kimusan Release Notes

Four releases in two days, three of them today, to clean up after one change of mine. Sorry. Writing the open message into the address bar, added in 4.4.3 so that Back works and a message can be linked, reset a different piece of the mailbox on every click, and each one surfaced as its own bug. Everything the address bar carries is now read and applied in one place, and the rest of the links that write it have been gone through rather than waited on.

If you are on 4.4.3, 4.4.4 or 4.4.5, take this one.

Fixed

• Opening a message from page 2 or later jumped back to page 1, after which the previous and next arrows walked a list that no longer held the open message and appeared to do nothing. A message link has nowhere to record the page, so the route reported page one for every one of them and the list was reloaded at the top. Reported by @lvarnava (#157)
• Opening a message from a search threw the search away and reloaded the whole folder behind it. The link dropped the search, which the route has always been able to carry after the uid. Found while fixing #157, not reported
• Clicking the conversation count showed the whole list, and Back to list stayed in the thread. The test that stops every message click refetching the list compared the folder, page and search, and the thread uid is none of those: it travels inside the folder part, so entering or leaving a thread changed nothing it looked at and the reload was skipped in both directions. Reported by @floppybl (#156)
• Reloading the browser while reading a message inside a thread came back with the whole folder behind it. The thread uid was applied only when the address bar held no message. Found by going through the remaining links rather than from a report

Fixed

Take this one if you run 4.4.3 or 4.4.4 and any of your folders has a space, an accent or a nested path: opening a message showed nothing at all.

A message opened to an empty body, in any folder whose name is not plain ASCII. The fix for #153 in 4.4.4 put the correct folder hash into the address bar, and then the route handler took that hash for a folder name: it compared it against the open message's full name, which never matches, built a replacement message naming a folder that does not exist, and the request for it was dropped without a word. So the body loaded and was immediately replaced by nothing. Both the comparison and the new message now use the folder's full name, which the route handler has already resolved. Diagnosed, down to the line, by @remmmi (#155)

Installing the Debian package over an older tachyon package stopped on a file conflict. The rename in 4.4.3 left tachyon-webmail owning the same paths without declaring that it replaces them, so apt install ./tachyon-webmail_*.deb aborted unless the old package was removed first, which broke unattended installs. A versioned Replaces hands the files over. There is deliberately no Breaks: Debian's unrelated tachyon ray tracer also satisfies << 4.4.3~, and apt would have offered to remove it. Diagnosed and tested, including against python-apt, by @ZaphodB (#154)

Asking for a message in a folder that cannot be resolved now says so in the browser console, with [debug] javascript = On. It returned false in silence before, which is how the two bugs above stayed invisible while the message view simply sat empty

Changed

Installing the Debian package now warns, once, while an older tachyon package is still installed. Replaces hands over the shared files but does not remove that package, and what stays behind is a complete older copy of the application under /usr/share/tachyon, missing the security fixes from 4.4.0 through 4.4.3. Run apt remove tachyon to clear it

Take this one if you run 4.4.3: clicking a message could fill the search box and open nothing, for anyone whose folders are not named in plain ASCII.

Fixed

Clicking a message filled the search box and showed nothing, on 4.4.3 only. Message links name a folder by a URL-safe hash of its full name, because a full name may hold the hierarchy delimiter and anything else; the click path passed the full name instead, so a folder like Lists/dev produced extra path segments, no route matched it, and the tail was read as page and search. A folder named only [a-z0-9._-] hashes to itself, which is why INBOX behaved normally and this reached release: Dovecot's default . delimiter is in that class, Mailcow's / is not. Two older instances of the same mistake go with it, in the folder jumped to when a message is not in the current list, which is also how "select next after delete" moves, and in the notification for several new messages. Reported by @codiflow (#153)

The admin Contacts connection test reported plain success while contacts were switched off, so a green result said less than it appeared to and sent an administrator hunting for the fault elsewhere. It now has three outcomes: the database failing, the database answering while the feature is off, and both together. Found through #145

