Next.js has been concerned by several CVEs last time and it's clearly
overkill for our needs (static export) so in order to enlight our stack
we migrate to vite & tanstack-router
Co-authored-by: jbpenrath <jb.penrath@gmail.com>
DSN/bounce and read-receipt reports embed a message/delivery-status part.
A PST stores it as a flat byte blob, and reconstructing the .eml fed it to
compose_email as a message/delivery-status attachment. There, email.generator
dispatches to _handle_message_delivery_status, which assumes a structured
(list) payload: given our flat base64 string it iterated character by
character and raised "'str' object has no attribute 'policy'", aborting the
whole compose. Every PST message carrying such a report was silently dropped,
and any send/widget/autoreply with the same attachment type would fail too.
Relabel message/delivery-status to text/plain at the single choke point
(create_attachment_part) so all compose callers are covered without
duplicating the guard. The bytes are RFC822-style text, so they stay readable
and intact; no other attachment type reaches a payload-structured generator
branch, so normal mail is unaffected.
Also skip empty / whitespace-only PST attachments: DSN reports expose blank
diagnostic parts that libpff surfaces as attachments, which imported as
0-byte parts rendering as broken in the UI while carrying no information.
Previously, we considered as email container only ones
prefixed by `IPF.Note` but it appears `IPF.Imap` can also
contains email so we can miss some mails during import.
The "may" level was verifying the peer cert and falling back to
cleartext on mismatch, which then bounced on STARTTLS-required
servers (e.g. Mandrill's SES-backed inbound returns 530 to MAIL
FROM in cleartext). Realigned on Postfix's documented behavior:
- "may": opportunistic TLS, no cert verification.
- "secure": mandatory TLS + CA chain + hostname check; defers if
STARTTLS isn't advertised or handshake fails.
- "encrypt" is dropped (replaced by "secure").
Also wires MTA_OUT_SMTP_TLS_SECURITY_LEVEL through both the direct
and relay paths — it had been declared but never read — and
collapses the four proxy_* kwargs + sender_hostname of
send_smtp_mail into a single SmtpProxy dataclass.
Two distinct AttributeError crashes were firing on legitimate inbound
mail and producing 5xx-equivalent failures (parse aborts, autoreply
skipped).
1. Flanker scanner crashed on `multipart/report` bounces whose status
part used an RFC 6533 i18n content type (`message/global-delivery-
status` and siblings). The same crash path was reachable for every
`message/*` subtype not in flanker's hardcoded list — `partial`,
`imdn+xml`, `sip`, `cpim`, future / vendor subtypes. Fixed in the
flanker fork (i18n predicates + traverse fallback + make_part guard);
pin bumped to 77f4582044f1a8549d49333d50d9bded1176ca09.
2. `parsed["headers"]` returned `str` for single occurrences and
`list[str]` when duplicated. Every scalar consumer (`.strip()`,
`.lower()`, `.startswith()` on Subject / Message-ID / Precedence /
Return-Path / etc.) crashed the moment a header was repeated. The
parser now applies a fixed per-header type contract driven by the
IANA Provisional Message Header Field Registry: headers registered
with max=1 (RFC 5322 §3.6, RFC 3834, RFC 2045/2046/2183, RFC 4021,
RFC 3798, RFC 5703, RFC 8058, RFC 8098) are `str` with first-wins
semantics matching stdlib `email.message.Message[name]`; every
other header is `list[str]` in document order. `headers_blocks`
stays uniformly list-typed for the trusted-relays cut.
If a draft is the single thread message, delete it should not
trigger a request to refresh thread message list because this is
wasteful and it also display a toast error as the thread does not
exist anymore.
First when the sending reach the timeout, instead to display a toast
error
with a message that lets believe the message cannot be sent, we display
a warning message mentionning that sending takes more time than
expected.
Then, once a message is sent, we optimistically update thread cache to
hide
immediately the sent draft and show instead the message in the thread
view.
On slow machines, a race condition can occur when unselectThread is
trigger and another action is also triggered. e.g: when user mark as
unread a thread, the thread is unselect and the request to mark it as
unread is trigger but sometimes, the request is completed before the
router navigation so the observer in charge to mark visible message has
unread is trigger again and finally, the thread is not marked as
unread...
In f360570798, a
migration in 3 parts has been done. This was
a progressive migration and in order to be able
to restore data model in case of failure, we simply
deprecate some fields. Now that everything is fine in
production, we can safely remove those fields.
defusedxml was not declared into dependencies. In local
environment this one should be installed as transitive
deps but during deployment this deps was not found.
