chore(deps): actions/setup-node ^ v7.0.0 by floatpanebot · Pull Request #1682 · floatpane/matcha

floatpanebot · 2026-07-14T02:57:11Z

What?

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	`v6` → `v7`

Release Notes

actions/setup-node (actions/setup-node)

`v7.0.0`

Compare Source

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in #1577
Migrate to ESM and upgrade dependencies by @gowridurgad in #1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in #1558
Only use mirrorToken in getManifest if it's provided by @deiga in #1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in #1536
docs: Update restore-only cache documentation by @priya-kinthali in #1550
docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in #1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1569

New Contributors

@chiranjib-swain made their first contribution in #1536
@deiga made their first contribution in #1548
@jasongin made their first contribution in #1569

Full Changelog: actions/setup-node@v6...v7.0.0

`v7`

Compare Source

Why?

Automated dependency update via Renovate.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

## What? Adds a v1 release backporting, merge queue behaivor, e.t.c. ## Why? We are ready to start working on v1 of matcha. v0 will still be maintained and supplied security updates, bug fixes, QoL features --------- Signed-off-by: drew <me@andrinoff.com>

## What? Uses [`go-keybind`](https://github.com/floatpane/go-keybind). ## Why? Easier to maintain/expand Signed-off-by: drew <me@andrinoff.com>

## What? Implements a complete test suite for the `encryption.go`. ## Why? The previous implementation had no test coverage for the `encryption.go`. Closes #886

## What? Deduplicate unread badge counting across `emailsByAcct` and `folderEmails` by tracking seen emails with `AccountID + UID`. Added a regression test for the case where the same unread email exists in both stores. <img width="595" height="652" alt="image" src="https://github.com/user-attachments/assets/8c837fb8-017c-4c7c-aa2c-052f244288b2" /> ## Why? Closes #1107 `syncUnreadBadge` counted unread emails from both stores independently, but the stores can contain the same fetched messages. This could make the macOS unread badge show roughly double the real unread count. <img width="598" height="647" alt="image" src="https://github.com/user-attachments/assets/f2b1c267-29bc-4d4c-a116-4c91af789722" />

## What? Updates `flake.lock` to the latest revisions of all flake inputs (`nixpkgs`, `flake-utils`, etc.). ## Why? Keeps Nix inputs current so contributors and CI build against fresh `nixpkgs`. Picks up upstream security and toolchain fixes. Generated automatically by the flake-lock update workflow on changes to `go.sum`.

## What? Regenerates `gomod2nix.toml` to reflect the current `go.mod` / `go.sum`. ## Why? Keeps the Nix build in sync with Go module changes. Without this, `nix build` fails when new or upgraded Go deps are missing from `gomod2nix.toml`. Generated automatically by the gomod2nix sync workflow.

