imapflow 2.1.2 → 2.2.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [2.2.1](https://github.com/postalsys/imapflow/compare/v2.2.0...v2.2.1) (2026-10-01)
+
+
+### Bug Fixes
+
+* do not enable IMAP4rev2 on Strato RZimapd ([dce30f8](https://github.com/postalsys/imapflow/commit/dce30f86ab5caa8c1d31320d21c16cb73a611a0c)), closes [#411](https://github.com/postalsys/imapflow/issues/411)
+
+## [2.2.0](https://github.com/postalsys/imapflow/compare/v2.1.2...v2.2.0) (2026-10-01)
+
+
+### Features
+
+* let the client choose the hash behind the fallback message id ([0eb74e1](https://github.com/postalsys/imapflow/commit/0eb74e1915b7b568ed137b69d0cfbcce0100679f))
+
 ## [2.1.2](https://github.com/postalsys/imapflow/compare/v2.1.1...v2.1.2) (2026-09-28)
 
 

package/dist/cjs/commands/fetch.js

@@ -182,7 +182,7 @@ async function fetch(connection, range, query, options) {
                     // (useful for large result sets). Otherwise, collect all into messages.list.
                     FETCH: async (untagged) => {
                         messages.count++;
-                        let formatted = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox);
+                        let formatted = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox, connection.idHashAlgorithm);
                         if (typeof options.onUntaggedFetch === 'function') {
                             await new Promise((resolve, reject) => {
                                 options.onUntaggedFetch(formatted, err => {

package/dist/cjs/imap-flow.d.ts

@@ -136,6 +136,8 @@ export declare class ImapFlow extends EventEmitter {
     idling: boolean;
     /** Whether log entries are also emitted as 'log' events, see the `emitLogs` option */
     emitLogs: boolean;
+    /** Hash algorithm for the fallback message id, see `ImapFlowOptions.idHashAlgorithm` */
+    idHashAlgorithm: string;
     /** The personal namespace, from the NAMESPACE command */
     namespace: NamespaceObject | undefined;
     /** Every namespace the server reported */

package/dist/cjs/imap-flow.js

@@ -83,6 +83,12 @@ const RAW_SENSITIVE_COMMANDS = new Set(['LOGIN', 'AUTHENTICATE']);
 // Stand-in payload for a withheld raw client frame. Fixed width, so the entry says nothing
 // about the length of what it replaced.
 const RAW_HIDDEN_PLACEHOLDER = Buffer.from('(* value hidden *)\r\n').toString('base64');
+// Servers, matched by the name in their ID response, that advertise IMAP4rev2 next to
+// IMAP4rev1 and accept ENABLE IMAP4rev2, but misbehave once it is enabled. ENABLE cannot
+// be undone (RFC 5161), so these are kept in IMAP4rev1 mode from the start. Strato's
+// RZimapd (7.1.12, 2026-09) answers every SEARCH in a rev2 session with an ESEARCH
+// response that omits ALL, which reads as "no matches" for any query. Names are lowercase
+const BROKEN_REV2_SERVERS = new Set(['rzimapd']);
 // Whether any attribute of a command is marked as a secret. Recurses into nested lists because
 // the command compiler honors `sensitive` at any depth, and the two must agree on what counts.
 function hasSensitiveAttribute(attributes) {
@@ -285,6 +291,7 @@ class ImapFlow extends node_events_1.EventEmitter {
         this._openDownloads = 0;
         this.missingIdleCommand = (this.options.missingIdleCommand || '').toString().toUpperCase().trim() || 'NOOP';
         this.disableBinary = !!this.options.disableBinary;
+        this.idHashAlgorithm = this.options.idHashAlgorithm || 'md5';
         this.skipListSubscribedArg = false;
         this.skipListStatusArgs = false;
         this.skipListAuxArgs = false;
@@ -1164,6 +1171,12 @@ class ImapFlow extends node_events_1.EventEmitter {
             // re-request ID after LOGIN
             this.idRequested = await this.run('ID', this.clientInfo);
         }
+        let serverName = this.serverInfo?.name;
+        if (!this.skipRev2 && typeof serverName === 'string' && BROKEN_REV2_SERVERS.has(serverName.trim().toLowerCase())) {
+            // Same effect as disableIMAP4rev2, decided before autoEnable() can send the ENABLE
+            this.skipRev2 = true;
+            this.log.info({ msg: 'Not enabling IMAP4rev2, the server is known to answer SEARCH incorrectly in that mode', server: serverName, cid: this.id });
+        }
         // Make sure we have namespace set. This should also throw if Exchange actually failed authentication
         let nsResponse = await this.run('NAMESPACE');
         if (nsResponse && nsResponse.error && nsResponse.status === 'BAD' && /User is authenticated but not connected/i.test(nsResponse.text)) {
@@ -1809,7 +1822,7 @@ class ImapFlow extends node_events_1.EventEmitter {
             // mailbox closed, ignore
             return;
         }
-        let message = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox);
+        let message = await (0, tools_js_1.formatMessageResponse)(untagged, mailbox, this.idHashAlgorithm);
         if (message.flags) {
             let updateEvent = {
                 path: mailbox.path,

