Piler releases

Scanner 1.3.1

Fri, 23 Oct 2026 00:00:00 +0000

Fixed

The scanner ignored PILER_STORE_DIR and PILER_ASTORE_DIR when it read the emails from the store directly: it always used /var/piler/store/<server id>, and looked for the attachments in the wrong directory. It uses the configured directories now.
PILER_STORE_DIR without a trailing slash (e.g. /srv/piler/store) gave a wrong store path, and no email could be read.
SEMANTIC_SEARCH_MAX_TOKENS limited the email body in bytes, not characters, so a Hebrew or Cyrillic email got about half the text of an English one, and the cut could split a character. Emails embedded earlier keep their embeddings until they are embedded again, e.g. by running the scanner with -backfill.

Changed

The scanner logs a warning when it reads the emails through retrieverd (RETRIEVER_METHOD=socket), which is not recommended and will be phased out.

[Security] piler-smtp 1.1.7

Sun, 18 Oct 2026 00:00:00 +0000

Security

Improved verification of the licensed hostname.

Fixed

In multi-tenant mode, a recipient piler-smtp rejects gets a permanent error (550) instead of a temporary one, so the sending server doesn't keep retrying it.

[Security] piler-ee 2.2.4

Sat, 17 Oct 2026 00:00:00 +0000

2.2.3 was not released; its changes are included here.

Added

Outlook add-in (off by default, OUTLOOK_ADDIN_ENABLED): search the archive, preview a message, read the full message and restore it to the mailbox from Outlook on the web, new Outlook for Windows, classic Outlook and Outlook for Mac. Served by piler-ui itself; the add-in asks Outlook for the lowest permission and reads nothing of the mailbox. See Outlook add-in.
Bcc recipients from the SMTP envelope: piler-smtp can write the envelope of each email to an envelope file (enable_envelope_sidecar), and the envelope recipients are archived like the To and Cc ones, so a Bcc recipient finds the email. A copy of an email delivered in another SMTP transaction adds its recipients to the archived email (ENVELOPE_MERGE_WINDOW_HOURS). See Envelope recipients.
Envelope sender: recorded for each email; auditors see it in the message view, with a warning when it differs from the From header, and can search by it (mailfrom:, "Envelope sender" field).
EXTRA_RECIPIENTS_HEADER: archive the addresses of a header added by the MTA or the journaling setup (e.g. X-Envelope-To) as recipients.
ARCHIVE_MESSAGE_VARIANTS: a message with the Message-ID of an archived one but different content is archived as a message of its own instead of being dropped as a duplicate. Auditors see the other messages with the same Message-ID as related copies, also across the nodes of a multi-node setup.
pilerimport and Bcc recipients of migrated mail: an envelope file next to an EML (message.eml.env) adds its recipients; -add-recipients (with -dry-run) adds them to mail imported earlier, without importing it again. Every message that gets recipients has an audit log entry, also sent to the SIEM when SIEM export is enabled.
POST /api/v1/message/lookup: find an archived message by its Message-ID, also on the master of a multi-node setup.

Security

Per-message access checks extended to exports, similar messages, related attachments, bulk removal and message categories, matching the checks of search and the message view.
API access tokens carry the user's category and group restrictions, so API clients and multi-node workers see the same messages as the web UI.
AI thread summaries only include, and only share between users, the messages of the thread the user may see.
A removed message (by the user, a data officer or a GDPR erasure) stays out of the search until it's purged, also when a copy of it arrives again or pilerimport processes it.
pilerimport installed setuid takes its configuration only from its protected configuration file, not from the caller's environment.
API requests with a Bearer token no longer create a server-side session.

Changed

pilerimport honours ARCHIVE_MESSAGE_VARIANTS and SPAM_HEADER_LINE like the piler daemon.
The "Top Attachment Types" analytics widget is labelled as a cumulative total of all archived attachments.
More data-* customization hooks on the Search and Audit Log pages; accessibility and HTML markup fixes.
Upgraded frontend dependencies (Vue, axios, DOMPurify).

