What's Changed

• Add onboarding flow with redesigned key setup UI that guides new users through key generation or import
• Redesign key backup dialog with two-step save flow
• Show pending state for recipients in the editor while keys are looked up on the keyserver
• Show account mismatch dialog with retry option when Gmail authorization returns a different Google account than expected
• Fix UTF-8 multibyte character corruption in decrypted MIME messages (#893)
• Fix popup briefly flashing the normal menu before showing the setup menu on profiles without keys
• Fix watch list initialization race on first install in Chrome (#908)
• Support new cloud.microsoft domain for M365 Outlook and update Microsoft webmail entries in default authorized domain list
• Drop separate Edge build (Edge uses the Chrome package)
• [API] Modernize JSDoc pipeline and document web components
• Update translations and normalize l10n files to Weblate format
• Update dependencies; require Node 24+ and npm 11+ for builds

Full Changelog: v6.2.1...v6.3.0

What's Changed

• Fix browser detection for Chrome 144 compatibility

Full Changelog: v6.2.0...v6.2.1

What's Changed

• Offer key backup function after completing the key generation process in the app UI
• Remove De-Mail providers from default authorized domain list
• [API] Normalize armored message in decrypt container to fix decryption issue of malformed messages
• [API] Fix content script injection after domain authorization request
• Migrate testing infrastructure to Jest, RTL and Puppeteer

Full Changelog: v6.1.0...v6.2.0

What's Changed

• Migrate Firefox add-on to manifest v3
• Support for displaying encrypted subject lines in the email content area
• Reactivate password cache (temporarily disabled in v6.0)
• Disable sign-only button in editor email contains attachments
• Fix sign-only function in the editor when using GnuPG keyring
• Fix GnuPG keyring not available after service worker shutdown
• Replace node-sass with dart-sass
• [Security] Replace Angular v1 component for recipient input with React component based on react-tag-input
• [Security] Update Bootstrap to 4.6.2
• [Security] Deprecate client-API settings container (keyring.createSettingsContainer())
• [Security] Remove dead code in mvelo.storage that is vulnerable to prototype pollution
• [Security] Fix weak validation of WKD blocklist
• [Security] Improve key type validation during key import
• [Security] Deactivate demo.mailvelope.com site in default authorized domain list
• [Security] Update OpenPGP.js to 5.11.3

Full Changelog: v6.0.1...v6.1.0

What's Changed

• Support HTML view in multipart/signed messages
• Remove attachment frame if extraction of signature in multipart/signed fails
• Fix reload button in the Mailvelope menu has no effect
• Fix decrypted message not shown as dimensions of decrypt view is set to zero
• Fix decrypt popup viewer of decrypt result view in app

Full Changelog: v6.0.0...v6.0.1

What's Changed

• [Chrome] Migrate to Manifest V3 (service worker)
• Large refactoring of controller architecture and event handling
• Fix error if multipart/signed message has a S/MIME signature
• Traverse first two levels of MIME tree to search for attachment nodes
• Update react-datepicker to v4.20
• Gmail decrypt frame: fix for scroll bar hides close button
• Replace moment library with date-fsn
• Detect port when using the authorize domain function of the client-API

Full Changelog: v5.2.0...v6.0.0

Note: v6.0.0 is a Chrome-only release. We will publish a manifest v3 update for Edge soon. Firefox will stay on manifest v2 as of now and we will publish new releases as v5.x.x from the branch manifest-v2.

• Measure onboarding success with opt-in for 1% of users (Clean Insights)
• Auto text wrap in display container for cleartext signed messages
• Fix duplicate key entries in the keyring after reload of GnuPG keyring
• Add better hint when GnuPG is installed but not detected
• Use crypto.randomUUID() for unique identifiers

• Fix click on links in decrypted message leading to page loading errors
• Update dependencies

• [Gmail] Fix detection of encrypted attachments

• Support signature verification independent of sender identity (sender email address not available or does not match user identities on sender key
• Display signature verification results in the file decryption UI (OpenPGP.js, previously only available with GnuPG keyring)
• Warn about signature inconsistency between message and attachments
• Improve detection of messages with detached signatures
• Fix key import not updating existing keys properly
• Fix undefined password in private key backup after prior usage of password cache