## What? This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [charm.land/bubbletea/v2](https://redirect.github.com/charmbracelet/bubbletea) | `v2.0.6` → `v2.0.7` | ![age](https://developer.mend.io/api/mc/badges/age/go/charm.land%2fbubbletea%2fv2/v2.0.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/charm.land%2fbubbletea%2fv2/v2.0.6/v2.0.7?slim=true) | --- ### Release Notes <details> <summary>charmbracelet/bubbletea (charm.land/bubbletea/v2)</summary> ### [`v2.0.7`](https://redirect.github.com/charmbracelet/bubbletea/releases/tag/v2.0.7) [Compare Source](https://redirect.github.com/charmbracelet/bubbletea/compare/v2.0.6...v2.0.7) ### A few lil’ stability patches Hi! This is a patch release with a few solid improvements around stability and correctness. - [@lrstanley](https://redirect.github.com/lrstanley), one of our faves, fixed a race condition around mice in the Cursed Renderer - [@lawrence3699](https://redirect.github.com/lawrence3699) fixed a panic that could happen when input's not available - We fixed a correctness issue with regard to mouse releases when Kitty Keyboard was active (thanks, [@mitchellh](https://redirect.github.com/mitchellh)) Thanks for using Bubble Tea, and if you see anything awry please do let us know! —Charm 👋 #### Changelog ##### Fixed - [`c60f0c5`](https://redirect.github.com/charmbracelet/bubbletea/commit/c60f0c53042238305ec13b486326588f12aea0ec): fix: prevent data race with cursedRenderer.onMouse ([#1691](https://redirect.github.com/charmbracelet/bubbletea/issues/1691)) ([@lrstanley](https://redirect.github.com/lrstanley)) - [`074596e`](https://redirect.github.com/charmbracelet/bubbletea/commit/074596e14e2f5ca5e3986ee72e7c08f1569c4178): fix: skip input reader restore when input is disabled ([#1680](https://redirect.github.com/charmbracelet/bubbletea/issues/1680)) ([@lawrence3699](https://redirect.github.com/lawrence3699)) - [`878d7df`](https://redirect.github.com/charmbracelet/bubbletea/commit/878d7df2f2b02f3ca8db177fa8553834bc35ea7c): fix(deps): bump ultraviolet for kitty keyboard fix ([@meowgorithm](https://redirect.github.com/meowgorithm)) *** <a href="https://charm.land/"><img alt="The Charm logo" src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a> Thoughts? Questions? We love hearing from you. Feel free to reach out on [X](https://x.com/charmcli), [Discord](https://charm.land/discord), [Slack](https://charm.land/slack), [The Fediverse](https://mastodon.social/@charmcli), [Bluesky](https://bsky.app/profile/charm.land). </details> ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react](https://react.dev/) ([source](https://redirect.github.com/facebook/react/tree/HEAD/packages/react)) | [`19.2.6` → `19.2.7`](https://renovatebot.com/diffs/npm/react/19.2.6/19.2.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react/19.2.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react/19.2.6/19.2.7?slim=true) | | [react-dom](https://react.dev/) ([source](https://redirect.github.com/facebook/react/tree/HEAD/packages/react-dom)) | [`19.2.6` → `19.2.7`](https://renovatebot.com/diffs/npm/react-dom/19.2.6/19.2.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react-dom/19.2.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-dom/19.2.6/19.2.7?slim=true) | --- ### Release Notes <details> <summary>facebook/react (react)</summary> ### [`v19.2.7`](https://redirect.github.com/facebook/react/releases/tag/v19.2.7): 19.2.7 (June 1st, 2026) [Compare Source](https://redirect.github.com/facebook/react/compare/v19.2.6...v19.2.7) ##### React Server Components - Fixed missing `FormData` entries in Server Actions which regressed in 19.2.6 ([#36566](https://redirect.github.com/facebook/react/pull/36566) by [@unstubbable](https://redirect.github.com/unstubbable)) </details> ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? Regenerates `gomod2nix.toml` to reflect the current `go.mod` / `go.sum`. ## Why? Keeps the Nix build in sync with Go module changes. Without this, `nix build` fails when new or upgraded Go deps are missing from `gomod2nix.toml`. Generated automatically by the gomod2nix sync workflow.

## What? Adds a mention about v1 release in the README (master branch ## Why? So that people know, that, even, if there are no commits on master, we still are developing Signed-off-by: drew <me@andrinoff.com>

Signed-off-by: drew <me@andrinoff.com>

## What? This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://redirect.github.com/actions/go-versions) | uses-with | patch | `1.26.3` → `1.26.4` | --- ### Release Notes <details> <summary>actions/go-versions (go)</summary> ### [`v1.26.4`](https://redirect.github.com/actions/go-versions/releases/tag/1.26.4-26891772857): 1.26.4 [Compare Source](https://redirect.github.com/actions/go-versions/compare/1.26.3-25533533231...1.26.4-26891772857) Go 1.26.4 </details> ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) ([changelog](https://redirect.github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd..df4cb1c069e1874edd31b4311f1884172cec0e10)) | action | digest | `de0fac2` → `df4cb1c` | ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).  Co-authored-by: Drew Smirnoff <drew@floatpane.com>

Co-authored-by: Drew Smirnoff <drew@floatpane.com>

## What? Gate the `LIST ... RETURN (STATUS (UNSEEN))` request in `FetchFolders` on the server advertising the LIST-STATUS capability (RFC 5819). When the server doesn't support it, send a plain `LIST "" "*"` and populate unread counts with a per-mailbox `STATUS (UNSEEN)` fallback instead. ## Why? Fixes #1426 Signed-off-by: drew <me@andrinoff.com>

## What? Checks if the composer has contents at the moment of interrupt signal (`ctrl+c`). If so, it saves the draft before quitting ## Why? It is easy to accidentally quit, and it was unforgiving, without saving anything. Especially including that the default quit keybind is the same as "copy" on linux and windows (`ctrl+c`) Signed-off-by: drew <me@andrinoff.com>

