emailengine-app 2.63.2 → 2.63.4

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [2.63.4](https://github.com/postalsys/emailengine/compare/v2.63.3...v2.63.4) (2026-03-09)
+
+
+### Bug Fixes
+
+* guard null imapClient dereferences during async operations ([671bcee](https://github.com/postalsys/emailengine/commit/671bcee4e81c7c0d6421617c3e25ec6906cb1abb))
+* prevent null dereference crash in getImapConnection during connection drops ([6a356fd](https://github.com/postalsys/emailengine/commit/6a356fd20e1412a070c26c093108c4ea2a722a5c))
+* throw instead of silent return in select() null guard, revert redundant optional chaining ([cb7db50](https://github.com/postalsys/emailengine/commit/cb7db5024e0b00f8a773328dd5e0009067bed0b6))
+* update tests for getCurrentListing null guard changes ([a644f9c](https://github.com/postalsys/emailengine/commit/a644f9c1c3f3e4cbce388e43bfa319f11f4a469c))
+
+## [2.63.3](https://github.com/postalsys/emailengine/compare/v2.63.2...v2.63.3) (2026-03-05)
+
+
+### Bug Fixes
+
+* handle undici HeadersTimeoutError as transient in Pub/Sub and OAuth2 paths ([8b3b698](https://github.com/postalsys/emailengine/commit/8b3b69880ab09119df4ca377d085db261eae2763))
+* prevent IMAP worker crash on ImapFlow unhandled rejection during IDLE recovery ([86ebb02](https://github.com/postalsys/emailengine/commit/86ebb02c321ffa758966af1957509c10e20a35fc))
+* prevent transient network errors during OAuth2 token refresh from being misclassified as auth failures ([38fa212](https://github.com/postalsys/emailengine/commit/38fa212092847b727ac1d02541103c032a983dc7))
+* retry transient network errors in Gmail and Outlook API request functions ([08ea0da](https://github.com/postalsys/emailengine/commit/08ea0daecaec73c58a91ac07df5d0f0ffc083a2f))
+* treat DNS errors as transient in Google Pub/Sub polling loop ([ec33673](https://github.com/postalsys/emailengine/commit/ec33673b47242fd7156b4641c9c4924a33eaf9e5))
+
 ## [2.63.2](https://github.com/postalsys/emailengine/compare/v2.63.1...v2.63.2) (2026-03-03)
 
 

package/data/google-crawlers.json

@@ -1,5 +1,5 @@
 {
-    "creationTime": "2026-03-02T15:45:59.000000",
+    "creationTime": "2026-03-06T15:46:26.000000",
     "prefixes": [
         {
             "ipv6Prefix": "2001:4860:4801:2008::/64"

package/lib/email-client/base-client.js

@@ -538,6 +538,28 @@ class BaseClient {
                 });
                 accessToken = accountData.oauth2.accessToken;
             } catch (err) {
+                // Transient network errors are not authentication failures
+                let isNetworkError =
+                    err.code === 'ENOTFOUND' ||
+                    err.code === 'ETIMEDOUT' ||
+                    err.code === 'ECONNREFUSED' ||
+                    err.code === 'ECONNRESET' ||
+                    err.code === 'EAI_AGAIN' ||
+                    err.code === 'UND_ERR_CONNECT_TIMEOUT' ||
+                    err.code === 'UND_ERR_SOCKET' ||
+                    err.code === 'UND_ERR_HEADERS_TIMEOUT';
+
+                if (isNetworkError) {
+                    ctx.logger.error({
+                        msg: 'Network error during OAuth2 token refresh',
+                        account: accountObject.account,
+                        code: err.code,
+                        err
+                    });
+                    // Do not mark as authenticationFailed, let the caller handle as a connection error
+                    throw err;
+                }
+
                 err.authenticationFailed = true;
                 let notifyData = {
                     response: err.message,

package/lib/email-client/gmail/gmail-api.js

@@ -12,6 +12,18 @@ const LIST_BATCH_SIZE = 10;
 const MAX_RETRY_ATTEMPTS = 3;
 const RETRY_BASE_DELAY = 1000; // 1 second base delay
 
