release: v2.0.11

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.20

Changes

• build: pin the frontend builder image to the last QEMU-safe digest (300bf79)
• fix: align the row action icons across both download tables (ec01524)
• fix: stop offering a dead Start button on queued downloads (closes #1081) (a6d81d4)

What's Changed

• refactor(gui): split app_icon around an AppIconExt trait by @AprilNEA in #1422
• fix(gui): hold a config reload until the agent connects by @AprilNEA in #1416
• refactor(ipc): own the client handshake once and guard it with ast-grep by @AprilNEA in #1424
• refactor(core): name the process roles, host profiles, and environment knobs once by @AprilNEA in #1426
• refactor(ipc,cli): bound the handshake once and give the CLI one agent door by @AprilNEA in #1427
• refactor(core): build every worker runtime in one place by @AprilNEA in #1428
• refactor(core): spell the app bundle's layout once by @AprilNEA in #1429
• docs(infra): add openlogi workflow skills by @AprilNEA in #1409
• docs(infra): refine agent guidance and diagnostic workflows by @AprilNEA in #1485
• refactor(cli): give the command modules that carry code a file of their own by @AprilNEA in #1494
• refactor(hidpp): split the pending-request queue and the mock channel out of channel.rs by @AprilNEA in #1495
• refactor(hook): split the macOS backend by responsibility by @AprilNEA in #1496
• refactor(hook): split the Linux backend into the evdev hook and the foreground watcher by @AprilNEA in #1497
• chore: drop an unused dependency, a dead parameter, and stale docs by @AprilNEA in #1487
• refactor(gui): let state mutators own their events and views share one relevance filter by @AprilNEA in #1505
• refactor(gui): give write-on-release sliders one component by @AprilNEA in #1506
• refactor(ipc): own the observe loop's connection state in one Observer by @AprilNEA in #1507
• perf(gui): resolve each device's assets once per asset generation by @AprilNEA in #1508
• refactor(gui): say what the state types are by @AprilNEA in #1509
• refactor(core): give the key vocabulary one owner by @AprilNEA in #1488
• refactor(core): give seven copied decisions one owner each by @AprilNEA in #1489
• refactor(xtask): spell xtask's waits and its bundle builder in the workspace's vocabulary by @AprilNEA in #1490
• ci(windows): run the tests on Windows by @AprilNEA in #1491
• refactor(device): drop the capture paths nothing calls and type the session errors by @AprilNEA in #1500
• refactor(core): split the config module by concern by @AprilNEA in #1511
• refactor(device): split the inventory and probe modules by responsibility by @AprilNEA in #1512
• refactor(device): call durations that bound a wait timeouts by @AprilNEA in #1513
• refactor(device): run gesture and keyboard capture through one session skeleton by @AprilNEA in #1501
• refactor(device): share one pending-restore token between capture and host switch by @AprilNEA in #1502
• refactor(agent): run the capture watchers on one harness and name the device-access handles by @AprilNEA in #1503
• refactor: say what eight identifiers are by @AprilNEA in #1517
• refactor(camera): suffix the macOS backends like the other platforms' by @AprilNEA in #1518
• refactor(gui): move the F-key geometry into function_row/key_points.rs by @AprilNEA in #1525
• refactor(agent): move the device list and re-apply plan into orchestrator/devices.rs by @AprilNEA in #1526
• refactor(gui): split the AppState tests by what they exercise by @AprilNEA in #1527
• refactor(inject): run scripts and workflows once, over four platform hooks by @AprilNEA in #1529
• refactor(core): split the config tests by what they exercise by @AprilNEA in #1530
• refactor(device): split the inventory and gesture capture tests by what they exercise by @AprilNEA in #1531
• refactor(agent): split the orchestrator tests by what they exercise by @AprilNEA in #1532
• refactor(hidpp): split the channel tests by what they exercise by @AprilNEA in #1533
• refactor(device): move the host-switch session's tests to host_switch/tests.rs by @AprilNEA in #1535
• refactor(agent): move the button runtime's worker loop into button/worker.rs by @AprilNEA in #1536
• refactor(inject): break the macOS injector into scroll, browser and SPI modules by @AprilNEA in #1537
• refactor(gui): move the mouse view's binding labels and tests out of view.rs by @AprilNEA in #1538
• refactor(gui): move the camera panel's row builders into controls/rows.rs by @AprilNEA in #1539
• feat(gui): detect and display installation sources by @AprilNEA in #1515
• docs(gui): mend the desktop crate's intra-doc links by @AprilNEA in #1541
• chore: release v0.8.6 by @AprilNEA[bot] in #1481

