DBX Mail

Versions

• v0.1.5Nov 4, 2026Latest

  Local-first multi-account mail workbench that runs as a DBX plugin: IMAP sync, conversation view, rich composer, attachments written to a real folder on disk and an offline outbox. Filesystem work (saving attachments, .eml import/export, folder browsing, raw message cache) is done by the bundled Rust sidecar, so the plugin page itself has no file or network access. v0.1.5: native packages for four more targets. The sidecar is a prebuilt Rust binary, so every target has to be compiled on its own machine; releases are now built by CI on each platform's own runner (windows-x64, linux-x64, linux-arm64, darwin-x64, darwin-arm64) and this catalogue entry lists all five. There are no functional changes — the sources are identical to 0.1.4 apart from the version string. v0.1.4 is a security and licensing release. Quoted reply/forward bodies are now sanitised before they reach the composer — previously a malicious HTML mail could run inline handlers through the reply quote, which could then call the sidecar API; draft bodies and the final innerHTML assignment go through the same allow-list, and quoting replaces remote images with a text placeholder. The image proxy now re-validates every redirect hop instead of only the first URL, and the blocked ranges cover 100.64/10, 240/4, 198.18/15 and IPv4-mapped IPv6. Remote images and CSS background urls are neutralised before the HTML is attached, so opening a message issues no request at all until you press 显示图片. On the licensing side, LICENSE is restored to the verbatim FSF text (copyright belongs in NOTICE), and THIRD-PARTY-NOTICES now lists every dependency licence — including CDLA-Permissive-2.0 for webpki-roots, Unicode-3.0 for the ICU4X crates and Zlib for zlib-rs — with full texts under licenses/. v0.1.3: long messages scroll again — the workbench grid left its implicit row height to the content, so a tall body pushed the reader pane past the window; page-level styles that newsletters ship are no longer applied to the message container, so wide mails are no longer clipped horizontally; non-primary folders sync on open, and the empty state plus the header refresh button sync only the folder you are looking at. v0.1.0–v0.1.2: IMAP folder names are encoded as modified UTF-7 (RFC 3501) and an RFC 2971 ID is sent when the server advertises it, which fixes 163/126 answering SELECT with 'Unsafe Login'; remote images are blocked by default and fetched through the local sidecar as data URLs on request; mail <style> blocks are extracted and scoped to the message container so they cannot restyle the app; Tailwind preflight resets inside message bodies are undone element by element; dark mode strips hard-coded colours.