postalsys/emailengine v2.84.2

on GitHub

Upgrade notes

This release hardens EmailEngine following a security review. A few of the changes are visible after upgrading:

• STARTTLS is required on cleartext IMAP and SMTP connections. An account or SMTP gateway with secure: false now fails to connect if the server does not offer STARTTLS, instead of continuing unencrypted. An IMAP account in this situation goes to connectError with Server does not support STARTTLS. For a server on a trusted network that has no TLS at all, set imap.requireTLS: false / smtp.requireTLS: false on the account (or requireTLS: false on the gateway), or untick Require STARTTLS in the admin interface. See STARTTLS.
• Admin sessions are signed out by the upgrade, and sessions now expire 30 days after sign-in.
• Hosted authentication form links created before the upgrade no longer work. Generate new links with POST /v1/authentication/form.
• Enabling TOTP for the admin account asks for the password.

2.84.2 (2026-10-18)

Bug Fixes

• bound what hostile message content and mail servers can make a worker do (02daa27)
• bump @postalsys/email-text-tools to 2.4.24 and @postalsys/ee-client to 1.8.2, embed cid: images only in image attributes (3d40506)
• bump @zone-eu/mailsplit to 5.4.24, mailparser to 3.9.41 and imapflow to 2.5.3 (3266d8d)
• bump @zone-eu/mailsplit to 5.4.25, mailparser to 3.9.42 and imapflow to 2.5.4 (76415b0)
• bump libmime to 5.5.1, libqp to 3.0.1, libbase64 to 1.4.1 and nodemailer to 10.1.7 (a934ba7)
• bump node from ebfe2f9 to 44fce69 (#676) (54a6b87)
• bump nodemailer to 10.1.5, joi to 18.3.0 and the owned packages that pinned the previous releases (8faa692)
• bump nodemailer to 10.1.6, smtp-server to 3.20.1 and mailparser to 3.9.45 (bcf583e)
• bump the owned dependencies to the releases of the 2026-10-16 security scan (2cbd569)
• close the paths a bound or narrowed API token could use to reach other accounts (c87c861)
• derive a separate signing key per purpose from the service secret (1fa3368)
• document the TLS options in the API reference and keep the admin modules within their size budgets (9d96a0c)
• give admin sessions a lifetime, count only failed sign-ins and ask for the password before enabling TOTP (d08d3ab)
• harden the IMAP proxy and the SMTP listener against unauthenticated clients (34ebdad)
• keep account ids apart in Redis keys and URLs, and bound licenses, mail merges and stored secrets (c9d3547)
• keep narrowed tokens off the webhook target, bound slow webhook targets and stop secrets leaking through logs and error payloads (40ce6cb)
• keep STARTTLS opportunistic for an IMAP account that opts out of requiring it (42cac3a)
• penalise only timed-out webhook targets, log hapi's internal request errors and run the integration tier against cleartext mocks (4578cc6)
• save the webhook and OAuth2 app forms when a list field is not sent (8157671)
• share the helpers the security fixes duplicated and move each rule to where it covers every caller (b9ba3ec)
• treat an unreachable network as a transient connection failure (b0b4dd5)
• trim the line ends of a text body in linear time when rendering it as html (d5d30cd)