+// Network-level errors that are transient and should be retried
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ETIMEDOUT',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT'
+]);
+
 // Gmail API error code mapping to internal error codes
 // https://developers.google.com/gmail/api/reference/rest#error-codes
 const GMAIL_ERROR_MAP = {
@@ -117,6 +129,29 @@ async function request(context, url, method, payload, options = {}) {
         } catch (err) {
             lastError = err;
 
+            // Check if this is a transient network error
+            if (TRANSIENT_NETWORK_CODES.has(err.code) && attempt < maxRetries) {
+                const delay = RETRY_BASE_DELAY * Math.pow(2, attempt) + Math.random() * 500;
+
+                context.logger.warn({
+                    msg: 'Transient network error during Gmail API request, retrying',
+                    account: context.account,
+                    attempt: attempt + 1,
+                    maxRetries,
+                    delay,
+                    code: err.code
+                });
+
+                metricsMeta({ account: context.account }, context.logger, 'oauth2ApiRequest', 'inc', {
+                    status: 'network_error',
+                    provider: 'gmail',
+                    statusCode: '0'
+                });
+
+                await new Promise(resolve => setTimeout(resolve, delay));
+                continue;
+            }
+
             // Check if this is a rate limit error
             if (isRateLimitError(err) && attempt < maxRetries) {
                 const delay = calculateRetryDelay(err, attempt);

package/lib/email-client/imap/mailbox.js

@@ -94,7 +94,10 @@ class Mailbox {
     getMailboxStatus(connectionClient) {
         connectionClient = connectionClient || this.connection.imapClient;
         if (!connectionClient) {
-            throw new Error('IMAP connection not available');
+            let err = new Error('IMAP connection not available');
+            err.code = 'IMAPConnectionClosing';
+            err.statusCode = 503;
+            throw err;
         }
 
         let mailboxInfo = connectionClient.mailbox;
@@ -490,6 +493,12 @@ class Mailbox {
      * @param {Boolean} skipIdle - Don't start IDLE after selecting
      */
     async select(skipIdle) {
+        if (!this.connection.imapClient) {
+            let err = new Error('IMAP connection not available');
+            err.code = 'IMAPConnectionClosing';
+            err.statusCode = 503;
+            throw err;
+        }
         const currentLock = this.connection.imapClient.currentLock;
         // Avoid interfering with any active operations
         if (currentLock) {
@@ -520,7 +529,7 @@ class Mailbox {
 
         // Check if we still need to select after getting the lock
         // Another operation might have already selected this mailbox while we were waiting
-        if (this.connection.imapClient.mailbox && this.connection.imapClient.mailbox.path === this.path) {
+        if (this.connection.imapClient?.mailbox && this.connection.imapClient.mailbox.path === this.path) {
             this.logger.trace({
                 msg: 'Mailbox already selected after lock acquired',
                 path: this.path
@@ -551,7 +560,10 @@ class Mailbox {
         connectionClient = connectionClient || this.connection.imapClient;
 
         if (!connectionClient) {
-            throw new Error('IMAP connection not available');
+            let err = new Error('IMAP connection not available');
+            err.code = 'IMAPConnectionClosing';
+            err.statusCode = 503;
+            throw err;
         }
 
         let lock = await connectionClient.getMailboxLock(this.path, options || {});
@@ -613,7 +625,13 @@ class Mailbox {
                     return false;
                 })
                 .then(() => this.select())
-                .catch(err => this.logger.error({ msg: 'Sync error', err }));
+                .catch(err => {
+                    if (err.code === 'IMAPConnectionClosing') {
+                        this.logger.debug({ msg: 'Sync skipped, connection closing', err });
+                    } else {
+                        this.logger.error({ msg: 'Sync error', err });
+                    }
+                });
         }, 1000);
     }
 
