MailFlow

v2.0.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 23d Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

email emailclient unifiedinbox webmail

Summary

AI summary

Mobile UI fixes improve tab overflow indicator and sidebar collapsibility.

Full changelog

What's new in v2.0.1

This is a patch release with mobile UI fixes.

Mobile fixes

Settings tab bar now shows a gradient overflow indicator when there are more tabs to the right, and hides it automatically when scrolled to the last tab (#185)
Sidebar bottom section (profile, settings, sign out) is now collapsible on mobile — tap your name to expand or collapse, keeping the sidebar compact by default (#186)

Security

window.open calls for mailto: links now consistently pass noopener,noreferrer to prevent the opened tab from holding a reference back to the app

Upgrading from v2.0.0: pull the new image and restart — no database migrations or configuration changes required.

Upgrading from v1.x: four additive database migrations run automatically on first startup (spam training log, password reset tokens, message categories, and list-unsubscribe columns). All are idempotent and non-breaking. See the v2.0.0 release notes for the full list of changes since v1.x.

Security Fixes

`window.open` mailto: links now include `noopener,noreferrer` to prevent reference leakage

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track MailFlow

Get notified when new releases ship.

About MailFlow

Unified webmail client

All releases →