Full Changelog: v0.8.5...v0.8.6

Changelog

Bug fixes

• 66ce01c: fix: shutdown cron not working when lazy ping is enabled, close #1773 (@seriousm4x)

With the release of our South Dakota DLC, we invite you all to join us on Thursday, the 24th of September, for the newest World of Trucks event - Cruising South Dakota! Roll through the Mount Rushmore State and take in its wide-open landscapes, natural beauty and rich history.

So, what is the challenge? Haul cargo to or from any city in South Dakota and help the community reach a collective goal of 150,000,000 miles (241,402,000 km). With the strength of our #BestCommunityEver, we know you will smash it! 

Hit the road by #CruisingSouthDakota, where vast prairies meet the rugged Black Hills and the otherworldly Badlands, with long crossings over the Missouri River along the way. But this land carries far more than scenery, it holds stories that reach deep into the past. The Black Hills, known to the Lakota people as Paha Sapa, are sacred ground, while Badlands National Park preserves one of the richest fossil beds on Earth. This is where giants like SUE the T. rex slept for millions of years before being discovered.

During your travels, you can look forward to many spectacular views and highlights, such as:

• Mount Rushmore National Memorial, the iconic monument carved into a granite face in the Black Hills.
• Badlands National Park, a dramatic maze of layered rock spires and buttes unlike anywhere else in America.
• Deadwood, the legendary gold rush town where Wild Bill Hickok played his final hand.
• Missouri River crossings, where the great river divides the rolling east from the rugged west of the state.

As with past Cruising events, you can also participate using your own trailer by selecting jobs from the External Market!

The South Dakota DLC features 13 incredible cities to explore, and we're offering an exclusive reward for completing your personal goal, which will require you to deliver a job to or from all of them. All jobs for the event must be at least 100 miles (161 km) long.

Take part in this breathtaking journey across the Great Plains, from South Dakota's sweeping landscapes and Black Hills to its frontier towns. Let's roll through the Mount Rushmore State!

Rules

Using External Contracts or External Market, with a World of Trucks-connected profile in American Truck Simulator, the community goal is to drive 150,000,000 miles (241,402,000 km) while delivering cargoes to or from any city in South Dakota.

When a player has completed deliveries to or from all 13 South Dakota cities, they will achieve their personal goal.

All jobs for the event must be at least 100 miles (161 km) long.

You can check if your recent deliveries met these conditions using your Log Book in your World of Trucks profile.

Rewards

• Personal: Players who complete deliveries to or from all 13 South Dakota cities will earn a personal World of Trucks Achievement and a Call of the Badlands ATS truck paint job Steam inventory item.

• Community: When the community goal of driving 150,000,000 miles (241,402,000 km) during deliveries to or from any city in South Dakota is met, players who have also achieved their personal goal will receive a Ring-necked Pheasant Steam inventory item.

Note: In order to qualify for the community reward, you must complete your personal goal in American Truck Simulator. Each reward will be a Steam inventory item for American Truck Simulator. Once completed, claim your rewards on the Events page of your World of Trucks profile.

The event will conclude on Sunday, the 22nd of November at 23:59 UTC.

Gear up for the latest addition to American Truck Simulator and join us for #CruisingSouthDakota! Share your screenshots and videos with us on our Facebook, X (formerly Twitter), and Instagram profiles, and we will share our favourite ones (we may even feature some of them in a future blog post!).

