Hello everyone,
we have released a new maintenance and security relaease 26.9.20260928.
SECURITY: this release fixes multiple high level security vulnerabilities, everyone is strongly adviced to update to it!
This maintenance update is quite a major one!
Having revamped many parts of the EGroupware interface (widgets) over the past few months, we have now rewritten another key component: Nextmatch/Lists. This has been implemented in almost all areas.
Another major development: we have redeveloped large sections of the email client and, in doing so, have also added support for JMAP.
The email app is now noticeably faster, even with IMAP servers.
JMAP is a communication protocol for accessing mail servers – essentially what was previously done via IMAP. JMAP is, in effect, the modern version of IMAP.
As a result, we will soon be able to provide a Stalwart mail server that is compatible with JMAP.
Please note:
We have not been able to test against every possible email server, service and configuration.
In particular, we have tested:
- Dovecot
- Cyrus
- GMail
- GMX
- and a few others…
It is therefore possible that some users may experience email-related issues. In that case, please report the issue immediately here in the forum (or via our support team if you are a customer)!
.
Release notes:
- Addressbook/Filemanager/Infolog/Mail/Tracker: new web-component for lists (aka et2-nextmatch)
- Addressbook/CardDAV: fixed importing a group with 2 or more contacts failed after recent security updates
- Calendar/Mail/Preferences: add preference to always show full date+time
- Filemanager/WebDAV: allow multipart/form-data uploads via webdav.php// URL incl. multiple files at once
- Mail: new client-side talking via JMAP directly with the mail-server (or our own shim for IMAP)
- Mail: add PGP signature verification core engine (openpgp.js, client-side)
- Mail: Certificate validation
- Mail: Onw flags/Coloured flags
- Invoices: validate invoice-number uniqueness (per seller) on change
- Invoices: allow configuring default invoice- and mail-templates per invoice-type
- Registration: fix not working registration after previous security release
- Api: don’t show the “new build available” notice on the login page
- Filemanager, Calendar, Addressbook, Collabora: fix mail-compose buttons silently doing nothing
- Filemanager: add xerox-scan.php bridge for Xerox scanner HTTP filing
- Filemanager/WebDAV: added logging like CalDAV/CardDAV enabled via user-preferenes
- Mail: fix “Save as Draft and Print” throwing “Profile change failed!”
- Mail: fix reply/forward ignoring the “force HTML/plain” preference
- Mail: fix reply cursor starting in the To field instead of the body
- Mail: fix clicking the current folder no longer refreshing the view
- Mail: fix folder tree marking both a folder and its parent as current
- Mail: fix Excel/CSV attachments downloading with a random UUID filename
- Mail: attachments of s/Mime encrypted messages were not shown
- All apps: a date/time field in a filter can be typed in again
- Et2Date: compare typed dates against the localized display format
- Preferences: fix “integer”-type settings rendering as a literal placeholder box
- Timesheet: preference to switch off the scheduling-conflict warning
- 4th pre-release of master rebase, final release expected beginning of the week
- Addressbook: country column-filter showed no country names
- Api: fix high CPU use and sluggish typing while a list is open
- Api: stop an application-tab switch rebuilding every nextmatch row
- AiTools: translate/select-text/apply always empty for mail body / et2-iframe widget
- Calendar: fix freetime search returning no results
- Filemanager: a file dropped on an expanded folder’s child went to the wrong folder
- Mail: local-shim accounts’ own JMAP endpoint URL could mismatch the page’s connect-src ‘self’ CSP and get silently blocked by the browser
- Mail: checkCert wizard no longer re-diagnoses a certificate mismatch the user already accepted, and shows the original error when its own probe finds nothing wrong
- Mail: preview.js failed CSP in Firefox, blocking mailto:/internal-link activation for every message
- ImportExport: export/import preview crashed and never actually appeared
- ProjectManager: convert the project, element and price lists to Et2Nextmatch
- Timesheet: nextmatch actions showed no result message
- SECURITY: this release fixes multiple high and critical level security vulnerabilities, everyone is strongly adviced to update to it!