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.1.2";
+export declare const version = "2.2.1";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.1.2";
+exports.version = "2.2.1";
 exports.homepage = "https://imapflow.com/";

package/dist/cjs/tools.d.ts

@@ -284,9 +284,10 @@ export declare function getColorFlags(color: string | null | undefined): {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject): Promise<FetchMessageObject>;
+export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject, idHashAlgorithm?: string): Promise<FetchMessageObject>;
 /**
  * Strips surrounding double quotes from a name string.
  *

package/dist/cjs/tools.js

@@ -700,9 +700,10 @@ function getColorFlags(color) {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-async function formatMessageResponse(untagged, mailbox) {
+async function formatMessageResponse(untagged, mailbox, idHashAlgorithm) {
     let map = {};
     // The sequence number indexes into mailbox state, so an unusable one is dropped rather
     // than coerced to NaN or Infinity
@@ -884,13 +885,14 @@ async function formatMessageResponse(untagged, mailbox) {
                 // ignore
             }
         }
-        // Non-cryptographic identifier: MD5 is used only to derive a stable, compact
-        // account-unique id from non-secret data (path:uidValidity:uid). No security
-        // property (collision/preimage resistance, secrecy) is relied upon, so a fast
-        // hash is the appropriate choice here - not a security-sensitive use.
+        // Non-cryptographic identifier: the hash only derives a stable, compact account-unique
+        // id from non-secret data (path:uidValidity:uid). No security property (collision or
+        // preimage resistance, secrecy) is relied upon, so the fast default is MD5; a host whose
+        // OpenSSL runs in FIPS mode has no MD5 and names another algorithm through the client
+        // option, at the price of ids that differ from the default ones
         map.id =
             map.emailId ||
-                (0, node_crypto_1.createHash)('md5')
+                (0, node_crypto_1.createHash)(idHashAlgorithm || 'md5')
                     .update([path, mailbox.uidValidity?.toString() || '', map.uid.toString()].join(':'))
                     .digest('hex');
     }

package/dist/cjs/types.d.ts

@@ -44,6 +44,14 @@ export interface ImapFlowOptions {
     clientInfo?: IdInfoObject | undefined;
     /** If true, then do not start IDLE when connection is established */
     disableAutoIdle?: boolean | undefined;
+    /**
+     * Hash algorithm (any name Node's crypto supports) for the fallback message `id` that is
+     * derived from the mailbox path, UIDVALIDITY and UID when the server provides no email id
+     * through OBJECTID or X-GM-EXT-1. Defaults to `'md5'`, which keeps the ids earlier releases
+     * produced. A host whose OpenSSL runs in FIPS mode does not offer MD5, and has to set a
+     * different one, for example `'sha256'`, which yields a 64 character hex id
+     */
+    idHashAlgorithm?: string | undefined;
     /**
      * How long (in ms) the connection has to be inactive before IDLE is started automatically.
      * Keep it above the pause your own code usually leaves between two commands, otherwise every
@@ -97,7 +105,7 @@ export interface ImapFlowOptions {
     disableBinary?: boolean | undefined;
     /** If true, do not enable supported extensions */
     disableAutoEnable?: boolean | undefined;
-    /** If true, do not enable IMAP4rev2 mode even if the server advertises it, and do not treat the advertisement as support for anything IMAP4rev2 implies, such as the extended LIST syntax */
+    /** If true, do not enable IMAP4rev2 mode even if the server advertises it, and do not treat the advertisement as support for anything IMAP4rev2 implies, such as the extended LIST syntax. Servers known to misbehave in IMAP4rev2 mode (Strato RZimapd, detected from its ID response) are kept out of it without this option */
     disableIMAP4rev2?: boolean | undefined;
     /**
      * How long to wait for a usable transport, covering DNS resolution, proxy negotiation and the

