Tachyon - Releases

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published

Added

• OAuth2 for additional accounts, not only the one you log in with. A Gmail, Office 365 or generic OAuth2 account can be added from Settings, Accounts without an app password, and so without turning on 2-step verification to obtain one (#90)
• The generic OAuth2 plugin is now genuinely generic. Its endpoints, scopes, userinfo URL and the domains it answers for are configuration, so it serves any provider that does RFC 7628 and can say which address was authorized
• Swipe sideways on a phone to reach the next or previous message. The list is hidden while a message is open, so reading a run of mail otherwise meant closing each one and finding your place again. The message follows your finger, and a chevron appears once the gesture has gone far enough to act on (#102)
• Delivery receipts carry an envelope id, so a notification arriving days later can be tied to the message that caused it (#96)

Fixed

• Encrypting a message without also signing it broke both send and save, with TypeError: e.findIndex is not a function and nothing sent or saved. Choosing the crypto method in 4.2.4 started treating a value as a list that collapses to false when the feature is off, and for a draft regardless. Inherited from SnappyMail, where nothing ever did more than read its length (#103)
• S/MIME messages would not decrypt on Exchange. The MIME headers openssl needs were read from BODY[<part>.MIME], which Exchange answers with NIL, correctly: the message is not multipart, so there is no part-level header and the Content-Type is the message's own. The body reached openssl as a bare base64 blob with nothing reporting why. Diagnosed from an IMAP trace supplied by @reaisinc (#92)
• View original, Download original and attachment downloads failed in the installed app. Running as a PWA, a link opened in a tab lands in the browser, a separate context, so the request goes out cross-site and without the session cookie that identifies the account. The content is now fetched inside the app and handed over as a blob; an ordinary browser tab still streams from the server as before (#81)
• Delivery receipts asked for success and failure but never delay. Many servers decline success notifications as backscatter protection while honouring delay, so a queued or retried message reported nothing at all (#96)
• Requesting a delivery receipt did nothing on a domain set to use php mail(), which cannot pass the SMTP parameters one needs. The request was discarded in silence. The admin panel now says what the setting costs, beside the setting (#96)
• The Office 365 add-account flow could not work on a default install. Its signed state carried a CSRF token compared against the session's, and that value comes from a cookie the cross-site redirect withholds, so a fresh one was minted and the comparison could never match. This guarded its plain login too (#90)
• The Gmail plugin's token refresh wrote the new expiry to an undefined variable, so every IMAP, SMTP and Sieve connection refreshed the token again for the life of the session

Changed

• Release tarballs carry real timestamps. PharData gave every entry an mtime of 1970, so an install deployed from the tarball served Last-Modified: Thu, 01 Jan 1970 for every asset, leaving browsers nothing to revalidate against and letting a bad cached copy outlive a reinstall. The zip was never affected
• Russian and Chinese are more complete, thanks to @lvarnava and @dreamawake

Added

• Delivery receipts carry an envelope id, so a notification that turns up days later can be matched to the message that caused it (#96)

Fixed

• Requesting a delivery receipt did nothing whatsoever on a domain set to use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so the request was discarded in silence, with the tick box in the compose window doing precisely nothing. The admin panel now says what the setting costs beside the setting itself, and both places a request used to be dropped without a word are logged. Found by @lvarnava, who noticed the one domain it worked on was the one with the box unticked (#96)
• Delivery receipts asked for success and failure but never delay. Plenty of servers decline to send success notifications as backscatter protection while still honouring delay, so a message that was queued or retried reported nothing at all to the sender (#96)
• Placeholder text was invisible on Xv, Linen and Squares. The rule meant to colour it was written with one colon rather than two, so it matched nothing and had never applied on any theme. Those three are also the only ones pairing a light wallpaper with a translucent black login box, which composited to mid grey; their own labels sat at 3.86:1, below the readable threshold, which nobody had reported (#94)
• The messages per page limit now caps the default, rather than the larger of the two setting the ceiling. A default above the limit was handing every new user a number their own settings screen would refuse the moment they opened it (#73)
• PDF attachments lost their preview link and the eye badge added in 4.0.5. The check read navigator.mimeTypes, a deprecated API that browsers now populate only while the built-in PDF viewer is enabled, so it came back empty on anything current. It asks navigator.pdfViewerEnabled instead

