imapflow 2.1.1 → 2.2.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [2.2.0](https://github.com/postalsys/imapflow/compare/v2.1.2...v2.2.0) (2026-10-01)
+
+
+### Features
+
+* let the client choose the hash behind the fallback message id ([0eb74e1](https://github.com/postalsys/imapflow/commit/0eb74e1915b7b568ed137b69d0cfbcce0100679f))
+
+## [2.1.2](https://github.com/postalsys/imapflow/compare/v2.1.1...v2.1.2) (2026-09-28)
+
+
+### Bug Fixes
+
+* **deps:** update libmime to 5.4.6 and mailsplit to 5.4.19 ([f6afb32](https://github.com/postalsys/imapflow/commit/f6afb32cbb1df43993a1df2cbd003e013bc10fa8))
+
 ## [2.1.1](https://github.com/postalsys/imapflow/compare/v2.1.0...v2.1.1) (2026-09-28)
 
 

package/dist/cjs/commands/fetch.js

@@ -182,7 +182,7 @@ async function fetch(connection, range, query, options) {
                     // (useful for large result sets). Otherwise, collect all into messages.list.
                     FETCH: async (untagged) => {
                         messages.count++;
-                        let formatted = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox);
+                        let formatted = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox, connection.idHashAlgorithm);
                         if (typeof options.onUntaggedFetch === 'function') {
                             await new Promise((resolve, reject) => {
                                 options.onUntaggedFetch(formatted, err => {

package/dist/cjs/imap-flow.d.ts

@@ -136,6 +136,8 @@ export declare class ImapFlow extends EventEmitter {
     idling: boolean;
     /** Whether log entries are also emitted as 'log' events, see the `emitLogs` option */
     emitLogs: boolean;
+    /** Hash algorithm for the fallback message id, see `ImapFlowOptions.idHashAlgorithm` */
+    idHashAlgorithm: string;
     /** The personal namespace, from the NAMESPACE command */
     namespace: NamespaceObject | undefined;
     /** Every namespace the server reported */

package/dist/cjs/imap-flow.js

@@ -285,6 +285,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         this._openDownloads = 0;
         this.missingIdleCommand = (this.options.missingIdleCommand || '').toString().toUpperCase().trim() || 'NOOP';
         this.disableBinary = !!this.options.disableBinary;
+        this.idHashAlgorithm = this.options.idHashAlgorithm || 'md5';
         this.skipListSubscribedArg = false;
         this.skipListStatusArgs = false;
         this.skipListAuxArgs = false;
@@ -1809,7 +1810,7 @@ class ImapFlow extends node_events_1.EventEmitter {
             // mailbox closed, ignore
             return;
         }
-        let message = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox);
+        let message = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox, this.idHashAlgorithm);
         if (message.flags) {
             let updateEvent = {
                 path: mailbox.path,

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.1.1";
+export declare const version = "2.2.0";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.1.1";
+exports.version = "2.2.0";
 exports.homepage = "https://imapflow.com/";

package/dist/cjs/tools.d.ts

@@ -284,9 +284,10 @@ export declare function getColorFlags(color: string | null | undefined): {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject): Promise<FetchMessageObject>;
+export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject, idHashAlgorithm?: string): Promise<FetchMessageObject>;
 /**
  * Strips surrounding double quotes from a name string.
  *

package/dist/cjs/tools.js

@@ -700,9 +700,10 @@ function getColorFlags(color) {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-async function formatMessageResponse(untagged, mailbox) {
+async function formatMessageResponse(untagged, mailbox, idHashAlgorithm) {
     let map = {};
     // The sequence number indexes into mailbox state, so an unusable one is dropped rather
     // than coerced to NaN or Infinity
@@ -884,13 +885,14 @@ async function formatMessageResponse(untagged, mailbox) {
                 // ignore
             }
         }
-        // Non-cryptographic identifier: MD5 is used only to derive a stable, compact
-        // account-unique id from non-secret data (path:uidValidity:uid). No security
-        // property (collision/preimage resistance, secrecy) is relied upon, so a fast
-        // hash is the appropriate choice here - not a security-sensitive use.
+        // Non-cryptographic identifier: the hash only derives a stable, compact account-unique
+        // id from non-secret data (path:uidValidity:uid). No security property (collision or
+        // preimage resistance, secrecy) is relied upon, so the fast default is MD5; a host whose
+        // OpenSSL runs in FIPS mode has no MD5 and names another algorithm through the client
+        // option, at the price of ids that differ from the default ones
         map.id =
             map.emailId ||
-                (0, node_crypto_1.createHash)('md5')
+                (0, node_crypto_1.createHash)(idHashAlgorithm || 'md5')
                     .update([path, mailbox.uidValidity?.toString() || '', map.uid.toString()].join(':'))
                     .digest('hex');
     }

package/dist/cjs/types.d.ts

@@ -44,6 +44,14 @@ export interface ImapFlowOptions {
     clientInfo?: IdInfoObject | undefined;
     /** If true, then do not start IDLE when connection is established */
     disableAutoIdle?: boolean | undefined;
+    /**
+     * Hash algorithm (any name Node's crypto supports) for the fallback message `id` that is
+     * derived from the mailbox path, UIDVALIDITY and UID when the server provides no email id
+     * through OBJECTID or X-GM-EXT-1. Defaults to `'md5'`, which keeps the ids earlier releases
+     * produced. A host whose OpenSSL runs in FIPS mode does not offer MD5, and has to set a
+     * different one, for example `'sha256'`, which yields a 64 character hex id
+     */
+    idHashAlgorithm?: string | undefined;
     /**
      * How long (in ms) the connection has to be inactive before IDLE is started automatically.
      * Keep it above the pause your own code usually leaves between two commands, otherwise every

