[ravimehra9911]

Fixes the actionable findings from the 2026-10-25 security audit.

Changes

• next 15.5.28 (GHSA-2464-fhr4-w9xw image-optimizer RCE, GHSA-p3m5-59mp-jv5r Server Actions DoS). 15.5.28 still pins postcss@8.4.31, so the postcss advisories needed an extra step: an overrides entry gives next postcss ^8.5.30 (the same copy Tailwind and Vite use). npm audit --omit=dev now reports 0 vulnerabilities. eslint-config-next is bumped to match.
• electron ^44.9.3 (GHSA-jr5w-w6x2-84p9). build.electronVersion is updated to match. electron/package.json doesn't pin a version.
• Download path escape (src/lib/attachments.ts):
  • safe() turns names made only of dots into file and puts _ in front of Windows device names (CON, NUL, COM1, LPT1…, with or without an extension).
  • targetOf now resolves the path and throws if it would land outside Downloads/MailClean.
  • Before this fix, a sender named .. saved files into ~/Downloads.
• Dev/self-host server:
  • npm run dev and npm start now pass -H 127.0.0.1, so they're no longer reachable from the local network.
  • When MAILCLEAN_TOKEN is unset, the middleware refuses API requests whose Origin isn't the server's own host (or X-Forwarded-Host, for reverse proxies), whose Origin is null, or whose Sec-Fetch-Site is cross-site.
  • The Google OAuth routes stay open. The demo/Vercel branch and the desktop token path are unchanged.
• Electron: new will-redirect handler (another origin → cancelled and opened in the system browser, like will-navigate) and will-frame-navigate handler (subframes can't load another origin). Main-frame navigation is still handled by will-navigate.
• Tests: new src/lib/attachments.test.ts (.., ., separators and device names stay under Downloads/MailClean) and src/middleware.test.ts (cross-site refusals, same origin, proxy host, OAuth routes, token mode and demo unchanged). PR Tests for attachments, clean-up actions, rules and middleware #3 adds broader tests in these same two files. Whichever lands second will need a simple add/add merge of the two files.

Checks

npm run typecheck, npm run lint, npm test (48 tests) and npm run build all pass. I also ran a smoke test of next start -H 127.0.0.1 with an empty temp DATA_DIR. It listens only on 127.0.0.1, a cross-site text/plain POST to /api/clean gets 403, and same-origin requests pass the middleware.

Not tested: the Electron handlers weren't run. npm's install-script policy blocked Electron's binary download in this checkout, so only node --check was run on main.cjs. Please try a desktop build before release.

Left for later (low)

• Protect encryption.key with Electron safeStorage (Keychain/DPAPI) instead of keeping it next to the database.
• Pin the IP checked by isPublicHttps for one-click unsubscribe (DNS rebinding; already mostly blocked by TLS).
• Lock "reset" should also clear downloads / downloaded_parts and revoke Google tokens, like DELETE /api/accounts/[id].
• Dev-only advisories: vitest 3 → tinypool / @vitest/mocker (fixing them needs vitest 4.1.12+). npm audit also flags fast-uri in the dev tree.
• A CSP header for the desktop window, and optionally requiring Content-Type: application/json on API POSTs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mailclean	Ready	Preview	Oct 25, 2026 10:11am UTC