Changed

• The README credits Weblate and charts progress per language, as the Libre plan asks
• CONTRIBUTING opens with translating, the one kind of contribution that needs none of the toolchain, and its release switches, gulp advice and debug config keys match the code again
• SECURITY.md listed 3.x as the supported line and asked for encrypted email without giving either an address or a key, so there was no way to report a vulnerability privately. Private reporting is enabled on the repository and the policy points at it
• Seven dead files left over from SnappyMail and RainLoop are gone from the repository root, along with a roadmap that finished months ago
• Release assets upload with gh, and packages.json is no longer re-committed when only the signatures moved
• Russian and Danish are substantially more complete, thanks to @lvarnava and @BrainDeLook

Added

• A Calendar button on the folder panel, beside the Contacts one that was already there (#75)
• Messages per page is now two admin settings rather than one: a default, and a separate limit on what a user may choose. Both are on the General tab instead of only in the config file (#73)

Fixed

• A long webmail title broke two-factor enrolment outright. The title is the QR code's issuer and appears in it twice, and percent-encoding turns one Cyrillic character into six bytes, so a 60 character title came to 744 bytes against the 213 a QR code of that size holds. The title is shortened now rather than the code failing, and the failure it used to produce named neither the real input nor the real limit (#80)
• The settings input capped messages per page at 50 while the save clamped at 100 and the admin could configure anything, so a site set higher could not be matched from the settings screen (#73)
• A still-enabled SnappyMail could leave the Nextcloud session holding a user id but no passphrase, so auto-login found nothing to send and presented an empty password field with nothing to explain it (#72)
• The General and Config admin tabs edit the same keys, and General never re-read them, so a value changed on Config still showed the old number and saving put it back
• Search filters were not applied on a fresh login, because the settings lookup needed a session that imap.after-login runs before. Thanks to @wojt-janowski
• Weblate's safe-html autofix had escaped & to & inside translated strings. Those render as text, not HTML, so eight languages were displaying the entity. A CI check now fails on it rather than leaving it to review

Changed

• Russian is substantially more complete, thanks to @lvarnava and @BrainDeLook

Fixed

• The SnappyMail logo was still shipping in nine places, including desktop notifications, the admin About tab and both the Nextcloud and ownCloud integrations. Its Braille dots read SNAPPY (#51)
• Search filters were shared by every account on the install, so a rule filing mail into a folder that exists in one mailbox ran against all of them. Because the rules run during login, the resulting failure was reported as a failed login. Filters are now per address, and an existing list stays with the account that created it
• Deleting a search filter appeared to do nothing while actually deleting it
• Search filters moved messages out of INBOX even when they were found elsewhere
• Editing an account at an internationalised domain failed with "Unknown error". The account list is sent to the client in unicode while accounts are stored under the ASCII form, and the address was not converted back on the way in, so the lookup found nothing
• A sender with no avatar answered 404, which logged a console error for most of a normal message list, and was the one response carrying no cache headers, so every render asked again and redid the lookups behind it

Added

• Add an invitation to a calendar from the message it arrived in. Handles files holding several events, and recurring series with moved occurrences
• Import a whole .ics file into a calendar
• A date picker in place of the native one, which rendered in the browser's locale and ignored everything Tachyon asked of it, plus a date format setting that follows the interface language by default
• Week numbers and first day of the week are user settings
• Release artifacts are signed, and the public key ships alongside them

Changed

• Seven designs that shipped as a light theme and a dark theme are now one theme each, switched with the light/dark toggle: Stripes, Love, Snow, Blurred, Squares, Wood, and Shine (formerly DarkShine and NightShine). A saved theme migrates on its own, and an account on a dark build lands on the merged theme already in dark mode
• Default, Linen, A, Xv and Clear gained a dark mode; Magnetic gained a light one. All 16 themes now answer the toggle

Fixed

• The admin panel's update button downloaded the cPanel package rather than the webmail one, so updating always failed
• Image whitelist entries were being overwritten by whichever session wrote last, rather than expiring as it appeared
• The Contacts menu opened partly off screen on phones (#50)
• The calendar grid was dark grey on light themes and white on some dark ones
• The event editor honours a 24-hour clock, keeps its fields inside the dialog, and moving the start past the end carries the end with it
• Nextcloud translation catalogues registered under the old app id, so none of them loaded
• fail2ban filters, AUR package metadata and release signing still described SnappyMail