@@ -1090,7 +1108,7 @@ class Mailbox {
 
         // Resolve Gmail category for inbox messages
         if (
-            this.connection.imapClient.capabilities.has('X-GM-EXT-1') &&
+            this.connection.imapClient?.capabilities?.has('X-GM-EXT-1') &&
             this.isAllMail &&
             messageInfo.labels &&
             messageInfo.labels.includes('\\Inbox') &&
@@ -2069,7 +2087,7 @@ class Mailbox {
             }
 
             // Partial sync if CONDSTORE indicates only new messages or flag changes
-            if (canUseCondstorePartialSync(this.connection.imapClient, storedStatus, mailboxStatus)) {
+            if (this.connection.imapClient && canUseCondstorePartialSync(this.connection.imapClient, storedStatus, mailboxStatus)) {
                 return await this.partialSync(storedStatus);
             }
 

package/lib/email-client/imap/sync-operations.js

@@ -197,7 +197,10 @@ class SyncOperations {
         this.mailbox.syncing = true;
         try {
             if (!this.connection.imapClient) {
-                throw new Error('IMAP connection not available');
+                let err = new Error('IMAP connection not available');
+                err.code = 'IMAPConnectionClosing';
+                err.statusCode = 503;
+                throw err;
             }
 
             let knownUidNext = typeof storedStatus.uidNext === 'number' ? storedStatus.uidNext || 1 : 1;
@@ -351,7 +354,10 @@ class SyncOperations {
         this.mailbox.syncing = true;
         try {
             if (!this.connection.imapClient) {
-                throw new Error('IMAP connection not available');
+                let err = new Error('IMAP connection not available');
+                err.code = 'IMAPConnectionClosing';
+                err.statusCode = 503;
+                throw err;
             }
 
             let fields = { uid: true, flags: true, modseq: true, emailId: true, labels: true, internalDate: true };
@@ -378,7 +384,10 @@ class SyncOperations {
                     let imapClient = this.connection.imapClient;
                     if (!imapClient || !imapClient.usable) {
                         this.logger.error({ msg: 'IMAP client not available for partial sync' });
-                        throw new Error('IMAP connection not available');
+                        let err = new Error('IMAP connection not available');
+                        err.code = 'IMAPConnectionClosing';
+                        err.statusCode = 503;
+                        throw err;
                     }
 
                     try {
@@ -556,7 +565,10 @@ class SyncOperations {
                         const imapClient = this.connection.imapClient;
                         if (!imapClient || !imapClient.usable) {
                             this.logger.error({ msg: 'IMAP client not available for FETCH' });
-                            throw new Error('IMAP connection not available');
+                            let err = new Error('IMAP connection not available');
+                            err.code = 'IMAPConnectionClosing';
+                            err.statusCode = 503;
+                            throw err;
                         }
 
                         try {
@@ -728,7 +740,7 @@ class SyncOperations {
 
                             // Verify we're still on the correct mailbox after the delay
                             // Another operation might have changed the mailbox while we were waiting
-                            const currentMailbox = this.connection.imapClient.mailbox;
+                            const currentMailbox = this.connection.imapClient?.mailbox;
                             if (!currentMailbox || currentMailbox.path !== this.mailbox.path) {
                                 this.logger.error({
                                     msg: 'Mailbox changed during retry delay, aborting sync',

package/lib/email-client/imap-client.js

@@ -191,6 +191,12 @@ class IMAPClient extends BaseClient {
         let syncing = this.syncing || ['init', 'connecting', 'syncing'].includes(this.state);
         if (!noPool && (!syncing || !allowSecondary)) {
             // Return the primary connection for most operations
+            if (!this.imapClient) {
+                let err = new Error('IMAP connection not available');
+                err.code = 'IMAPConnectionClosing';
+                err.statusCode = 503;
+                throw err;
+            }
             return this.imapClient;
         }
 
