2.88.0 (2026-11-10)
Summary
EmailEngine 2.88.0 supports license keys for monthly plans, and a subscription license whose payment has lapsed now pauses EmailEngine instead of removing the key, resuming on its own once the invoice is paid. The release also closes several security gaps found in a review of revocation, admin sign-in and OAuth2 account setup, and fixes Microsoft 365 IMAP requests that failed when an access token expired.
Who should upgrade
- Everyone: this release carries security fixes (open change streams after a token was revoked, admin sign-in gaps around passkeys and SSO, OAuth2 address pinning on Microsoft tenants).
- Required if you buy a monthly plan: license keys of monthly plans need EmailEngine 2.88.0 or newer. Earlier releases cannot load them.
- Recommended if you use Microsoft 365 over IMAP: API requests no longer fail with "AccessTokenExpired" about once per token lifetime.
Breaking changes / action required
- A
EENGINE_*_FILEvariable that names a file EmailEngine cannot read now stops the startup with the variable and path named. It used to start as if the value were not set, which could leave the admin interface open. - Heroku: the app manifest no longer sets
NODE_TLS_REJECT_UNAUTHORIZED=0. Existing Heroku apps keep that variable until it is removed; setEENGINE_REDIS_TLS_REJECT_UNAUTHORIZED=falsefirst, then remove it. - Rotating the admin password through
EENGINE_PREPARED_PASSWORDnow also removes the admin's passkeys, as a password change from the security page already did. - A delivery that runs into the send deadline is no longer retried (the server may already have the message); it ends as failed and can be retried from the outbox.
Highlights
- Monthly plans: licenses of monthly plans are signed with their own key, shown as "Billing: Monthly plan" on the License page and as
details.billinginGET /v1/license, and checked at startup. - Subscription payment window: when the subscription behind a license is not in good standing, postalsys.com names a deadline (from 10 December 2026: 7 days after a failed monthly renewal, 28 after a yearly one, none after a cancellation; until then 28 days in every case). EmailEngine keeps working until then, then pauses email processing and the API while keeping the key, accounts and data, and resumes when the invoice is paid. The License page shows the date and has a "Check subscription now" button;
GET /v1/licensereports asubscriptionobject. - The EmailEngine License Agreement 3.0 ships with this release and takes effect on 10 December 2026.
- Fairness under load: one account's large messages, slow webhook receivers or heavy calendar files no longer hold the shared workers for everyone else.
- Change streams (
/v1/changes,/admin/changes) close when their token or session is revoked; deleting an account removes its exports.
Features
- monthly-plan licenses, and pause instead of removing a lapsed subscription license (9250815)
Bug Fixes
- accept only provider-verified identities when pinning an OAuth2 account setup (1e9b6c1)
- close admin sign-in gaps around passkeys, SSO and the password check (a4c4409)
- do not retry an SMTP delivery that ran into the deadline, and report final failures as final (48d0983)
- e2e overlay flakes, and a confirmation OK that could read as declined (b3559b3)
- end change streams on revocation, remove exports with their account, refuse queue metadata as a job (53e7948)
- end IMAP proxy sessions on revocation and stop NIL arguments from crashing the proxy (6e2756e)
- find an account's exports through an index instead of a keyspace scan (2ab5ba1)
- keep one account's mail, webhooks and senders from monopolising the shared workers (381c4fd)
- record a confirmation's OK click before the dialog reports closing (c754c9f)
- refuse to start when a _FILE secret can not be read and stop disabling TLS checks on Heroku (71d4191)
- replace Microsoft 365 IMAP sessions before their access token expires (500e4d2)
- update dependencies (5997ced)