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published

Added

• OAuth2 for additional accounts, not only the one you log in with. A Gmail, Office 365 or generic OAuth2 account can be added from Settings, Accounts without an app password, and so without turning on 2-step verification to obtain one (#90)
• The generic OAuth2 plugin is now genuinely generic. Its endpoints, scopes, userinfo URL and the domains it answers for are configuration, so it serves any provider that does RFC 7628 and can say which address was authorized
• Swipe sideways on a phone to reach the next or previous message. The list is hidden while a message is open, so reading a run of mail otherwise meant closing each one and finding your place again. The message follows your finger, and a chevron appears once the gesture has gone far enough to act on (#102)
• Delivery receipts carry an envelope id, so a notification arriving days later can be tied to the message that caused it (#96)

Fixed

• Encrypting a message without also signing it broke both send and save, with TypeError: e.findIndex is not a function and nothing sent or saved. Choosing the crypto method in 4.2.4 started treating a value as a list that collapses to false when the feature is off, and for a draft regardless. Inherited from SnappyMail, where nothing ever did more than read its length (#103)
• S/MIME messages would not decrypt on Exchange. The MIME headers openssl needs were read from BODY[<part>.MIME], which Exchange answers with NIL, correctly: the message is not multipart, so there is no part-level header and the Content-Type is the message's own. The body reached openssl as a bare base64 blob with nothing reporting why. Diagnosed from an IMAP trace supplied by @reaisinc (#92)
• View original, Download original and attachment downloads failed in the installed app. Running as a PWA, a link opened in a tab lands in the browser, a separate context, so the request goes out cross-site and without the session cookie that identifies the account. The content is now fetched inside the app and handed over as a blob; an ordinary browser tab still streams from the server as before (#81)
• Delivery receipts asked for success and failure but never delay. Many servers decline success notifications as backscatter protection while honouring delay, so a queued or retried message reported nothing at all (#96)
• Requesting a delivery receipt did nothing on a domain set to use php mail(), which cannot pass the SMTP parameters one needs. The request was discarded in silence. The admin panel now says what the setting costs, beside the setting (#96)
• The Office 365 add-account flow could not work on a default install. Its signed state carried a CSRF token compared against the session's, and that value comes from a cookie the cross-site redirect withholds, so a fresh one was minted and the comparison could never match. This guarded its plain login too (#90)
• The Gmail plugin's token refresh wrote the new expiry to an undefined variable, so every IMAP, SMTP and Sieve connection refreshed the token again for the life of the session

Changed

• Release tarballs carry real timestamps. PharData gave every entry an mtime of 1970, so an install deployed from the tarball served Last-Modified: Thu, 01 Jan 1970 for every asset, leaving browsers nothing to revalidate against and letting a bad cached copy outlive a reinstall. The zip was never affected
• Russian and Chinese are more complete, thanks to @lvarnava and @dreamawake

Added

• Delivery receipts carry an envelope id, so a notification that turns up days later can be matched to the message that caused it (#96)

Fixed

• Requesting a delivery receipt did nothing whatsoever on a domain set to use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so the request was discarded in silence, with the tick box in the compose window doing precisely nothing. The admin panel now says what the setting costs beside the setting itself, and both places a request used to be dropped without a word are logged. Found by @lvarnava, who noticed the one domain it worked on was the one with the box unticked (#96)
• Delivery receipts asked for success and failure but never delay. Plenty of servers decline to send success notifications as backscatter protection while still honouring delay, so a message that was queued or retried reported nothing at all to the sender (#96)
• Placeholder text was invisible on Xv, Linen and Squares. The rule meant to colour it was written with one colon rather than two, so it matched nothing and had never applied on any theme. Those three are also the only ones pairing a light wallpaper with a translucent black login box, which composited to mid grey; their own labels sat at 3.86:1, below the readable threshold, which nobody had reported (#94)
• The messages per page limit now caps the default, rather than the larger of the two setting the ceiling. A default above the limit was handing every new user a number their own settings screen would refuse the moment they opened it (#73)
• PDF attachments lost their preview link and the eye badge added in 4.0.5. The check read navigator.mimeTypes, a deprecated API that browsers now populate only while the built-in PDF viewer is enabled, so it came back empty on anything current. It asks navigator.pdfViewerEnabled instead

