1.12.0 lets you create filter rules straight from a message, offers the code from sign-in mail for one-click copying, and gives a phone linked with "Link Mobile App" a sign-in of its own, for every kind of account. Search now leaves Spam and Trash out by default, and emptying an ordinary folder moves its mail to the Trash. Browsers with many logins start up much faster. It also contains three security fixes, so please update.
Auth: The password+TOTP login no longer sends the webmail's OAuth client secret to a mail server the user chose when custom JMAP endpoints are allowed. Only admin-configured servers get it
Auth: The identity provider round trip for "Link Mobile App" can no longer sign the browser in as whichever account answered it, and a re-authentication the provider answered from an existing session instead of a fresh login is refused
Mail: Opening a previewed SVG attachment in a new tab no longer runs the sender's script in the webmail origin
Features
Mail: A "Rules" entry in the message right-click menu creates filter rules from the message: always move mail from its sender, domain or mailing list, mark it read, tag it, or block the sender. A new rule can also run on the messages already in the folder, and it can be undone from the toast
Filters: The rule editor suggests conditions from the message it was opened from (subject, recipients, List-Id, sender domain), and the new "is the address" and "has the domain" conditions match an address exactly
Mail: Codes from sign-in and confirmation mail show as a copy chip in the message, and in the list for a day. "Show Verification Codes" in settings turns it off
Mail: In the unified view, rows can be tinted with their account's color instead of showing the account dot, and tags this browser has no definition for, such as ones set by a server-side filter, get a color of their own instead of grey (#1052, thanks @lucamzanon)
Search: The folder dropdown shows subfolders indented under their parents
Composer: Pasted plain-text lines that start with "- ", "* ", "• ", "1. " or "1) " become real lists
Calendar: The event popover finds the join link of Teams, Zoom, Meet, Webex, Jitsi, Whereby and GoTo meetings in the location or description, and the location opens in maps, with a copy button next to it (#1095, thanks @lucletoffe)
Server: LIBRETRANSLATE_API_KEY_FILE, BULWARK_JWT_AUTH_SECRET_FILE, BULWARK_STALWART_MASTER_USER_FILE and BULWARK_STALWART_MASTER_PASSWORD_FILE read these secrets from files, and the admin config accepts oauthClientSecretFile and sessionSecretFile (#897, thanks @Cameo007)
Plugins: PLUGIN_SIGNING_KEY_FILE points at an existing Ed25519 key for signing managed plugin bundles, for read-only secret mounts (#996, thanks @mulatta)
Releases: Container images and release files come with a signed build provenance attestation, and the standalone tarballs get a .sha256. The README explains how to check them with gh attestation verify
Changes
Search: Search leaves out Spam and Trash unless "All folders" is picked in the folder dropdown. A search started in Spam or Trash searches that folder
Mail: Emptying a folder other than Trash or Junk moves its mail to the Trash, unless deleted mail is set to be removed permanently
Mobile app: "Link Mobile App" is offered for every account. Password and password+TOTP accounts confirm their password (and code) in the dialog. The phone gets a sign-in of its own, so signing out in the browser no longer signs it out, and a sign-in link to copy sits next to the QR code. Failed password attempts are limited per account
Calendar: Events are drawn as solid blocks of their calendar's color; declined and cancelled events are outlined
UI: Success and info toasts are plain cards; only errors and warnings are colored
Performance: With many logins, the browser restores them four at a time and no longer reloads every login's folders, identities and push connections each time one of them connects (#1132, thanks @lucamzanon)
License: An additional permission under section 7 of the AGPL allows distributing apps built from this code through app stores. It is provisional until every earlier contributor has agreed (consent request) and applies in full to contributions made since 30 September 2026
Docs: Guidelines for AI-assisted contributions in the README and CONTRIBUTING.md
Fixes
Mail: Clicking a folder's unread count lists only that folder's unread mail, not unread mail from every folder of every account
Mail: In "unread first" lists, a message you open stays in place until you open another
Mail: The message list no longer flashes a reload right after the page opens