## What? This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/floatpane/bubble-overlay](https://redirect.github.com/floatpane/bubble-overlay) | `v0.0.1` → `v0.1.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2ffloatpane%2fbubble-overlay/v0.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2ffloatpane%2fbubble-overlay/v0.0.1/v0.1.0?slim=true) | --- ### Release Notes <details> <summary>floatpane/bubble-overlay (github.com/floatpane/bubble-overlay)</summary> ### [`v0.1.0`](https://redirect.github.com/floatpane/bubble-overlay/releases/tag/v0.1.0) [Compare Source](https://redirect.github.com/floatpane/bubble-overlay/compare/v0.0.1...v0.1.0)  #### What's Changed ##### Dependencies - chore(deps): github.com/charmbracelet/x/ansi ^ v0.11.7 by [@floatpanebot](https://redirect.github.com/floatpanebot) in [#5](https://redirect.github.com/floatpane/bubble-overlay/pull/5) - chore(deps): go ^ 1.26.4 by [@floatpanebot](https://redirect.github.com/floatpanebot) in [#11](https://redirect.github.com/floatpane/bubble-overlay/pull/11) #### New Contributors - [@floatpanebot](https://redirect.github.com/floatpanebot) made their first contribution in [#5](https://redirect.github.com/floatpane/bubble-overlay/pull/5) **Full Changelog**: <floatpane/bubble-overlay@v0.0.1...v0.1.0> *** **Install:** ```bash go get github.com/floatpane/bubble-overlay@v0.1.0 ``` See the [Go reference](https://pkg.go.dev/github.com/floatpane/bubble-overlay) for full API documentation. </details> ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? Regenerates `gomod2nix.toml` to reflect the current `go.mod` / `go.sum`. ## Why? Keeps the Nix build in sync with Go module changes. Without this, `nix build` fails when new or upgraded Go deps are missing from `gomod2nix.toml`. Generated automatically by the gomod2nix sync workflow.

## What? Updates `flake.lock` to the latest revisions of all flake inputs (`nixpkgs`, `flake-utils`, etc.). ## Why? Keeps Nix inputs current so contributors and CI build against fresh `nixpkgs`. Picks up upstream security and toolchain fixes. Generated automatically by the flake-lock update workflow on changes to `go.sum`.

## What? Uses `overlay.Center` for the move modal. ## Why? The previous version messed with the inbox contents on both sides. Like in #1435 Signed-off-by: drew <me@andrinoff.com>

## What? Makes the protocol selection a "combobox" ## Why? Closes #1230 --------- Signed-off-by: drew <me@andrinoff.com>

## What? Moves the log message for i18n to loglevel `verbose` ## Why? Each time you used to load matcha in secure mode, these messages would appear and possibly block the UI Signed-off-by: drew <me@andrinoff.com>

## What? The code to support JMAP authentication via API tokens was in place, it just wasn't wired up correctly. This fixes that. - JMAP protocol selection ended up getting routed to IMAP code - no way to specify `token` for `account.AuthMethod` - `hasBackendProvider` didn't account for/support `jmap` - modified placeholder when `account.AuthMethod` is `token` to say `API Token` instead of `Password / App Password` - modified tip for `inputAuthMethod` when protocol is `jmap` ## Why? Because I use Fastmail, want to use JMAP, and want to be able to read my email. JMAP authentication with Fastmail via API Tokens wasn't working for multiple reasons. Fastmail is the largest (only?) JMAP supporting email host and they require API Tokens. I have manually confirmed that this authenticates just fine with my Fastmail account via JMAP and the API token.

## What? in `jmap.go` - added a `resolveUID` function - added a `resolveUIDByQuery` function ## Why? Email body fetch always failed with "jmap: no cached ID" (backend/jmap/jmap.go) FetchEmailBody relied on p.idToJMAPID being pre-populated by FetchEmails on the same Provider instance. However, the fetcher layer creates a fresh Provider for every call, so the map is always empty when FetchEmailBody runs. The fix adds a resolveUID method that checks the in-memory cache first (fast path when the daemon reuses the same instance), then falls back to resolveUIDByQuery. The fallback issues an Email/query for the folder, reads the JMAP string IDs directly from QueryResponse.IDs, hashes each one with FNV-32a, and returns the match — also warming the cache as a side effect.