Changed

• The README credits Weblate and charts progress per language, as the Libre plan asks
• CONTRIBUTING opens with translating, the one kind of contribution that needs none of the toolchain, and its release switches, gulp advice and debug config keys match the code again
• SECURITY.md listed 3.x as the supported line and asked for encrypted email without giving either an address or a key, so there was no way to report a vulnerability privately. Private reporting is enabled on the repository and the policy points at it
• Seven dead files left over from SnappyMail and RainLoop are gone from the repository root, along with a roadmap that finished months ago
• Release assets upload with gh, and packages.json is no longer re-committed when only the signatures moved
• Russian and Danish are substantially more complete, thanks to @lvarnava and @BrainDeLook

Added

• A Calendar button on the folder panel, beside the Contacts one that was already there (#75)
• Messages per page is now two admin settings rather than one: a default, and a separate limit on what a user may choose. Both are on the General tab instead of only in the config file (#73)

Fixed

• A long webmail title broke two-factor enrolment outright. The title is the QR code's issuer and appears in it twice, and percent-encoding turns one Cyrillic character into six bytes, so a 60 character title came to 744 bytes against the 213 a QR code of that size holds. The title is shortened now rather than the code failing, and the failure it used to produce named neither the real input nor the real limit (#80)
• The settings input capped messages per page at 50 while the save clamped at 100 and the admin could configure anything, so a site set higher could not be matched from the settings screen (#73)
• A still-enabled SnappyMail could leave the Nextcloud session holding a user id but no passphrase, so auto-login found nothing to send and presented an empty password field with nothing to explain it (#72)
• The General and Config admin tabs edit the same keys, and General never re-read them, so a value changed on Config still showed the old number and saving put it back
• Search filters were not applied on a fresh login, because the settings lookup needed a session that imap.after-login runs before. Thanks to @wojt-janowski
• Weblate's safe-html autofix had escaped & to & inside translated strings. Those render as text, not HTML, so eight languages were displaying the entity. A CI check now fails on it rather than leaving it to review

Changed

• Russian is substantially more complete, thanks to @lvarnava and @BrainDeLook

Fixed

• The SnappyMail logo was still shipping in nine places, including desktop notifications, the admin About tab and both the Nextcloud and ownCloud integrations. Its Braille dots read SNAPPY (#51)
• Search filters were shared by every account on the install, so a rule filing mail into a folder that exists in one mailbox ran against all of them. Because the rules run during login, the resulting failure was reported as a failed login. Filters are now per address, and an existing list stays with the account that created it
• Deleting a search filter appeared to do nothing while actually deleting it
• Search filters moved messages out of INBOX even when they were found elsewhere
• Editing an account at an internationalised domain failed with "Unknown error". The account list is sent to the client in unicode while accounts are stored under the ASCII form, and the address was not converted back on the way in, so the lookup found nothing
• A sender with no avatar answered 404, which logged a console error for most of a normal message list, and was the one response carrying no cache headers, so every render asked again and redid the lookups behind it

Added

• Add an invitation to a calendar from the message it arrived in. Handles files holding several events, and recurring series with moved occurrences
• Import a whole .ics file into a calendar
• A date picker in place of the native one, which rendered in the browser's locale and ignored everything Tachyon asked of it, plus a date format setting that follows the interface language by default
• Week numbers and first day of the week are user settings
• Release artifacts are signed, and the public key ships alongside them

Changed

• Seven designs that shipped as a light theme and a dark theme are now one theme each, switched with the light/dark toggle: Stripes, Love, Snow, Blurred, Squares, Wood, and Shine (formerly DarkShine and NightShine). A saved theme migrates on its own, and an account on a dark build lands on the merged theme already in dark mode
• Default, Linen, A, Xv and Clear gained a dark mode; Magnetic gained a light one. All 16 themes now answer the toggle

Fixed

• The admin panel's update button downloaded the cPanel package rather than the webmail one, so updating always failed
• Image whitelist entries were being overwritten by whichever session wrote last, rather than expiring as it appeared
• The Contacts menu opened partly off screen on phones (#50)
• The calendar grid was dark grey on light themes and white on some dark ones
• The event editor honours a 24-hour clock, keeps its fields inside the dialog, and moving the start past the end carries the end with it
• Nextcloud translation catalogues registered under the old app id, so none of them loaded
• fail2ban filters, AUR package metadata and release signing still described SnappyMail

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published

Added

• OAuth2 for additional accounts, not only the one you log in with. A Gmail, Office 365 or generic OAuth2 account can be added from Settings, Accounts without an app password, and so without turning on 2-step verification to obtain one (#90)
• The generic OAuth2 plugin is now genuinely generic. Its endpoints, scopes, userinfo URL and the domains it answers for are configuration, so it serves any provider that does RFC 7628 and can say which address was authorized
• Swipe sideways on a phone to reach the next or previous message. The list is hidden while a message is open, so reading a run of mail otherwise meant closing each one and finding your place again. The message follows your finger, and a chevron appears once the gesture has gone far enough to act on (#102)
• Delivery receipts carry an envelope id, so a notification arriving days later can be tied to the message that caused it (#96)