@@ -202,14 +208,19 @@ class IMAPClient extends BaseClient {
             if (connectionClient && connectionClient.usable) {
                 connectionOptions.connectionClient = connectionClient;
                 return connectionClient;
-            } else {
-                // fall back to default connection
-                return this.imapClient;
             }
         } catch (err) {
             this.logger.error({ msg: 'Failed to acquire command connection', reason, err });
-            return this.imapClient;
         }
+
+        // Fall back to primary connection
+        if (!this.imapClient) {
+            let err = new Error('IMAP connection not available');
+            err.code = 'IMAPConnectionClosing';
+            err.statusCode = 503;
+            throw err;
+        }
+        return this.imapClient;
     }
 
     /**
@@ -535,14 +546,6 @@ class IMAPClient extends BaseClient {
         this.checkIMAPConnection(connectionOptions);
 
         const connectionClient = await this.getImapConnection(connectionOptions, 'getCurrentListing');
-        if (!connectionClient) {
-            if (this.imapClient) {
-                this.imapClient.close();
-            }
-            let error = new Error('Failed to get connection');
-            error.code = 'ConnectionError';
-            throw error;
-        }
 
         let accountData = await this.accountObject.loadAccountData();
 
@@ -802,7 +805,11 @@ class IMAPClient extends BaseClient {
             try {
                 await mailbox.onOpen(event);
             } catch (err) {
-                imapClient.log.error({ msg: 'Open error', err });
+                if (err.code === 'IMAPConnectionClosing') {
+                    imapClient.log.debug({ msg: 'Open skipped, connection closing', err });
+                } else {
+                    imapClient.log.error({ msg: 'Open error', err });
+                }
             }
         });
 

package/lib/email-client/outlook/graph-api.js

@@ -7,6 +7,18 @@ const { OUTLOOK_MAX_BATCH_SIZE, OUTLOOK_MAX_RETRY_ATTEMPTS, OUTLOOK_RETRY_BASE_D
 // Maximum number of operations in a single batch request to Microsoft Graph API
 const MAX_BATCH_SIZE = OUTLOOK_MAX_BATCH_SIZE;
 
+// Network-level errors that are transient and should be retried
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ETIMEDOUT',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT'
+]);
+
 // MS Graph API error code mapping to internal error codes
 // https://learn.microsoft.com/en-us/graph/errors
 const GRAPH_ERROR_MAP = {
@@ -163,6 +175,25 @@ async function requestWithRetry(context, url, method, payload, options = {}) {
         try {
             return await request(context, url, method, payload, options);
         } catch (err) {
+            // Retry on transient network errors
+            if (TRANSIENT_NETWORK_CODES.has(err.code) && attempt < maxRetries) {
+                lastError = err;
+                const delay = Math.min(OUTLOOK_RETRY_BASE_DELAY * Math.pow(2, attempt), OUTLOOK_RETRY_MAX_DELAY);
+
+                context.logger.warn({
+                    msg: 'Transient network error during Graph API request, retrying',
+                    account: context.account,
+                    attempt: attempt + 1,
+                    maxRetries,
+                    delay,
+                    code: err.code,
+                    url
+                });
+
+                await new Promise(resolve => setTimeout(resolve, delay * 1000));
+                continue;
+            }
+
             // Only retry on 429 (rate limit) errors
             if (err.oauthRequest?.status !== 429 || attempt === maxRetries) {
                 throw err;

