1.26.2 (10/22/2026)
This is a security patch release. Eight eMudhra intermediate certificates had their private keys compromised, so an attacker holding one could impersonate any mail server or website. (https://emudhra.we-have-a-problem.com/)
The previous release (1.26.1) updated Electron, and this release ensures that Mailspring's sync engine delegates trust decisions to the system certificate chain on every platform and for every connection (IMAP, SMTP, Caldav, etc). MacOS and Windows invalidated the eMudhra certificates by adding them to a separate "distrust" policy store, and this release ensures that Mailspring consults that list and well as the certificate trust chain when opening secure connections.
Bug Fixes:
- Fixed emails that declare a dark color scheme turning the message background black. (#2988)
- Fixed the Back and Close buttons in account setup not responding to clicks.
- The MCP server's
reply_to_threadtool now loads the message body before quoting it. - On macOS, fixed the Darkside theme's window controls sticking to the top of the window. (#2984) Thanks @AlexandreAgrn!
- Fixed calendar and contacts sync leaving a network connection open after every request, which piled up hundreds of open sockets per account over time. Thanks @Alintya.