LoginSign Up
← Back to all sparks
P

Proton Bridge

COMMS
Velocity5.0

Encrypted email bridge connecting Proton Mail to desktop email clients

proton.me/mail/bridge ↗

Proton Bridge is in pure maintenance: security patches and RFC compliance fixes dominate 2026

email-privacyimapsecurity-maintenanceproton
◆Current state
Proton Bridge has shipped six releases since February, none of which introduce user-visible features. The work is security vulnerability patching (August 2026 CVEs), RFC3501 IMAP compliance fixes, Go toolchain upgrades, and bug fixes in the Gluon IMAP server component. The v3.24.0 cycle added IMAP connection limiting and buffer pooling for message decryption — the most substantive user-affecting work in the reviewed period.
◆Where it's heading
Proton Bridge is in a sustain phase. The Gluon subsystem is getting more robust error reporting, CPU/memory bounds on the RFCP parser, and feature flags for controlled rollouts — signals of hardening a component that has historically caused reliability issues. No new end-user capabilities are visible in the roadmap from the changelog alone.
◆Prediction
The next release will likely be another security or compatibility patch. Meaningful feature expansion would require Proton to signal a direction change for Bridge publicly, and nothing in this changelog points toward one.

◆Recent moves

  1. 7d ago

    Security patches and RFC3501 IMAP compliance fixes

    v3.27.0 patches August 2026 vulnerabilities and fixes several IMAP correctness issues: RFC3501-compliant body-fld-enc and body-fld-param responses, a SQL table bug in UpdateRemoteMessageID, and chunked ID handling in RemoveMessagesFromMailbox. Maintenance work consistent with the year's pattern.

    View source ↗
  2. 1mo ago

    macOS 27 crash fix, vulnerability patches, Go 1.26.4 toolchain

    v3.26.0 patches July 2026 vulnerabilities, fixes a macOS 27 crash, and updates the Go toolchain to 1.26.4. The HV request environment fix and structural literal comparison fallback are correctness improvements that won't be noticeable in normal use.

    View source ↗
  3. 3mo ago

    Vulnerability patches, toolchain update, legacy code removal

    v3.25.0 patches March 2026 vulnerabilities, updates the Go toolchain, and removes legacy code (old versioner, stale feature flags). Attachment filename sanitization in debug mode and a MIME boundary generation fix are the only user-adjacent changes.

    View source ↗
  4. 4mo ago

    Go base image update to Debian Bullseye

    v3.24.2 updates the Go base image to Debian Bullseye. Single-line changelog entry; no user impact.

    View source ↗
  5. 4mo ago

    Restore previous IMAP unlabel endpoint behind feature flag

    v3.24.1 restores old endpoint logic for IMAP unlabeling under a feature flag, reverting a behavior change that broke workflows in some configurations. Pure regression fix.

    View source ↗
  6. 5mo ago

    IMAP connection limiting and message decryption buffer pooling

    v3.24.0 adds IMAP connection limiting (via a Gluon builder option), buffer pooling for message building and decryption, and Go 1.26.1. The buffer pooling is the only change with direct user impact: it improves throughput for clients with high message volumes, and was the most substantive release in the February–September window.

    View source ↗