package/lib/oauth/pubsub/google.js

@@ -203,7 +203,18 @@ class PubSubInstance {
             await oauth2Apps.setMeta(this.app, { pubSubFlag: null });
         } catch (err) {
             // Transient network errors are expected for long-polling connections
-            if (['ETIMEDOUT', 'ECONNRESET', 'ECONNREFUSED', 'UND_ERR_SOCKET', 'UND_ERR_CONNECT_TIMEOUT'].includes(err.code)) {
+            if (
+                [
+                    'ENOTFOUND',
+                    'EAI_AGAIN',
+                    'ETIMEDOUT',
+                    'ECONNRESET',
+                    'ECONNREFUSED',
+                    'UND_ERR_SOCKET',
+                    'UND_ERR_CONNECT_TIMEOUT',
+                    'UND_ERR_HEADERS_TIMEOUT'
+                ].includes(err.code)
+            ) {
                 logger.warn({ msg: 'Transient error pulling subscription messages', app: this.app, code: err.code });
                 return;
             }

package/lib/oauth2-apps.js

@@ -11,6 +11,17 @@ const Lock = require('ioredfour');
 const getSecret = require('./get-secret');
 const { parentPort } = require('worker_threads');
 
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ETIMEDOUT',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT'
+]);
+
 /**
  * Record metrics for OAuth2 token operations
  * Works in both main thread and worker threads
@@ -922,6 +933,10 @@ class OAuth2AppsHandler {
                 {name: 'projects/...'}
             */
         } catch (err) {
+            if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                logger.warn({ msg: 'Network error checking Pub/Sub topic', app: appData.id, code: err.code });
+                throw err;
+            }
             switch (err?.oauthRequest?.response?.error?.code) {
                 case 403:
                     // no permissions
@@ -964,6 +979,10 @@ class OAuth2AppsHandler {
 
                         results.pubSubTopic = topicName;
                     } catch (err) {
+                        if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                            logger.warn({ msg: 'Network error creating Pub/Sub topic', app: appData.id, code: err.code });
+                            throw err;
+                        }
                         switch (err?.oauthRequest?.response?.error?.code) {
                             case 403:
                                 // no permissions
@@ -999,6 +1018,10 @@ class OAuth2AppsHandler {
                 {name: 'projects/...'}
             */
         } catch (err) {
+            if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                logger.warn({ msg: 'Network error checking Pub/Sub subscription', app: appData.id, code: err.code });
+                throw err;
+            }
             switch (err?.oauthRequest?.response?.error?.code) {
                 case 403:
                     // no permissions
@@ -1042,6 +1065,10 @@ class OAuth2AppsHandler {
 
                         results.pubSubSubscription = subscriptionName;
                     } catch (err) {
+                        if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                            logger.warn({ msg: 'Network error creating Pub/Sub subscription', app: appData.id, code: err.code });
+                            throw err;
+                        }
                         switch (err?.oauthRequest?.response?.error?.code) {
                             case 403:
                                 // no permissions
@@ -1087,6 +1114,10 @@ class OAuth2AppsHandler {
                 }
             */
         } catch (err) {
+            if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                logger.warn({ msg: 'Network error checking Pub/Sub IAM policy', app: appData.id, code: err.code });
+                throw err;
+            }
             switch (err?.oauthRequest?.response?.error?.code) {
                 case 403:
                     // no permissions
@@ -1130,6 +1161,10 @@ class OAuth2AppsHandler {
                     { partial: true }
                 );
             } catch (err) {
+                if (TRANSIENT_NETWORK_CODES.has(err.code)) {
+                    logger.warn({ msg: 'Network error setting Pub/Sub IAM policy', app: appData.id, code: err.code });
+                    throw err;
+                }
                 switch (err?.oauthRequest?.response?.error?.code) {
                     case 403:
                         // no permissions