Added

A line or two of the message body under the subject in the list, off by default, with a setting under General for one line or two. The text comes from the IMAP server over PREVIEW (RFC 8970), which means no extra fetching and no HTML to strip, since the server is required to hand over plain text. Where a server cannot do it the setting says so rather than appearing to work, and where an administrator has turned it off the setting is hidden. Asked for by @DanClarke-io (#148)

A show/passphrase toggle on both login screens. Hidden by default, and it cannot submit the form or reveal anything before the page has finished loading. Asked for by @goddies (#131)

A Material theme, modelled on Material Design 3, in light and dark, with no web fonts fetched. Thanks to @DanClarke-io (#151)

MailClient::MessageListByTuples(), a supported way for a plugin to hand the core a page of [folder, uid] pairs and have it fetched and rendered, for search backed by an external index or a conversation ordering. The caller's order is kept across folders, repeats collapse, and pairs that could not be read are reported back. Asked for by @remmmi (#140)

Changed

The login-o365 documentation no longer offers the two redirect URI forms as equal alternatives. Microsoft permits a query parameter in a redirect URI only for work and school registrations, so a personal Outlook account must use the path form, which is the extension's default. Raised in #114

Translations updated for Polish and Russian

This week Tachyon Webmail got its (registered) 10,000th download from GitHub. Who knew, when I started this fork back in June. Thanks everyone!

This release is worth taking if you run 4.4.2: opening Drafts could fail outright on PHP 8.4, the Debian package pulled in a second PHP, and logging out did not end the session.

Known issues

An installation upgraded from before 4.4.0 can find Contacts, Calendar and additional accounts switched off, with nothing in the interface to say why and only AddressBook[ERROR]: CryptKeyError[111] in the log. Each user has a .cryptkey sealed with their mail password, and on hosts with neither the sodium extension nor a usable OpenSSL cipher it was sealed with XXTEA. The forgery fix in 4.4.0 changed how that key is derived, because the salt stored inside such a token was the entire key, so one written before 4.4.0 cannot be read after it and cannot be recovered without reopening the hole. Delete that user's storage/<domain>/<user>/.cryptkey and log in again. A saved CardDAV, CalDAV or OAuth password then has to be entered once more; contacts and calendar entries are not encrypted with this key and are untouched. A mail password changed outside Tachyon has the same effect, since nothing is left to reseal the key with. See the FAQ entry for 111. Reported by @janciorules (#145)

Security

Logging out left the server-side session alive. Logout() asked the browser to drop two cookies and nothing else: the StorageType::SESSION record that getMainAccountFromToken() actually checks stayed where it was, and the clear of the SESSION_TOKEN cookie had been commented out. Anyone holding a copy of the cookies from before the logout kept full mailbox access without the password, and since FileStorage::Get() touches the file on every read, a session being replayed never aged into the three hour sweep either. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-gc87-g2gf-xj6q)

Backup restore ran without an admin session. JsonAdminRestoreData asked only whether the request had reached the admin panel, which is true for anyone able to load it, and the core rule requiring a login for Admin* actions did not cover it: a plugin action is dispatched as PluginJsonAdminRestoreData, so the test on the name starting with Admin never matched. The restore now demands an admin login, ignores the client's Content-Type, and will only write to the four directories and the one contacts database a backup legitimately contains, refusing the archive outright if it holds anything else. Reported by Fathi Ben Nasr, Convergent Cloud Computing (GHSA-5r45-3mqm-hcvg)

The IMAP sequence-set range pattern had no end anchor, so a value merely starting like a range was passed through whole and anything following it was read as more of the IMAP command. Nothing in the tree feeds it anything but server-derived integers, so this was a sharp edge rather than a hole, but it is the single place every FETCH, STORE and COPY sequence is built. Found while answering @remmmi (#140)

Fixed

Opening Drafts could report "unknown error" and show nothing, on PHP 8.4. A draft holds whatever was typed, so an address can have no domain at all, and idn_to_utf8('') throws a ValueError on 8.4 where older versions returned false. That happened while the message list was being serialised, so the whole response failed rather than one address. Reported by @daniu-de (#122)

