Next.js has been concerned by several CVEs last time and it's clearly
overkill for our needs (static export) so in order to enlight our stack
we migrate to vite & tanstack-router
Co-authored-by: jbpenrath <jb.penrath@gmail.com>
DSN/bounce and read-receipt reports embed a message/delivery-status part.
A PST stores it as a flat byte blob, and reconstructing the .eml fed it to
compose_email as a message/delivery-status attachment. There, email.generator
dispatches to _handle_message_delivery_status, which assumes a structured
(list) payload: given our flat base64 string it iterated character by
character and raised "'str' object has no attribute 'policy'", aborting the
whole compose. Every PST message carrying such a report was silently dropped,
and any send/widget/autoreply with the same attachment type would fail too.
Relabel message/delivery-status to text/plain at the single choke point
(create_attachment_part) so all compose callers are covered without
duplicating the guard. The bytes are RFC822-style text, so they stay readable
and intact; no other attachment type reaches a payload-structured generator
branch, so normal mail is unaffected.
Also skip empty / whitespace-only PST attachments: DSN reports expose blank
diagnostic parts that libpff surfaces as attachments, which imported as
0-byte parts rendering as broken in the UI while carrying no information.
Previously, we considered as email container only ones
prefixed by `IPF.Note` but it appears `IPF.Imap` can also
contains email so we can miss some mails during import.
The "may" level was verifying the peer cert and falling back to
cleartext on mismatch, which then bounced on STARTTLS-required
servers (e.g. Mandrill's SES-backed inbound returns 530 to MAIL
FROM in cleartext). Realigned on Postfix's documented behavior:
- "may": opportunistic TLS, no cert verification.
- "secure": mandatory TLS + CA chain + hostname check; defers if
STARTTLS isn't advertised or handshake fails.
- "encrypt" is dropped (replaced by "secure").
Also wires MTA_OUT_SMTP_TLS_SECURITY_LEVEL through both the direct
and relay paths — it had been declared but never read — and
collapses the four proxy_* kwargs + sender_hostname of
send_smtp_mail into a single SmtpProxy dataclass.
Two distinct AttributeError crashes were firing on legitimate inbound
mail and producing 5xx-equivalent failures (parse aborts, autoreply
skipped).
1. Flanker scanner crashed on `multipart/report` bounces whose status
part used an RFC 6533 i18n content type (`message/global-delivery-
status` and siblings). The same crash path was reachable for every
`message/*` subtype not in flanker's hardcoded list — `partial`,
`imdn+xml`, `sip`, `cpim`, future / vendor subtypes. Fixed in the
flanker fork (i18n predicates + traverse fallback + make_part guard);
pin bumped to 77f4582044f1a8549d49333d50d9bded1176ca09.
2. `parsed["headers"]` returned `str` for single occurrences and
`list[str]` when duplicated. Every scalar consumer (`.strip()`,
`.lower()`, `.startswith()` on Subject / Message-ID / Precedence /
Return-Path / etc.) crashed the moment a header was repeated. The
parser now applies a fixed per-header type contract driven by the
IANA Provisional Message Header Field Registry: headers registered
with max=1 (RFC 5322 §3.6, RFC 3834, RFC 2045/2046/2183, RFC 4021,
RFC 3798, RFC 5703, RFC 8058, RFC 8098) are `str` with first-wins
semantics matching stdlib `email.message.Message[name]`; every
other header is `list[str]` in document order. `headers_blocks`
stays uniformly list-typed for the trusted-relays cut.
If a draft is the single thread message, delete it should not
trigger a request to refresh thread message list because this is
wasteful and it also display a toast error as the thread does not
exist anymore.
First when the sending reach the timeout, instead to display a toast
error
with a message that lets believe the message cannot be sent, we display
a warning message mentionning that sending takes more time than
expected.
Then, once a message is sent, we optimistically update thread cache to
hide
immediately the sent draft and show instead the message in the thread
view.
On slow machines, a race condition can occur when unselectThread is
trigger and another action is also triggered. e.g: when user mark as
unread a thread, the thread is unselect and the request to mark it as
unread is trigger but sometimes, the request is completed before the
router navigation so the observer in charge to mark visible message has
unread is trigger again and finally, the thread is not marked as
unread...