Mail: On tablets, the message list comes back when the reading pane empties, for example after the open message is deleted or moved
Mail: Dividers between rows no longer disappear at 125% or 150% display scaling
Mail: The unread dot is centred on the sender avatar
Mail: Attachments declared with a type the browser cannot show, such as application/x-as400attachment from IBM i systems, application/x-pdf or a catch-all type, preview according to their file name (#1127, thanks @dealerweb)
Send: Recipients the server refuses at send are reported. When it refuses all of them, the message stays open as not sent; otherwise a warning names the refused ones (#1123)
Composer: The message body stays reachable in short reading panes, such as the bottom reading pane on a laptop (#1114)
Composer: Pasted plain text keeps its blank lines
Push: A notification link waits for a login that is still reconnecting instead of reporting the account as signed out, opens the folder of the right account, and no longer pulls you away from something you opened in the meantime (#1131, thanks @lucamzanon)
Push: A browser subscribed with another VAPID key resubscribes on its own, and Firefox can turn push on again when it cannot read its old subscription (#1121, thanks @shukiv)
Calendar: Dragged events no longer disappear: all-day events moved in the month view keep their start, and occurrences of recurring events with a UTC start, as in Google Calendar exports, no longer shift by the time-zone offset (#1119)
Calendar: A failed calendar fetch no longer hides every calendar or leaves only the birthday calendar selected
Calendar: The all-day area of the week view is sized from the visible week, stacks each day's tasks under its all-day events, and collapses to three rows with a toggle (#1122, thanks @sanitz)
Calendar: The Save button shows while an event is saving, and a save refused for its length says so (#921, thanks @texchi2)
Calendar: Invitations no longer carry blank participant names or an empty description (#748, thanks @lucletoffe)
Files: Files shared with you open and save in the office editor (#1094)
Files: Office editing works behind a reverse proxy at a sub-path (NEXT_PUBLIC_BASE_PATH) (#1101, thanks @dealerweb)
Accounts: Adding a sixth account through server-side SSO no longer overwrites the first account's sign-in
Mobile app: The app's "Sign in via webmail" keeps working past the first token expiry when the webmail uses a confidential OAuth client or an identity provider on another host
Admin: Admin sign-in works over plain HTTP. The admin cookie's Secure flag follows the request, or COOKIE_SECURE when it is set (#1063, thanks @lucamzanon)
Admin: The OAuth scope fields show the actual default scopes, which do not include offline_access (#1126)
Lite: SSO sessions survive a page reload with identity providers such as Rauthy that refuse an early token refresh (#552)
UI: The app retries loading its configuration after a timeout or a failed request instead of staying broken (#1112, thanks @theLucius7)
Docker: The image builds from a remote Git context (#1118)
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.19.2
Bug fix
Fixed step 3D model viewer colors when one part contains multiple colors
Various changes
Update KiCad symbols and footprints lists by @jbtronics in #1562
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.19.1
Bug fix
Fixed content security policy that prevented the step loading capability of the 3D model viewer
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.19.0
New features
Added 3D model viewer, with support of STL, 3MF, OBJ, STEP, and more
Improved builtin footprint gallery viewer
Support to add custom "builtin footprints"
Added additional footprint images based on KiCad 3D models. You can download them with php bin/console partdb:attachments:download-footprint-images
Improvements
Optimized performance of part table views
Bugfixes
Fix remembered tabs hiding validation errors by @LMatt08 in #1559
1.11.2 fixes the Docker image and the standalone tarballs of 1.11.1, which did not start. It contains all the security fixes from 1.11.1, so please update.
Docker: The server starts again. 1.11.1 excluded data/ from the standalone build with a pattern that also dropped Next.js's own metadata modules, so the Docker image and the bulwark-standalone-* tarballs failed on startup. npm start and Bulwark Lite were not affected
1.11.1 is a security and bug-fix release. It fixes four reported vulnerabilities, two of them critical, and the findings of a security audit. Please update.
