maathimself/mailflow v3.4.0

on GitHub

MailFlow v3.4.0

A reliability release. The headline change is that folder counts now come from the IMAP server rather than from MailFlow's own cache, which closes a family of bugs where the app could not tell that its cache was wrong.

Features

• Google OAuth for Gmail and Google Workspace (#359): connect Gmail and Workspace mailboxes over OAuth2 instead of an app password. This is required when a Workspace admin has disabled app passwords org-wide, which previously made those mailboxes impossible to add. Includes a setup card in Settings > Integrations with the Google Cloud steps, id_token verification against Google's JWKS, and a reconnect prompt when a grant is revoked. Available in all nine interface languages.
• Server-authoritative folder counts: STATUS (MESSAGES UNSEEN UIDNEXT UIDVALIDITY HIGHESTMODSEQ) is now polled per folder, and badges, the unread API and the mailbox header render those observations. An unknown count is shown as unknown rather than as zero, and a stale one is marked rather than silently displayed as current.
• Choose the default sender for the unified inbox (#417): pick which account new mail is sent from when composing from All Inboxes.
• Draft autosave (#413): drafts save on pause and when the tab is hidden, and you are warned before a refresh discards unsaved changes.
• Diagnostics report (Settings > About): reliability signals and a performance baseline, for reporting sync problems with evidence.

Fixes

• Self-sent Gmail mail no longer disappears from the inbox (#418): relocate-by-Message-ID has been removed. Two live UIDs may legitimately share a Message-ID, within one folder or across folders, so it was never proof of a move. It also caused reading one message to mark a second as read. Membership is now identified by account, folder and UID on every provider.
• Non-INBOX folders stay current instead of being frozen at first backfill, so mail filed from another client appears.
• A deleted folder no longer loops forever: removing a folder on the server left its cached messages stranded, which kept the reconciler trying to open a mailbox that no longer existed, indefinitely.
• A deleted account no longer pins the client: the selected account is validated against the account list, so deleting the one you had selected falls back to the unified inbox instead of leaving an empty mailbox and a badge that never updates.
• Mobile resynchronises on wake: returning to a suspended tab refreshes immediately rather than waiting for a timer that was frozen with it, including after a back/forward cache restore.
• A provider that refuses a connection and recovers no longer shows the account as broken. Transient refusals are held back until they repeat; authentication and configuration failures still surface immediately.
• Search failures are surfaced (#421) instead of showing an empty list or the previous query's results.
• Folders are created at the server's real path (#420), fixing silent failures on servers with a namespace prefix such as INBOX..
• Inline-disposed text attachments stay downloadable (#425) rather than being absorbed into the message body.
• The inbox rules sweep runs in the background (#426), so a large mailbox no longer hits the proxy timeout and reports failure while still applying moves.
• Subfolder creation works on folders with no children yet (#419).
• Links typed after a pasted link stay separate (#415), and outgoing http:// and bare-domain links keep their href.
• Copying works without a secure context (#416).
• Emails render fully: fixed messages whose documents never finish loading, and leftover whitespace below shorter emails.
• Settings changed just before a reload are no longer lost.
• The categorizer no longer silently skips messages during backfill.
• Bulk moves reconcile honestly when the server returns no UIDPLUS map (#407).
• Duplicate collapsing keeps the unread copy.
• MailFlow survives dependency failures: a PostgreSQL restart no longer kills the API, a Redis outage no longer silently disables the duplicate-send guard, and nginx re-resolves the backend after it is recreated.

Security

• Patched high-severity advisories in qs (denial of service via express) and @tiptap/core (prototype pollution producing executable DOM attributes, plus quadratic ReDoS), and a stored XSS fix in sanitize-html, which sanitises every inbound message body.

Build

• The frontend nginx base image is overridable via NGINX_BASE (#422), for hosts whose older kernels cannot install packages from the current Alpine repo.

Upgrading

No action required. The schema migration is additive and runs automatically. Reload any open tab once to pick up the new frontend.