## What? Messages are held for `N` seconds before delivery, with a recall window. ## Why? Saves users from sending mistakes, just like Gmail/Outlook. Closes #1139

## What? Makes Background daemon optional in the settings ## Why? Temporary fix for #1448, also a good option to have for users to turn off, if they do not want the daemon on. --------- Signed-off-by: drew <me@andrinoff.com>

## What? Refreshes the feature screenshots in `docs/docs/assets/features/`. ### Screenshots included: - `compose_email.png` - `compose_empty.png` - `drafts.png` - `email_view.png` - `inbox_view.png` - `main_menu.png` - `settings.png` - `theme_settings.png` - `threading_demo.png` ## Why? Keeps documentation visuals aligned with the current TUI. Generated automatically by the Generate Screenshots workflow on the latest release. Co-authored-by: floatpanebot <278062430+floatpanebot@users.noreply.github.com>

## What? Replaces `public/assets/demo.gif` with a freshly recorded VHS run. ## Why? Keeps the demo GIF aligned with the latest release so README and docs reflect current behaviour. Generated automatically by the Update Demo VHS workflow. Co-authored-by: floatpanebot <278062430+floatpanebot@users.noreply.github.com>

## What? Fixes crashes when sending. ## Why? Fixes #1453 Signed-off-by: drew <me@andrinoff.com>

## What? Improves queue, by making undo non-blocking ## Why? You had to wait for 5 seconds in order to use Matcha again Signed-off-by: drew <me@andrinoff.com>

## What? This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://redirect.github.com/actions/go-versions) | uses-with | patch | `1.26.4` → `1.26.5` | --- ### Release Notes <details> <summary>actions/go-versions (go)</summary> ### [`v1.26.5`](https://redirect.github.com/actions/go-versions/releases/tag/1.26.5-28913679792): 1.26.5 [Compare Source](https://redirect.github.com/actions/go-versions/compare/1.26.4-26891772857...1.26.5-28913679792) Go 1.26.5 </details> ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://redirect.github.com/golang/go)) | golang | patch | `1.26.4` → `1.26.5` | ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).  Co-authored-by: Drew Smirnoff <drew@floatpane.com>

## What? This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.38.0` → `v0.40.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.38.0...refs/tags/v0.40.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2ftext/v0.40.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2ftext/v0.38.0/v0.40.0?slim=true) | ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/floatpane/bubble-overlay](https://redirect.github.com/floatpane/bubble-overlay) | `v0.2.0` → `v0.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2ffloatpane%2fbubble-overlay/v0.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2ffloatpane%2fbubble-overlay/v0.2.0/v0.3.0?slim=true) | --- ### Release Notes <details> <summary>floatpane/bubble-overlay (github.com/floatpane/bubble-overlay)</summary> ### [`v0.3.0`](https://redirect.github.com/floatpane/bubble-overlay/releases/tag/v0.3.0) [Compare Source](https://redirect.github.com/floatpane/bubble-overlay/compare/v0.2.0...v0.3.0)  **Full Changelog**: <floatpane/bubble-overlay@v0.2.0...v0.3.0> *** **Install:** ```bash go get github.com/floatpane/bubble-overlay@v0.3.0 ``` See the [Go reference](https://pkg.go.dev/github.com/floatpane/bubble-overlay) for full API documentation. </details> ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.44.0` → `v0.45.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.44.0...refs/tags/v0.45.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fterm/v0.45.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fterm/v0.44.0/v0.45.0?slim=true) | ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [cachix/install-nix-action](https://redirect.github.com/cachix/install-nix-action) ([changelog](https://redirect.github.com/cachix/install-nix-action/compare/8aa03977d8d733052d78f4e008a241fd1dbf36b3..a49548c11d9846ad46ecc0115273879b045f001c)) | action | digest | `8aa0397` → `a49548c` | ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? Adds a Reply-All function (`shift+r`) ## Why? Closes #1667 --------- Signed-off-by: drew <me@andrinoff.com>

## What? Updates `flake.lock` to the latest revisions of all flake inputs (`nixpkgs`, `flake-utils`, etc.). ## Why? Keeps Nix inputs current so contributors and CI build against fresh `nixpkgs`. Picks up upstream security and toolchain fixes. Generated automatically by the flake-lock update workflow on changes to `go.sum`.