The Debian package pulled in a second PHP. 4.4.2 added a versioned php-fpm (>= 2:8.2~) dependency, which no unversioned Provides can satisfy, so an existing working php8.3-fpm stopped counting and apt installed 8.4 beside it. The constraints are gone, as they were in 4.4.1; the 8.2 floor is still enforced at startup by Integrity::phpVersion(). Reported by @lvarnava (#134)

The package is now called tachyon-webmail. Debian already ships an unrelated tachyon in bookworm/main, a parallel ray tracer. Reported by @lvarnava (#135)

A fresh install could log that it had created the admin password and where to read it, and that password was then refused. It was written to admin_password.txt before the hash was stored, and Config::Save() returns a bool that nothing looked at, so wherever application.ini could not be written the file existed and held a password that had never been stored anywhere. Saved first now, and the file is written only if that worked. Reported by @jon4156 (#133)

The ics-viewer fix listed in 4.4.2 reached releases but not git checkouts: #127 widened the match in message.js and left message.min.js, the file the plugin actually loads, untouched. Release packaging runs terser over every plugin, which is how this turned up

In the Nextcloud file picker, the "Select folder" footer showed where it means nothing. It used the hidden binding, which any author rule carrying a display beats, and is now bound on visible. The button is also relabelled to the already-translated save string. Reported by @lvarnava (#117)

Added

The Back button now closes an open message, and a message has its own link. The route has always understood #/mailbox/<folder>/m<uid>, so a pasted link worked, but nothing ever wrote such a hash. Opening a message now pushes a history entry, arrow keys replace it rather than leaving one per message, and the preview pane filling itself at folder load writes nothing. Idea from @remmmi (#141)

Back out of the last of the client's own history entries and you are asked before you leave, rather than simply landing wherever you were before

The Nextcloud folder picker opens on the folder used last, with each level on the way down opened, so a nested folder is reached rather than only a top level one. Asked for by @lvarnava (#117)

Changed

The date format setting now previews with a date whose parts cannot be confused for one another. Thanks to Antonios Vamporakis (#137)

Translations updated for Polish and French, and plugin strings for Polish, French and Russian

A release worth taking promptly: 4.4.0 and 4.4.1 could make login impossible on a host without the sodium extension.

Fixed

• Upgrading to 4.4.0 could make login impossible on a host without the sodium extension, with Folders error: HTTP Token mismatch after every attempt. openssl_get_cipher_methods() lists ciphers the provider will not actually use, and on OpenSSL 3 that includes aes-256-cbc-hmac-sha1, which is the shipped default. Encryption fell back to xxtea, correctly, but the hardening added in 4.4.0 then refused xxtea whenever openssl_decrypt() merely existed, so the server rejected the tokens it had just minted and no session could be established. The cipher is now tried rather than looked up, a working one is used when the configured one is not, and the refusal asks whether openssl can really be used. Affected installs are signed out once and move to proper encryption. Reported by @realsimix (#121)
• Save in Nextcloud selected a folder, turned its spinner and wrote nothing. The plugin called \OCP\Files::getStorage(), which Nextcloud deprecated in 14 and has since removed, so the call threw and the save failed silently. The same call was in the "Save as .eml" path. Reported by @BlackIkeEagle (#116)
• The Nextcloud file picker put a select button on every folder row and floated its checkboxes out of line. Folders now carry a radio confirmed from the footer, file names are clickable labels, and the rows line up. Reported by @lvarnava (#117)
• A plugin updated to a build-numbered version kept reporting the version before it and offered the same update for ever. The release-time bump wrote the new version into packages.json but packaged an index.php still declaring the old one, and the admin panel reads the installed version from that constant. Reported by @ivnmad (#119)
• Several callers passed HTTP headers as an associative array, which reached curl as bare values and were sent malformed and dropped: the integrity check, the breach lookup, which therefore travelled without its API key, and the CardDAV upload path, which answered 403 supported-address-data. Thanks to @FathiBenNasr (#124)
• Only the first data-* attribute was stripped from a composed message, because removing an attribute while iterating a live DOMNamedNodeMap ends the iteration. The rest went out in sent mail and saved drafts. Thanks to @FathiBenNasr (#126)
• An empty contact list on either side of a CardDAV sync deleted everything on the other. An empty list is more often a fault than an intent, so deletions in that direction are now skipped and logged. Thanks to @FathiBenNasr (#125)
• The ics-viewer panel never appeared on invitations from Evolution or Exchange, which put the calendar part inline and repeat it as application/ics rather than attaching text/calendar. Thanks to @FathiBenNasr (#127)