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• fix(desktop): load the e2e Playwright config by moving it to the package root by @Fr4ncis in #5435
• fix(muya): ignore a table tool click once its table left the document (#5442) by @Jocs in #5443
• docs: add StarDesk as a special sponsor by @Jocs in #5444
• fix(tests): Windows paths + CI + timeout fix by @dzid26 in #5323
• ci: check every text file out as LF so the Windows test leg sees the same bytes by @Jocs in #5447
• ci: bound the unit-test job at ten minutes by @Jocs in #5448
• fix(desktop): keep title bar path segments in order under the Bidi algorithm by @dronov-dmitry in #5317
• fix(muya): apply pandoc's tex_math_dollars constraints to $…$ (#5446) by @Jocs in #5449
• feat: add the texMathDollars preference, replacing the math option (#5446) by @Jocs in #5450
• feat: implement pandoc's tex_math_gfm, replacing the GitLab compatibility option (#5446) by @Jocs in #5457
• feat: show selected text word count by @Renakoni in #4457

New Contributors

• @Fr4ncis made their first contribution in #5435
• @dronov-dmitry made their first contribution in #5317

Full Changelog: v0.20.0-rc.4...v0.20.0-rc.5

release: v2.0.10

Pre-release. This is a test build for Bulwark Lite. Not recommended for production. The latest Docker tag stays on 1.10.0. To try the server build, use ghcr.io/bulwarkmail/webmail:1.11.0-beta.1.

Bulwark Lite

Bulwark Lite is a static build of the webmail. It has no Node server: the browser talks to your JMAP server directly.

• bulwark-lite-1.11.0-beta.1.zip: unpack it on any static web host (nginx, Caddy, S3, Pages…). Set your JMAP server in config.json. The JMAP server must allow CORS from the webmail origin.
• bulwark-lite-stalwart.zip: a Stalwart Application bundle. Install it as an Application in Stalwart and it serves itself under the configured prefix (e.g. /webmail).

The Lite zips are attached once the Build Static Lite workflow finishes (a few minutes after publishing).

Please report problems with the Lite build in the issue tracker.

Also in this pre-release

• New "Flat fields" theme
• Icon set migrated from Lucide to Tabler Icons
• Hardened Lite login, deep-link replay and settings gating

release: v2.0.9

📦 Downloads available at

• https://user.bitfocus.io/download

💵 Donate to the project at

• open collective https://opencollective.com/companion

Companion v5.0.6 - Release Notes

🐞 BUG FIXES

• surface module compatibility check using wrong versions #4472
• improve UX of internal: Local Variable: Set value name field, clarifying what is valid input #4467
• unable to change version of surface module
• better logging in internal actions when not finding local variable to update #4466
• Page dropdown not scrolling to the current page #4456
• respect explicit show_topbar when scaling legacy font sizes
• suppress logging for rosstalk noop commands #4463
• sanitise custom-variable option values
• update canvas library to fix png containing svg issue #4438

Full Changelog: v5.0.5...v5.0.6

In June, we announced that we are working on the Indiana DLC for American Truck Simulator. While our map teams are busy bringing the Hoosier State to life, they first had to experience it for themselves. Let's take a look back at their research trip to Indiana!

The team that set out for Indiana consisted of the map DLC lead Dubak, our map designers Lukáš and Martin, and our researcher Spekin. Today, they will share their impressions from the trip and a couple of photos they captured along the way. Below, we are also bringing a few screenshots from the work-in-progress map!

"This was my second research trip to the US, and every time it's an incredible experience for me. It boasts not only amazing nature and landscapes, but also rich and beautiful cities. Before the trip, we were a bit worried that Indiana would be a state full of fields, but we were completely wrong. It was a great experience, and I'm really glad that my team and I get to build this wonderful state and show players all the beauty and hidden gems Indiana has to offer," Dubak told us.

They travelled across the state, visiting many of its cities and landmarks, from Indianapolis to Fort Wayne, Evansville, South Bend, and more. "We were blown away by the memorial and the Capitol in Indianapolis, and we also checked out a massive steel mill in East Chicago, Lake Monroe, and the Indiana Dunes National Park," Dubak said.

During their nine-day journey, the team gathered plenty of references and experienced the atmosphere of each place they visited. They explained that walking the streets and visiting these places in real life before recreating them in the editor was a completely new experience.

