Update dependency suitenumerique/messages to v0.9.0

[renovate]

This PR contains the following updates:

Package	Update	Change
suitenumerique/messages	minor	0.5.0 → 0.9.0

---

Release Notes

suitenumerique/messages (suitenumerique/messages)

v0.9.0

Compare Source

Added

• Push notification system for iOS, Android and Web
• Bootstrap Capacitor mobile apps (iOS/Android) sharing the existing SPA
• Self-hosted OTA update chain for mobile apps
• Mobile OIDC session handoff via a one-time token on an allowlisted deep link
• Inbound webhooks and message postmarks
• Host allowlist to bypass SSRF checks on internal networks
• Detect raw text links in HTML bodies and warn the user before redirect #​744
• Support a next param at login to restore the requested route after auth
• Display unread count in the mailbox dropdown #​738
• Add X-Mailer header on outbound messages
• Cache-busting source version in build
• Full documentation on spam processing

Changed

• Rewrite MTA-in in pure Python to remove the Postfix dependency #​692
• Refactor imports: retries, continuous mode, direct-to-offload storage,
  cancellation and a list UI in the settings modal #​742
• Serve frontend configuration from the backend #​734
• Deliver the CSRF token via the session instead of a cookie
• Generate message-id with the builtin email.utils.make_msgid #​730
• Set up browserslist and Vite legacy plugin to support Chrome >= 109 #​741 #​750
• Reset search when switching mailbox #​743
• Clearer message on the no-mailbox view
• Explicit feedback when a user is authenticated on the IdP but has no account
• Improve make bootstrap setup time and overall DevX
• Bump django-lasuite to 0.0.27
• Upgrade Keycloak theme to 2.3.4 #​732

Removed

• Remove the TESTDOMAIN feature, superseded by autojoin domains
• Remove the react-email component from outbound message rendering

Fixed

• Fix relay block indentation breaking SASL auth in MTA out #​733
• Fix Outlook Web handler in the unquote logic #​754
• Fix premature line wrapping in the composer on Safari 26 #​735 #​740
• Fix line break in the composer on Chrome for Android #​725
• Set an attachment name fallback
• Fix hardcoded lang=en that might trigger auto-translate
• Improve re-processing of inbound messages from the admin
• Save the origin IP across STARTTLS restarts (pymta)

Security

• Bump keycloak to 26.6.4 (CERTFR-2026-AVI-0815) #​729

v0.8.0

Compare Source

Added

• Allow permanently deleting drafts and improve draft edition
• Allow passwordless mailbox creation when identity sync is off #​707
• Gather mailbox settings into a dialog
• Translate template placeholder and add user_name builtin variable
• Report selfcheck status to Sentry crons #​694

Changed

• Drop Next.js for Vite + TanStack Router #​675
• Move email parser & composer to new jmap-email library #​700
• Add PyPI release scripts for jmap-email
• Use LaGaufreV2 component
• Improve thread navigation a11y and multiselect UX #​708
• Refine mailbox dropdown menu #​705
• New homepage illustration #​702
• Internationalize missing strings
• Wrap autoreply date column
• Bump dompurify to 3.4.11
• Bump django-lasuite to 0.0.26 #​689

Fixed

• Fix composer issues
• Add To header to outbound mails missing one #​712
• Manage message/delivery-status attachments at compose
• Persist mailbox name when contact is missing
• Fix order and default calendar selection when RSVPing #​699
• Fix display of recurring events with exceptions #​686
• Fix opportunistic TLS against MXes with mismatched certs #​687
• Fix mbox detection as text/html with some libmagic versions #​696
• Complete PST email folder prefixes list
• Fix milter socket permission race on startup #​693

Security

• Add some defense-in-depth bits #​706
• Harden SMTP connection & proxies config
• Harden inbound email parsing #​695

v0.7.0

Compare Source

Added

• Attachments preview #​676
• Add link to a CalDAV instance to accept events directly #​584

Changed

• Improve sending experience #​681
• Remove deprecated model fields from tiered storage migration #​678

Fixed

• Unmount thread view immediately on unselect thread #​680
• Prevent refetch thread messages on draft deletion #​682

v0.6.0

Compare Source

Added

• Add thread assignation feature #​645
• Add mention notifications via UserEvent #​621
• Allow sending internal messages through ThreadEvent #​566
• Add thread deep linking #​664
• Add label assignment with archive and bulk label widget
• Enable inviting users that haven't logged in yet #​644
• Add configurable inbound auth backends #​636
• Add encryption, custom scopes, levels and auditing on channels #​599
• Add recursive SPF check and optional send-time validation #​625
• Add tiered storage and refactor blobs/attachments
• Add mandatory TOTP field and search field in admin #​667
• Add silent login support
• Make panel sections resizable
• Add read/unread action on thread action bar #​659
• Add lprobe healthchecks and checksum verification for lprobe + Caddy #​600

Changed

• Improve message composer
• Switch back to Python's stdlib for email composition
• Put split thread feature behind a feature flag #​624
• Show tooltip to confirm mailbox refresh
• Disable application menu when no option is available
• Focus to field on forward
• Align send button on the left
• Upgrade Cunningham and ui-kit
• Localize attachment separator
• Force default language on frontend #​647
• Add DNS propagation delay info #​654
• Allow specifying a channel id for the home feedback widget #​655
• Support legacy and new widget attribute #​650
• Update widget logic to latest version #​649
• Refactor thread query cache management #​642
• Allow reindexing from a given date
• Defer indexation tasks for better throughput
• Improve search_reindex bulk payload
• Move imports and reindex worker queues to dedicated containers #​643
• Bump Keycloak to 26.6.1 #​637

Fixed

• Improve PST import logic
• Allow thread editor to destroy thread accesses #​668
• Enforce full edit rights on thread mutations
• Fix race condition in last-editor deletion guard
• Fix thread panel header with nested label #​658
• Fix label popup stacking with create-label modal #​635
• Fix email parsing edge cases with UTF-8 in flanker #​656
• Fix threads ordering #​617
• Fix double request and flickering on search #​596
• Handle non-serializable Celery task errors and stop infinite polling #​633
• Quote error field and log SOCKS proxy in outbound delivery #​626
• Do not mark thread as read when sending autoreply #​594

Security

• Stop flagging inbound From=To mails as is_sender #​652
• Force including special characters in generated passwords #​640
• Factorize SSRF code and allow redirects in image proxy #​631

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.