Fixed

Duplicates left an orphaned encrypted message file in the store (and in the S3 bucket); new duplicates no longer do.
A message whose search index write failed stayed archived but unsearchable; a later copy of it now restores its index entry.
Copies of a message arriving at the same moment could both be archived.
Ingest deadlocks between the analytics sync and concurrent archiving (e.g. pilerimport failing with "Deadlock found").
Emails whose To header lists several addresses inside one pair of angle brackets ended up in the error directory; an unusable address in To/Cc is now skipped and logged instead of failing the email.
IMAP logins with Mailcow lost the user's local group addresses.
Multi-node: removal requests and the data officer's approval or rejection now take effect on the worker that has the message; restore and the message view report the worker's errors instead of returning an empty or wrong result.
The thread indicator could be missing for regular users in long threads.
A purged message answers "the message has been purged" instead of an error.
Upgrading from 1.x: migration 005 failed with "Illegal mix of collations" on some MariaDB versions, and the deb package left the obsolete 1.x configuration files behind, blocking the piler-smtp installation.

piler-smtp 1.1.6

Sat, 17 Oct 2026 00:00:00 +0000

Fixed

An archive address encoded again by the mail server is no longer recorded as an envelope recipient. This happens when the mail server's archiving rules also run for the archive copies they added (seen with Axigen Acceptance & Routing rules). The address is logged, and the email is still archived with its other recipients.

piler-smtp 1.1.5

Tue, 13 Oct 2026 00:00:00 +0000

Fixed

The ownership of /var/piler set by the deb package's post-install script.

[Security] piler-smtp 1.1.4

Wed, 07 Oct 2026 00:00:00 +0000

Added

Envelope files (enable_envelope_sidecar, off by default): the envelope of each email is written to a .env file next to it, with the envelope sender and the envelope recipients encoded in the archive address (<tenant>+<local part>=<domain>@<archive host>), so that Bcc recipients can be archived. See Envelope recipients. Needs Piler Enterprise 2.2.4 or later.

Security

Hardened the SMTP input handling: limits on lines without a line ending, correct handling of BDAT chunks (with enable_chunking=1), bare LF line endings and NUL bytes in the message.

Scanner 1.3.0

Sun, 27 Sep 2026 00:00:00 +0000

Changed

The ML phishing detector no longer depends on a native runtime library or CGO - it's now a fully static, dependency-free Go binary. This makes the scanner image smaller, faster to build, and easier to deploy across architectures.
Retrained the phishing-detection model on a substantially larger and more diverse set of examples. Internal testing shows a meaningful reduction in false positives (legitimate email incorrectly flagged) versus the previous model, with no loss in detection rate.
Simplified the scanner's Docker image build to a prebuilt-binary copy, matching the main application image's build process.

[Security] piler-ee 2.2.2

Tue, 22 Sep 2026 00:00:00 +0000

Security

Upgraded grpc and go.opentelemetry.io/otel to address CVE-2026-84304 and related CVEs

Added

Per-message delete action in the preview pane
Stable HTML customization hooks (data-* attributes) for MSP frontend integration
Multi-node support for user email purge

Changed

piler-ui Docker image build simplified to a prebuilt-binary copy (matches the pattern later applied to the scanner image)
Manticore search engine upgraded to 29.9.0
Message selection: Ctrl/Cmd+click for single-message selection, Shift+click for range selection

Fixed

Table content clipping in dashboard cards
Bogus sort order in multinode search results
Regular users seeing 0 search results in multinode mode
Timezone validation failing on Alpine runtime images (IANA tzdata now embedded rather than relying on the host OS)
Unmounted Vue templates briefly flashing placeholder content (v-cloak)
Trailing boundary CRLF in attachment MIME parts incorrectly flagged as invalid
False-positive attachment size mismatch logging for base64-encoded attachments
S3 promotion window returning an empty 200 instead of 503

