2.78.0 (2026-08-12)
Features
- accounts: pin an account to an expected email identity (a64bb60), closes #626
- admin-ui: keep the access-token banner in view and make the reference nav usable on a phone (a4bb55f)
- admin: mark the operation being read in the API reference sidebar (700eab7)
Bug Fixes
- accounts: let a wrong-account setup be retried instead of bouncing it back (4cd6ac4)
- accounts: remove the messages an account had queued when it is deleted (ba6897f)
- auth: replace unmaintained speakeasy and base32.js with in-house implementations (9abaaaa)
- bounces: read every block of a delivery-status body (a99878e)
- bounces: report every delivery-status field and describe one recipient (71300c3)
- deps: replace deprecated msgpack5 with @msgpack/msgpack behind a compatibility wrapper (9c40ebc)
- deps: replace stagnant xml2js with fast-xml-parser in IMAP settings autodetection (bfd6ec5)
- deps: update dependencies (libmime 5.4.2, nodemailer 9.0.5, imapflow 1.6.6) (abd8034)
- deps: update email-text-tools and email-ai-tools to pull in patched dompurify (GHSA-55q2-fjhq-7xh7) (148130f)
- deps: update imapflow to 1.7.0, certs to 1.0.17, templates to 2.0.2 (cafae8c)
- deps: update our own packages so the tree carries one copy of each (4a6e79f)
- oauth2: fall back to stored credentials when useAuthServer is set but no auth server is configured (cd460b0)
- webhooks: bind the egress check to the address actually connected to (#631) (2d68b37)
Performance Improvements
- accounts: unlink the account keys instead of deleting them inline (ec11210)