package/dist/esm/commands/fetch.js

@@ -179,7 +179,7 @@ export default async function fetch(connection, range, query, options) {
                     // (useful for large result sets). Otherwise, collect all into messages.list.
                     FETCH: async (untagged) => {
                         messages.count++;
-                        let formatted = await formatMessageResponse(untagged, mailbox);
+                        let formatted = await formatMessageResponse(untagged, mailbox, connection.idHashAlgorithm);
                         if (typeof options.onUntaggedFetch === 'function') {
                             await new Promise((resolve, reject) => {
                                 options.onUntaggedFetch(formatted, err => {

package/dist/esm/imap-flow.d.ts

@@ -136,6 +136,8 @@ export declare class ImapFlow extends EventEmitter {
     idling: boolean;
     /** Whether log entries are also emitted as 'log' events, see the `emitLogs` option */
     emitLogs: boolean;
+    /** Hash algorithm for the fallback message id, see `ImapFlowOptions.idHashAlgorithm` */
+    idHashAlgorithm: string;
     /** The personal namespace, from the NAMESPACE command */
     namespace: NamespaceObject | undefined;
     /** Every namespace the server reported */

package/dist/esm/imap-flow.js

@@ -244,6 +244,7 @@ export class ImapFlow extends EventEmitter {
         this._openDownloads = 0;
         this.missingIdleCommand = (this.options.missingIdleCommand || '').toString().toUpperCase().trim() || 'NOOP';
         this.disableBinary = !!this.options.disableBinary;
+        this.idHashAlgorithm = this.options.idHashAlgorithm || 'md5';
         this.skipListSubscribedArg = false;
         this.skipListStatusArgs = false;
         this.skipListAuxArgs = false;
@@ -1768,7 +1769,7 @@ export class ImapFlow extends EventEmitter {
             // mailbox closed, ignore
             return;
         }
-        let message = await formatMessageResponse(untagged, mailbox);
+        let message = await formatMessageResponse(untagged, mailbox, this.idHashAlgorithm);
         if (message.flags) {
             let updateEvent = {
                 path: mailbox.path,

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.1.1";
+export declare const version = "2.2.0";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.1.1";
+export const version = "2.2.0";
 export const homepage = "https://imapflow.com/";

package/dist/esm/tools.d.ts

@@ -284,9 +284,10 @@ export declare function getColorFlags(color: string | null | undefined): {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject): Promise<FetchMessageObject>;
+export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject, idHashAlgorithm?: string): Promise<FetchMessageObject>;
 /**
  * Strips surrounding double quotes from a name string.
  *

package/dist/esm/tools.js

@@ -645,9 +645,10 @@ export function getColorFlags(color) {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-export async function formatMessageResponse(untagged, mailbox) {
+export async function formatMessageResponse(untagged, mailbox, idHashAlgorithm) {
     let map = {};
     // The sequence number indexes into mailbox state, so an unusable one is dropped rather
     // than coerced to NaN or Infinity
@@ -829,13 +830,14 @@ export async function formatMessageResponse(untagged, mailbox) {
                 // ignore
             }
         }
-        // Non-cryptographic identifier: MD5 is used only to derive a stable, compact
-        // account-unique id from non-secret data (path:uidValidity:uid). No security
-        // property (collision/preimage resistance, secrecy) is relied upon, so a fast
-        // hash is the appropriate choice here - not a security-sensitive use.
+        // Non-cryptographic identifier: the hash only derives a stable, compact account-unique
+        // id from non-secret data (path:uidValidity:uid). No security property (collision or
+        // preimage resistance, secrecy) is relied upon, so the fast default is MD5; a host whose
+        // OpenSSL runs in FIPS mode has no MD5 and names another algorithm through the client
+        // option, at the price of ids that differ from the default ones
         map.id =
             map.emailId ||
-                createHash('md5')
+                createHash(idHashAlgorithm || 'md5')
                     .update([path, mailbox.uidValidity?.toString() || '', map.uid.toString()].join(':'))
                     .digest('hex');
     }

package/dist/esm/types.d.ts

@@ -44,6 +44,14 @@ export interface ImapFlowOptions {
     clientInfo?: IdInfoObject | undefined;
     /** If true, then do not start IDLE when connection is established */
     disableAutoIdle?: boolean | undefined;
+    /**
+     * Hash algorithm (any name Node's crypto supports) for the fallback message `id` that is
+     * derived from the mailbox path, UIDVALIDITY and UID when the server provides no email id
+     * through OBJECTID or X-GM-EXT-1. Defaults to `'md5'`, which keeps the ids earlier releases
+     * produced. A host whose OpenSSL runs in FIPS mode does not offer MD5, and has to set a
+     * different one, for example `'sha256'`, which yields a 64 character hex id
+     */
+    idHashAlgorithm?: string | undefined;
     /**
      * How long (in ms) the connection has to be inactive before IDLE is started automatically.
      * Keep it above the pause your own code usually leaves between two commands, otherwise every

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.1.1",
+    "version": "2.2.0",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -81,12 +81,12 @@
         "wrangler": "4.142.0"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.18",
+        "@zone-eu/mailsplit": "5.4.19",
         "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
-        "libbase64": "1.3.0",
-        "libmime": "5.4.5",
-        "libqp": "2.1.1",
+        "libbase64": "1.3.1",
+        "libmime": "5.4.6",
+        "libqp": "2.1.2",
         "pino": "10.3.1",
         "socks": "2.8.10"
     },