[Security] piler-ee 2.2.1

Sun, 06 Sep 2026 00:00:00 +0000

Security

Upgraded nanoid to 3.3.18 to fix CVE-2026-67213 (high severity)

Added

S3_SKIP_EXISTING_OBJECTS to skip re-uploading objects already present across nodes
S3_PART_SIZE_MB and S3_DISABLE_MULTIPART knobs for s3uploader
purge --restore-id for restoring a specific prior purge run; PACKAGES.md documenting package build/signing

Changed

Dockerfiles upgraded to alpine:3.24; audit log table gained stable CSS identifiers for MSP customization
RPM_RELEASE override for RPM packaging; fixed dpkg-sig removal on package updates

Fixed

Fixed a tenant-configuration bug that could cause scheduled purges to be skipped
Nested-multipart attachments misindexed in pilerimport; mismatched download objects now caught explicitly
Five distinct archiving bugs: duplicate detection, purge tombstone handling, From header overflow, enable_purge flag handling, and an attachment-processing race condition
Purge command: tombstone restore, recipient preservation, dry-run loop behavior, missing-env-var warning

piler-smtp 1.1.3

Tue, 01 Sep 2026 00:00:00 +0000

Added

Packages for Ubuntu 26.04.

Fixed

A deadline for every connection that sending a byte now and then can't extend, and a limit on the connections from one IP address, so one client can no longer keep others from connecting.
With smtp_access_list=1, an empty or unreadable access list now rejects every client instead of allowing all of them.
Package dependencies.

piler-ee 2.2.0

Sun, 16 Aug 2026 00:00:00 +0000

Changed

Semantic search embeddings: replaced in-process ONNX embedding generation with calls to an external, OpenAI-compatible HTTP endpoint (SEMANTIC_SEARCH_ENDPOINT_URL); piler-ui image switched to an Alpine base as a result (no longer needs ONNX Runtime/CGO)

Added

OX (Open-Xchange) webmail integration: theme, language, timezone, and iframe CSS synchronization

Fixed

Session cookie expiry handled incorrectly in some flows; dompurify upgraded alongside the fix
Multi-tenant provisioning; tenant GUI URL not hot-reloading after change
OAuth2 configs being rebuilt per-request instead of cached in multi-tenant mode
Health page's "received messages" chart rendering incorrectly

Scanner 1.2.0

Sun, 16 Aug 2026 00:00:00 +0000

Changed

Semantic search embeddings are computed by an external, OpenAI-compatible endpoint (SEMANTIC_SEARCH_ENDPOINT_URL, e.g. Ollama) instead of in-process ONNX models. The model is your choice; see Semantic search.

[Security] piler-ee 2.1.5

Sun, 26 Jul 2026 00:00:00 +0000

Security

grpc bumped to v1.82.1 to fix security vulnerabilities
gofiber and golang.org/x/net upgraded (security-motivated)
dompurify 3.4.11 → 3.4.12

Added

Pending conversations: badge in search results plus a dedicated drawer for messages awaiting a reply
Attachment indexing gated on TIKA_URL being configured, rather than always-on
Explicit Dependabot workflow for automated dependency PRs
Standby-node support for import jobs; multi-node import handling
Theme and accent-color support carried over from EAM authentication

Changed

Build tooling switched from the previous bundler to Vite (and bumped several times through the 6.4→8.1 series as issues were found); iframe session cookie set to SameSite=None for embedding scenarios; listens for a postMessage theme-change event from a parent iframe
Import job handling simplified

Fixed

Email direction now computed per-message from the local domain table, rather than a possibly-stale cached value
c.IP() captured before entering a goroutine in ZipAndStreamDownloadRemote (was reading a request-scoped value after the request had already returned)
Multi-node export; mobile screen layout issues; vendor CSS handling under the Vite build; header parser edge case; several import/migration fixes; purge logging