Admin: Only a Stalwart superuser gets into the admin dashboard. The admin probe accepted Stalwart's default tenant-admin role, so the administrator of a single tenant was signed into a dashboard that configures the whole instance (GHSA-v6hr-cmxm-pv73, thanks @douwezijlstra-frl)
Admin: Admin status is only taken from an admin-configured server. A context cookie minted while custom JMAP endpoints were allowed let a user-chosen server keep answering the admin probe after the switch was turned off (GHSA-j867-89p4-v8hm, thanks @Vip3r-MC)
API: Cross-origin writes are refused on the JMAP passthrough and every other cookie-authenticated /api/ route, not only /api/auth/*. A page on a same-site sibling origin could run arbitrary JMAP as the signed-in user. The gate also decides on the decoded path, so /api/%61uth/... no longer skips it (GHSA-9mvj-98f5-9q6g, thanks @kah-ja)
Admin: Admin sign-in attempts are also capped at 50 per 15 minutes across all clients, because a forged X-Forwarded-For got a fresh per-IP budget when no reverse proxy is in front (GHSA-7pj2-232x-6698, thanks @richardweinberger)
Admin: Impersonation no longer puts the Stalwart master password into the session cookie. The webmail creates an app password on the target mailbox that expires after 8 hours and is revoked on sign-out, and a used impersonation link is refused after a restart or on another replica
Mail: A sender can no longer fake a DMARC or DKIM pass in the security badges, with a crafted envelope address or an Authentication-Results header of their own
Mail: Opening an SVG attachment's thumbnail on its own no longer runs the sender's script in the webmail origin
Mail: Remote content stays blocked in the mobile conversation view, the .eml attachment preview, the quoted original of a reply or forward, the print view, and for URL spellings the filter missed (backslashes, CSS escapes, image-set())
Mail: Links in image maps (<area>) no longer keep window.opener
Mail: A mailto: unsubscribe goes to the single address in the link, and the confirmation shows recipient, subject and body before sending
Mail: A crafted winmail.dat no longer freezes the tab
Composer: A sender name containing a quote can no longer add a recipient to a draft
Filters: Rule names, header names and sizes are escaped, so rules from plugins or imported filter sets cannot add commands such as redirect to the Sieve script
Plugins: Hooks and slots need a declared permission, like the host API does. http.post can no longer reach the JMAP passthrough, /api/admin/*, /api/settings or other credentialed routes, and plugin storage is kept per account and deleted on sign-out
Themes: The theme CSS sanitizer no longer lets remote resources through (url(//host), CSS escapes, image-set(), @font-face sources), and theme CSS can only target :root and .dark, also when a plugin transforms it
Files: WOPI file downloads are always served as inert attachments, so a blob typed text/html cannot run script in the webmail origin
Server: The SSRF guard also blocks loopback beyond 127.0.0.1, CGNAT, benchmark, multicast and reserved ranges, and NAT64, 6to4 and Teredo addresses that wrap an internal IPv4 address. Telemetry targets are checked at connect time, and OAuth token and revocation requests never follow redirects
Auth: Synced settings are keyed on the account a bearer token belongs to, so on a multi-domain server john@b.example can no longer read the settings of john@a.example
Auth: Wrong passwords tried through the login pre-check are limited, so the route can no longer be used as a password oracle or trip Stalwart's ban against the webmail itself
Auth: Signing out ends office editor sessions opened in that browser, and a full sign-out clears search history, open tabs, Files recents, staged plugin uploads and the other accounts' leftovers, also in other open tabs
Auth: Signing out when another account's restore had failed no longer leaves that account resumable
Auth: The failed TOTP login no longer passes on a user-chosen server's error body
Server: Visitors who are not signed in no longer get detailed health data, the pending advisory text, the plugin list, the full admin policy or every server's domain list
Server: The setup token is passed in the URL fragment, so it stays out of access logs, referers and history
Server: Not-found pages outside the app tree cannot be framed, ALLOWED_FRAME_ANCESTORS never applies to the admin dashboard or setup, and sibling subdomains can no longer widen the sidebar-app frame-src
Server: Favicons are only served as raster images
Docker: Runtime state and secrets (data/, local-data/, .env) stay out of the standalone build and the image, and the mock JMAP server can no longer be switched on in a release build