In f360570798, a
migration in 3 parts has been done. This was
a progressive migration and in order to be able
to restore data model in case of failure, we simply
deprecate some fields. Now that everything is fine in
production, we can safely remove those fields.
defusedxml was not declared into dependencies. In local
environment this one should be installed as transitive
deps but during deployment this deps was not found.
CalDAV-backed mailbox calendar actions: RSVP (Accept/Decline/Maybe), Add to calendar, calendar chooser, calendar listing, and conflict detection — actions enqueue background tasks and return task IDs; new API endpoints documented.
Follow-up to 6144ccb2: the graceful drop stopped the 500 on /send/,
but every reply to an Outlook/MAPI thread lost threading because
Python 3.14's MsgIDListHeader (now the default for In-Reply-To and
References) truncates obs-id-left ids with multiple '@' in the local
part at the first '@' on serialize. The pre-stdlib flanker composer
used to write those bytes through unchanged.
Route both headers to UnstructuredHeader through a dedicated
HeaderRegistry. The instance has to be dedicated: policy.clone()
shares header_factory by reference with policy.SMTP and policy.default,
so mutating in place would silently change parsing process-wide. The
msg-id regex is loosened to allow multiple '@' now that the value
goes out verbatim; the whitespace ban stays (UnstructuredHeader folds
mid-id and receivers would then truncate at the fold), as does the
graceful drop from 6144ccb2 for the cases that genuinely can't ship
(whitespace, no '@', nested brackets, CR/LF injection attempts).
The PST importer's mirror regex is loosened in sync so archive imports
preserve threading on the same kind of ids. Two parametrized tests
lock the regression surface against silent narrowing — eight real-world
shapes that must round-trip on the wire and eight that must drop.
Currently, user can delete/edit an internal message while
it is within the edit timeframe defined by
`MAX_THREAD_EVENT_EDIT_DELAY`. First feedbacks raises that
this limit is not relevant for deletion.
- Improve error management for pst
We get some pst that are unparsable by pypff. To help user to understand
that the issue is coming from the PST file, we improve the exception
raised by pst task and display a custom error message according to the
error format.
- Recover Exchange X.500-only senders during PST import
Sent items from shared mailboxes — and many internal Exchange messages —
expose every PR_SENDER_*/PR_SENT_REPRESENTING_* slot as an unresolvable
X.500 DN. compose_email then rejected the EML for lack of a valid From
address and pst_tasks silently dropped the message at debug level, so
entire folders disappeared from the import without a trace.
- Prevent duplicate messages on PST re-import
PST messages without transport_headers (drafts, locally composed items)
were reconstructed with no Message-ID at all, and Exchange/O365 exports
sometimes drop the header even on received items. With no mime_id to
key on, deliver_inbound_message skipped its dedup check and inserted
the same message on every import — and even twice within a single
import when the same message appeared in multiple Outlook folders.
Allow user to copy/paste a thread link with other mailbox users.
Currently, if the user copy the current url, the link is broken once
the thread has been moved from the origin folder. It is also possible
to target a message or internal message.
* allow to render table in email
Improve email exporter to support table elements. We do not add
blocknote tool to add explicitly table but we allow user to
copy/paste it and render it properly.
* upgrade to blocknote 0.49.0
Remove a bug that prevent to use backspace in an empty block.
https://github.com/TypeCellOS/BlockNote/pull/2610
This allows to use S3-compatible object storage to offload blobs, making Postgres much lighter. We design for storing ~1B emails on a single instance.
We also take this opportunity to do model changes on blobs & attachments.
Migration 0027 is one-way, no going back after this one so check your backups.
Latest fixes in the stdlib make it a more solid alternative for strict composition than Flanker. We keep Flanker for now for lenient inbound parsing. We add stronger tests and fuzzing to validate we didn't regress.
As a follow-up of the mention feature, we build upon ThreadEvent & UserEvent
models a feature to assign users to a thread.
We allow to filter mailboxe's inbox through assignation state (assigned to me, unassigned).
The thread share modal has been forked from ui-kit to be able to list users of each
mailbox and add a cta to assign them to the thread. A section above shows assigned users.