## What? Regenerates `gomod2nix.toml` to reflect the current `go.mod` / `go.sum`. ## Why? Keeps the Nix build in sync with Go module changes. Without this, `nix build` fails when new or upgraded Go deps are missing from `gomod2nix.toml`. Generated automatically by the gomod2nix sync workflow.

## What? Replaces `public/assets/demo.gif` with a freshly recorded VHS run. ## Why? Keeps the demo GIF aligned with the latest release so README and docs reflect current behaviour. Generated automatically by the Update Demo VHS workflow. Co-authored-by: floatpanebot <278062430+floatpanebot@users.noreply.github.com>

## What? Refreshes the feature screenshots in `docs/docs/assets/features/`. ### Screenshots included: - `compose_email.png` - `compose_empty.png` - `drafts.png` - `email_view.png` - `inbox_view.png` - `main_menu.png` - `settings.png` - `theme_settings.png` - `threading_demo.png` ## Why? Keeps documentation visuals aligned with the current TUI. Generated automatically by the Generate Screenshots workflow on the latest release. Co-authored-by: floatpanebot <278062430+floatpanebot@users.noreply.github.com>

## What? Wrap config file parse errors with the file path, and replace the `panic()` in `defaultKeybinds()` with a logged warning. ## Why? Closes #1520 When a config file is malformed, the error only showed a raw JSON parse error with no indication of which file was broken. Users had no way to know what to fix. If the embedded `default_keybinds.json` was somehow corrupted, the application crashed with a panic instead of degrading gracefully. --------- Co-authored-by: kawacukennedy <kennedykawacu@gmail.com>

## What? This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/labeler](https://redirect.github.com/actions/labeler) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/labeler (actions/labeler)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/labeler/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/labeler/compare/v7.0.0...v7.0.0) ##### What's Changed ##### Enhancements: - Migrate to ESM and update dependencies by [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#949](https://redirect.github.com/actions/labeler/pull/949) **Full Changelog**: <actions/labeler@v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/labeler/compare/v6.2.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/labeler/compare/v6.2.0...v7.0.0) </details> ## Why? Automated dependency update via Renovate. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

## What? Fetches the actual IMAP folder name for attachment downloads ## Why? Fixes #1689 --------- Signed-off-by: drew <me@andrinoff.com>

## What? - Added try-catch block to make it easier to debug OAuth2 errors encountered while authenticating IMAP. - Revised Outlook URL generation code for updated Entra ID redirect ## Why? I wasn't able to authenticate my Outlook emails previously. I'm not fully sure if the documentation clearly states that you need your Entra ID redirect to be configured as "Web" rather than "Mobile & Desktop App," but that is also a needed fix.

## What? Fixes several issues with Gmail ## Why? Fixes #1674 Signed-off-by: drew <me@andrinoff.com>

floatpanebot · 2026-09-25T06:59:15Z

This has had no activity for 45 days. It will be closed in 21 days unless updated. Comment or remove the stale label to keep it open.

floatpanebot · 2026-09-27T04:46:51Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

floatpanebot · 2026-10-16T06:38:49Z

Closing due to inactivity. Reopen if still relevant.

andrinoff and others added 30 commits June 1, 2026 23:20

chore: use go-keybind (#1397)

1890665

## What? Uses [`go-keybind`](https://github.com/floatpane/go-keybind). ## Why? Easier to maintain/expand Signed-off-by: drew <me@andrinoff.com>

test: implement encryption tests (#1399)

e4987f3

## What? Implements a complete test suite for the `encryption.go`. ## Why? The previous implementation had no test coverage for the `encryption.go`. Closes #886

docs: add a mention of v1 in README (#1409)

ced3444

## What? Adds a mention about v1 release in the README (master branch ## Why? So that people know, that, even, if there are no commits on master, we still are developing Signed-off-by: drew <me@andrinoff.com>

docs: remove gitads (#1428)

e9adba8

Signed-off-by: drew <me@andrinoff.com>

chore(deps): go ^ 1.26.4 (#1419)

e06a2fe

Co-authored-by: Drew Smirnoff <drew@floatpane.com>

fix(ui): use overlay for move modal (#1440)

c090aa6

## What? Uses `overlay.Center` for the move modal. ## Why? The previous version messed with the inbox contents on both sides. Like in #1435 Signed-off-by: drew <me@andrinoff.com>

fix: better protocol selector (#1441)

