v2.3.0
New features
- Custom AI actions — define your own AI actions with a dropdown menu, synced across devices (#202)
- AI results persist per device — AI action output is saved and restored when you revisit a message (#204)
- CardDAV contact sync — sync contacts from external servers like Nextcloud (#209)
- Recipient editing in compose — edit and copy To/Cc/Bcc recipients directly; fixed suggestion-list scrolling (#210)
- Read/unread rule condition — inbox rules can now match on whether a message is read or unread, useful when running rules over existing mail (#203)
Fixes
- Login screen now follows your selected theme (and your OS light/dark preference on first visit) instead of always showing dark (#208)
- SSO: honor
require_email_verified = offwhen provisioning new users (#211) - Layout preset is sanitized on read, hardening against removed presets (#207)
Security & reliability hardening
- SSRF-safe outbound fetch, Redis-backed rate limiting, robust async error handling, and cleaner worker teardown
- SSO-lockout guard, bulk-move resync, and snippet indexer scheduling
- End-to-end audit follow-ups: ReDoS guards on inbox-rule regex, IMAP reconnect lock, CardDAV auth hardening, Microsoft OAuth refresh gating/serialization, session + trusted-device invalidation on password reset, fail-safe credential decryption, login/CardDAV timing-oracle fixes, duplicate-account advisory lock, CSRF custom-header defense, and a reconcile-delete race guard
- Client-side email HTML sanitization (div + print) and DOMPurify 3.4.11