"As a map designer, I was thrilled to have the opportunity to visit the US in person. You can feel the atmosphere and the scale of everything around you. Personally, I enjoyed all the landmarks in Indiana - from courthouses and churches to banks, statues, historical monuments, memorials, and murals, not to mention the small details here and there. History has shaped the US greatly, and you have the opportunity to experience that," Lukáš shared with us.

Being there in person also reveals smaller details that can be difficult to notice through street view or other sources. This helps the team understand what is important to include in the game and what gives each place its authentic feel.

"As a map designer, I looked for all the details that make every corner authentic. If you are sufficiently attentive, you can find a lot of interesting stuff around. For example, I learned that bigger is better. You can hardly go wrong with that. I also love discovering all the different advertisements, billboards, and signs. I created a large photo gallery of them so that our branding and asset team could use them as inspiration for the state of Indiana and upcoming projects. We also saw an Amish community in the region, which was really interesting. Overall, the research trip was a great experience, and I would love to come back for more inspiration," Lukáš said.

For Martin, it was the diversity of Indiana's landscapes and the roads connecting them that made the biggest impression.

"I was amazed by how diverse the landscape actually is, with plenty of forested areas that transition into national parks, wetlands, prairies, and even sand dunes up north along Lake Michigan. What captivated me the most was probably the scenic IN-46 highway between Bloomington and Columbus. The road winds through the Norman Upland, home to Indiana's largest state park, Brown County State Park. We drove through many towns packed with truly memorable landmarks. In the capital, Indianapolis, it was fascinating to see modern skyscraper architecture blending with historic buildings, churches, cathedrals, and beautifully maintained parks," Martin shared with us.

Even Spekin was surprised by some of the things he saw during the trip, despite his role as a researcher, which means he spends a lot of time studying upcoming DLC areas and preparing references for the rest of the team.

"I was shocked by how big everything is in the US. For example, flags, totems, grain bins, or even roads and countryside are not as straight as they seem on street view, and you can also see the elevation. We observed and measured everything from a random curb in the city to grown corn in the countryside, so the biggest task was just not to look suspicious while capturing those details," he told us.

As a researcher, Spekin records everything that could be useful to other departments and considers how these references could be used in the game, while keeping our scale and other map limitations in mind: "Sometimes a reference can be just for inspiration, like night photos of buildings with neon lights or backlit advertisements, which are often difficult to find. During the trip, however, this was much easier, as we often arrived at our final destination late at night," he shared. 

"It might sound weird, but I like farm areas, so grain elevators, barns, and animals are my favorite ones, so you can probably guess what my photo library looks like. I also love industrial zones, so I really enjoyed Gary Steel Works, even though we saw it only from the outside. We also visited a few old covered bridges in Indiana, and I know it's just an old bridge, but I liked it a lot. Of course, I enjoyed the whole trip, every city and every town. I wish we could put everything into the game," Spekin says.

While our work on the map is still in its early stages, we also wanted to give you a small preview of what's already getting done. 

Here, you can see a few locations that are taking shape for the Indiana DLC, including the public library in Evansville, Acy Lake, and locations around Indianapolis and along I-69 and US 30.

And that's it from today's blog! We hope you have enjoyed this report from our research trip to Indiana. If you are looking forward to exploring the Hoosier State like we did, be sure to add the Indiana DLC to your Steam wishlist and show your support to our team working on it!

Don't forget to follow us on X/Twitter, Instagram, Facebook, Bluesky, and TikTok, or subscribe to our newsletter for the latest development updates. Until next time, we will see you on the road!

⭐ New Feature: FQDN support with DNS and mDNS

Device addresses can now be configured using a fully qualified domain name instead of an IPv4 address. UpSnap resolves regular hostnames through DNS and .local hostnames through mDNS before pinging, waking, shutting down, or putting a device to sleep.

Changelog

Others

• 9f05b1c: Docker - add line in compose for dbus if using fqdn with .local domain (#1772) (@invario)
• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 730873a: goreleaser: build for riscv64 (@seriousm4x)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 5435d91: remove broadcast again (@seriousm4x)
• 2c244be: update deps (@seriousm4x)
• fc4e34d: update docker dev container (@seriousm4x)

Features

• Added a read-only API endpoint to retrieve preview deployment runtime logs by application UUID and pull request ID, with line limits and optional timestamps. (#11884)

Fixes

• Fixed deployment status and metadata processing when remote command output contained leading or trailing whitespace.

