1.17.0 (2026-10-21)

1.17.0 gives plugins real panels: a panel next to the message you write or read can fill its height, start folded, be opened by the plugin, and be dragged wider, and plugins get right-click menus on selected text in the composer and in a message. Plugins can also search mail and the settings, read the user's preferences and the app's version. The AI Writing Assistant in the marketplace builds on this and needs this release. The reader's side panel stays open from message to message, and the admin panel is reworked around a settings-style sidebar with one URL per page. The Docker images move to Node.js 24.22.1 for a Node.js security fix.

Thank you for your donations:

• You? Become a sponsor!

One-time

• @bultester
• Anonymous
• Anonymous
• Anonymous

Monthly

• @superspacehosting
• @naokton
• @yerTools
• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

• Server: The Docker images are built on Node.js 24.22.1, which fixes an out-of-bounds write in the Brotli decoder (CVE-2026-111497). The server decodes Brotli responses when it fetches a calendar subscription, a WebDAV share or a plugin request, so a signed-in user could point it at a host that sends a crafted response and run code on the server. The same Node.js release fixes TLS hostname checks for servers addressed by IP. Standalone installs run on the system's Node.js: update it to 22.23.4, 24.22.1 or 26.12.1

Features

• Plugins: A panel slot (composer-sidebar, composer-sidebar-right, email-detail-sidebar) can fill its panel and scroll inside (fill), start folded until the user or the plugin opens it (startFolded), and be opened, closed and toggled by the plugin with api.ui.openPanel, closePanel and togglePanel, which answer null where no panel is on screen (phones), so a plugin can fall back to a dialog. A panel opened this way gets a focusRequest prop
• Plugins: The composer's plugin panels get the composer id, the draft and the selected text as it changes; the reader's side panel gets the selected text; reader frames learn whether they are on a phone, a tablet or a desktop (deviceType)
• Plugins: Right-click menus on selected text: composer-selection-menu in the message being written and reader-selection-menu in an open message. The browser's own menu stays until a plugin adds entries; the webmail then draws Cut and Copy and the plugin's entries, and the click carries the selected text
• Plugins: Text selected inside a message's body (an HTML mail in its frame) now reaches onTextSelectionChange
• Plugins: Plugins can search mail with api.email.search, search the settings and read the user's preferences, and read the app's name and version with api.app.getInfo
• Mail: The reader's side panel stays open when you move to another message, and its toggle sits in the reader toolbar, which now runs over the side panels to the right edge
• Composer: The plugin panels beside the composer can be dragged wider or narrower, and keep their width
• Admin: The admin panel is reworked around a settings-style sidebar with one URL per page, the real navigation rail and extension icons

Fixes

• Mail: Rescheduling a scheduled message cancels the original send before creating the new one, so it works on servers that allow one active submission per message (#1308)
• Mail: Dragging messages out of the list and downloading attachments, inline images and the raw message in the Pro view use the account that owns the message, so shared and secondary-account messages no longer fail (#1299, #1300, thanks @VasilisNtovolos)
• Mail: Deleting a message from its hover actions shows the actions on the next row that slides under the pointer, so you can delete one after another from the same spot (#1297, thanks @dealerweb)
• Mail: PDF attachment previews open in Safari (#1301)
• Mail: The contact card for a sender or recipient opens in place instead of sliding in from the top left
• Plugins: A plugin's passphrase dialog stays open while you type (#1302)
• Plugins: The push preference mirror no longer throws in sandboxed plugin frames (#1298, thanks @dealerweb)
• Layout: A pane divider stops following the mouse when the button is released over a frame
• i18n: The German dialog that hands a sign-in to the mobile app is translated (#1296, thanks @dealerweb)

• Milestone

This is a fourth security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were already fixed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

• PHP CVE-2026-109618, CVE-2026-109619 php#2026-10-21-5

This release has been made by @Alkarex, @Frenzie and newcomer @icco

Full changelog:

• Security
  • Docker alternative image (Alpine 3.24) updated with PHP 8.5.12 and Apache 2.4.69 #9475
  • Docker: disable PHP session.upload_progress.enabled for additional security #9476
• I18n
  • Improve Dutch #9479