package/dist/esm/commands/fetch.js

@@ -179,7 +179,7 @@ export default async function fetch(connection, range, query, options) {
                     // (useful for large result sets). Otherwise, collect all into messages.list.
                     FETCH: async (untagged) => {
                         messages.count++;
-                        let formatted = await formatMessageResponse(untagged, mailbox);
+                        let formatted = await formatMessageResponse(untagged, mailbox, connection.idHashAlgorithm);
                         if (typeof options.onUntaggedFetch === 'function') {
                             await new Promise((resolve, reject) => {
                                 options.onUntaggedFetch(formatted, err => {

package/dist/esm/imap-flow.d.ts

@@ -136,6 +136,8 @@ export declare class ImapFlow extends EventEmitter {
     idling: boolean;
     /** Whether log entries are also emitted as 'log' events, see the `emitLogs` option */
     emitLogs: boolean;
+    /** Hash algorithm for the fallback message id, see `ImapFlowOptions.idHashAlgorithm` */
+    idHashAlgorithm: string;
     /** The personal namespace, from the NAMESPACE command */
     namespace: NamespaceObject | undefined;
     /** Every namespace the server reported */

package/dist/esm/imap-flow.js

@@ -42,6 +42,12 @@ const RAW_SENSITIVE_COMMANDS = new Set(['LOGIN', 'AUTHENTICATE']);
 // Stand-in payload for a withheld raw client frame. Fixed width, so the entry says nothing
 // about the length of what it replaced.
 const RAW_HIDDEN_PLACEHOLDER = Buffer.from('(* value hidden *)\r\n').toString('base64');
+// Servers, matched by the name in their ID response, that advertise IMAP4rev2 next to
+// IMAP4rev1 and accept ENABLE IMAP4rev2, but misbehave once it is enabled. ENABLE cannot
+// be undone (RFC 5161), so these are kept in IMAP4rev1 mode from the start. Strato's
+// RZimapd (7.1.12, 2026-09) answers every SEARCH in a rev2 session with an ESEARCH
+// response that omits ALL, which reads as "no matches" for any query. Names are lowercase
+const BROKEN_REV2_SERVERS = new Set(['rzimapd']);
 // Whether any attribute of a command is marked as a secret. Recurses into nested lists because
 // the command compiler honors `sensitive` at any depth, and the two must agree on what counts.
 function hasSensitiveAttribute(attributes) {
@@ -244,6 +250,7 @@ export class ImapFlow extends EventEmitter {
         this._openDownloads = 0;
         this.missingIdleCommand = (this.options.missingIdleCommand || '').toString().toUpperCase().trim() || 'NOOP';
         this.disableBinary = !!this.options.disableBinary;
+        this.idHashAlgorithm = this.options.idHashAlgorithm || 'md5';
         this.skipListSubscribedArg = false;
         this.skipListStatusArgs = false;
         this.skipListAuxArgs = false;
@@ -1123,6 +1130,12 @@ export class ImapFlow extends EventEmitter {
             // re-request ID after LOGIN
             this.idRequested = await this.run('ID', this.clientInfo);
         }
+        let serverName = this.serverInfo?.name;
+        if (!this.skipRev2 && typeof serverName === 'string' && BROKEN_REV2_SERVERS.has(serverName.trim().toLowerCase())) {
+            // Same effect as disableIMAP4rev2, decided before autoEnable() can send the ENABLE
+            this.skipRev2 = true;
+            this.log.info({ msg: 'Not enabling IMAP4rev2, the server is known to answer SEARCH incorrectly in that mode', server: serverName, cid: this.id });
+        }
         // Make sure we have namespace set. This should also throw if Exchange actually failed authentication
         let nsResponse = await this.run('NAMESPACE');
         if (nsResponse && nsResponse.error && nsResponse.status === 'BAD' && /User is authenticated but not connected/i.test(nsResponse.text)) {
@@ -1768,7 +1781,7 @@ export class ImapFlow extends EventEmitter {
             // mailbox closed, ignore
             return;
         }
-        let message = await formatMessageResponse(untagged, mailbox);
+        let message = await formatMessageResponse(untagged, mailbox, this.idHashAlgorithm);
         if (message.flags) {
             let updateEvent = {
                 path: mailbox.path,

