTR identity options
  • i18n: Register Arabic messages in the client IntlProvider
  • i18n: Fix the Hebrew Drafts folder label
  • i18n: Add missing translation keys across 22 locales
  • Deps: Bump dompurify to 3.4.12 and next-intl to 4.13.3

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track webmail

Get notified when new releases ship.

Sign up free

About webmail

Webmail built for the 21st Century. A modern, self-hosted email client for Stalwart Mail Server powered by the JMAP protocol. Email, calendar, contacts and files. Fast, private, and open source.

All releases →

Related context

Related tools

Earlier breaking changes

  • v1.7.0 Server‑managed plugin bundles must be Ed25519‑signed and admin‑approved before loading.
  • v1.7.0 Bundle hash is now full SHA-256; legacy hashes auto-migrated.
  • v1.7.0 Server-managed bundles require Ed25519 signature verification.
  • v1.7.0 Plugins run in sandboxed iframe with postMessage RPC bridge.

Beta — feedback welcome: [email protected]