Security

• The two-factor-auth plugin keeps its TOTP secret sealed rather than in clear, and backup codes only as hashes. A code from an already-accepted 30 second step is refused, and five failures in fifteen minutes lock that account's second factor for fifteen. Existing enrolments and printed backup codes carry over untouched. Thanks to @FathiBenNasr (#128)
• The avatars plugin answered without a session and fetched a URL chosen by whoever asked, with the SSRF gate switched off, then cached the result under any address. Only instances with bimi or favicon enabled were affected; both default to off

Changed

• The Debian package gains a signed tachyon_<version>-1_all.changes file for importing into reprepro or aptly, declares php-xml, without which a clean Debian 13 install fails the integrity check, and requires PHP 8.2 or later. php-openssl, php-exif and php-sodium are dropped, none of them being real packages on Debian. Thanks to @dionysius (#129)
• The two-factor secret is now tied to APP_SALT. Lose or regenerate SALT.php, by restoring a backup without it for instance, and every user loses their second factor with no way back but an administrator clearing their record. Before this the secret was stored in clear and survived such a change. Back up SALT.php with the data directory

Fixed

Upgrading to 4.4.0 could leave you unable to log in, with Folders error: HTTP Token mismatch on every attempt. The first request after an upgrade empties the cache directory, and requests arriving together all got past the version check before any of them recorded the new version, so several walked and deleted the same tree at once. One removed a directory another had already listed, and that request died with a fatal part way through the page. The browser then held a page with no usable request token and every later call was rejected, which looked like a login fault rather than an install one. Reported by @realsimix (#121)

A security release. Nine issues were reported privately by @ZaphodB, eight of which are inherited from SnappyMail and present in its v2.38.2. They were disclosed publicly on 2026-10-06 before the report reached us, so there is nothing left to embargo. Upstream has been told.

Security

An encoded-word in a Message-ID could inject headers into a reply. DecodeHeaderValue stripped CR and LF before decoding RFC 2047, so =?utf-8?B?...?= carrying a line break came out with it intact; replying copies Message-ID into In-Reply-To, and the reply then carried header lines, or body text, chosen by whoever sent the original. Sent as you, DKIM-signed by your domain, saved to Sent. Line breaks are now stripped after decoding and again in Mime\Header, which every outgoing header is built through (GHSA-xqxm-5325-888x)

S/MIME reported altered messages as validly signed. openssl_pkcs7_verify was called with PKCS7_NOSIGS, which tells OpenSSL not to check the signature, and any well-formed signed message then reported success. A message changed after signing displayed as signed by the certificate holder (GHSA-8gqc-2rq5-57j6)

Crypt tokens were forgeable. The algorithm came from the token itself, so a client could ask for xxtea anywhere, and the xxtea key was the token's own 16-byte salt followed by the server passphrase. XXTEA reads only the first 16 bytes of a key, so the passphrase never took part and anyone could mint tokens every consumer accepted. Xxtea is now refused where sodium or openssl exists, the algorithm name is checked against a list, and the key is derived through SHA-256 (GHSA-92qg-8v85-4rpc)

Two-step verification could be switched off, wiped, replaced or read with nothing but a session. A current code or a backup code is now required for each. Backup codes were also generated with rand() rather than a CSPRNG