Lite: Sign-out revokes the refresh token, and a failed token login no longer keeps the password in sessionStorage
Lite: Every static page gets a CSP that allows only its own inline scripts, the Stalwart bundle refuses to run inside a foreign frame, and the Stalwart install instructions use a tagged release with a published .sha256 instead of releases/latest
Features
Calendar: Tasks with a due date show in the month view (#1107)
Changes
Plugins: Hooks that change outgoing mail need email:send, and display takeovers need email:render-takeover. Plugins that don't declare them lose those hooks
Themes: Theme CSS keeps only :root and .dark rules plus @font-face, @keyframes, @media and @supports. Every url() except a #fragment is removed
Admin: Impersonated sessions end after 8 hours, and sessions minted by earlier versions are signed out
Server: /api/health?detailed=true needs a session
Fixes
Mail: The inbox keeps rendering when a message has an unparsable date (#1099)
Mail: A folder no longer switches back to the unified inbox while it loads (#1102, thanks @guisea)
Mail: Replies in the unified inbox come from the identity of the account that received the mail (#1104)
Mail: Mail deleted during a list refresh no longer reappears (#966)
Mail: The message list no longer jumps while attachment chips load
Mail: Scrolling the unified inbox, cross-account views, tag views and "All folders" search no longer skips messages
Mail: A failed message-list read keeps the list on screen instead of showing an empty folder
Mail: Marking read, starring, tagging, emptying a folder and cancelling a scheduled send report it when the server refuses them
Mail: Tagging and pinning write only the keywords that change, so they no longer mark mail unread that was read on another device
Mail: New mail and folder changes keep arriving for users with seven or more shared accounts
Send: A dropped connection can no longer send a message twice
Send: Undo and edit of a message sent from a group identity act in the group's own account
Composer: A reply draft stays in its thread when it is re-opened or undone
Composer: An open draft stays on its own account across an account switch
Accounts: Quick account switches no longer mix up identities, so replies go out with the right From address
Accounts: Folders, filters and the account security page no longer show the previous account's data after a switch
Accounts: Settings sync turns back on after signing out of one of several accounts
Push: A notification opens its message in the account it came from
Calendar: Events you declined show struck through (#1110)
Calendar: Daily recurring events keep going past a DST gap
Calendar: iCal subscriptions stay with the login that created them, so refreshing or removing one no longer touches a calendar of another login
Auth: SSO sign-in behind nginx no longer fails with a 502 when the cookies would overflow its header buffer (#1096)
Auth: Sign-in and addresses work on internationalized domains (#1100)
Lite: A rate-limited token endpoint no longer signs you out
i18n: The dark/light mode titles and the "Themes" settings tab are translated in every language (#1105, #1106, thanks @dulinux), and so is the themes settings panel
This release adds bulk actions for vulnerability findings, a redesigned risk-based security view, container process visibility, and search in the template selector.
It also improves update workflows, Compose handling, backups, Easy Join, and activity processing while resolving several access and configuration issues.
Security and vulnerability management
Added bulk ignore and restore actions for vulnerability findings — 8dd49f1ac48b6dc1a17c960e08287338934eb33f (#4158) (@kmendell)
Redesigned the risk-based security view — cac682df3161e4228b5217fc3c9361700485c280 (#4204) (@kmendell)
Improved the risk score model — 0238e1414138788e1b674b1ae9d1ffc5b65adc38 (#4205) (@kmendell)
Accepted Safari’s unrequested appid=false value during passkey assertions — a7db1aeafd3aff1e5e3161780dd37d117ac0084a (#4208) (@kmendell)
Containers, projects, and updates
Added a container processes tab — bbc70f7d6007b3532c1bc103e30e1cb9222ef6fe (#4187) (@kmendell)
Routed container updates through the activity system — 2e35dfda39ed51e692fb4b00c944fd1ba6ceb6e5 (#4167) (@kmendell)
Resolved pending update status consistently across containers, projects, and the dashboard — aaac10a0d5e1105edfa01a0708f4cdbaf6e96375 (#4189) (@kmendell)
Preserved Compose formatting when applying tag updates — b9d64a9f116f700f64fa30ebc04d5816e3174f20 (#4172) (@kmendell)
MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.