- InfoLog: context-menu popups (start/due date, delegation) failed with “Cannot read properties of undefined (reading ‘action_var’)”
- Mail: replying/forwarding from an already-open message popup silently did nothing
- Mail: replying/forwarding a plain-text message under “force HTML” lost all line breaks
- Mail: restore the row-list S/MIME icon, add the same detection-only icon for PGP
- Mail: received mail (preview + display popup) now defaults to the user’s compose font/size
- Mail: a message’s font/size in the Sent folder didn’t match what was shown while composing
- Mail: forwarding a message could show a raw “object could not be deleted” error
- Mail: a forwarded-as-attachment .eml’s own internal parts were also listed as separate attachments
- Mail: opening a forwarded-as-attachment .eml showed its raw MIME source, not its body
- Mail: a failed distribution-list resolution on send was mislabeled “Account not reachable”
- Mail: a bare PDF/image message (no separate body at all) showed completely blank
- Mail: a mailto: link’s subject/body never reached the compose window
- Mail: REST-uploaded attachments never appeared in a compose window opened via REST
- NewsAdmin: fix checkPublicIP() is not a function / forgotten commit
- Timesheet: warn (instead of silently blocking) when a scheduling conflict can’t be shown
- Timesheet: “Insert in document” merged selected sum rows as blank rows
- Many translations
This Maintenance update is provided via Docker container.
If you have problems with this update, you can easily revert to the previous version:
Manual (container) update/downgrade in a Docker installation
Manuelles (Container)-Update/Downgrade in einer Docker-Installation
New functions / preferences or other important things:
- Addressbook/Filemanager/Infolog/Mail/Tracker: new web-component for lists (aka et2-nextmatch)
We have rewritten another key component: Nextmatch/Lists. This has been implemented in almost all areas (Addressbook/Filemanager/Infolog/Mail/Tracker), the remaining positions will follow.
Nothing significant will change for users. The appearance of highlighted rows is slightly different. The width of the column headers can now be adjusted more easily. The data in the columns is also better arranged.
Data usually loads faster than before.
- Calendar/Mail/Preferences: add preference to always show full date+time
It is now possible to customise the display of the date and time via the user settings:
- Mail: new client-side talking via JMAP directly with the mail-server (or our own shim for IMAP)
The EGroupware email client now supports JMAP as well as IMAP. This will be important in future for supporting modern mail servers such as Stalwart.
We will provide further details on this at a later date.
- Mail: add PGP signature verification core engine (openpgp.js, client-side)
We have further expanded our support for encryption and signing (and verification). We will explain this in detail later.
- Mail: Certificate validation
For security reasons, verification of the mail server certificate is now the default setting. This verification can be disabled if necessary:
However, we strongly advise that you adjust the settings so that a valid, verifiable certificate is used. Disabling the verification is not a solution; it simply reduces security.
- Mail: Onw flags/Coloured flags
It is now possible to use your own flags. The flags are created and managed as categories for emails:
The existing ‘Important/red’ flag has now been supplemented with additional coloured flags:
- Filemanager: add xerox-scan.php bridge for Xerox scanner HTTP filing
We have added support for Xerox scanners. This allows scanned documents to be saved directly to EGroupware.
- Filemanager/WebDAV: added logging like CalDAV/CardDAV enabled via user-preferenes
It is now also possible to enable logging for WebDAV:
- Timesheet: preference to switch off the scheduling-conflict warning
It is now possible to disable the warning about overlapping timesheets via the user settings:
The update information is collected in the following topic
https://help.egroupware.org/t/new-features-preferences-or-other-important-things-since-release-of-egroupware-26/79581
in reverse chronological order.
Please follow us, give us likes or stars: 
Kind regards
Your EGroupware team