Remote images loaded without consent through srcset and CSS. Only src goes through the consent and proxy rewrite, and only three CSS properties are handled, so url() in mask-image and friends fetched on sight. A relative URL did it through the proxy on your own origin, which works as a read receipt

Attachments were rendered inline as whatever type their sender declared, so an HTML attachment became a page on your origin. A short list of types is now shown as declared, any other text/* shows its source, and the rest download. SVG is included, with a sandbox policy so that opening one directly cannot run script either

The ?/Test integrity diagnostic answered without a login, taking its target from the request's own Host header and printing back every response header

S/MIME actions put the client's part id into an IMAP FETCH unchecked

The image proxy's SSRF gate let through CGNAT, IETF protocol assignments, benchmarking and multicast ranges, deprecated IPv6 site-local and multicast, the server's own addresses, and IPv6 forms carrying an embedded IPv4 address. The gate was added after 4.3.1 and never shipped without these

Added

• Attachment search matches on the real MIME body structure instead of guessing from a Content-Type header, and remembers what it learned per mailbox so a repeat search costs nothing. Inline images no longer count as attachments. Thanks to @wojt-janowski (#76)
• An Unraid Community Applications template, so Tachyon installs from the Apps tab (#113)

Fixed

• Decrypted S/MIME messages lost every byte that was not valid UTF-8, so anything not in English arrived full of replacement characters. The decrypted MIME was put through a JSON encoder that substitutes invalid UTF-8, before the parser had a chance to apply each part's declared charset (#32)
• An encrypted S/MIME message now decrypts as it opens, where an administrator turns that on under Security. It never raises a passphrase dialog to do it: where a passphrase would be needed and is not already held, the message stays encrypted and the Decrypt button works as before (#92)
• Attachment search aborted on any message the server would not describe, losing the whole result rather than that one message
• DAV ignored the [ssl] configuration that IMAP, SMTP and Sieve honour, so a private CA or a deliberately relaxed install behaved differently for calendars and address books than for mail on the same server. capath works as well as cafile

Changed

:latest no longer follows a pre-release tag. Anything pinned to it, including the Docker examples and the Unraid template, was offered pre-releases as routine updates

Translating a plugin did nothing, and nobody could see why

@lvarnava translated several plugins, updated, and found his work missing. Reasonably, he asked what he'd done wrong. Nothing, as it turns out.

Weblate merges a plugin translation into that plugin's langs/ directory. It has no reason to touch the plugin's index.php, so the version the plugin declares stays exactly where it was. The release then builds the package, translation and all, and publishes it under that same unchanged version. Your install compares what it has against what is offered, sees the same number, and concludes there is nothing to do.

So the translation shipped. It sat in the package on the server, correct and complete, with no route to a single user. Neither end was wrong about anything, which is why it went unnoticed for two months.

Plugins now get a build number that moves whenever their contents move, so a merged translation shows up as an update. No conversion step was missing, no setting was wrong. Just a number that never changed.

Eight plugins republished

Those already carrying work that could not reach you: Russian and Danish translations for change-password, kolab, login-register, nextcloud, search-filters and two-factor-auth.

Also login-o365 and login-oauth2. Their OAuth2 fixes went out in 4.3.0 under versions that had already been published, which means they had precisely the same problem as the translations.

Go to Admin → Extensions and update them there. Upgrading Tachyon does not bring plugins with it.

Thank you

@lvarnava, again, for asking why instead of assuming it was his mistake.

Your other mailboxes can use OAuth2 now

Adding a second Gmail account used to mean an app password, which means switching on 2-step verification to get one. That's a lot of ceremony to read a second inbox. Now Gmail, Office 365 and the generic OAuth2 extension can all authenticate an extra account properly: Add account, press the provider button, approve, done.

Two confessions came out of building it.