Fixed

• Encrypting a message without also signing it broke both send and save, with TypeError: e.findIndex is not a function and nothing sent or saved. Choosing the crypto method in 4.2.4 started treating a value as a list that collapses to false when the feature is off, and for a draft regardless. Inherited from SnappyMail, where nothing ever did more than read its length (#103)
• S/MIME messages would not decrypt on Exchange. The MIME headers openssl needs were read from BODY[<part>.MIME], which Exchange answers with NIL, correctly: the message is not multipart, so there is no part-level header and the Content-Type is the message's own. The body reached openssl as a bare base64 blob with nothing reporting why. Diagnosed from an IMAP trace supplied by @reaisinc (#92)
• View original, Download original and attachment downloads failed in the installed app. Running as a PWA, a link opened in a tab lands in the browser, a separate context, so the request goes out cross-site and without the session cookie that identifies the account. The content is now fetched inside the app and handed over as a blob; an ordinary browser tab still streams from the server as before (#81)
• Delivery receipts asked for success and failure but never delay. Many servers decline success notifications as backscatter protection while honouring delay, so a queued or retried message reported nothing at all (#96)
• Requesting a delivery receipt did nothing on a domain set to use php mail(), which cannot pass the SMTP parameters one needs. The request was discarded in silence. The admin panel now says what the setting costs, beside the setting (#96)
• The Office 365 add-account flow could not work on a default install. Its signed state carried a CSRF token compared against the session's, and that value comes from a cookie the cross-site redirect withholds, so a fresh one was minted and the comparison could never match. This guarded its plain login too (#90)
• The Gmail plugin's token refresh wrote the new expiry to an undefined variable, so every IMAP, SMTP and Sieve connection refreshed the token again for the life of the session

Changed

• Release tarballs carry real timestamps. PharData gave every entry an mtime of 1970, so an install deployed from the tarball served Last-Modified: Thu, 01 Jan 1970 for every asset, leaving browsers nothing to revalidate against and letting a bad cached copy outlive a reinstall. The zip was never affected
• Russian and Chinese are more complete, thanks to @lvarnava and @dreamawake

Added

• Delivery receipts carry an envelope id, so a notification that turns up days later can be matched to the message that caused it (#96)

Fixed

• Requesting a delivery receipt did nothing whatsoever on a domain set to use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so the request was discarded in silence, with the tick box in the compose window doing precisely nothing. The admin panel now says what the setting costs beside the setting itself, and both places a request used to be dropped without a word are logged. Found by @lvarnava, who noticed the one domain it worked on was the one with the box unticked (#96)
• Delivery receipts asked for success and failure but never delay. Plenty of servers decline to send success notifications as backscatter protection while still honouring delay, so a message that was queued or retried reported nothing at all to the sender (#96)
• Placeholder text was invisible on Xv, Linen and Squares. The rule meant to colour it was written with one colon rather than two, so it matched nothing and had never applied on any theme. Those three are also the only ones pairing a light wallpaper with a translucent black login box, which composited to mid grey; their own labels sat at 3.86:1, below the readable threshold, which nobody had reported (#94)
• The messages per page limit now caps the default, rather than the larger of the two setting the ceiling. A default above the limit was handing every new user a number their own settings screen would refuse the moment they opened it (#73)
• PDF attachments lost their preview link and the eye badge added in 4.0.5. The check read navigator.mimeTypes, a deprecated API that browsers now populate only while the built-in PDF viewer is enabled, so it came back empty on anything current. It asks navigator.pdfViewerEnabled instead

Changed

• The README credits Weblate and charts progress per language, as the Libre plan asks
• CONTRIBUTING opens with translating, the one kind of contribution that needs none of the toolchain, and its release switches, gulp advice and debug config keys match the code again
• SECURITY.md listed 3.x as the supported line and asked for encrypted email without giving either an address or a key, so there was no way to report a vulnerability privately. Private reporting is enabled on the repository and the policy points at it
• Seven dead files left over from SnappyMail and RainLoop are gone from the repository root, along with a roadmap that finished months ago
• Release assets upload with gh, and packages.json is no longer re-committed when only the signatures moved
• Russian and Danish are substantially more complete, thanks to @lvarnava and @BrainDeLook

