A tachyon is a particle that, if it existed, would arrive before it left. Fitting, then, that this release is mostly about how the thing looks, which is the part users notice first and maintainers get to last.
Version 4.1.0 rather than 4.0.10: six new config keys, two new endpoints, a rebuilt Branding tab, and one visible change on upgrade. Details at the bottom.
The webmail client formerly known as "a text label"
The loading screen used to be a word and a spinner. It now has an actual mark, drawn inline and filled with currentColor, so it takes the colour of whatever theme you are running instead of insisting on being black on your dark background.
Getting there was educational. The mark shipped twice in a state I would rather not describe, once cropped so hard the envelope became an orphaned triangle, and once with every path but the first silently swallowed because the template pipeline rewrites /> to > and an unclosed <path> in SVG eats its siblings. Closing tags are spelled out now. There is a comment. There will not be a third time.
The favicon and the PWA icons come from the same artwork. The icon file carries 16, 32 and 48 instead of only 16, the apple-touch icon went from 64 to the 180 iOS actually asks for, and the maskable PWA icon is sized to survive Android cropping it to a circle, which caps the artwork at 72.8% of the frame for this aspect ratio. Yes, that number was calculated rather than guessed.
Branding you can actually reach
The Branding tab grew up.
Login logo is now a choice of three: the Tachyon logo, your own artwork, or nothing at all. The built-in one follows your theme. Custom uploads come in two flavours, one for light backgrounds and one for dark, because a single transparent PNG cannot be both and one of your users is always on the wrong theme. Upload one and it serves both; upload two and each scheme picks its own. The preview shows them on a white tile and a dark tile side by side, which is the entire point.
Favicon is an upload now, not just a URL box. Tachyon icon, your file, or an external address. SVG is recommended and the panel says so, because there is no image resizing available here and an SVG is the only format that scales to every slot a browser asks for.
Login page footer for an imprint or a support link. It is plain text, not HTML, and that is deliberate: this is the page where people type their password, so the text is split into runs and links in the client and rendered through text bindings. <script>, onerror, javascript: and data: all come out as visible characters. Any http(s) address becomes a link. Put as many in as you like.
The admin login finally has a logo too, instead of a bare "Admin Panel" line that made the two doors to the same product look like different buildings.
Icons that mean what they depict
The logout button was a question mark. Not a metaphor, an actual circle-help glyph, mapped there during the 4.0.0 icon migration because there was no logout icon to map to. It is a door now. The same wrong icon was on the user dropdown, where a text label had been quietly covering for it.
The light-mode button was a sun emoji, in colour, next to two monochrome glyphs, because U+2600 gets emoji presentation on most platforms. That prompted a sweep of every html, js, less and css file in the tree for codepoints that can render in colour, which turned up a key, a paperclip, a link, a tick, a cross and a play triangle. All masks now, all taking the text colour.
Left alone deliberately: the paperclip in exported documents, which have no access to the icon sheet, and the label glyph in compose, which is not an icon at all but a marker inside saved draft text.
The Nextcloud file picker was setting data-icon to an emoji, which matched no rule whatsoever and drew nothing. It had been invisible rather than ugly.
Things that were quietly broken
Logo uploads appeared to fail. They never did. The file was always stored as logo.<ext>, so every upload reused the URL the browser already had cached for a day, and you got the old picture back. Names carry a digest of the contents now.
The SVG favicon link had an empty href when no SVG was configured, which resolves to the current page, so the browser cheerfully fetched the entire HTML document and tried to interpret it as an icon.
Admin TOTP can be cleared from the panel, so you can turn two-factor off or rotate to a new secret without editing application.ini. The recovery route is documented on that setting for anyone already locked out.
Please read this one
The admin TOTP secret used to be generated with Math.random(). That is a predictably seeded generator with no unguessability guarantee, and it was producing the shared secret protecting your admin panel. It uses crypto.getRandomValues now.
If you set up admin two-factor before this release, generate a fresh secret. There is a Clear button for exactly this. It is not an emergency and I have not demonstrated an attack, but it is ten seconds of your time.
This one is inherited from SnappyMail, added upstream in March 2024, so it applies there too.
Also
logs.syslog_ident lets you name what this instance reports to syslog and authpriv, so several installs on one host stop being indistinguishable in the log and a per-instance fail2ban filter becomes possible. Thanks to @de4niih for the request, and for arguing it belonged in core rather than a plugin. Agreed.
Upgrading
Your login page will start showing the Tachyon logo where it previously showed the loading text. If you would rather it did not, Branding has a "No logo" setting.
Nothing else needs doing. No plugin updates this release.
The question mark was ours: that button was a power symbol before the fork and our own icon
migration mapped it to the wrong glyph. The colour emoji are mostly inherited, and the same
migration simply did not finish converting them. The syslog name and the TOTP generator apply
to SnappyMail too.