The Office 365 extension looked like it already did this. It couldn't. Its security check compared a token against one taken from a cookie, and the provider sends you back through a redirect that deliberately withholds that cookie. So it compared against a freshly invented value and never matched, which also broke ordinary o365 login on a default install. Upstream hit the same wall and left a branch titled "fails due to missing cookies". They weren't wrong.

The generic OAuth2 extension, meanwhile, had never run. Not once, not for anybody. It called a class that doesn't exist on its only live code path, and three more faults sat quietly behind that one because nothing ever got far enough to reach them. It works now, and it's finally generic: point it at any provider that speaks the standard.

Setup for all three is in the FAQ.

false.length is politely undefined

Encrypt a message without signing it and nothing was sent, nothing was saved, just TypeError: e.findIndex is not a function.

The compose window keeps a list of ways it can sign. With signing off, that list isn't empty, it's false. SnappyMail got away with this for years because nothing ever did more than ask its length, and JavaScript answers that question with a shrug. Then I taught it to reorder the list by your preferred method, and false has no opinion about ordering.

Exchange was right and we were rude about it

S/MIME wouldn't decrypt on Exchange. We asked for the headers belonging to part 1; Exchange said NIL. Correct of it: the message isn't a container with an encrypted part inside, it is the encrypted blob, and a single-part message has no part-level header to give. We took that truthful "nothing", pasted it onto the body, and handed openssl a bare base64 lump.

Installed as an app, links stopped working

View original, Download original and attachment downloads all failed from the Chrome app shortcut. Installed, Tachyon has its own browsing context, so opening a link in a tab lands it in the browser, which counts as somewhere else, so the session cookie stays behind. Fetched inside the app now.

Also

• Swipe left and right on a phone to move between messages.
• Delivery receipts ask for delay notifications, which servers will often send even when they refuse success ones, and they stop pretending to work on domains using php mail(), which cannot request them at all.
• Release tarballs finally carry real timestamps instead of claiming 1 January 1970.

Upgrading

If you run the o365 or generic OAuth2 extension, recheck the configuration rather than assuming this is transparent. One was broken by default and the other never worked.

Thank you

• @lvarnava, a fortnight of patient testing across three issues, and for finding the cause of one himself after I sent him down two blind alleys.
• @reaisinc, whose IMAP trace corrected my diagnosis instead of confirming it.
• @sir-andreas, for a report so precise it needed no follow-up.
• @dreamawake, for the Chinese translation.

Delivery receipts, and the art of getting a straight answer out of a mail server

Someone asked why delivery receipts were not arriving. Simple question. The answer took a week.

The code said they worked. The checkbox was bound, the flag reached the server, the right parameters went out on the wire, and the SMTP logs confirmed every step of it. Google was asked directly whether it supports delivery notifications and said no, which explained nothing, because the notification was supposed to come from the sending server anyway. Thunderbird was doing much the same thing and getting answers. We were doing much the same thing and getting silence. RFC 3461 was consulted at length and was, as ever, technically helpful.

What nobody was looking at was a checkbox on the domain configuration: Use php mail(). mail() cannot pass the SMTP parameters a receipt needs, so on every domain with it ticked the request was thrown away without a word. @lvarnava spotted it by comparing the domain where receipts worked against the ones where they did not, which is more than the code, the logs, the RFC and Google managed between them.

The tick box in the compose window had been doing nothing whatsoever on those domains, and nothing anywhere said so. It does now, directly under the setting responsible.

Receipts also forgot about delays

Chasing that turned up a second, genuine problem. We asked servers to notify on success and on failure, but never on delay. Plenty of servers refuse to send success notifications at all, since spammers abuse them, while honouring delay perfectly happily. So a message that got queued or retried reported nothing back to you. Thunderbird has asked for all three for years, which is why it looked more reliable against identical servers.

Receipts now also carry an envelope id, so one that turns up two days later can be matched to the message that caused it.

The placeholder that was never there

&:placeholder has one colon. It needs two. A selector with one colon matches nothing at all, so the rule meant to colour login placeholder text had never applied, on any theme, in any release.

