New features
- Two-factor authentication — TOTP (authenticator app), email OTP, and persistent device trust. Admins can set enforcement policy (off / required) and trust duration (7 days, 30 days, permanent, or never) in the admin panel.
- Todoist integration — link a Todoist account from the admin Apps tab. Create tasks directly from emails via the message toolbar.
- Composer font groups and email priority — choose font family groups in the composer and set message priority (low / normal / high / urgent).
- Improved mobile compose UX — cleaner field layout and simplified toolbar for composing on mobile.
Fixes
- Wide fixed-layout HTML emails no longer clip on mobile — content is scaled to fit the viewport.
- Mark-as-read now fires immediately on tap rather than waiting for the synthesized click event, closing the window where a fast back-swipe could race against the state update.
- Mark-as-read is retried once on network failure before reverting, reducing spurious "still unread" appearances on unreliable mobile connections.
- Resolved ghost touches and scrambled gesture recognition in the mobile message list after rapid swiping.
- Fixed an edge case where thread resolution could overwrite the optimistic mark-as-read update before the API call completed.
- Back swipe no longer exits the PWA context on iOS standalone mode.
- Todoist connection status now syncs correctly on app load.
- Message toolbar cleaned up — icon-only buttons with tighter spacing.
Performance
- Div-renderer utilities (PostCSS, CSS scoping) are now lazy-loaded and excluded from the main bundle when the div renderer is disabled.
Upgrade notes
- Two database migrations run automatically on startup (
0019_user_integrations,0020_mfa_device_trust). No manual steps required. - 2FA is off by default. Existing users are not affected unless an admin enables enforcement under Settings → Security.
- One new optional environment variable:
VITE_EMAIL_DIV_RENDER(defaultfalse). The div-based renderer is experimental — do not enable in production.