postalsys/emailengine v2.87.0

on GitHub

2.87.0 (2026-10-29)

Summary

This release moves the prebuilt binaries and the Docker image to a Node.js version patched for CVE-2026-111497, a remote code execution flaw in the Brotli decoder bundled with Node.js. It also adds one-time passcode support through the OTP-Token header, and lets account deletion report and require OAuth2 grant revocation.

Who should upgrade

• Everyone running the prebuilt binaries or the Docker image, promptly. 2.86.0 and earlier embed a Node.js version with the Brotli flaw (binaries on 24.20.0, Docker image on 24.22.0). EmailEngine decompresses HTTP responses from servers it does not control, such as IMAP/SMTP autodiscovery hosts and webhook targets. The binaries are now built on Node.js 24.22.1 and the Docker image on 24.22.2.
• npm installs run on your own Node.js: upgrade Node.js itself to 24.22.1, 22.23.4 or later. Node.js 20 receives no fix for this flaw.

Highlights

• One-time passcodes: POST /v1/account/{account}/submit accepts otp: { code, origin } and sends it as the OTP-Token header (draft-goto-otp-token). Message details on IMAP, Gmail API and MS Graph accounts report otp: { code, origin, authenticated }, where authenticated is true only when Gmail or Microsoft 365 recorded a passing DKIM signature from the origin's domain. Experimental, follows the draft.
• OAuth2 revocation on delete: DELETE /v1/account/{account}?revoke=true now reports the outcome under revocation instead of answering the same whatever the provider said. revoke=required deletes the account only once the grant is confirmed gone, so a failure can be retried.
• AI summary on Gmail API accounts now trusts Google's own authentication results, as MS Graph accounts already did with Microsoft's. Before, sender authentication was reported as unknown on every Gmail API message.
• Support links in the admin UI, the OpenAPI document and the default IMAP ID now point at emailengine.app/support.
• Dependency updates, including imapflow 2.10.0, nodemailer 10.3.1, mailparser 3.14.1 and bullmq 6.5.0.

Features

• send and read one-time passcodes through the OTP-Token header (ad2f388)

Bug Fixes

• bump bullmq to 6.5.0 and @sentry/node-core to 10.77.1 (250ec90)
• bump nodemailer to 10.3.0, mailparser to 3.13.0 and other dependencies (ad88bc7)
• let the AI summary trust Google's authentication header on Gmail API accounts (78038c5)
• move the Docker image to Node 24.22.2 for the Brotli decoder fix (CVE-2026-111497) (b6efd8e)
• point support links at emailengine.app/support and support@postalsys.com (795b217)
• report the OAuth2 revocation outcome on account delete, and add revoke=required (cc5908d)
• separate the admin footer links into a labelled link list (65aa96d)
• update @postalsys/certs to 2.0.3 and smtp-server to 3.21.2 (d4a1946)
• update bullmq to 6.4.2 (4af5825)
• update ee-client to 1.10.0 (6595d46)
• update imapflow to 2.10.0 (06928a5)
• update nodemailer to 10.3.1, mailparser to 3.14.1, ee-client to 1.9.0 and email-ai-tools to 2.4.0 (8aeafb4)