imapflow 2.11.0

v2.11.0

on Node.js NPM

2.11.0 (2026-11-06)

Summary

Adds the sessionExpires option for servers that end a session at a known time, such as Exchange Online, which ends an IMAP session when the OAuth2 access token it authenticated with expires.

Who should upgrade

Anyone connecting to Microsoft 365 or Outlook.com over IMAP with OAuth2 who sees commands fail with BYE Session invalidated - AccessTokenExpired roughly once per token lifetime. Nothing changes unless the new option is set.

Highlights

• sessionExpires (a Date or milliseconds since the epoch) and sessionExpiryLead (default 5 minutes): from the lead before the expiry the client closes the connection the first time nothing runs on it, with an idling connection counting as free, and shortly before the expiry it closes it regardless. The close is reported like close(), so the application reconnects with a fresh token instead of losing a command to the server's BYE.

Features

• sessionExpires option closes a session before the server ends it (51a64ac)