4e6108f

## What? Makes the protocol selection a "combobox" ## Why? Closes #1230 --------- Signed-off-by: drew <me@andrinoff.com>

fix: move "Language set" to loglevel (#1442)

28a4580

## What? Moves the log message for i18n to loglevel `verbose` ## Why? Each time you used to load matcha in secure mode, these messages would appear and possibly block the UI Signed-off-by: drew <me@andrinoff.com>

feat: send or unsend matcha messages (#1434)

8fd928e

## What? Messages are held for `N` seconds before delivery, with a recall window. ## Why? Saves users from sending mistakes, just like Gmail/Outlook. Closes #1139

feat: make daemon optional (#1450)

b30febd

## What? Makes Background daemon optional in the settings ## Why? Temporary fix for #1448, also a good option to have for users to turn off, if they do not want the daemon on. --------- Signed-off-by: drew <me@andrinoff.com>

fix: crashes when sending (#1454)

8710452

## What? Fixes crashes when sending. ## Why? Fixes #1453 Signed-off-by: drew <me@andrinoff.com>

fix: make undo message non-blocking (#1455)

a7c5ba1

## What? Improves queue, by making undo non-blocking ## Why? You had to wait for 5 seconds in order to use Matcha again Signed-off-by: drew <me@andrinoff.com>

floatpanebot and others added 11 commits July 8, 2026 10:22

feat: reply-all (#1673)

5685a20

## What? Adds a Reply-All function (`shift+r`) ## Why? Closes #1667 --------- Signed-off-by: drew <me@andrinoff.com>

floatpanebot requested a review from a team as a code owner July 14, 2026 02:57

floatpanebot added dependencies Dependency updates size/XS Diff: 0–10 lines labels Jul 14, 2026

floatpanebot force-pushed the renovate/actions-setup-node-7.x branch from 647ee48 to 3463096 Compare July 14, 2026 05:34

kawacukennedy and others added 2 commits July 24, 2026 13:39

floatpanebot force-pushed the renovate/actions-setup-node-7.x branch from 3463096 to cfb5e38 Compare July 24, 2026 14:55

andrinoff and others added 2 commits July 27, 2026 12:18

fix: attatchments not downloaded (#1699)

1be6dfa

## What? Fetches the actual IMAP folder name for attachment downloads ## Why? Fixes #1689 --------- Signed-off-by: drew <me@andrinoff.com>

floatpanebot force-pushed the renovate/actions-setup-node-7.x branch from cfb5e38 to 0dc446d Compare July 27, 2026 14:34

andrinoff and others added 2 commits August 10, 2026 06:41

fix(gmail): empty provider, login (#1703)

5198d8f

## What? Fixes several issues with Gmail ## Why? Fixes #1674 Signed-off-by: drew <me@andrinoff.com>

chore(deps): actions/setup-node ^ v7.0.0

dc16108

floatpanebot force-pushed the renovate/actions-setup-node-7.x branch from 0dc446d to dc16108 Compare August 10, 2026 07:41

floatpanebot added the stale No activity for extended period label Sep 25, 2026

andrinoff force-pushed the master branch from 5198d8f to 0e75ae0 Compare September 27, 2026 04:32

floatpanebot closed this Oct 16, 2026

Navigation Menu

Repository navigation

chore(deps): actions/setup-node ^ v7.0.0 - #1682

chore(deps): actions/setup-node ^ v7.0.0#1682
floatpanebot wants to merge 87 commits into
masterfrom
renovate/actions-setup-node-7.x

floatpanebot commented Jul 14, 2026 •

edited

Loading

Uh oh!

floatpanebot commented Sep 25, 2026

Uh oh!

floatpanebot commented Sep 27, 2026

Uh oh!

floatpanebot commented Oct 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Conversation

floatpanebot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What?

Release Notes

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

v7

Why?

Configuration

Uh oh!

floatpanebot commented Sep 25, 2026

Uh oh!

floatpanebot commented Sep 27, 2026

Edited/Blocked Notification

Uh oh!

floatpanebot commented Oct 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

floatpanebot commented Jul 14, 2026 •

edited

Loading

`v7.0.0`

`v7`