← Back tolarr; Back to Changelog →

Changelog

August 2026

## v0.3.6 release — compose, threading, multi-account - **Conversation threading** — Gmail-style thread collapsing in the inbox, full thread view in the message pane - **Multi-account switcher** — log into a second mailbox without losing the first session (Proton-style) - **Catch-all domain mailboxes** — one mailbox claims an entire domain; any unmatched address routes to it - **Rich compose** — WYSIWYG HTML editor, live Markdown split preview, full-screen minimizable modal - **Attachments** — send attachments (streamed to Resend), sent copies keep attachment bytes - **Inbox filtering** — address badge + filter by recipient or sender - **Reply improvements** — plain/markdown/HTML formats, editable From for catch-all mailboxes - **Security fix** — cross-tenant IDOR patched; signed-in tenants can no longer manipulate another tenant's mail - **Attachment fix** — inbound attachment content now extracted from raw RFC822 (the `download_url` field never existed)

🚀 Features

  • [10/08]feat: inbox list collapses by thread, Gmail-style
  • [10/08]feat: Gmail-style conversation threading, in the message pane
  • [10/08]feat: reply gets the same rich formats as compose (plain/markdown/HTML)
  • [10/08]feat: editable reply From for catch-all mailboxes; fix real cross-tenant IDOR found along the way
  • [10/08]feat: multi-account switcher, like Proton's — logging into a second mailbox no longer costs you the first one's session
  • [10/08]feat: inbox address badge + filter by recipient/sender (issue #2)
  • [10/08]feat: catch-all domain mailboxes (issue #1)
  • [08/08]feat: widen compose modal to fill the viewport, make it minimizable
  • [08/08]feat: real WYSIWYG editor for HTML compose, live split preview for Markdown
  • [06/08]feat: keep sent attachments, and fix three envelope bugs they exposed
  • [06/08]feat: send attachments (streamed to Resend, not stored)
  • [06/08]feat(ui): per-tenant brand, mobile layout, quieter sidebar
  • [06/08]feat(ui): English/French interface with a language switch
  • [06/08]feat: surface the retention policy in the UI, and correct its docs
  • [06/08]feat: log destructive bulk actions
  • [06/08]feat: tag rename/delete, click-to-copy address, Markdown and HTML compose
  • [06/08]feat(ui): light theme and larger base type
  • [06/08]feat: encrypt tenant Resend credentials at rest
  • [06/08]feat: accept the mailbox password from stdin or env
  • [06/08]feat: sanitize inbound HTML, per-tenant reset links, webhook logging
  • [05/08]feat: compose (new mail) + per-mailbox Resend credentials

🐛 Bug Fixes

  • [10/08]fix: starring has never actually worked from the UI
  • [10/08]fix: compose From stuck on the previous account; allow send/reply-as any address for catch-all mailboxes
  • [09/08]fix: inbound attachment content — the download_url assumption was wrong
  • [06/08]fix: log when inbound content cannot be fetched, and stop calling it 'not kept'
  • [06/08]fix: smoke.sh failed intermittently on SIGPIPE
  • [06/08]fix: make the sanitize migration idempotent
  • [06/08]fix: migrate mailbox schema from the CLI, and don't panic on short tokens

📚 Documentation

  • [08/08]docs: scope attachment storage migration to machin-esetres
  • [07/08]docs: drop the broken-poche warning, fixed upstream in poche v0.3.1
  • [07/08]docs: outward-facing README, one-command bootstrap, screenshots

🧪 Testing

  • [07/08]test: add unit tests for compose/markdown/credentials + CI workflow

⚙️ Miscellaneous Tasks

  • [06/08]chore: log the Host a webhook arrived on

💼 Other

  • [06/08]release: v0.3.6
  • [06/08]Merge: compose, multi-tenant Resend, HTML sanitizing, webhook hardening