❌

Normale weergave

Ontvangen — 6 Augustus 2026 ⏭ Selfhosted

v1.8.0 - Nested Tags, Encryption at Rest, Forward as Attachment, Deep Links, Catalan Translation, Expanded Plugin APIs

✇Bulwark
Door: rathlinus
6 Augustus 2026 om 19:44

1.8.0 (2026-08-06)

Thank you for your donations:

One-time

Monthly

Features

  • Mail: Nest tags in a tree by picking a parent when you create one
  • Mail: Per-tag visibility — always, only when unread, or always hidden
  • Mail: Assign and clear several tags at once, with a reworked tag display
  • Mail: Recover tags from the server by scanning mail for JMAP keywords no local tag explains (#658)
  • Mail: "Forward as attachment" in the viewer and the message-list context menu
  • Mail: Refresh button in the mail-list toolbar
  • Composer: Confirm sending without a subject instead of blocking the send, with "Don't ask again" (#684)
  • Contacts: Contact cards for organizations (#701)
  • Security: Manage S/MIME and PGP public keys and configure Stalwart encryption at rest from account security settings
  • Notifications: Background notification onboarding, sequenced after the PWA install prompt
  • Navigation: Deep links for mail, calendar, contacts, files, and settings, with screen-reader improvements
  • Settings: Always show the Unified Mailbox switch in Layout settings
  • i18n: Catalan translation
  • i18n: Localized editor toolbar across every locale
  • Plugins: Contact API — contact.get, contact.create, contact.update, contact.search
  • Plugins: user.getAccounts and user.getIdentities
  • Plugins: user.logout method and logout hook
  • Plugins: Crypto API — public-key management and encryption-at-rest control on the privileged tier
  • Plugins: onBeforeBlobUpload can offload an attachment to external storage
  • Plugins: Binary Blob/File bodies for api.http.post
  • Plugins: upfiles.get moved behind email:blob-read, off the privileged tier
  • Dev: Mock JMAP defaults now include nested tags

Changes

  • Mail: The "Reset to defaults" button is gone from tag settings — one stray click wiped a carefully built tag list, with no confirmation and no undo

Fixes

  • Send: Send through the identity's own account client so DKIM matches the From domain (#461)
  • Send: Split Name <addr> recipients into the JMAP name and email fields (#672)
  • Send: Time out stalled JMAP requests so a send can't hang forever (#702)
  • Mail: Keep inline images when replying to application/octet-stream cid parts (#543)
  • Mail: Reply on your own thread message no longer re-addresses the original recipients (#703)
  • Mail: Empty folder no longer stops after 500 emails (#711)
  • Mail: Move messages across accounts from the "Move to" context menu, preserving read state and deferring source removal to Stalwart
  • Mail: Stop resurrecting deleted rows in the mailbox refresh merge
  • Mail: Keep the message/rfc822 attachment visible after inline unwrapping
  • Mail: Strip sender and recipient names from forward-as-attachment filenames
  • Mail: Open mailto: links in the built-in composer
  • Mail: Spell out the full tag path in drag-and-drop toasts, so Personal/Receipts and Work/Receipts no longer read as the same tag
  • Mail: Act on current email state in the context menu's mark-as-read instead of a stale copy
  • Mail: Match the selected-row tint between dark and light mode
  • Mail: Restore lost animations after the Tailwind config move
  • Drafts: Restore the sender identity when reopening a draft
  • Calendar: Stop re-adding the organizer to the attendee list on every save (#731)
  • Calendar: Stop re-probing shared accounts that have no calendar access
  • Calendar: Route the parse dump through the debug logger
  • Contacts: Stop minting duplicate "Trusted Senders" address books (#730)
  • Contacts: Hide Contacts and Calendars when the account lacks the JMAP capability
  • Contacts: Require an explicit shared-account fallback for contacts and calendars
  • Files: Show the modification date instead of the creation date (#700)
  • PWA: Honor the configured theme color in the desktop title bar and keep it in step with the active theme (#671)
  • Accounts: Reconcile the stale persisted account chip after an impersonation handoff
  • Auth: Only request a credential cookie when the server has a SESSION_SECRET
  • JMAP: Split requests to stay inside the server's advertised limits — maxCallsInRequest, maxObjectsInGet/InSet, maxSizeRequest, and concurrency
  • JMAP: Treat an aborted SSE connect as a close, not a failure
  • JMAP: Surface the underlying network error cause in passthrough failures
  • Settings: Avoid leaving TZ="undefined" when restoring an unset timezone
  • Plugins: Stop a privileged plugin from reading another privileged plugin's PRF secret
  • Plugins: Correct the method names for message errors and crypto.getPublicKeys
  • i18n: Restore key parity across locales and the English send_timeout string
  • Docs: Document the remaining env vars in the env templates, and correct the facts and headings in README and FEATURES