Changes
docs: point readers at the wiki from the README top and the issue forms (dfe3daa)
fix: let a refused bookmarklet see why it was refused (e165b36)
test: pin that scheme-less internal URLs are refused before any fetch (2979e3a)
fix: refuse state-changing requests and socket connections from other sites (772a16c)
Config - An APP_KEY value now must be set. It should be already set in the vast majority of cases, we just no longer fall back to a default value where unset, and instead error. If you get an error upon access after upgrading, ensure a key is set. You can find guidance here.
Full List of Changes
Added interface layout system for UI customization, with theme system support. (#6179)
Added API endpoints for searching within a specific book or chapter. Thanks to @enableservices. (#6182)
Added a page scroll progress indicator. (#6176, #5932)
Added ability to easily download API docs as JSON or HTML. (#6198)
Updated translations with the latest Crowdin changes. (#6225)
Updated app logo with better accessibility text. (#6171)
Updated codebase static analysis to PHPStan Level 5. (#6143, #6089)
Updated config to remove default APP_KEY value. (#6210)
Updated new WYSIWYG editor with a range of fixes and improvements. (#6207)
Updated page create/update endpoints to allow a changelog message. (#6162)
Updated user password changes to require their existing password. (#6181)
Fixed incorrect LDAP group result handling scenario. (#6088)
Fixed lack of label text connected to checkboxes for screen readers. Thanks to @MHameed. (#6173)
Fixed markdown table alignment being removed by page content filtering. (#6167)
Fixed page content popup being caught in text selection range. (#6214)
Fixed unexpected error when using an invalid page ID with the API. (#6136)
1.11.0 introduces Bulwark Lite, a static build of the webmail that runs without a Node server, and fixes many places where Bulwark and Stalwart disagreed about mail, filters, calendars, contacts and files. It contains everything from the three 1.11.0 betas. The latest Docker tag moves to this release.
Lite: Bulwark Lite, a static build that talks to the JMAP server straight from the browser. npm run build:lite builds it, and every release ships bulwark-lite-<version>.zip for any static web host
Lite: bulwark-lite-stalwart.zip, a Stalwart Application bundle that picks up its mount prefix at runtime, with OpenID Connect login
Mail: Toasts for mail actions that gave no feedback, and an "email sent" toast after immediate sends
Filters: "Keep a copy" option for forward actions
Filters: Per-rule "Also move messages marked as spam" option
Admin: Login page toggles in admin settings for the version, the 2FA code option, the heading and the subtitle (#1068)
Navigation: Deep links resolve to the local instance
Changes
Auth: Signing out of an SSO account also signs out of the identity provider when it advertises an end_session_endpoint (#905). Set OAUTH_END_SESSION=false to keep the provider session, for example when other apps share it, and OAUTH_POST_LOGOUT_REDIRECT_URI to send users back to the webmail afterwards
Filters: Move and copy rules leave mail that Stalwart marked as spam in Junk. Before, a rule such as "subject contains invoice" also collected phishing. "Keep" rules stay unguarded as the allow-list
Mail: Search sends terms exactly as typed, without adding a prefix wildcard, in tag views too
Mail: The message list loads attachment chips lazily, so large folders open faster (#1089)
Send: Scheduled send is limited to 7 days, the most Stalwart accepts
UI: Icon set migrated from Lucide to Tabler Icons
Docker: Pre-releases no longer move the latest tags
Docs: Most README details moved to the website docs, with new screenshots
Fixes
Mail: "All folders" search includes shared accounts (#1082)
Mail: A search inside a tag view narrows the tag instead of replacing it (#1084, thanks @rotterp)
Mail: Leaving an account drops a search folder scope that belongs to it (#1084, thanks @rotterp)
Mail: A failed search shows an error instead of "No results found"
Mail: In unified views, threads belong to the account that owns them (#1012, thanks @lucamzanon)
Mail: A failed move between accounts no longer deletes the original
Mail: "Mark all as read" marks every unread message instead of skipping pages past the first 500
Mail: Mark as spam and not spam report moves the server refuses
Mail: Unread-first order keeps bringing up unread mail past the first page
