maathimself/mailflow v4.0.5

MailFlow v4.0.5

on GitHub

MailFlow v4.0.5

Personal Outlook.com and Hotmail accounts now connect with no setup, adding an account starts from a simple provider chooser, and connection problems say what's wrong and how to fix it. GTD gains state chips in the inbox, GTD states in the move picker, and a Done that clears the whole conversation. Thanks to @salmonumbrella for the GTD pull requests, to @Monkey7539 for reviewing them, and to everyone who reported these.

Security

• DOMPurify updated to 3.4.17. 3.4.16 and earlier have three critical advisories. MailFlow doesn't use any of the affected modes, so it wasn't exposed, but the update keeps it that way.
• Backend dependencies updated for new advisories: sanitize-html 2.18.1 (sanitizer bypasses), nodemailer 10.2.1 (address parsing), undici 6.29.1 (denial of service), and Express 4.22.3 with its body-parser and qs (denial of service), plus ip-address.
• Accounts can't be created with sign-in details from the request. Microsoft and Google accounts are only created by their sign-in, and editing a signed-in account can no longer change its servers.

New

• Outlook.com, Hotmail, Live and MSN accounts with no setup (#674). MailFlow now ships its own Microsoft app for personal accounts, so you no longer need to register one in Microsoft Entra. Add the account, open Microsoft's page, enter the code, and you're done. Microsoft may label the app "unverified"; that's expected. Your sign-in goes straight from Microsoft to your server, and MailFlow's maintainers never see your mail or tokens. Work and school accounts still use your own app. The shared app is on by default; admins can turn it off under Settings > Email providers or with MS_BUILTIN_APP=false in .env.
• A new Add account screen. Choose Outlook.com, Microsoft 365, Gmail, Yahoo, iCloud or Other, or just type your address and MailFlow picks the right one. Microsoft and Google sign-in happen right there, and MailFlow only says an account is connected once it has actually reached your mailbox. The empty inbox has an Add account button too.
• Connection problems that tell you what to do. An account that can't connect now says why, with the fix next to it: "Outlook.com is blocking mail apps" with the steps to turn IMAP on, "Sign in to Microsoft again" when a sign-in has expired, and so on. Signing in again as a different address no longer adds a second account by mistake.
• Email provider settings for admins. Microsoft and Google sign-in setup moved from Integrations to an admin-only Settings > Email providers, with the shared Microsoft app switch and your own app's setup in one place.
• GTD state chips in the inbox (#582). Inbox and search rows show a chip for each GTD state on the message or its conversation. Waiting chips show their age and turn stale after 14 days.
• GTD states first in the move picker (#658, #657). With GTD on, every move picker leads with Todo, Delegated, Watch, Reference and Someday, which tag the message like the t/d/w/v/b keys instead of moving it.

Fixes

• Done on a Waiting conversation (#660, #659). Done now clears every copy in the conversation, so the row no longer disappears and comes back. A reply you haven't opened is archived unread. On servers without UIDPLUS, Done only moves the message you acted on, so nothing can be hidden or mixed up.
• Read state on GTD copies (#662, #661). On Fastmail and other servers that keep flags per copy, marking a GTD message read now reaches every copy, so it no longer turns unread again.
• Edit screen for signed-in accounts. Microsoft and Google accounts show "Signed in as" with a Sign in again button instead of password and server fields. The mailbox to open stays editable, for shared or delegated mailboxes; existing custom values are kept.
• Fewer retries for expired Microsoft sign-ins. An account whose sign-in has expired for good now backs off until you sign in again, instead of retrying every 90 seconds. Problems with the app itself, such as an expired client secret, still retry quickly, and saving the fixed app under Settings > Email providers reconnects its accounts right away.

Upgrading

ghcr.io/maathimself/mailflow-backend:latest points at 4.0.5, published for amd64 and arm64.

• Two database migrations (0069 and 0070), applied automatically when the backend starts. They add columns for each Microsoft account's sign-in app and for account error codes; existing data is unchanged.
• Microsoft and Google sign-in settings moved from Settings > Integrations to Settings > Email providers (admins only). Existing configuration carries over.
• Downgrading to 4.0.4: Microsoft accounts added with MailFlow's shared app won't refresh their sign-in on 4.0.4.
• Your own reverse proxy: if MailFlow sits behind a proxy you configured yourself, allow at least 60 seconds for /oauth/ requests (the bundled nginx configs already do). Sign-in now waits for the mailbox to connect before answering.
• Outlook.com needs IMAP turned on for mail apps: in Outlook.com, Settings > Mail > Forwarding and IMAP > Let devices and apps use IMAP. MailFlow tells you if it's off.

MailFlow is built and maintained by one person. If it's useful to you, you can support it on GitHub Sponsors or Ko-fi. Thank you to everyone who already does.