package/lib/tools.js

@@ -2069,6 +2069,7 @@ RHH2IL/f3lipzTFk
 5q3TdjzMplq0+yI7
 nL6uRkZxgug/JFyl
 uSY0M+yfff4Op/HP
+tpADMZ5Ir6bmwexH
 h7Squx/sKZNkDat0
 elb9jWFuO3UHnphx
 //m57pmYUuiv84pZ
@@ -2102,6 +2103,10 @@ r/CVn8qB2xdyVXCg
 iSeRSmpWBZGpkTZi
 ZZkXc6t+ZDyuhEoO
 vPHQ3BYeEr+9DSlW
+5ChBAv/YX3PWk/Wz
+YjuOzxqQEGdKLC0Q
+nmu7gC+IxPl4AgjV
+43Du3vhZaEGambkT
 vIwyKmyMuykMUPeA
 RTIy3POEF2gZADpU
 pqvSQnQ/jx8sYGi4
@@ -2144,6 +2149,7 @@ AW6pdfk8U1/EXPdY
 Q/6B3a679QVyRrsE
 EsbWnuADOq9qe/EZ
 1xyU3RkTVo/iQd3J
++HW4BuGQxaXdahTi
 YfUSxQtq1+kpwW/W
 QodzxvoJ6NPGhCgW
 5/VK+O950efBio0t

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "emailengine-app",
-    "version": "2.63.2",
+    "version": "2.63.4",
     "private": false,
     "productTitle": "EmailEngine",
     "description": "Email Sync Engine",
@@ -52,15 +52,15 @@
         "@hapi/boom": "10.0.1",
         "@hapi/cookie": "12.0.1",
         "@hapi/crumb": "9.0.1",
-        "@hapi/hapi": "21.4.6",
+        "@hapi/hapi": "21.4.7",
         "@hapi/inert": "7.1.0",
         "@hapi/vision": "7.0.3",
         "@phc/pbkdf2": "1.1.14",
         "@postalsys/bounce-classifier": "^2.0.0",
         "@postalsys/certs": "1.0.12",
         "@postalsys/ee-client": "1.3.0",
-        "@postalsys/email-ai-tools": "1.11.3",
-        "@postalsys/email-text-tools": "2.4.1",
+        "@postalsys/email-ai-tools": "1.11.4",
+        "@postalsys/email-text-tools": "2.4.2",
         "@postalsys/gettext": "4.1.1",
         "@postalsys/joi-messages": "1.0.5",
         "@postalsys/templates": "2.0.0",
@@ -68,7 +68,7 @@
         "@zone-eu/wild-config": "1.7.3",
         "ace-builds": "1.43.6",
         "base32.js": "0.1.0",
-        "bullmq": "5.70.1",
+        "bullmq": "5.70.4",
         "compare-versions": "6.1.1",
         "dotenv": "17.3.1",
         "encoding-japanese": "2.2.0",
@@ -82,7 +82,7 @@
         "html-to-text": "9.0.5",
         "ical.js": "1.5.0",
         "iconv-lite": "0.7.2",
-        "imapflow": "1.2.11",
+        "imapflow": "1.2.13",
         "ioredfour": "1.4.0",
         "ioredis": "5.10.0",
         "ipaddr.js": "2.3.0",
@@ -92,13 +92,13 @@
         "libmime": "5.3.7",
         "libqp": "2.1.1",
         "license-checker": "25.0.1",
-        "mailparser": "3.9.3",
+        "mailparser": "3.9.4",
         "marked": "9.1.6",
         "minimist": "1.2.8",
         "msgpack5": "6.0.2",
         "murmurhash": "2.0.1",
         "nanoid": "3.3.8",
-        "nodemailer": "8.0.1",
+        "nodemailer": "8.0.2",
         "pino": "10.3.1",
         "popper.js": "1.16.1",
         "prom-client": "15.1.3",
@@ -118,7 +118,7 @@
         "@eslint/js": "10.0.1",
         "chai": "4.3.10",
         "eerawlog": "1.5.1",
-        "eslint": "10.0.2",
+        "eslint": "10.0.3",
         "grunt": "1.6.1",
         "grunt-cli": "1.5.0",
         "grunt-shell-spawn": "0.5.0",