7.0.2

fix(dynamic): make search_refresh actually refresh virtual folders

7.0.1

fix(security): prevent path traversal in HTML compose img src handler [CVE-2026-58451] Reported by evan. Coordinated by VulnCheck.
fix(imp): prevent search and subscribe PHP warnings

7.0.0

fix(doc): repair changelog.yml syntax for legacy 0.0.1 entry
test: add @coversNothing and drop empty anonymous-class parens in ItipRequestCounterTest
chore: update CI
fix: is: time-ago is the trigger, not the outcome
fix(dynamic): handle dynamically inserted time elements via MutationObserver (#22)
refactor: Most of PR #82 's changes are no longer needed due horde/base#120 and horde/Date#19
fix(message): use locale-aware time formatting in IMP_Message_Date (#22)
fix(themes): dark-mode overrides for dynamic compose
fix(compose): batch multi-file attachment uploads into one request (#76)
fix(compose): batch multi-file attachment uploads into one request (#76)
fix(dynamic): localize relative date display via Intl.RelativeTimeFormat (#22)
fix: Intermittent crashes when session data cannot be unpacked
fix(imp): repair HTML view-in-popup after Horde 6 CSRF tokens
fix(imp): avoid undefined data key in delivery status render
feat(imp): show iTip RSVP UI above invitation HTML body
feat(imp): show iTip RSVP UI above invitation HTML body
fix(icons): update delete-small autocompleter remove icon
fix(icons): update delete-small autocompleter remove icon
feat(imp): Expose IMP dynamic view dimensions as CSS custom properties
Address review: use sidebar's rendered clientWidth for left offsets
Expose IMP dynamic view dimensions as CSS custom properties
Merge pull request #68 from horde/feat/polish_EAS16.1
test: rename misleading counter-accept test
Potential fix for pull request finding
Potential fix for pull request finding
Update mime_drivers.php
feat(imp): wire EAS 16.1 counter-proposal accept/decline in iTip UI
Merge pull request #67 from horde/feat/Initial_EAS16.1-support
Delete doc/pr directory
fix(imp): address COUNTER iTIP review feedback
feat(imp): handle COUNTER accept/decline workflows and proposal updates

7.0.0-RC5

fix(imp): repair PHP 8.4 use imports and iTip handling for calendar replies
fix(imp): repair PHP 8.4 use imports and iTip handling for calendar replies
fix(imp): invalidate search cache when mailboxes change
fix(imp): guard missing HTTP_HOST in getAutoLoginServer()

7.0.0-RC4

refactor(imp): retire 'hashtable' IMAP cache driver, fall through to 'cache'
style: php-cs-fixer
Remove broken config/conf.imp.php symlink
Update smartmobile.js
Refactor summary handling for URL instances
fix(security): restrict unserialize allowed_classes (ZDI-20-1051)

7.0.0-RC3

Merge pull request #54 from horde/feat/adopt-compress-nls-psr4
refactor: Use PSR-4 version of horde/compress and horde/nls
fix: misplaced use statement
fix: resize icons, closes #47
chore: Update workflow dependency

7.0.0-RC2

Class IMP_Imap not found
feat(imap): add XOAUTH2 authentication support
Implement try-catch for old server key retrieval
style: PER-1
refactor: Identity Factory now returns the PSR-4 class
refactor: Degrate IMP_Prefs_Identity to a shim for Horde\Imp\IdentityDriverPrefs
refactor(Identity): Build a PSR-4 Identity Driver
fix: Initialize stdClass before accessing attributes

7.0.0-RC1

refactor(injector): Widen type hints from Horde_Injector to Horde_Injector|Injector
refactor: Migrate from strftime to IntlDateFormatter
fix: Simplify Torben's previous PR on download URLs
test: Cover KeyStorage class
feat: Add some modern types to KeyStorage and optionally throw on error.
feat: Emit a warning notification if the SMIME key appears corrupt
feat: Emit a warning notification if the key appears corrupt
fix: Wrong prefix for PSR-4
feat: base64-encode keys for storage
Refactor download URL extraction logic
docs: Upgrade note on hashtable driver abuse as a temp fs
refactor: Accept Horde\Util\Variables in most places which accept Horde_Variables
docs: icon license
style: Changed CSS and icon assets to Lucide Icons with proper attribution
fix: Make imp more explicit when email address was not configured
docs(conf.php.dist): Add missing keys
fix: guard convertCharset() against null getContents() for PHP 8.1+
fix: Null safety
docs: Add documented example config file
fix: More defensive code when trying to drop tables
docs: Clarify where to put local overrides

7.0.0-beta3

chore: Use modern domhtml internally in test
fix: Make IMP compatible with both modern and old style Horde\Util\Variables in many places

7.0.0-beta2

fix: Also accept modern Domhtml class
feat(kolab)!: Remove Kolab example hook