What's Changed

• feat(api): expose runtime logs for preview deployments by @andrasbacsai in #11884

Full Changelog: v4.3.22...v4.3.23

Breaking Changes

• Removed host-path configuration for persistent volumes from the UI and API. API requests that include host_path are now rejected.

Features

• Added a pull request settings modal with refresh and deployment controls for preview deployments.
• Added real-time Sentinel synchronization status across server and application views.
• Added separate options to delete local and S3 archives when a volume backup schedule was removed.

Fixes

• Generated separate Traefik rules for comma-separated Docker Compose preview domains, which fixed broken preview routing (#11812, closed #7915).
• Fell back to the system DNS resolver when configured resolvers returned no address records (#11811, closed #11810).
• Preserved whitespace in streamed command output, which prevented Docker Compose argument injection from corrupting Dockerfiles (#11466, closed #11386).
• Preserved pull request filters in deployment history and showed the active filter.
• Redirected team switches to the dashboard to prevent invalid cross-team pages.

Improvements

• Made scheduled tasks, database backups, volume backups, and Docker cleanups execute only once per occurrence across distributed schedulers.
• Improved volume backup execution details and archive actions on mobile devices.
• Simplified persistent storage controls and kept volume actions on one line.

What's Changed

• fix(previews): split compose domains into Traefik labels by @andrasbacsai in #11812
• fix(dns): fall back to system resolver by @andrasbacsai in #11811
• fix(deployments): preserve whitespace in saved command output by @andrasbacsai in #11466
• chore: merge main into next by @github-actions[bot] in #11866

Full Changelog: v4.3.21...v4.3.22

release: v2.0.8

 The Stable channel has been updated to 153.0.8010.52/.53 for Windows and Mac and 153.0.8010.52 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log 

Security Fixes and Rewards

[TBD][500417361] Critical CVE-2026-93374: Use after free in Dawn. Reported by Florian Schweitzer on 2026-04-08 [N/A][548085797] Critical CVE-2026-93372: Buffer overflow in WebGL. Reported by Google on 2026-08-17 [$3,000][550839154] High CVE-2026-93375: Incorrect reference resolution in Tracing. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-08-22 [TBD][541707261] High CVE-2026-93382: Use after free in PDFium. Reported by WinD39 - Huynh Dinh Vu on 2026-08-02 [N/A][553130676] High CVE-2026-93387: Improper state validation in Skia. Reported by Google on 2026-08-26 [N/A][553132214] High CVE-2026-93373: Use after free in Extensions. Reported by Google on 2026-08-26 [TBD][556853443] High CVE-2026-93381: Buffer overflow in PDFium. Reported by SeungMyung Lee (@sm1ee), Siung kim (@ksw9722) on 2026-09-03 [TBD][560039872] High CVE-2026-93379: Incorrect authorization in ORB. Reported by OGINOME Tomohito on 2026-09-11 [N/A][560121552] High CVE-2026-93377: Type confusion in V8. Reported by Google on 2026-09-11 [N/A][498411599] Medium CVE-2026-93380: Race condition in FileSystem. Reported by Google on 2026-04-01 [N/A][511832293] Medium CVE-2026-93384: Server-side request forgery in Omnibox. Reported by Google on 2026-05-10 [N/A][515493668] Medium CVE-2026-93383: Information leak in Permissions. Reported by Google on 2026-05-22 [N/A][520521197] Medium CVE-2026-93376: Out of bounds read in DataTransfer. Reported by Google on 2026-06-05 [N/A][540051167] Medium CVE-2026-93378: Missing authorization in Storage. Reported by Google on 2026-07-28 [N/A][553136980] Medium CVE-2026-93385: Information leak in Paint. Reported by Google on 2026-08-26 [N/A][513996595] Low CVE-2026-93386: UI misrepresentation in WebAppInstalls. Reported by Google on 2026-05-17

 The Extended Stable channel has been updated to 152.0.7977.134 for Windows and Mac which will roll out over the coming days/weeks.

1.10.0 (2026-09-17)

Thank you for your donations:

• You? Become a sponsor!

One-time

• @windsource

Monthly

• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @zeddD1abl0
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

This release fixes six vulnerabilities reported by Jan Kahmen (turingpoint). Please update.

• Mail: HTML mail could run script in the webmail origin. cid: references were rewritten to blob: URLs that kept the sender's Content-Type, and the reverse proxy skipped every security header — CSP included — on app paths whose last segment contains a dot, although the signed-in mail, calendar, contacts and files routes render there. Blob URLs are now retyped as inert, link clicks from the message frame are gated by scheme, and the proxy only skips headers for an explicit static-asset allowlist (GHSA-xvjh-v9c6-qcvc, thanks @kah-ja)
• Auth: POST /api/auth/session and POST /api/auth/stalwart-context minted identity cookies without checking the supplied credentials against the JMAP server, so anyone could obtain a cookie for an arbitrary username and read that user's server-side settings. Credentials are now verified upstream before a cookie is issued: Basic credentials are bound to the account they authenticate, Bearer tokens to the session's username and identity. Deployments whose webmail container cannot reach the JMAP server no longer receive identity cookies, so cross-device settings sync stops working there (GHSA-wxcm-j4jc-9fxq, thanks @kah-ja)
• Plugins: The /plugin-sandbox runtime trusted whichever window posted the first message, so a foreign site could window.open() it, post its own init, and run code under the route's unsafe-eval CSP in the app origin — with or without plugins enabled. The sandbox now only accepts its framing window, and the proxy refuses to serve the route outside an iframe or when plugins are disabled (GHSA-96cx-gx36-3g79, thanks @kah-ja)
• Auth: Encrypted payloads now carry a purpose, so a WOPI editor access token can no longer be presented as a jmap_stalwart_ctx session cookie (GHSA-cqqx-mjcf-mh55, thanks @kah-ja)
• Auth: Reject cross-site requests to /api/auth/*. A malicious page could POST the victim's browser into an attacker-controlled account (session fixation) (GHSA-qvr9-m8cq-7wvg, thanks @kah-ja)
• Mail: Strip CR/LF and other control characters from the header values of generated read receipts. A crafted, RFC 2047-encoded subject could inject additional headers into the receipt (GHSA-w38p-hpqv-g89c, thanks @kah-ja)
• Auth / Branding: Pin the resolved IP at connect time for stored custom JMAP endpoints and branding URLs too, closing the DNS-rebinding gap left after GHSA-24w9-8r42-8jwm

Features

• Search: Global search across mail, contacts, calendar and files — query parser, ranking and cross-account providers, a search palette, and a search tab in the Pro shell with avatars, tinted icons and structured previews (#641); hits open through the owning login on every surface (#847)
• Files: Office document editing through WOPI — Collabora Online, OnlyOffice and EuroOffice (#425); the demo Files drive ships office document fixtures and a word-processor icon
• Calendar: Freely scrolling month, week and day views (#759), infinite scroll in the agenda view, and a setting to turn free scrolling off
• Calendar: Recurring occurrences use Stalwart's synthetic ids (#140)
• Calendar: Attendee free/busy via Principal/getAvailability
• Calendar: Invitations and updates surface from CalendarEventNotification, and invitations are organized as the default ParticipantIdentity
• Mail: Per-message HTML / plain-text toggle (#1022)
• Mail: Share mail folders with other users via mail:share; share notifications appear as toasts
• Mail: Search hits are highlighted with SearchSnippet/get
• Mail: Pushes are resolved with Email/changes and Mailbox/changes deltas instead of refetching the list
• Mail: Attachments show on list rows and open from there (#947, thanks @shukiv)
• Mail: Filter advanced search by message size
• Mail: Deleting a non-empty folder offers to delete its messages along with it
• Mail: "Clear search when switching folders" setting (#852, thanks @shukiv)
• Mail: Default sidebar apps for all users (#931)
• Send: Request delivery status notifications and REQUIRETLS when sending
• Reply: Choose exact-address or same-domain matching for replying from the address a message was received at (#1000)
• Composer: Sticky formatting toolbar, font-size picker and background colour (#987, thanks @ibayue)
• Contacts: Sort contacts by last name (#963)
• Contacts: Set an address book as default (#924)
• Mobile: Search-first header replacing the second toolbar row, with the query clearable from the header (#945, thanks @shukiv)
• PWA: The installed app icon shows the unread count via the Badging API (#934, thanks @dev-hive-kazniisa)
• Auth: prompt=select_account is sent to the identity provider when adding another account (#979, thanks @Almost-Senseless-Coder)
• Admin: Server-side switch for the Stalwart JMAP passthrough (#904)
• Plugins: ui.openDialog and a plugin-dialog slot for large, clickable custom UI (#975, thanks @bartfaizoli76)
• Plugins: attachment-actions and composer-attachment-source slots (#974, thanks @bartfaizoli76)
• Plugins: OAuth callback handler, extended contacts and address-book API (#925, thanks @ponchofiesta)
• Accessibility: Better labelling of the email list for screen readers (#1008, thanks @Almost-Senseless-Coder)
• i18n: Norwegian Bokmål (#829, thanks @larstobi)
• i18n: Traditional Chinese (Taiwan) (#932, thanks @kchuang1015)
• CI: The test suite runs on every push and pull request (#647)
• Dev: FileNode and blob round-trip in the mock JMAP server, and WOPI on the same-origin dev server

Changes

• Docs: Installer section removed from the README and formatting cleaned up
• Security policy: New vulnerability report email address

Fixes

• Filters: Render the "Keep" action as fileinto "INBOX" (#1027)
• Mail: List tagged mail from every account in the tag view, not just the selected folder's account (#1038)
• Mail: Dragging a message out of the list could hang the tab when generated .eml file names collided (#1039)
• Mail: Preserve label filtering during mailbox refreshes (#1017, thanks @ctaoist)
• Mail: Hide body-embedded cid: parts declared as application/octet-stream from the attachment list (#1005, thanks @dealerweb)
• Mail: Stop stretching images that carry their own max-width (#1034, thanks @shukiv), and let sender tables keep theirs (#790)
• Mail: Refetch the body when JMAP truncates the displayed part instead of rendering a blank message (#928, thanks @hildebrandttk)
• Mail: Auto-detect text direction in the read, print, plain-text, thread and .eml preview views (#663, thanks @shukiv)
• Mail: Open search hits from shared folders in the right account (#923)
• Mail: Collapse search hits for the same server object reached through several logins (#641)
• Mail: Guard quick search against stale responses (#872, thanks @vj1235432)
• Mail: Only show the unified mailbox section when it can be populated (#843), and stop it missing accounts that had not connected yet (#959, thanks @hildebrandttk)
• Mail: Surface Email/set failures on delete and move (#956)
• Mail: Report a missing archive mailbox instead of failing silently (#578), and archive shared-inbox mail into the owner's archive (#889)
• Mail: Mark as spam from the viewer after the message left the list (#695)
• Mail: Subscribe newly created mailboxes (#951)
• Mail: Sort folders in the role assignment dropdown (#984)
• Mail: Add the missing "Scheduled" folder role label (#495)
• Mail: Wire the x shortcut to thread expansion (#683)
• Mail: Keep the reading-mode toggle mounted so toolbar buttons stop jumping (#964)
• Mail: Stop the batch toolbar hiding the message you just selected (#948, thanks @shukiv), keep rows in place when it opens, and drop the duplicate selection checkbox
• Mail: Align the unread dot with the first line (#715, thanks @lucletoffe) and centre the sender avatar against the row (#953, thanks @shukiv)
• Mail: Use Simplified Chinese for the selected-messages label (#786)
• Send: Send from the address a message was delivered to (#991, thanks @rotterp)
• Send: Set the answered flag when a reply goes out with a send delay (#985)
• Composer: Upload attachments through the composing identity's account (#943)
• Composer: Pro compose tabs default their From to the open mailbox (#990, thanks @rotterp)
• Calendar: Jump to the day picked in the mini calendar (#1037, thanks @dealerweb)
• Calendar: Wait for the JMAP client before loading the account principal, and recognise a refused principal read by its JMAP error type (#1036, thanks @dealerweb)
• Calendar: Dedupe participants, resolve contact names across alias domains, and show the organizer's status (#986, thanks @ibayue)
• Calendar: Linkify URLs in the event description (#968, thanks @lucletoffe)
• Calendar: RSVP controls (#967, thanks @wrycu)
• Calendar: Normalize task progress states (#994, thanks @mulatta) and omit progressUpdated from the task completion payload (#958, thanks @sanitz)
• Calendar: Preserve task alarms that the edit dialog does not show (#504)
• Calendar: Report calendar clear failures instead of counting zero (#434)