CalDAV-backed mailbox calendar actions: RSVP (Accept/Decline/Maybe), Add to calendar, calendar chooser, calendar listing, and conflict detection — actions enqueue background tasks and return task IDs; new API endpoints documented.
Follow-up to 6144ccb2: the graceful drop stopped the 500 on /send/,
but every reply to an Outlook/MAPI thread lost threading because
Python 3.14's MsgIDListHeader (now the default for In-Reply-To and
References) truncates obs-id-left ids with multiple '@' in the local
part at the first '@' on serialize. The pre-stdlib flanker composer
used to write those bytes through unchanged.
Route both headers to UnstructuredHeader through a dedicated
HeaderRegistry. The instance has to be dedicated: policy.clone()
shares header_factory by reference with policy.SMTP and policy.default,
so mutating in place would silently change parsing process-wide. The
msg-id regex is loosened to allow multiple '@' now that the value
goes out verbatim; the whitespace ban stays (UnstructuredHeader folds
mid-id and receivers would then truncate at the fold), as does the
graceful drop from 6144ccb2 for the cases that genuinely can't ship
(whitespace, no '@', nested brackets, CR/LF injection attempts).
The PST importer's mirror regex is loosened in sync so archive imports
preserve threading on the same kind of ids. Two parametrized tests
lock the regression surface against silent narrowing — eight real-world
shapes that must round-trip on the wire and eight that must drop.
Currently, user can delete/edit an internal message while
it is within the edit timeframe defined by
`MAX_THREAD_EVENT_EDIT_DELAY`. First feedbacks raises that
this limit is not relevant for deletion.
- Improve error management for pst
We get some pst that are unparsable by pypff. To help user to understand
that the issue is coming from the PST file, we improve the exception
raised by pst task and display a custom error message according to the
error format.
- Recover Exchange X.500-only senders during PST import
Sent items from shared mailboxes — and many internal Exchange messages —
expose every PR_SENDER_*/PR_SENT_REPRESENTING_* slot as an unresolvable
X.500 DN. compose_email then rejected the EML for lack of a valid From
address and pst_tasks silently dropped the message at debug level, so
entire folders disappeared from the import without a trace.
- Prevent duplicate messages on PST re-import
PST messages without transport_headers (drafts, locally composed items)
were reconstructed with no Message-ID at all, and Exchange/O365 exports
sometimes drop the header even on received items. With no mime_id to
key on, deliver_inbound_message skipped its dedup check and inserted
the same message on every import — and even twice within a single
import when the same message appeared in multiple Outlook folders.
Allow user to copy/paste a thread link with other mailbox users.
Currently, if the user copy the current url, the link is broken once
the thread has been moved from the origin folder. It is also possible
to target a message or internal message.
* allow to render table in email
Improve email exporter to support table elements. We do not add
blocknote tool to add explicitly table but we allow user to
copy/paste it and render it properly.
* upgrade to blocknote 0.49.0
Remove a bug that prevent to use backspace in an empty block.
https://github.com/TypeCellOS/BlockNote/pull/2610
This allows to use S3-compatible object storage to offload blobs, making Postgres much lighter. We design for storing ~1B emails on a single instance.
We also take this opportunity to do model changes on blobs & attachments.
Migration 0027 is one-way, no going back after this one so check your backups.
Latest fixes in the stdlib make it a more solid alternative for strict composition than Flanker. We keep Flanker for now for lenient inbound parsing. We add stronger tests and fuzzing to validate we didn't regress.
As a follow-up of the mention feature, we build upon ThreadEvent & UserEvent
models a feature to assign users to a thread.
We allow to filter mailboxe's inbox through assignation state (assigned to me, unassigned).
The thread share modal has been forked from ui-kit to be able to list users of each
mailbox and add a cta to assign them to the thread. A section above shows assigned users.
Currently, only mailbox editors can remove thread access to their
mailbox.
Actually, thread access deletion must be symmetric with creation rights.
So
any user with thread management ability should be able to delete a
thread
access.
The `ATTACHMENT_SEPARATORS` only contains a english separator and as
this
string is displayed within other mail client, for non-english users it
can
be weird to see an english string. That's why we add new separators and
according to the sender language, we use the localized separator that
correspond to him.
Sylvain Zimmer