-
Improve frontend display
Stablestb released this
2026-08-22 17:14:51 +02:00 | 0 commits to main since this releaseFeatures
- Each message in a mailbox now shows its expiry date, alongside its date, sender, and subject — just like temporary mailboxes already show theirs on the overview page.
Fixes
- Fixed the "Permanent mailboxes" and "My temporary mailboxes" headings on the overview page rendering at different sizes. They're now both the same heading level.
- Fixed mailbox and message list rows not filling the width of their container, instead shrinking to fit their content — most noticeable on wider screens, where entries would sit awkwardly narrow on the left.
-
2026-08-22 16:48:06 +02:00 | 1 commits to main since this releaseFixes
- Mail is no longer wrongly deleted on mail setups where the
Delivered-Toheader doesn't name the actual destination address — notably catch-all mailboxes, whereDelivered-Tocommonly ends up holding just the mailbox's own base address. Deaddrop now also checks the firstReceived:header'sfor <address>clause,X-Original-To,To, andCc, in that order, and matches against the first address among those that resolves to a live virtual inbox.
Other
- When a message still can't be matched to any inbox, the deletion log now includes the value of every one of these headers (not just whichever one was checked), to make delivery-configuration problems diagnosable straight from the log.
- Mail is no longer wrongly deleted on mail setups where the
-
More logging improvments
Stable -
2026-08-22 15:40:06 +02:00 | 3 commits to main since this releaseFeatures
- The config file is now watched for changes and reloaded automatically, controlled by a new
general.auto_reloadoption (default: on). Most settings — IMAP connection details, address patterns, lifetimes, the expunge interval, the base URL, and permanent addresses — take effect live, without a restart.general.secret,http.listen_addr, and the[oidc]section are deliberately excluded and require a restart, since applying them live would be unsafe or destructive (rotating the secret, for instance, would invalidate every session and delete every existing temporary mailbox).
Fixes
- Log messages for mail deleted because it was addressed to an expired or unrecognized inbox now include the destination address, making it much easier to tell why a message didn't reach its inbox.
Other
- Renamed "Temporary mailboxes" to "My temporary mailboxes" on the overview page, to make clearer what the list contains.
- The config file is now watched for changes and reloaded automatically, controlled by a new
-
Add a /v1/health endpoint
Stable2026-08-22 14:29:33 +02:00 | 7 commits to main since this releaseFeatures
- Added a
GET /v1/healthendpoint for load balancers and monitoring: returns 200{"status":"ok"}when the app and its backing IMAP connection are healthy, or 500{"status":"backend not available"}if the IMAP connection is down. Unauthenticated, and discloses nothing beyond that up/down status.
- Added a
-
2026-08-22 13:31:30 +02:00 | 8 commits to main since this releaseFeatures
- Temporary mailboxes you've created are now remembered across visits. The overview page has a new "Temporary mailboxes" section, listed just below the permanent ones, showing every temporary mailbox this browser has created and its expiry time — no more needing to keep the link around yourself. Entries can be removed individually, and mailboxes that have since expired are dropped from the list automatically.
-
Add localization for German
Stable2026-08-22 13:04:34 +02:00 | 9 commits to main since this releaseFeatures
- Added localization, starting with English and German. The frontend UI (overview page, mailbox and message views, the create-mailbox dialog) is now fully translated in both languages, with a language switcher in the header. The locale is auto-detected from the browser on first visit and falls back to English; an explicit choice is remembered across visits. Dates now format according to the selected language rather than just the raw browser locale.
-
Improve security
Stable2026-08-22 12:27:36 +02:00 | 10 commits to main since this releaseSecurity
- Sandboxed message rendering + a site-wide Content-Security-Policy. HTML email bodies now render inside a sandboxed
<iframe>with scripting disabled outright, instead of being injected into the app's own page, and every response now carries a strict CSP. Together these mean a bug in the HTML sanitizer alone is no longer enough to execute script or exfiltrate data from a viewed message. - Removed the last third-party dependency (the API docs page's Swagger UI is now fully self-hosted instead of loaded from a CDN) — this is what made the strict CSP possible without carving out exceptions.
- Fixed an open redirect in the OIDC login flow: the post-login return URL is now validated to a same-origin path, closing a phishing vector where a legitimate-looking Deaddrop login link could end in a redirect to an attacker-controlled site.
- Fixed the most significant finding of a full security audit: the raw message-part API endpoint now always forces a file download, even for a message's own inline HTML body (which has no filename). Previously, navigating directly to that URL could render a sender's raw, unsanitized HTML inline in the app's own origin.
- Message expiry no longer trusts the sender's
Date:header. A sender could previously set an arbitrary future date on their own message to keep it around past its configured lifetime; expiry is now based on the mail server's own receipt timestamp instead. - Added size limits on IMAP-sourced message bodies and API request bodies, to prevent a maliciously large message or request from exhausting memory.
general.secretnow requires a minimum length (32 bytes) at startup, since it's the root key behind all signing, session, and OAuth-state security.- Added automated dependency vulnerability scanning (
govulncheck,npm audit) to the test suite — this immediately caught the Go toolchain being a few patch releases behind on several standard-library CVE fixes, now updated. - Published
SECURITY.md, documenting Deaddrop's full security model (access control, control-message integrity, session/OIDC handling, and input handling from both IMAP and the API).
Fixes
- Fixed a bug affecting most real-world HTML email: message bodies encoded as quoted-printable or base64 (the vast majority of HTML emails, and any non-ASCII plain text) were served back still-encoded instead of decoded, so they displayed corrupted rather than as their actual content.
Other
- Various fixes to the CI/build pipeline (Forgejo Actions compatibility, and ensuring the full test suite runs cleanly from a fresh checkout).
- Sandboxed message rendering + a site-wide Content-Security-Policy. HTML email bodies now render inside a sandboxed
-
Initial release
StableAll checks were successfulBuild and publish image / docker (push) Successful in 2m44s2026-08-21 18:40:51 +02:00 | 22 commits to main since this release