Added

• A Calendar button on the folder panel, beside the Contacts one that was already there (#75)
• Messages per page is now two admin settings rather than one: a default, and a separate limit on what a user may choose. Both are on the General tab instead of only in the config file (#73)

Fixed

• A long webmail title broke two-factor enrolment outright. The title is the QR code's issuer and appears in it twice, and percent-encoding turns one Cyrillic character into six bytes, so a 60 character title came to 744 bytes against the 213 a QR code of that size holds. The title is shortened now rather than the code failing, and the failure it used to produce named neither the real input nor the real limit (#80)
• The settings input capped messages per page at 50 while the save clamped at 100 and the admin could configure anything, so a site set higher could not be matched from the settings screen (#73)
• A still-enabled SnappyMail could leave the Nextcloud session holding a user id but no passphrase, so auto-login found nothing to send and presented an empty password field with nothing to explain it (#72)
• The General and Config admin tabs edit the same keys, and General never re-read them, so a value changed on Config still showed the old number and saving put it back
• Search filters were not applied on a fresh login, because the settings lookup needed a session that imap.after-login runs before. Thanks to @wojt-janowski
• Weblate's safe-html autofix had escaped & to & inside translated strings. Those render as text, not HTML, so eight languages were displaying the entity. A CI check now fails on it rather than leaving it to review

Changed

• Russian is substantially more complete, thanks to @lvarnava and @BrainDeLook

Fixed

• The SnappyMail logo was still shipping in nine places, including desktop notifications, the admin About tab and both the Nextcloud and ownCloud integrations. Its Braille dots read SNAPPY (#51)
• Search filters were shared by every account on the install, so a rule filing mail into a folder that exists in one mailbox ran against all of them. Because the rules run during login, the resulting failure was reported as a failed login. Filters are now per address, and an existing list stays with the account that created it
• Deleting a search filter appeared to do nothing while actually deleting it
• Search filters moved messages out of INBOX even when they were found elsewhere
• Editing an account at an internationalised domain failed with "Unknown error". The account list is sent to the client in unicode while accounts are stored under the ASCII form, and the address was not converted back on the way in, so the lookup found nothing
• A sender with no avatar answered 404, which logged a console error for most of a normal message list, and was the one response carrying no cache headers, so every render asked again and redid the lookups behind it

Added

• Add an invitation to a calendar from the message it arrived in. Handles files holding several events, and recurring series with moved occurrences
• Import a whole .ics file into a calendar
• A date picker in place of the native one, which rendered in the browser's locale and ignored everything Tachyon asked of it, plus a date format setting that follows the interface language by default
• Week numbers and first day of the week are user settings
• Release artifacts are signed, and the public key ships alongside them

Changed

• Seven designs that shipped as a light theme and a dark theme are now one theme each, switched with the light/dark toggle: Stripes, Love, Snow, Blurred, Squares, Wood, and Shine (formerly DarkShine and NightShine). A saved theme migrates on its own, and an account on a dark build lands on the merged theme already in dark mode
• Default, Linen, A, Xv and Clear gained a dark mode; Magnetic gained a light one. All 16 themes now answer the toggle

Fixed

• The admin panel's update button downloaded the cPanel package rather than the webmail one, so updating always failed
• Image whitelist entries were being overwritten by whichever session wrote last, rather than expiring as it appeared
• The Contacts menu opened partly off screen on phones (#50)
• The calendar grid was dark grey on light themes and white on some dark ones
• The event editor honours a 24-hour clock, keeps its fields inside the dialog, and moving the start past the end carries the end with it
• Nextcloud translation catalogues registered under the old app id, so none of them loaded
• fail2ban filters, AUR package metadata and release signing still described SnappyMail

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published

Added

• OAuth2 for additional accounts, not only the one you log in with. A Gmail, Office 365 or generic OAuth2 account can be added from Settings, Accounts without an app password, and so without turning on 2-step verification to obtain one (#90)
• The generic OAuth2 plugin is now genuinely generic. Its endpoints, scopes, userinfo URL and the domains it answers for are configuration, so it serves any provider that does RFC 7628 and can say which address was authorized
• Swipe sideways on a phone to reach the next or previous message. The list is hidden while a message is open, so reading a run of mail otherwise meant closing each one and finding your place again. The message follows your finger, and a chevron appears once the gesture has gone far enough to act on (#102)
• Delivery receipts carry an envelope id, so a notification arriving days later can be tied to the message that caused it (#96)