Fixing the colon alone would have put white text on the four themes with light login boxes, so it now takes the colour each theme already defines for that box. Xv, Linen and Squares then turned out to have a second problem underneath: a light wallpaper behind a half-transparent black box composites to mid grey, and their own labels were sitting at 3.86:1. Below readable. Nobody had mentioned it.

Also

PDF attachments have their preview back. The check asked a browser API deprecated in 2021 that now answers only while the built-in PDF viewer is enabled, so the ground moved rather than the code. Messages per page has a limit that limits, instead of the larger of two numbers quietly winning. Seven dead files from the RainLoop and SnappyMail days have left the repository root.

The security policy deserves its own line. It named 3.x as the supported version and asked for encrypted email while giving neither an address nor a key, so there was in practice no way to report a vulnerability privately at all. Private reporting is switched on now and the policy points at it.

Thank you

@lvarnava worked out what was really going on, and produced Thunderbird logs for comparison when asked, which is the only reason the delay problem was found at all. Also a large part of the Russian translation, with @BrainDeLook.

And Weblate, which now gets its credit in the README where it belongs, next to a chart of how each language is doing. If yours is looking thin, that link is how you fix it.

Someone set their webmail title to their full company name, in Russian, and discovered that two-factor enrolment stopped working. The title goes into the QR code twice, percent-encoding turns each Cyrillic character into six bytes, and 744 bytes will not fit in a square that holds 213. The branding was, quite literally, too big for the box.

The error message was no help either. It said code length overflow. (1756>128), in which neither number is your input and neither is the real limit. It now shortens the title instead of giving up, so you keep as much of your name as fits.

A committee decided how many messages fit on a page

There were three opinions. The settings input said 50. The code that saved your choice said 100. The admin setting said whatever you typed. None of them consulted the others, so a site configured for 300 could not be set to 300 from the settings screen, and typing a bigger number just made the box turn red.

There are now two settings that mean different things, which is what was wanted all along: a default for people who never touch it, and a separate limit on what they may choose. Both live on the admin General tab rather than only in a config file.

The translation robot was helping

Weblate has an autofix that escapes HTML in translated strings. Our strings are not HTML, so eight languages spent a release displaying Simple, modern &amp; fast web-based email client to their users. Fixed, and there is now a check that fails the build rather than trusting anyone to notice.

Also

A Calendar button next to Contacts, where you would expect it. Search filters apply on a fresh login again rather than only after one. Nextcloud auto-login no longer hands you an empty password box with no explanation.

If you use search filters, update the extension too

The search filters fix is in the extension, not the core, and extensions update separately. Upgrading Tachyon will not bring it.

Go to Admin → Extensions, find search-filters 0.4 under Available for Update, and update it there. Without that step the filters still fail to apply on a fresh login, because 0.3 is what your install is running no matter which Tachyon version is underneath it.

Thank you

@lvarnava diagnosed the QR bug themselves, correctly, and cleared PHP 8.4 of a crime it did not commit. Also contributed a large part of the Russian translation, with @BrainDeLook.

@wojt-janowski found that search filters silently did nothing on a fresh login, because the settings lookup needed a session that had not been created yet, and fixed it.

@andhimue filed three of the things fixed here and one that is still open, all with the sort of detail that makes them findable.

Still the best part of this project.

Tachyon is named after a particle that moves faster than light. It has spent its entire existence running a calendar sync that never arrived anywhere at all. This release fixes that, and the physics joke writes itself.

The bug

Calendar sync compared two lists to work out what changed. One was keyed on the event's UID, the other on the .ics filename. No CalDAV server names a file after the UID inside it, so essentially nothing ever matched, and every single run reached the same conclusion: every event has been deleted from the server, and also every event is brand new. So it dutifully deleted all of them and downloaded all of them again. Then it did it once more, forever, at roughly three events per second.

On the install that finally caught it, 8,189 of 8,220 rows were affected. It was not an edge case. It was not about imported data. It was every Nextcloud calendar Tachyon has ever synced, including the birthday list Nextcloud generates itself. It simply hid well, because on a small calendar deleting everything and refetching it still finishes in under a second, which looks identical to working.