Mail: The tag button in a row's hover actions opens the tag picker instead of clearing the message's tags (#1032, thanks @douwezijlstra-frl)
Mail: Tag and tab counters no longer download every matching id
Mail: Text in fixed-width tables wraps to the screen on iOS (#1020)
Mail: Mail action toasts show again
Send: A send the server refuses is reported as failed instead of sent. When only filing the sent copy fails, a warning says so, so the mail is not sent twice
Send: A From override is also used as the envelope sender where the server accepts it. Where it doesn't, as on Stalwart, the composer says that the identity's address shows in the Return-Path (#1009)
Send: Sending with an identity adds its Bcc addresses
Composer: Attachments over the server's size limits are refused before upload
Composer: A staged attachment is kept until its upload finishes
Filters: Filters keep running while the auto-reply is on, and saving a filter no longer turns the auto-reply off
Filters: "Mark read", "star" and "add label" reach mail that the same rule moves, and rules keep their target folder after it is renamed
Filters: Forward actions respect the server's redirect limit (one on Stalwart) instead of being dropped without notice
Auto-reply: A warning appears before saving an auto-reply that Stalwart would refuse as too long
Calendar: Edits to a single occurrence stay on that occurrence and keep its details
Calendar: Date ranges are queried in the right time zone, and long recurring series or more than 1000 events no longer leave the calendar incomplete
Calendar: When the server refuses an event's invitations, you can save the event without sending them
Calendar: Subscriptions that fail with "Not authenticated" name the cause, such as a mail server certificate the webmail server does not trust (#1073)
Calendar: The subscription dialog no longer promises CalDAV URLs
Calendar: The import dropdown opens above the day and week views (#1049)
Contacts: Contacts with calendar, scheduling or free/busy links save, and cleared fields are cleared on the server
Contacts: vCard import no longer sends fields Stalwart rejects and writes addresses in the RFC 9553 form
Contacts: Deleting an address book that still holds contacts works
Files: Every file is listed, even when the account has more than maxObjectsInGet (#1069)
Files: Copying a folder copies its contents, and changes inside a shared drive go to the drive's account
Files: An upload or new folder whose name is taken becomes "name (2)" instead of failing
Files: Sharing works on Stalwart versions before 0.16.6
Files: Names Stalwart refuses are caught before sending, uploads store an accepted variant, and Office files keep their MIME type on Stalwart 0.16.6 and later
Account: You stay signed in after changing your password in settings
Account: Users who are not admins see their name, and changing the password or turning TOTP off asks for the current code
Auth: OAuth endpoints on the configured issuer's own host are accepted when they resolve to a private address, so split-DNS setups no longer need OAUTH_ALLOW_PRIVATE_ENDPOINTS (#1028)
Auth: Linking the mobile app re-authenticates against the account's own identity provider when OAuth is configured per server
Push: Push subscriptions are renewed before Stalwart's 7-day expiry, so a tab or app left open for over a week keeps getting notifications
Sharing: Principals are listed in directories with more than 500 users
Lite: The login page hides the server field once config.json sets jmapServerUrl (#1087)
Plugins: The plugin sandbox follows the app's "Automatic" language (#976, thanks @bartfaizoli76)
Pre-release. General test build for 1.11.0. Not recommended for production. The latest Docker tag stays on 1.10.0. To try it, use ghcr.io/bulwarkmail/webmail:1.11.0-beta.3.
Bulwark Lite zips (bulwark-lite-1.11.0-beta.3.zip for static hosts, bulwark-lite-stalwart.zip for Stalwart Applications) are attached once the Build Static Lite workflow finishes.
Added
Attendees can answer a single occurrence of a recurring event (#1086).
The message list loads attachment chips lazily, so large folders open faster (#1089).
Mail search sends search terms exactly as typed, without adding a prefix wildcard. This also applies in tag views.
Scheduled send is limited to 7 days, the most Stalwart accepts.
Fixed
"All folders" search includes shared accounts (#1082).
A search inside a tag view narrows the tag instead of replacing it.