Fixed

• Encrypting a message without also signing it broke both send and save, with TypeError: e.findIndex is not a function and nothing sent or saved. Choosing the crypto method in 4.2.4 started treating a value as a list that collapses to false when the feature is off, and for a draft regardless. Inherited from SnappyMail, where nothing ever did more than read its length (#103)
• S/MIME messages would not decrypt on Exchange. The MIME headers openssl needs were read from BODY[<part>.MIME], which Exchange answers with NIL, correctly: the message is not multipart, so there is no part-level header and the Content-Type is the message's own. The body reached openssl as a bare base64 blob with nothing reporting why. Diagnosed from an IMAP trace supplied by @reaisinc (#92)
• View original, Download original and attachment downloads failed in the installed app. Running as a PWA, a link opened in a tab lands in the browser, a separate context, so the request goes out cross-site and without the session cookie that identifies the account. The content is now fetched inside the app and handed over as a blob; an ordinary browser tab still streams from the server as before (#81)
• Delivery receipts asked for success and failure but never delay. Many servers decline success notifications as backscatter protection while honouring delay, so a queued or retried message reported nothing at all (#96)
• Requesting a delivery receipt did nothing on a domain set to use php mail(), which cannot pass the SMTP parameters one needs. The request was discarded in silence. The admin panel now says what the setting costs, beside the setting (#96)
• The Office 365 add-account flow could not work on a default install. Its signed state carried a CSRF token compared against the session's, and that value comes from a cookie the cross-site redirect withholds, so a fresh one was minted and the comparison could never match. This guarded its plain login too (#90)
• The Gmail plugin's token refresh wrote the new expiry to an undefined variable, so every IMAP, SMTP and Sieve connection refreshed the token again for the life of the session

Changed

• Release tarballs carry real timestamps. PharData gave every entry an mtime of 1970, so an install deployed from the tarball served Last-Modified: Thu, 01 Jan 1970 for every asset, leaving browsers nothing to revalidate against and letting a bad cached copy outlive a reinstall. The zip was never affected
• Russian and Chinese are more complete, thanks to @lvarnava and @dreamawake

Added

• Delivery receipts carry an envelope id, so a notification that turns up days later can be matched to the message that caused it (#96)

Fixed

• Requesting a delivery receipt did nothing whatsoever on a domain set to use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so the request was discarded in silence, with the tick box in the compose window doing precisely nothing. The admin panel now says what the setting costs beside the setting itself, and both places a request used to be dropped without a word are logged. Found by @lvarnava, who noticed the one domain it worked on was the one with the box unticked (#96)
• Delivery receipts asked for success and failure but never delay. Plenty of servers decline to send success notifications as backscatter protection while still honouring delay, so a message that was queued or retried reported nothing at all to the sender (#96)
• Placeholder text was invisible on Xv, Linen and Squares. The rule meant to colour it was written with one colon rather than two, so it matched nothing and had never applied on any theme. Those three are also the only ones pairing a light wallpaper with a translucent black login box, which composited to mid grey; their own labels sat at 3.86:1, below the readable threshold, which nobody had reported (#94)
• The messages per page limit now caps the default, rather than the larger of the two setting the ceiling. A default above the limit was handing every new user a number their own settings screen would refuse the moment they opened it (#73)
• PDF attachments lost their preview link and the eye badge added in 4.0.5. The check read navigator.mimeTypes, a deprecated API that browsers now populate only while the built-in PDF viewer is enabled, so it came back empty on anything current. It asks navigator.pdfViewerEnabled instead

Changed

• The README credits Weblate and charts progress per language, as the Libre plan asks
• CONTRIBUTING opens with translating, the one kind of contribution that needs none of the toolchain, and its release switches, gulp advice and debug config keys match the code again
• SECURITY.md listed 3.x as the supported line and asked for encrypted email without giving either an address or a key, so there was no way to report a vulnerability privately. Private reporting is enabled on the repository and the policy points at it
• Seven dead files left over from SnappyMail and RainLoop are gone from the repository root, along with a roadmap that finished months ago
• Release assets upload with gh, and packages.json is no longer re-committed when only the signatures moved
• Russian and Danish are substantially more complete, thanks to @lvarnava and @BrainDeLook

