This release adds 3 notable features for engineering teams evaluating rollout.
Published 25d
Communication & Email
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
email
emailclient
unifiedinbox
webmail
Affected surfaces
auth
Summary
AI summaryUpdates New features, Upgrade notes, and Performance across a mixed release.
Full changelog
New features
- Two-factor authentication — TOTP (authenticator app), email OTP, and persistent device trust. Admins can set enforcement policy (off / required) and trust duration (7 days, 30 days, permanent, or never) in the admin panel.
- Todoist integration — link a Todoist account from the admin Apps tab. Create tasks directly from emails via the message toolbar.
- Composer font groups and email priority — choose font family groups in the composer and set message priority (low / normal / high / urgent).
- Improved mobile compose UX — cleaner field layout and simplified toolbar for composing on mobile.
Fixes
- Wide fixed-layout HTML emails no longer clip on mobile — content is scaled to fit the viewport.
- Mark-as-read now fires immediately on tap rather than waiting for the synthesized click event, closing the window where a fast back-swipe could race against the state update.
- Mark-as-read is retried once on network failure before reverting, reducing spurious "still unread" appearances on unreliable mobile connections.
- Resolved ghost touches and scrambled gesture recognition in the mobile message list after rapid swiping.
- Fixed an edge case where thread resolution could overwrite the optimistic mark-as-read update before the API call completed.
- Back swipe no longer exits the PWA context on iOS standalone mode.
- Todoist connection status now syncs correctly on app load.
- Message toolbar cleaned up — icon-only buttons with tighter spacing.
Performance
- Div-renderer utilities (PostCSS, CSS scoping) are now lazy-loaded and excluded from the main bundle when the div renderer is disabled.
Upgrade notes
- Two database migrations run automatically on startup (
0019_user_integrations,0020_mfa_device_trust). No manual steps required. - 2FA is off by default. Existing users are not affected unless an admin enables enforcement under Settings → Security.
- One new optional environment variable:
VITE_EMAIL_DIV_RENDER(defaultfalse). The div-based renderer is experimental — do not enable in production.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]