maathimself/mailflow v2.0.0 on GitHub

What's new in v2.0.0

New inbox tabs: Primary, Newsletters, Social, Notifications, and Other automatically sort incoming mail by type using header detection and sender heuristics
Unified inbox view shows all mail across tabs
AI-powered classify button reclassifies a message when the automatic detection gets it wrong
Unsubscribe button appears directly in the message pane for detected newsletters — one click sends the unsubscribe request or opens the unsubscribe URL

Integrated AI assistant powered by any OpenAI-compatible provider (configure your own endpoint and API key in admin settings)
Summarize long email threads, draft replies, and ask questions about a message
AI assist button added to the mobile compose toolbar
AI tab in admin settings is clearly marked Beta

Mark any message as spam or not spam from the context menu, message pane toolbar, or bulk actions
Feedback is stored and will feed into automated filtering in a future release
Available in all 7 supported languages

Users can now recover their account via a recovery email address set in profile settings
Three-tier SMTP fallback ensures delivery even when the primary sending account is misconfigured (#176)

Tasks created from emails now include a deep link back to the original message (#180)

Mark messages as unread from the message pane toolbar and the mobile action menu (#183)

TOTP replay prevention: one-time codes can no longer be reused within their validity window
SSRF improvements: IMAP host validation now resolves DNS and blocks 6to4 and Teredo IPv6 tunnel addresses that embed private IPv4 ranges
CSS exfiltration prevention: external url() references in email <style> blocks are stripped at sanitization time
Password reset race condition: the token is now consumed atomically so two concurrent reset requests cannot both succeed
Signature sanitization: edited signatures are sanitized on send and draft save, not only at storage time
AI and subscription URL validation: custom AI base URLs and category subscription URLs are now validated through the same SSRF-safe host validator used for IMAP
Encryption key guard: the server now refuses to start and throws on encrypt rather than silently storing plaintext if ENCRYPTION_KEY is missing
Microsoft 365 id_token issuer validation: multi-tenant OAuth flows now verify the iss claim matches the tenant in the token
Trusted device cookie cleared on logout
Security headers: X-Frame-Options: DENY and Referrer-Policy: same-origin added to all responses
Double-send prevention: idempotency key support on the send endpoint prevents duplicate emails on network retry

Database migrations: all migrations are now idempotent (IF NOT EXISTS) and run without a statement timeout so large deployments don't fail mid-migration
IMAP connection leak fix: failed sync attempts now correctly close and remove the stale connection instead of leaving zombie TCP sockets
WebSocket broadcast isolation: a failing client socket no longer aborts delivery to other connected clients
Inbox rules N+1 fix: folder resolution for delete and archive rules is now cached across the message batch instead of re-queried per message
Shared Redis client: session store, TOTP replay prevention, and send idempotency now share a single Redis connection

No manual migration steps required. All schema changes apply automatically on first startup.
If you are running without ENCRYPTION_KEY set, the server will now refuse to start rather than silently degrading. Set ENCRYPTION_KEY to a 64-character hex string (openssl rand -hex 32) before upgrading.