src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release: v1.7.9 — Phase 1 critical+high fixes (17/18)

Browse Source 
Housekeeping:
- Bump VERSION to 1.7.9
- CHANGELOG entry for all Phase 1 fixes
- Mark Phase 1 as completed in development plan
This commit is contained in:
Bernd Rodler
2026-08-07 12:41:34 +02:00
parent 931d1fa06a
commit f34537adcf
3 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+24
View File
@@ -1,5 +1,29 @@
# Changelog
## 1.7.9 (2026-08-07)
### Bug Fixes (Phase 1 — VNCmailgraph audit)
- **Mail**: Network transport failures now throw `TransportError` instead of returning empty results, so offline/network-down is distinguishable from an empty folder (#C1)
- **Mail**: Push handler now refreshes contacts and files on remote state changes (#H1)
- **Calendar**: Recurrence expansion IDs use `::occurrence::` delimiter to prevent collision with shared-event prefixes (#C2)
- **Calendar**: Cross-account event aggregation now deduplicates by UID + recurrenceId, preventing phantom duplicates (#C3)
- **Calendar**: `calendarTasksEnabled` admin policy now enforced at runtime, not just in settings UI (#H13)
- **Tasks**: All task mutations (update, delete, toggle) now have error handling with store error state (#H14)
- **Settings**: `updateSetting()` now checks admin policy lock before writing; `force` opt-in for legitimate bypassers (#C7)
- **Settings**: `autoSelectReplyIdentity` now defaults to `true` — auto-identity selection on by default (#H18)
- **Templates**: HTML template bodies are now sanitized with DOMPurify on import to prevent stored XSS (#H7)
- **Auth**: User authentication endpoints now rate-limited — 10 attempts per (IP + username) per 15 minutes (#H3)
- **Auth**: Admin sessions now support token revocation via JTI blacklist on logout (#C4)
- **Auth**: Secure cookie flag now derived from `x-forwarded-proto`, not `NODE_ENV` (#H8)
- **Auth**: OAuth token exchange error logs no longer leak `access_token` (#H4)
- **Auth**: `isHashed()` no longer accepts bcrypt prefixes — scrypt-only, preventing lockout from bcrypt passwords (#H9)
- **Push**: WS→SSE fallback now awaits state snapshot before reconciliation to prevent missed deliveries (#H2)
- **Push**: Offline event handler added — push transports pause when browser goes offline, reconnect on online (#C8)
- **Index**: FTS5 schema-drop now logs a warning so operators know a rebuild is needed (#C6)
---
## 1.7.8 (2026-07-22)
### Features