Dependencies

Routine bumps: vue 3.5.38→3.5.39, postcss 8.5.16→8.5.23, axios 1.18.0→1.18.1, @vitejs/plugin-vue 5.2.4→6.0.7, plus a batch of GitHub Actions version bumps (actions/checkout, actions/setup-go, actions/setup-python, actions/upload-artifact, actions/download-artifact, docker/setup-buildx-action, docker/setup-qemu-action, docker/login-action, docker/metadata-action, softprops/action-gh-release)

piler-ee 2.1.4

Tue, 09 Jun 2026 00:00:00 +0000

Added

Standalone importer web app (cmd/import UI)
ANALYTICS_ENABLED environment variable
Rate limiting on authentication endpoints (security hardening)

Changed

All config keys now registered with viper regardless of whether a default is empty, so they can still be overridden via environment variables

Fixed

Microsoft 365 journal processing
LDAP authentication edge case
Header/footer branding logo display
serverId evaluation lacking a safety check
Import job responses missing the id field on creation
Purge endpoint failing on already-deleted emails
Background job SQL queries
Extremely long Message-ID/attachment filenames not handled correctly
chown command incorrect in package install scripts

Dependencies

gofiber/fiber 2.52.12 → 2.52.13 (main app and contrib/external-jwt-shared-secret)
Azure/go-ntlmssp bumped

piler-ee 2.1.3

Thu, 09 Apr 2026 00:00:00 +0000

Added

SHOW_IMPORT_MENU configuration option
NIS2 compliance documentation

Changed

Manticore upgraded to 25.0.0 in tests and the installer

Fixed

Swagger/OpenAPI docs generation

Dependencies

go.opentelemetry.io/otel/sdk 1.40.0 → 1.43.0
russellhaering/goxmldsig 1.4.0 → 1.6.0
google.golang.org/grpc 1.72.1 → 1.79.3

[Security] piler-ee 2.1.2

Sun, 15 Mar 2026 00:00:00 +0000

The largest release in this window - unified archiving for chat platforms, GDPR right-to-erasure, passkey authentication, multi-master-node HA, and a round of gosec-driven security hardening.

Security

Passkey (WebAuthn) authentication support added
gosec static-analysis fixes applied across reindex, imapimport, pilerimport, and s3uploader
TLS support added for the MySQL connection
Added additional iframe-embedding security headers
Sensitive SIEM connection details no longer appear in logs

Added

Slack and Microsoft Teams collectors: initial unified-archiving support for chat platforms, including a parallelized Slack collector and dedicated UI/API components
GDPR Right to Erasure: multi-node-aware implementation
Find similar messages: KNN vector search over message embeddings
Multi-master-node support (previously single-master architecture)
IMAP import checkpoint/resume support: connection details and progress are persisted so long-running imports can resume after an interruption
Swagger/OpenAPI documentation for the admin API
Attachment search, with flat mode made the default
SEMANTIC_SEARCH_ONNX_THREADS configuration option
SIEM Sumo Logic support

Changed

Metadata/attachment inserts now use a database transaction
ediscovery exports now emit an audit log entry
Purge performance improvements

Fixed

Deb packaging issue; API auth edge case; cron entry handling; various migration/import fixes

Dependencies

gofiber/fiber bumped in contrib/external-jwt-shared-secret; go.opentelemetry.io/otel/sdk 1.36.0 → 1.40.0; gofiber/fiber 2.52.11 → 2.52.12; filippo.io/edwards25519 1.1.0 → 1.1.1

piler-smtp 1.1.2

Mon, 12 Jan 2026 00:00:00 +0000

Fixed

Session handling.
arm64 deb package build.

piler-ee 2.1.1

Sat, 13 Dec 2025 00:00:00 +0000

Added

SIEM support
install.sh bare-metal installer script

Changed

Microsoft Teams collector updates

Dependencies

gofiber/utils bumped to 1.2.0