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.1.2";
+export declare const version = "2.2.1";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.1.2";
+export const version = "2.2.1";
 export const homepage = "https://imapflow.com/";

package/dist/esm/tools.d.ts

@@ -284,9 +284,10 @@ export declare function getColorFlags(color: string | null | undefined): {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject): Promise<FetchMessageObject>;
+export declare function formatMessageResponse(untagged: ImapResponse, mailbox: MailboxObject, idHashAlgorithm?: string): Promise<FetchMessageObject>;
 /**
  * Strips surrounding double quotes from a name string.
  *

package/dist/esm/tools.js

@@ -645,9 +645,10 @@ export function getColorFlags(color) {
  *
  * @param untagged - Parsed untagged IMAP response
  * @param mailbox - Current mailbox state object
+ * @param idHashAlgorithm - Hash for the fallback message id, `md5` unless the client was told otherwise
  * @returns Formatted message object with properties like seq, uid, flags, envelope, etc.
  */
-export async function formatMessageResponse(untagged, mailbox) {
+export async function formatMessageResponse(untagged, mailbox, idHashAlgorithm) {
     let map = {};
     // The sequence number indexes into mailbox state, so an unusable one is dropped rather
     // than coerced to NaN or Infinity
@@ -829,13 +830,14 @@ export async function formatMessageResponse(untagged, mailbox) {
                 // ignore
             }
         }
-        // Non-cryptographic identifier: MD5 is used only to derive a stable, compact
-        // account-unique id from non-secret data (path:uidValidity:uid). No security
-        // property (collision/preimage resistance, secrecy) is relied upon, so a fast
-        // hash is the appropriate choice here - not a security-sensitive use.
+        // Non-cryptographic identifier: the hash only derives a stable, compact account-unique
+        // id from non-secret data (path:uidValidity:uid). No security property (collision or
+        // preimage resistance, secrecy) is relied upon, so the fast default is MD5; a host whose
+        // OpenSSL runs in FIPS mode has no MD5 and names another algorithm through the client
+        // option, at the price of ids that differ from the default ones
         map.id =
             map.emailId ||
-                createHash('md5')
+                createHash(idHashAlgorithm || 'md5')
                     .update([path, mailbox.uidValidity?.toString() || '', map.uid.toString()].join(':'))
                     .digest('hex');
     }

package/dist/esm/types.d.ts

@@ -44,6 +44,14 @@ export interface ImapFlowOptions {
     clientInfo?: IdInfoObject | undefined;
     /** If true, then do not start IDLE when connection is established */
     disableAutoIdle?: boolean | undefined;
+    /**
+     * Hash algorithm (any name Node's crypto supports) for the fallback message `id` that is
+     * derived from the mailbox path, UIDVALIDITY and UID when the server provides no email id
+     * through OBJECTID or X-GM-EXT-1. Defaults to `'md5'`, which keeps the ids earlier releases
+     * produced. A host whose OpenSSL runs in FIPS mode does not offer MD5, and has to set a
+     * different one, for example `'sha256'`, which yields a 64 character hex id
+     */
+    idHashAlgorithm?: string | undefined;
     /**
      * How long (in ms) the connection has to be inactive before IDLE is started automatically.
      * Keep it above the pause your own code usually leaves between two commands, otherwise every
@@ -97,7 +105,7 @@ export interface ImapFlowOptions {
     disableBinary?: boolean | undefined;
     /** If true, do not enable supported extensions */
     disableAutoEnable?: boolean | undefined;
-    /** If true, do not enable IMAP4rev2 mode even if the server advertises it, and do not treat the advertisement as support for anything IMAP4rev2 implies, such as the extended LIST syntax */
+    /** If true, do not enable IMAP4rev2 mode even if the server advertises it, and do not treat the advertisement as support for anything IMAP4rev2 implies, such as the extended LIST syntax. Servers known to misbehave in IMAP4rev2 mode (Strato RZimapd, detected from its ID response) are kept out of it without this option */
     disableIMAP4rev2?: boolean | undefined;
     /**
      * How long to wait for a usable transport, covering DNS resolution, proxy negotiation and the

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.1.2",
+    "version": "2.2.1",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -72,13 +72,13 @@
         "c8": "12.0.0",
         "eslint": "10.11.0",
         "eslint-config-prettier": "10.1.8",
-        "globals": "17.12.0",
+        "globals": "17.13.0",
         "prettier": "3.9.9",
         "tsx": "4.23.15",
         "types-node-legacy": "npm:@types/node@20.0.0",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.70.1",
-        "wrangler": "4.142.0"
+        "typescript-eslint": "8.71.0",
+        "wrangler": "4.145.0"
     },
     "dependencies": {
         "@zone-eu/mailsplit": "5.4.19",