  •  
  • ↗️

v2.7.0

✇Arcane
Door: kmendell
6 Augustus 2026 om 00:21

Important

Project variable resolution now matches the Docker Compose CLI

Previously, environment variables set on Arcane's own container (such as PORT) could be picked up when resolving ${VARIABLE} references in your projects' compose files. This could cause surprising results — for example, a project using ${PORT:-8191} could end up binding to Arcane's own port instead of its default (#3499).

Starting with this release, variable references in a project's compose file resolve only from:

  • your global Variables (.env.global)
  • the project's own .env file
  • defaults in the compose file itself (${VAR:-default})
  • timezone and locale from Arcane's environment (TZ, LANG, LANGUAGE, LC_ALL)

This means a project deployed through Arcane now resolves its variables the same way as running docker compose up in the project directory, and projects can no longer accidentally pick up Arcane's own configuration.

If a project referenced a variable that was only defined on Arcane's container, add it under Customization → Variables to share it with all projects, or to that project's .env file. No other action is needed.

New features

  • simplify build registry image references (#3243 by @traeli)
  • add gated admin password reset to interal CLI (#3470 by @kmendell)
  • per user passkey mfa / passwordless login support (#3493 by @kmendell)
  • custom payload generic webhooks and google chat notifications (#3417 by @khanhx)
  • bump docker/compose to v5.4.0, gate diverged-volume recreation behind deploy option, pull pre_start hook and image-volume images (#3502 by @kmendell)

Bug fixes

  • synchronize structured log toggle state (#3418 by @Kstateag)
  • project log timestamps (#3456 by @Kstateag)
  • improve lifecycle permission diagnostics (#3404 by @Kstateag)
  • gate image event watcher to prevent registry rate limits (#3467 by @kmendell)
  • serialize bulk deletes and refresh image data (#3466 by @kmendell)
  • refresh image labels during self-upgrade (#3479 by @kmendell)
  • forward icon catalog setting over tunnel endpoints (#3495 by @kmendell)
  • update overridden env keys in place in effective .env instead of appending duplicates (#3496 by @kmendell)
  • bulk remove doing nothing on non-HTTPS deployments (#3498 by @kmendell)
  • stale environment bootstrap API keys accumulating and being undeletable (#3501 by @kmendell)
  • sheet panel animation restarting on hover during open (#3503 by @kmendell)
  • only grant default admin role during bootstrap or zero-admin recovery, not to any account named arcane (#3504 by @kmendell)
  • enforce configured password policy on all password creation and reset paths (#3505 by @kmendell)
  • stop leaking Arcane's own process environment into compose variable interpolation (#3508 by @kmendell)

CLI - Bug fixes

Dependencies

Other

  • move to coder/websocket library as it is actively maintained (#3431 by @kmendell)
  • move automation logic to use actors (#3458 by @kmendell)

Full Changelog: v2.6.0...v2.7.0

  •  
  • ↗️
❌