SECURITY Signal 56
Thunderbird 156 adds custom OAuth for POP3 and new enterprise policies
↗
Mozilla Thunderbird 156 introduces custom OAuth support for POP3 accounts, adds three new enterprise management policies, and resolves numerous bugs in IMAP, POP3, attachments, and calendar handling.
The addition of custom OAuth for POP3 expands authentication options for users relying on non-standard or self-hosted mail servers. New enterprise policies give administrators finer control over update settings, data collection, and message forwarding, which is critical for compliance in corporate environments. The extensive list of fixes for attachment handling and IMAP performance addresses specific operational pain points for heavy users.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Custom OAuth support is now available for POP3 accounts, allowing the use of issuer IDs and client secrets.
Three new enterprise policies have been added to disable update settings, lock data collection preferences, and stop automatic message forwarding filters.
The release fixes issues with PDF attachments, IMAP performance with large folders, and CalDAV invitation handling.
THE READ
What the cluster adds up to.
Thunderbird 156 shifts focus toward enterprise manageability and broader authentication flexibility. The introduction of custom OAuth for POP3 is a significant change, as it allows configurations to use an issuer ID and client secret, a feature previously more common in IMAP setups. This change directly impacts users who rely on POP3 for mail retrieval but require modern, token-based authentication methods rather than simple password entry.
For system administrators, the release introduces three specific policies that alter how the client behaves in managed environments. DisableUpdateSettings prevents users from modifying update preferences, DisableDataCollectionSettings locks data collection options, and DisableMessageForwardingFilters stops message filters from automatically forwarding messages. These controls address common security and compliance concerns by limiting user-level configuration changes that could bypass organizational policies.
The bulk of the release consists of stability fixes for core mail-handling functions. Notable corrections include resolving an issue where opening a PDF attachment resulted in an empty tab and fixing a bug where PDFs added from the compose window were misidentified as HTML. Additionally, attachment management operations like Save All and Detach All no longer fail after a single attachment is deleted, and links to detached attachments are no longer truncated when folder paths contain ampersands.
Performance and synchronization issues in IMAP and POP3 have also been addressed. IMAP improvements target performance with large folder collections and correct subfolder subscription errors, while POP3 fixes resolve duplicate long-named folders and issues with marking messages as new. For Exchange users, the release ensures that custom OAuth setup works correctly and that unsupported EWS archive folders no longer block mailbox synchronization.
The update also includes corrections for OpenPGP, S/MIME, and calendar functionality. OpenPGP signing with external GnuPG now works even when the primary key cannot sign, and remote content is prevented from loading inside encrypted messages opened from files. Calendar fixes address duplicate invitations caused by capitalization differences in CalDAV email addresses and ensure accepted invitations are stored in the correct calendar.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER