v1.11.0 - Bulwark Lite, Single-Occurrence RSVP & Stalwart Compatibility Fixes
1.11.0 (2026-09-23)
1.11.0 introduces Bulwark Lite, a static build of the webmail that runs without a Node server, and fixes many places where Bulwark and Stalwart disagreed about mail, filters, calendars, contacts and files. It contains everything from the three 1.11.0 betas. The latest Docker tag moves to this release.
Thank you for your donations:
- You? Become a sponsor!
One-time
Monthly
- @jsaathof
- @berkersal
- @NABarnes
- @felixzieger
- @pr0ton11
- @zeddD1abl0
- @fpauser
- @proxforge
- @spss20
- @elgringoYan
- @pauladams8
- @djpriest
- @umakers
- @zplizzi
- @jeremiah
- @Theoretisch1337
- @svandive
- @HiltMundell
Features
- Lite: Bulwark Lite, a static build that talks to the JMAP server straight from the browser.
npm run build:litebuilds it, and every release shipsbulwark-lite-<version>.zipfor any static web host - Lite:
bulwark-lite-stalwart.zip, a Stalwart Application bundle that picks up its mount prefix at runtime, with OpenID Connect login - Lite: Container image
ghcr.io/bulwarkmail/webmail-lite(#1081) - Themes: "Flat fields" theme
- Calendar: Attendees can answer a single occurrence of a recurring event (#1086)
- Mail: Office attachments open read-only in the document editor, straight from the message, when a WOPI editor is configured (#1047)
- Push: Optional inbox-only push notifications (#983, thanks @guisea)
- Mail: Toasts for mail actions that gave no feedback, and an "email sent" toast after immediate sends
- Filters: "Keep a copy" option for forward actions
- Filters: Per-rule "Also move messages marked as spam" option
- Admin: Login page toggles in admin settings for the version, the 2FA code option, the heading and the subtitle (#1068)
- Navigation: Deep links resolve to the local instance
Changes
- Auth: Signing out of an SSO account also signs out of the identity provider when it advertises an
end_session_endpoint(#905). SetOAUTH_END_SESSION=falseto keep the provider session, for example when other apps share it, andOAUTH_POST_LOGOUT_REDIRECT_URIto send users back to the webmail afterwards - Filters: Move and copy rules leave mail that Stalwart marked as spam in Junk. Before, a rule such as "subject contains invoice" also collected phishing. "Keep" rules stay unguarded as the allow-list
- Mail: Search sends terms exactly as typed, without adding a prefix wildcard, in tag views too
- Mail: The message list loads attachment chips lazily, so large folders open faster (#1089)
- Send: Scheduled send is limited to 7 days, the most Stalwart accepts
- UI: Icon set migrated from Lucide to Tabler Icons
- Docker: Pre-releases no longer move the
latesttags - Docs: Most README details moved to the website docs, with new screenshots
Fixes
- Mail: "All folders" search includes shared accounts (#1082)
- Mail: A search inside a tag view narrows the tag instead of replacing it (#1084, thanks @rotterp)
- Mail: Leaving an account drops a search folder scope that belongs to it (#1084, thanks @rotterp)
- Mail: A failed search shows an error instead of "No results found"
- Mail: In unified views, threads belong to the account that owns them (#1012, thanks @lucamzanon)
- Mail: A failed move between accounts no longer deletes the original
- Mail: "Mark all as read" marks every unread message instead of skipping pages past the first 500
- Mail: Mark as spam and not spam report moves the server refuses
- Mail: Unread-first order keeps bringing up unread mail past the first page
- Mail: The tag button in a row's hover actions opens the tag picker instead of clearing the message's tags (#1032, thanks @douwezijlstra-frl)
- Mail: Tag and tab counters no longer download every matching id
- Mail: Text in fixed-width tables wraps to the screen on iOS (#1020)
- Mail: Mail action toasts show again
- Send: A send the server refuses is reported as failed instead of sent. When only filing the sent copy fails, a warning says so, so the mail is not sent twice
- Send: A From override is also used as the envelope sender where the server accepts it. Where it doesn't, as on Stalwart, the composer says that the identity's address shows in the Return-Path (#1009)
- Send: Sending with an identity adds its Bcc addresses
- Composer: Attachments over the server's size limits are refused before upload
- Composer: A staged attachment is kept until its upload finishes
- Filters: Filters keep running while the auto-reply is on, and saving a filter no longer turns the auto-reply off
- Filters: "Mark read", "star" and "add label" reach mail that the same rule moves, and rules keep their target folder after it is renamed
- Filters: Forward actions respect the server's redirect limit (one on Stalwart) instead of being dropped without notice
- Auto-reply: A warning appears before saving an auto-reply that Stalwart would refuse as too long
- Calendar: Edits to a single occurrence stay on that occurrence and keep its details
- Calendar: Date ranges are queried in the right time zone, and long recurring series or more than 1000 events no longer leave the calendar incomplete
- Calendar: When the server refuses an event's invitations, you can save the event without sending them
- Calendar: Subscriptions that fail with "Not authenticated" name the cause, such as a mail server certificate the webmail server does not trust (#1073)
- Calendar: The subscription dialog no longer promises CalDAV URLs
- Calendar: The import dropdown opens above the day and week views (#1049)
- Contacts: Contacts with calendar, scheduling or free/busy links save, and cleared fields are cleared on the server
- Contacts: vCard import no longer sends fields Stalwart rejects and writes addresses in the RFC 9553 form
- Contacts: Deleting an address book that still holds contacts works
- Files: Every file is listed, even when the account has more than
maxObjectsInGet(#1069) - Files: Copying a folder copies its contents, and changes inside a shared drive go to the drive's account
- Files: An upload or new folder whose name is taken becomes "name (2)" instead of failing
- Files: Sharing works on Stalwart versions before 0.16.6
- Files: Names Stalwart refuses are caught before sending, uploads store an accepted variant, and Office files keep their MIME type on Stalwart 0.16.6 and later
- Account: You stay signed in after changing your password in settings
- Account: Users who are not admins see their name, and changing the password or turning TOTP off asks for the current code
- Auth: OAuth endpoints on the configured issuer's own host are accepted when they resolve to a private address, so split-DNS setups no longer need
OAUTH_ALLOW_PRIVATE_ENDPOINTS(#1028) - Auth: Linking the mobile app re-authenticates against the account's own identity provider when OAuth is configured per server
- Push: Push subscriptions are renewed before Stalwart's 7-day expiry, so a tab or app left open for over a week keeps getting notifications
- Sharing: Principals are listed in directories with more than 500 users
- Lite: The login page hides the server field once
config.jsonsetsjmapServerUrl(#1087) - Plugins: The plugin sandbox follows the app's "Automatic" language (#976, thanks @bartfaizoli76)
- UI: The global error page loads the app's styles