Leaving an account drops a search folder scope that belongs to it (#1084, thanks @rotterp).
In unified views, threads belong to the account that owns them (#1012, thanks @lucamzanon).
A failed move between accounts no longer loses the message.
"Mark all as read" marks every unread message and reports spam moves the server refuses.
Send and search report failed JMAP calls instead of claiming success.
Attachments over the server's size limits are refused before upload.
Sending with an identity adds its Bcc addresses.
Tag and tab counters no longer download every matching id.
Mail filters keep running while the auto-reply is on, keep flags and folder targets when mail is moved, and no longer pull spam out of Junk.
A warning appears before you save an auto-reply that Stalwart would refuse as too long.
Edits to a single occurrence stay on that occurrence and keep its details.
Calendar ranges are queried in the right time zone and past the server limits.
If the server refuses an event's invitations, you are offered to save the event anyway.
The calendar subscription dialog no longer promises CalDAV URLs.
Contacts with calendar links or cleared fields save correctly.
Files lists every file, even when the account has more than maxObjectsInGet (#1069).
Files can copy whole folders and write to shared drives, shares files on Stalwart versions before 0.16.6, and handles file names and types Stalwart refuses.
You stay signed in after changing your password in settings.
Users who are not admins see their name and can change a TOTP password.
Push subscriptions are renewed before Stalwart's 7-day expiry.
Sharing lists principals in directories with more than 500 users.
The plugin sandbox follows the app's "Automatic" language (#976, thanks @bartfaizoli76).
ai endpoints requested when the ai feature is unavailable (#27525)
admin: suppress MISSING_TRANSLATION errors to fix sluggish editing (#26108)
admin: sso default role placeholder shows "choose here" twice (#27685)
content-manager: create on the fly prefills inverse from component paths (#27636)
content-manager: saved list sort resets on base-route navigation (#27663)
core/core: koa response helper types missing in consumer projects (#27380)
database: updateMany with relation filter subquery (#26909)
database: document-id migration can take hours on large localized tables (#27404)
database: updateMany ignores _q and filters (#27769)
documentation: restore properties for repeated relation targets (#27592) — ⚠️ Reverted in v5.55.1 (causing a performance drop for Strapi projects with the documentation plugin) — please update your projects to 5.55.1 instead if you're impacted ⚠️
graphql: exclude custom resolvers from built-in query field detection (#27462)
upload: store unsigned urls in richtext and blocks fields (#27593)
upload: media library degrades for roles without settings.read (#27687)
upload: show more media grid columns on wider screens (#27711)
utils: normalize string chunks before buffering streams (#27700)
⚙️ Chore
deps: remove unused dependencies from @strapi/strapi (#27540)
docker: postgres dev container fails to start on postgres 18 (#27668)
upload: promote the new media library out of future/ (#27666)
Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216)
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.
Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.
Updated Unhead from 1.11.20 to 3.4.1 (#28248) @directus/themes now requires @unhead/vue 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the v2 and v3 migration guides.
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956)
The following fields are now correctly marked as nullable:
@directus/types: Comment.user_created, Comment.user_updated, FlowRaw.user_created, OperationRaw.options, OperationRaw.user_created, Preset.collection, Role.description, and ContentVersion.hash
@directus/sdk: DirectusRole.parent and DirectusVersion.hash
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970)
Breaking changes in @directus/sdk:
DirectusRelation.meta and DirectusRelation.schema are now nullable
DirectusPolicy.ip_access and DirectusRelation.meta.one_allowed_collections are now correctly typed as string[]
Breaking changes in @directus/types:
Policy.enforce_tfa is no longer nullable
Share.name, role, password, user_created, date_created and times_used are now nullable
Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143)
Update/delete by query now resolves the affected items with the read permissions enforced:
Read access to the collection's primary key field is now required.
The affected items are scoped to what the role can read, irrespective of update rights.
Nested o2m saves require read access on the child collection.
Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873)
The transport is configured through the following environment variables:
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
@directus/sdk
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
Removed the unused helper types ToTuple and TupleToUnion (#27956 by @kheiner)
✨ New Features & Improvements
@directus/app
Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable (#27792 by @br41nslug)
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
@directus/api
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
@directus/system-data
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/specs
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/types
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/cli
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/sdk
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/env
Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
🐛 Bug Fixes & Optimizations
@directus/app
Fixed the image editor's error notice rendering as an unstyled info message instead of an error (#28245 by @Nitwel)
Fixed relational edits made in quick succession saving duplicate create or update entries for the same row, which made the stale entry win and dropped block editor changes inside translations (#28247 by @alvarosabu)
Fixed the filter delete (x) button in the search bar's filter popover becoming unclickable on hover. (#28114 by @aniruddhav25)
Fixed table row context menus staying open when opening the menu on another row (#28191 by @robluton)
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
Fixed the date picker calendar showing English weekday names and starting the week on Sunday regardless of the user language (#28147 by @lazerg)
Replaced lodash with lodash-es in the Studio (#28245 by @Nitwel)
Added new DEV_APP_PORT env var for setting the app port while in development mode (#28112 by @robluton)
@directus/api
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143 by @br41nslug)
Fixed relational fields ordering to align with the order of fields in query parameters. (#28197 by @wakqasahmed)
Fixed Oracle JSON filtering and json() function returning quoted strings for scalar string values (#28264 by @wofiporia)
Fixed schema cache synchronization timeouts leaving stale bus subscriptions and pending timers behind (#28178 by @lazerg)
Fixed the global access cache ignoring the client IP (#28190 by @br41nslug)
Updated sharp, nodemailer, tiptap, js-yaml and mysql2 dependencies (#28219 by @br41nslug)
Fixed the block editor flickering and losing its controls while editing a version (#28105 by @alvarosabu)
Fixed schema diff generation for nested metadata additions and removals (#27880 by @thribhuvan003)
Fixed FilesService.uploadOne to prevent client payloads from overwriting system fields (e.g., uploaded_by, created_on etc) (#28208 by @br41nslug)
Fixed year() function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (year, month, week, day, weekday, hour, minute, second) return numbers instead of zero padded strings (#28257 by @galshir)
Fixed uploaded_on not being set for TUS uploads (#28043 by @kheiner)
Fixed comment updates and deletes enforcement (#28162 by @kheiner)
Fixed foreign key constraints being dropped when updating a relation with a partial payload (#28137 by @lazerg)
Updated Flows and Operations tools to automatically fix incorrect X/Y positions for flow operations when used through (#28159 by @bryantgillespie)
MCP and AI Assistant
@directus/types
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/sdk
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Added missing empty-parameter validation to readRelationByCollection, createField, deleteCollection, utilsExport, utilsImport, utilitySort, triggerFlow, and readShareInfo (#27970 by @kheiner)
Updated known-but-not-enforced string fields on directus_users, directus_settings, directus_deployment_runs (#28129 by @kheiner)
@directus/errors
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/schema-builder
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/utils
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/memory
Fixed the local key-value store treating equal setMax values as updates (#28172 by @jashkarangiya)
Fixed concurrent local KV updates losing increments or overwriting larger values in setMax. (#28194 by @jashkarangiya)
@directus/release-notes-generator
Renamed the blackbox test package to e2e (#28226 by @Nitwel)
This release fixes project directory creation, container update, and upgrade workflows.
It also improves backup coverage and updates the Compose example configuration.
Project and Compose fixes
Create missing project bind directories as the runtime user — 8bcb59d538a28bcd149b42bcbb9e096d10eb1059 (#4138) (@kmendell)
Update the Compose example to include DISTRIBUTION=1 — 1b21e5c3594d3e60d8f8a449981a078a989790d6 (@kmendell)
Container update and backup fixes
Allow manual updates for containers excluded from automatic updates — 6c227d02de0f412371f4124214934af2933fe7f5 (#4139) (@kmendell)
Preserve data volumes when recreating containers during upgrades — 75f6ddb2bb8cee8cec52259d11d5123fe7b97f4d (#4141) (@kmendell)
Include separately mounted projects in system backups — 081e638de8000ec033a7fe4b4ac036ff8571e238 (#4144) (@kmendell)
Log in