Added

• A Calendar button on the folder panel, beside the Contacts one that was already there (#75)
• Messages per page is now two admin settings rather than one: a default, and a separate limit on what a user may choose. Both are on the General tab instead of only in the config file (#73)

Fixed

• A long webmail title broke two-factor enrolment outright. The title is the QR code's issuer and appears in it twice, and percent-encoding turns one Cyrillic character into six bytes, so a 60 character title came to 744 bytes against the 213 a QR code of that size holds. The title is shortened now rather than the code failing, and the failure it used to produce named neither the real input nor the real limit (#80)
• The settings input capped messages per page at 50 while the save clamped at 100 and the admin could configure anything, so a site set higher could not be matched from the settings screen (#73)
• A still-enabled SnappyMail could leave the Nextcloud session holding a user id but no passphrase, so auto-login found nothing to send and presented an empty password field with nothing to explain it (#72)
• The General and Config admin tabs edit the same keys, and General never re-read them, so a value changed on Config still showed the old number and saving put it back
• Search filters were not applied on a fresh login, because the settings lookup needed a session that imap.after-login runs before. Thanks to @wojt-janowski
• Weblate's safe-html autofix had escaped & to & inside translated strings. Those render as text, not HTML, so eight languages were displaying the entity. A CI check now fails on it rather than leaving it to review

Changed

• Russian is substantially more complete, thanks to @lvarnava and @BrainDeLook

Fixed

• The SnappyMail logo was still shipping in nine places, including desktop notifications, the admin About tab and both the Nextcloud and ownCloud integrations. Its Braille dots read SNAPPY (#51)
• Search filters were shared by every account on the install, so a rule filing mail into a folder that exists in one mailbox ran against all of them. Because the rules run during login, the resulting failure was reported as a failed login. Filters are now per address, and an existing list stays with the account that created it
• Deleting a search filter appeared to do nothing while actually deleting it
• Search filters moved messages out of INBOX even when they were found elsewhere
• Editing an account at an internationalised domain failed with "Unknown error". The account list is sent to the client in unicode while accounts are stored under the ASCII form, and the address was not converted back on the way in, so the lookup found nothing
• A sender with no avatar answered 404, which logged a console error for most of a normal message list, and was the one response carrying no cache headers, so every render asked again and redid the lookups behind it

Added

• Add an invitation to a calendar from the message it arrived in. Handles files holding several events, and recurring series with moved occurrences
• Import a whole .ics file into a calendar
• A date picker in place of the native one, which rendered in the browser's locale and ignored everything Tachyon asked of it, plus a date format setting that follows the interface language by default
• Week numbers and first day of the week are user settings
• Release artifacts are signed, and the public key ships alongside them

Changed

• Seven designs that shipped as a light theme and a dark theme are now one theme each, switched with the light/dark toggle: Stripes, Love, Snow, Blurred, Squares, Wood, and Shine (formerly DarkShine and NightShine). A saved theme migrates on its own, and an account on a dark build lands on the merged theme already in dark mode
• Default, Linen, A, Xv and Clear gained a dark mode; Magnetic gained a light one. All 16 themes now answer the toggle

Fixed

• The admin panel's update button downloaded the cPanel package rather than the webmail one, so updating always failed
• Image whitelist entries were being overwritten by whichever session wrote last, rather than expiring as it appeared
• The Contacts menu opened partly off screen on phones (#50)
• The calendar grid was dark grey on light themes and white on some dark ones
• The event editor honours a 24-hour clock, keeps its fields inside the dialog, and moving the start past the end carries the end with it
• Nextcloud translation catalogues registered under the old app id, so none of them loaded
• fail2ban filters, AUR package metadata and release signing still described SnappyMail

Fixed

• Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

• An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)
• S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)
• Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)
• Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG
• Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt
• Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either
• The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header
• S/MIME actions put the client's part id into an IMAP FETCH unchecked
• The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

• :latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Fixed

• Plugin translations never reached an install. Weblate merges a translation into a plugin's langs/ directory and never touches its index.php, so the declared version stayed put, packages.json advertised the version the install already had, and Admin, Extensions offered nothing to update. The translation was inside the published package the whole time with no way to get at it. The published version now carries a build number that rises whenever a plugin's contents change, so a merged translation is offered as an update. Reported by @lvarnava in discussion #33

Changed

• Eight plugins are republished so their pending work actually ships: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth, and the OAuth2 fixes in login-o365 and login-oauth2, which went out in 4.3.0 under versions that had already been published