YariloMail 2.4.5: JMAP push, the Recent flag and auth policy ​

31 October 2026

YariloMail 2.4.5 is a patch release of the 2.4 stable line. It brings push to JMAP clients, \Recent to IMAP, and the auth policy request in full. Read "Before you upgrade" first: new accounts get four special-use folders by default, and the chart now allows every Sieve extension unless you set a list.

New ​

  • JMAP push: EventSource at /jmap/eventsource/, and JMAP over WebSocket at /jmap/ws/ (RFC 8887). Browser clients take a ticket from POST /jmap/ws/ticket; the chart generates the ticket key once and keeps it. A flag set over IMAP reaches a WebSocket client in a few milliseconds.
  • JMAP: Identity/set for any of the account's addresses, and header:* properties when Email/set creates a message.
  • \Recent in IMAP: a new message is \Recent to the first session that selects its folder, in RECENT, STATUS, FETCH and SEARCH RECENT / NEW / OLD, virtual mailboxes included.
  • Auth policy: the request body is built from templates (auth_policy_request_attributes), SCRAM logins go through the policy, and a refusal's message reaches the client. New metrics for decisions, errors and tarpit time.
  • fts_autoindex_max_recent_msgs: the indexer can skip folders that hold too many new messages.

Fixed ​

  • maildir under concurrent sessions: a FETCH no longer answers a live message empty when another session copies, flags or expunges in the same folder, and a COPY over an expunged message answers NO [EXPUNGEISSUED] and takes back what it copied (RFC 2180).
  • maildir STORE into two folders is about a quarter faster than in 2.4.4, and on mdbox and sdbox it stays within 2 % of 2.4.4.
  • The first seconds after a backend start: concurrent LISTs share one read of the shared-folder registry, and the Redis dict reads a key index instead of scanning the whole database.
  • IMAP: CAPABILITY names SORT and THREAD after login; SELECT answers [READ-ONLY] without a change right.
  • Submission: the login's EHLO lists what Submission serves, and each RCPT is relayed as the client sends it, so one refused recipient no longer stops the others.
  • Director: a moved user can log in again at once, and the last silent backend of a tag leaves routing instead of making logins wait for a dead pod.
  • Backend API: folder, quota and message verbs see mail an MDA or an import left in storage; quota recalc no longer resets counters with messages on disk.

Before you upgrade ​

  • Four special-use folders by default. Without a mailboxes block, accounts get Drafts, Junk, Sent and Trash on their next login or delivery. To keep the 2.4.4 behaviour, set mailboxes: {} on the namespace.
  • Sieve under Helm allows every extension by default. The chart's sieve.sieve_extensions is now empty, as the binary's default. To keep a restricted set, list it in your values.
  • LMTP refuses an unknown recipient at RCPT with 550 5.1.1, before the director. A recipient without a domain, such as <postmaster>, is looked up as written.
  • JMAP account ids changed. Clients that cached them fetch the session again, which most do on their next start.
  • Auth policy: the protocol value for ManageSieve is now sieve; peers in general.xclient.trusted_nets get no tarpit and no penalty.
  • Threading is on without the chart too. Docker Compose and hand-written configs that leave threading_enabled out now record conversations; run yarilo-migrate --thread-backfill for older mail.
  • The default image moved to Docker Hub (docker.io/0kaba0/yarilo), for the chart and for Compose.
  • Config schema 17 → 18: upgrade the chart and the image together. Pull the new image onto the backend nodes before helm upgrade, and keep room for one more backend pod.

Read the release notes before you run helm upgrade.

Get it ​