This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
ReleasePort's take
Light signalReleasePort Layer 1 v2.5.0 applies multiple bug‑fixes across search, archiving, IMAP handling, Gmail fallback, CardDAV rendering, High Contrast theme accessibility, message preview sanitization, snooze restoration, and keyboard shortcut conflict warnings.
Why it matters: All fixes (severity 40) address operational reliability for developers, SREs, and security engineers by preventing UI glitches, sync interruptions, rate‑limit errors, data loss on archive, rendering bugs, accessibility issues, unwanted tracking URLs, duplicate snooze handling, and silent shortcut overrides.
Summary
AI summaryUpdates New, Internal, and v2.5.0 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Archiving advances selection to next message for easier list clearing. Archiving advances selection to next message for easier list clearing. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | Low |
Upgraded fast-xml-parser to v5, clearing a dependency advisory. Upgraded fast-xml-parser to v5, clearing a dependency advisory. Source: granite4.1:30b@2026-07-13-audit Confidence: low |
— |
| Bugfix | Medium |
Gmail archiving falls back to All Mail when the Archive folder is absent. Gmail archiving falls back to All Mail when the Archive folder is absent. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
CardDAV contact fields with trailing ` ` and empty fields are correctly rendered, and overflow issues in badge/label display are fixed. CardDAV contact fields with trailing ` ` and empty fields are correctly rendered, and overflow issues in badge/label display are fixed. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Message previews no longer display raw tracking URLs or HTML markup; proper body text is shown. Message previews no longer display raw tracking URLs or HTML markup; proper body text is shown. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Snooze wake restores the correct message copy when duplicates exist across folders. Snooze wake restores the correct message copy when duplicates exist across folders. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Conflicting custom keyboard shortcuts log a warning instead of silently disabling defaults. Conflicting custom keyboard shortcuts log a warning instead of silently disabling defaults. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Search automatically closes when switching folders, unless "Search all folders" is enabled. Search automatically closes when switching folders, unless "Search all folders" is enabled. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Bugfix | Medium |
Device‑code connections for Outlook.com/Hotmail keep syncing after token refresh and recover automatically. Device‑code connections for Outlook.com/Hotmail keep syncing after token refresh and recover automatically. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Bugfix | Medium |
IMAP initial connections are paced per provider and account count to avoid rate limits in large setups. IMAP initial connections are paced per provider and account count to avoid rate limits in large setups. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Bugfix | Medium |
High Contrast theme uses readable dark text for accent buttons and selection checkmark, and logo/favicon follow custom accent color. High Contrast theme uses readable dark text for accent buttons and selection checkmark, and logo/favicon follow custom accent color. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Refactor | Low |
Declared `@tiptap/core`, moved `postcss` to runtime dependencies, and removed unused `GOOGLE_*` env vars. Declared `@tiptap/core`, moved `postcss` to runtime dependencies, and removed unused `GOOGLE_*` env vars. Source: granite4.1:30b@2026-07-13-audit Confidence: low |
— |
Full changelog
v2.5.0
New
- Search now closes automatically when you switch to a different folder, so you drop back into the normal folder view instead of a stale search. Searches stay open if "Search all folders" is on. (#221)
- Archiving now advances the selection to the next message, so you can clear a list without re-selecting each time. Thanks @salmonumbrella. (#247)
Fixes
- Microsoft personal accounts (Outlook.com / Hotmail): device-code connections now keep syncing past the first hour instead of dropping when the token refreshes. Accounts broken by the earlier issue recover automatically on the next refresh, no reconnect needed. The Client Secret field is also no longer marked required, since device-code accounts don't need one. (#216)
- IMAP scaling: initial connections are now paced per provider and by account count, so large multi-account setups (for example many PurelyMail accounts) no longer trip connection rate limits, IP bans, or account locks on startup. (#218)
- Gmail: archiving now works on stock Gmail accounts, which have no Archive folder — it falls back to All Mail. Thanks @salmonumbrella. (#243)
- CardDAV contacts: fixed contact fields ending in
and empty fields showing as (Nextcloud and other SabreDAV servers), plus the "Synced from CardDAV" badge and phone-type labels overflowing in the contact view. (#242) - High Contrast theme: accent buttons and the selection checkmark now use readable dark text instead of near-invisible white, and the logo and favicon follow a custom accent color. (#251)
- Message previews no longer show raw tracking URLs or HTML markup instead of body text. Thanks @salmonumbrella. (#249)
- Snooze: waking a message now restores only the correct copy when the same message exists in more than one folder. Thanks @salmonumbrella. (#244)
- Keyboard shortcuts: a customized shortcut that collides with a default now logs a warning instead of silently disabling the default. Thanks @salmonumbrella. (#245)
Internal
- Upgraded fast-xml-parser to v5, clearing a dependency advisory. Thanks @salmonumbrella. (#252)
- Dependency hygiene: declared
@tiptap/core, movedpostcssto runtime dependencies, and removed unusedGOOGLE_*env vars. Thanks @salmonumbrella. (#246) - Added a startup log summarizing IMAP connection pacing, for diagnosing large multi-account setups.
Contributors
Big thanks to @salmonumbrella for seven merged PRs this release (#243, #244, #245, #246, #247, #249, #252). Thanks also to everyone who reported issues: @Maomaoxion (#216), @rahhing (#218), @computrav (#221), @brmiller (#242), and @PaddiM8 (#251).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]