The deletion side is now guarded too. If the server hands back a listing that cannot be corroborated, Tachyon keeps what it has rather than believing it.

A first sync of 5,605 events used to be 5,605 requests. It is now about 56.

Also new: your server is a hoarder

Every Tachyon update installs itself next to the previous one, and nothing has ever removed the old copy. Not once. An install upgraded ten times has been quietly carrying ten complete copies of the application, plus whatever it inherited from a RainLoop or SnappyMail past life, like sediment layers in a riverbank.

The admin About tab now shows you the lot and deletes the ones you pick. It will not let you delete the one you are running, which felt worth building in.

Please rotate some passwords

If you run the Nextcloud app alongside a still-enabled SnappyMail, logins have been failing, and the failure was writing user passwords to nextcloud.log in plaintext. Both halves are fixed. Treat those logs as exposed.

Thank you

This is the first release where the interesting work mostly came from other people.

@wojt-janowski sent six pull requests: DAV redirects, the additional config file, the stderr driver under php-fpm, contact edits actually reaching the server, a DAV discovery harness, and a whole plugin for configuring sync at login.

@andhimue filed the calendar bug with row counts per calendar, then tested the fix by polling the database every two seconds for forty-seven minutes and verifying the totals against what DAV actually serves rather than trusting the database. Then caught a regression in the fix. That report is why this release exists.

@corsch, @realsimix and @m0urs reported the updater, the zlib log noise and the S/MIME signing problem, and @realsimix tested a fix I could not reproduce locally.

@nullablenone overhauled the Indonesian translation, and Weblate now has Tachyon set up for anyone who wants to bring another language along.

Something is starting to grow around this project, and it is a good deal more fun than working on it alone. Keep the bug reports coming, especially the awkward ones.

Our logo had been quietly spelling SNAPPY in Braille this whole time. Since June we have been shipping steganographic advertising for the project we forked, in the notification icon of all places, and nobody noticed because nobody expects a webmail client to be talking behind their back in a tactile writing system.

Bugfix release.

Update your plugins as well

Two of these fixes live in plugins, and a plugin never travels inside the core archive. After upgrading, open Admin, Packages and update:

• avatars 1.26
• search-filters 0.3

Extracting the release over your installation is not enough for those two.

The logo

Replaced in nine places, not the two the report found. Desktop notifications, the admin About tab, and a full set in each of the Nextcloud and ownCloud integrations. Three more were unreferenced leftovers and are simply gone. The filenames were no help: the two worst offenders had already been renamed tachyon-* without anyone touching the artwork. Thanks to @peterkeist for spotting it, and for reading Braille (#51).

Accounts on internationalised domains could not be edited

The account list is sent to the browser in unicode while accounts are stored under the ASCII form of the address, and it was never converted back on the way in. Editing kim@stopovervågning.dk therefore looked up a key that had never existed, and the failure carried no error code, so the browser reported "Unknown error". An account that genuinely is not there now says so.

Search filters were shared by every account

They were kept in one list, and plugin settings resolve to the main account for every additional account too, so every mailbox ran every rule at login. A rule filing mail into a folder that exists in only one of them failed in the others. Because the rules run during login, that failure came back as "authentication failed" for an account that had authenticated perfectly well.

Filters are now per address. An existing list stays with the account that created it, so nothing is lost and no other account inherits it. A rule that breaks now breaks alone and is logged, rather than taking the login with it.

Also: deleting a filter looked like it did nothing while actually deleting it, and filters moved messages out of INBOX even when they were found somewhere else.

Avatars

A sender with no picture answered 404, which put a console error on screen for most of a normal message list. It is a 204 now. Same behaviour, no noise. It was also the one response carrying no cache headers, so every list render asked again and redid the gravatar, favicon and BIMI lookups behind it. A miss is cached for the same day a hit is.

The full list is in CHANGELOG.md.