Currently, only mailbox editors can remove thread access to their
mailbox.
Actually, thread access deletion must be symmetric with creation rights.
So
any user with thread management ability should be able to delete a
thread
access.
The `ATTACHMENT_SEPARATORS` only contains a english separator and as
this
string is displayed within other mail client, for non-english users it
can
be weird to see an english string. That's why we add new separators and
according to the sender language, we use the localized separator that
correspond to him.
Currently when the user clicks on the refresh button, a spinner
is displayed during query is pending. Often, this query is really
fast so the user does not see the spinner and wonder if something
really happend. In order to improve ux here, we now display the
spinning icon at least for 700ms in this way, no matter the query
timing, the user will see something happend. Furthermore, we also
add a transient tooltip that display refresh state (number of
new message or Up to date).
Currently to mark a thread as read/unread, the user have to open a
dropdown
menu then click on the action... as this action can be done often, we
put it
directly in the thread action bar.
The thread query is an infinite one and the frontend logic is
based on the structuralSharing concept of react-query to
optimiscally update the react query cache on thread mutation in
order to improve ux. This part is a tricky one and it's easy to
introduce regression, that's why refactor it by moving the corresponding
logic into a mailbox-cache module, use a better naming (pin instead of optimistic)
and battle test it.
When the current view is filtering through a nested label, the thread
panel
title has no text because we only traverse root labels to try to find
the
one selected. Now we also recursively traverse children.
Add `NEXT_PUBLIC_FEEDBACK_WIDGET_HOME_CHANNEL` env var to be able to
set a specific channel id to receive feedback from unauthenticated
users.
For configuration ease and backward compatibility, if
`NEXT_PUBLIC_FEEDBACK_WIDGET_HOME_CHANNEL` is not set, the home feedback
widget fallback to `NEXT_PUBLIC_FEEDBACK_WIDGET_CHANNEL`.
A spoofed inbound with From == To was being marked is_sender=True via
the
`sender_email == recipient_email` shortcut in
_create_message_from_inbound.
Because MessageRecipient rows from the inbound path carry no
delivery_status, those messages matched retry_messages_task's
(is_sender=True AND delivery_status IN (RETRY, NULL)) filter and went
through send_message on every 5-min beat — DKIM-signing and re-emitting
the spam to every recipient on the envelope, externals included.
Legitimate self-sends are unaffected: send_message's internal redelivery
hits the mime_id dedup in deliver_inbound_message before reaching
_create_message_from_inbound, so the shortcut was already dead code on
the legitimate path.
The new widget loader consume `window._lasuite_widget` property to
know which widget to load. The previous version was using
`window._stmsg_header`. We refactor widget loading logic to support
both version with ease.
The new widget loader consume `window._lasuite_widget` property to
know which widget to load. The previous version was using
`window._stmsg_header`.
/!\ Update NEXT_PUBLIC_LAGAUFRE_WIDGET_PATH and
NEXT_PUBLIC_FEEDBACK_WIDGET_PATH
to target the new widget version before deploying this commit.
Add an option `--from-date` to the `search_reindex` management command.
In this way, in case of index task failure, we are able to reindex only
resources updated in a recent timeframe.
OpenSearch was returning 503/429 on delete_by_query under the load of
the periodic reindex. Each bulk_reindex_threads_task could fire up to
100 delete_by_query calls (one per chunk of 100 threads) to sweep
orphan messages, and bulk_delete_threads_task did one more to drop a
thread and all its children. delete_by_query holds a scroll context,
scans the index and refreshes per call — far heavier than the bulk
upserts running alongside it.
Tracking message deletes explicitly at signal time lets us replace
every hot-path delete_by_query with a bulk delete by _id:
- New search:pending_delete_messages set storing thread_id:message_id
pairs, fed by Message.post_delete (covers cascaded deletes too).
- New bulk_delete_messages_task issuing bulk DELETE actions with the
parent thread_id as routing.
- bulk_delete_threads_task rewritten to bulk DELETE thread parent docs
by _id; child message docs ride the new task via cascaded signals.
- _purge_orphan_docs and the per-chunk purge in reindex_bulk_threads
removed; reindex is now pure upsert.