• Calendar: Make the iCal subscription size limit configurable and show the real error (#692)
• Calendar: Paginate the event fetch on import so UID deduplication sees all existing events (#113)
• Contacts: Strip the local-account prefix from address-book ids on contact update (#1043)
• Contacts: Set name.full on all write paths so vCards carry the mandatory FN (#430)
• Contacts: Create new contacts in the selected address book (#940, thanks @ponchofiesta)
• Accounts: Detect HTTP/2 from the initial navigation timing so accounts are not capped at five (#1003, thanks @lucamzanon)
• Auth: Reject wrong passwords server-side so the browser never shows its Basic Auth dialog (#969)
• Auth: Stop retrying token refreshes that fail permanently (#972)
• Auth: Normalize the OAuth discovery base so a session JMAP_SERVER_URL refreshes (#971, thanks @thejdubb02)
• Auth: Use the selected server's issuer for SSO discovery (#952)
• Auth: Retry the JMAP session fetch when a redirect drops the auth header (#892)
• Auth: Drop max_age=0 from OIDC re-authentication requests (#938)
• Auth: Require a session for the translate API (#903)
• Mobile: Keep the actions panel below the status bar and pad attachment preview overlays for the iOS PWA safe area (#936)
• Mobile: Render plain-text-only mail as text in the thread view (#489)
• Mobile: Stop the More menu flashing open when a message is opened
• Mobile: Dismiss the search panel once a search runs, open the folder drawer from the right in RTL (#944, thanks @shukiv), and keep the account switcher header on screen
• PWA: Smaller margin for the app icons (#883, thanks @ponchofiesta)
• PWA: Focus the client before navigating on notification click (#914, thanks @bitfactory-dk)
• Push: Resolve push previews for shared and group mailboxes (#839)
• Plugins: Allow sandbox chunk loading with CORS (#922, thanks @mulatta)
• Plugins: Fail fast when the plugin storage database is blocked (#840)
• Plugins: Refill missing managed bundles from the server (#636)
• Plugins: Translations for plugins installed from the marketplace (#939, thanks @paulhenry46)
• Settings: Index newer settings and the flat calendar toggles in the settings search
• Settings: Invalidate the persisted update status after an upgrade
• UI: Readable native <select> option lists in dark themes (#999)
• i18n: German update (#1031, thanks @GyroGearl00se), "Forward as attachment" in more languages (#1016, thanks @dulinux), toolbar keys for nb and zh-TW (thanks @ibayue), and managed sidebar-app keys for zh-TW
• i18n: Preserve locale cookie precedence and normalize Chinese proxy locale detection (thanks @kchuang1015); keep basePath when normalizing a Chinese Accept-Language

Changelog

Others

• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 2c244be: update deps (@seriousm4x)

release: v2.0.7

New uNmINeD development snapshot is available for download!

Changes:

• Fixed 3-digit #rgb color parsing
• Fixed background color handling in web export
• Fixed Go to spawn and Go to player buttons for JE 26.x
• (GUI) Fixed broken highlighter GUI
• (GUI) Improved sun direction selector
• (Isometric) Speed (~2x) and memory optimizations
• (Isometric) Added sunlight shadow casting
• (Isometric) Added top edge lightening
• (Isometric) Added block variant randomization
• (Isometric) Added high precision alpha blending
• (Isometric) Added a lot of settings
• (Isometric) Improved water rendering quality
• (Isometric) Fixed zoom positioning
• (GUI) Updated ReactiveUI to 24.x
• Rolled back to .NET 10.x

Sunlight shadows in isometric mode: