Libraesva EA v26.5: Release Notes

Major features

This release introduces a comprehensive set of enhancements designed to elevate the Archiver platform across administration, performance, compliance, and user experience. The redesigned administration interface streamlines daily operations, while the next-generation indexing engine delivers measurable gains in speed and reliability. Expanded connector diagnostics provide deeper visibility into data flows, and new compliance controls ensure alignment with stringent regulatory requirements. Collectively, these improvements empower organizations to manage their archiving infrastructure with greater efficiency, confidence, and control.

Administration experience overhaul

The administration interface has been fully redesigned to reduce operational friction and improve execution speed.

Navigation has been simplified through a restructured menu hierarchy, enabling faster access to core areas and minimizing context switching. Contextual page descriptions are now embedded across the UI to clarify intent and available actions at the point of use.

A new in-app documentation panel provides contextual guidance without leaving the workflow, with direct access to full documentation when deeper detail is required. The result is a more predictable and efficient administrative experience, especially in complex environments.

Next-generation indexing engine

The indexing engine has been upgraded to a new generation architecture, delivering measurable improvements in performance, stability, and scalability.

Index maintenance has been optimized to reduce fragmentation and sustain consistent query performance over time, particularly in high-update scenarios. This results in more predictable latency and improved reliability under load.

Secondary indexing is now supported. These indexes reduce scan depth during query planning, allowing the engine to target relevant data subsets more efficiently. This significantly improves filtering performance and lowers resource consumption for large datasets.

Connector intelligence and diagnostics

Connector observability has been significantly expanded to improve transparency and troubleshooting.

A consolidated cleaning rules report provides a complete view of all configured rules per connector, simplifying audits and validation of data processing policies.

A new synchronization report delivers per-user visibility into sync status, including support state, progress, timing metrics, and detailed error reporting. In parallel, a summary view aggregates synchronization status across all users, enabling rapid identification of inconsistencies.

Connector-level statistics now include cleaning time metrics, offering direct insight into processing cost and performance trends over time.

Log retention and compliance controls (GDPR-aligned)

Log management has been extended to support stricter compliance and traceability requirements.

Archiver now tracks log and backup files with precise creation timestamps, improving auditability. Retention policies have been extended to log volumes, with a default duration of one year, and are automatically enforced across existing environments.

Audit log management has been formalized. User-generated actions on their own accounts (e.g., login, search) can be selectively removed, while all other events are preserved to maintain audit integrity.

The UI now supports granular filtering of audit events, and retention policies can be configured per tenant, enabling tailored compliance strategies while maintaining a one-year default baseline.

Advanced search with legal hold and retention policies

A new administrative search mode introduces full visibility into legal hold and retention policy enforcement.

Administrators can query emails matched by specific legal hold or retention rules, including combined filters across multiple policies. This enables precise identification of:

• Data protected from deletion due to legal hold
• Data scheduled for deletion under retention policies
• Overlaps between policy scopes

This capability provides a practical tool for compliance validation, risk assessment, and proactive data lifecycle management.

Deduplication for Microsoft 365 journaling involving groups

Journaling deduplication support has been extended to fully leverage Microsoft 365 group metadata, improving both data coverage and storage efficiency.

Journaling messages for M365 groups now include group membership details. Archiver extracts this information and correctly associates messages with all relevant users within the group, ensuring complete and accurate archiving.

In parallel, a background synchronization process updates group composition on an hourly basis. This ensures alignment with Microsoft 365 and maintains consistency over time.

Combined with enhanced metadata from journaling, this system significantly improves deduplication efficiency, reducing storage footprint while preserving full data fidelity.

SAML authentication for super administrators

SAML support has been extended beyond tenant-level authentication to include appliance-level access.

It is now possible to configure a dedicated SAML integration for super administrator access, enabling centralized identity management for the highest privilege level in the system.

This configuration allows precise control over which identities are authorized for super admin access via SAML, without impacting tenant-level configurations. The result is a cleaner separation of concerns and stronger access governance.

Features

• Email search: introduced quick filters such as today, yesterday, and similar options. These are available in a new panel that also includes filters for sent date and archived date
• Login: users can now authenticate using IMAP/PEC mailbox credentials. If credentials are updated, Archiver automatically synchronizes and updates the related connector configuration during login
• Export from search: export jobs can now be launched directly from the email search interface, streamlining and accelerating the export process
• Tenant recap page: added a new page providing a consolidated view of tenant information, including archived storage, email statistics, feature configuration, and resource usage
• Microsoft 365 username equivalence: supports UPN changes by recording both M365 unique ID and UPN; connectors automatically migrate folder structures to the new UPN based on M365 unique ID; email search now uses M365 unique ID to ensure users can access emails indexed under previous UPNs
• Attachment indexing: introduced a tool to index attachments of already archived emails, available after enabling the attachment indexing feature
• Dashboard service cards: added new cards for attachment indexing and cluster status
• Connectors scheduling: introduced a dedicated page for connector scheduling to improve visibility into planned activities
• Connectors synchronization: introduced a dedicated page to provide clearer insight into synchronization processes
• Connectors cleaning: introduced a dedicated page to monitor cleaning operations and related data
• Connector status recap: added a panel showing aggregated synchronization statistics across all users within a connector
• Users synchronization status: introduced a dedicated section to provide detailed insights into individual user synchronization states and related metrics
• Job statistics page: added a new page displaying aggregated statistics for large-scale jobs, including multiple archives import, single archive import, export, and volume migration
• Tenant configuration: added audit logs retention time, allowing tenant-level configuration to automatically delete audit log entries older than the specified retention period
• Tenant status page: introduced a new section to monitor tenant status across all customers, including archived storage, email counts, compression ratios, and last archiving activity
• Volume status page: added a new interface to monitor and manage storage volumes, including usage, performance metrics, and last update information
• Privacy officer report: moved detailed email information from the table into an attachment file to improve readability and expanded reporting on email search activity
• Deferred emails queue: added the ability to reprocess all emails for a specific tenant
• Deferred emails queue: added the ability to delete all emails for a specific tenant
• Deferred emails queue: added the option to download the full raw email for detailed analysis
• Deferred emails: introduced a new panel to display raw email content with color highlighting for improved readability
• Folder structure deduplication: introduced an automatic service to detect, merge, and consolidate duplicated folders within mailbox structures
• Audit logs page: added filtering options to exclude user-specific audit logs scheduled for deletion based on retention policies
• Attachment indexing statistics: added new metrics showing the number of indexed attachments, both globally and broken down by file type
• Log panel: introduced a new panel to display logs for jobs and services, with color highlighting for improved readability
• Cloud appliances disks: introduced a dedicated page to monitor disks status and related information
• Cloud appliances network: introduced a dedicated page to monitor network information such as IP addresses and DNS settings
• Export jobs: when configuring jobs, the estimated zip file size is now displayed
• Export formats: added support for exporting selected emails as plain PDF files directly to the chosen export volume
• IMAP connector: added support for automatically excluding draft emails from synchronization, reducing unnecessary processing and improving relevance
• Log and backup volumes: now display the total number of files stored in each volume
• Microsoft 365 configuration: now displays groups and their member lists on the configuration page

Security

• Custom session time: introduced the ability to configure session duration at a granular level, allowing different timeout values to be assigned to users based on their Archiver roles. This enables more precise control over security and usability, ensuring that higher-privilege roles can be managed with stricter session policies while maintaining flexibility for other users
• Sessions: enhanced session management capabilities by allowing administrators to invalidate active sessions and force logout of authenticated users. This provides greater control over access, improving security in scenarios such as credential compromise, role changes, or administrative enforcement of session policies
• Let’s Encrypt certificates: added support for the new intermediate CAs YE1, YE2, YR1, and YR2

Improvements

• Legacy folder structure volumes: deprecated since v25.12, these volumes are no longer used. On cloud appliances, all have already been removed. After upgrading to v26.5, Archiver will automatically remove all remaining volume content and configurations during the next nightly maintenance window
• Email search and folder structure: emails are now displayed only in the latest folder where Archiver last saw them in the mailbox, regardless of whether Archiver previously deleted them through connector cleaning functionality
• Disk cleanup: improved the nightly disk cleanup service to more effectively purge legacy folder structure metadata related to deleted and permanently removed emails, reducing residual data and improving storage consistency
• Volume file browser: enhanced navigation by introducing a clearer representation of the volume directory structure, along with improved visibility of file-level metadata to simplify inspection and troubleshooting
• Volume file browser: added a clear warning message when volume content listing fails due to credential issues, helping users quickly identify and resolve access problems
• Archiving rules: improved the explanation of custom header matching conditions within archiving policies, providing clearer guidance on how rules are evaluated
• Archiver footer: now visible only on login and dashboard pages to reduce interface clutter. Clicking on the displayed version redirects to the version and updates page
• Archiving and retention rules: enhanced tooltip explanations to better clarify rule priority and execution order, helping users correctly configure how multiple rules are applied
• Core services page: introduced user-friendly names for all services and added a start service action to allow manual recovery or intervention when needed
• Jobs popup: removed the progress bar animation when a job terminates with errors, providing a more accurate visual representation of job status
• Export jobs: improved memory management during export operations to prevent resource buildup while processing large volumes of emails
• Export jobs: reduced I/O bottlenecks by optimizing read and write operations on archive storage, improving overall export performance
• Export jobs: optimized folder structure computation when the “export data into folder structure” option is enabled, reducing processing overhead
• Export jobs: improved distribution of the download phase across multiple data volumes to better utilize available resources and maximize throughput
• Export jobs: resume failed exports from where they left off, so that after relaunching the last used filename and sequence number are retained
• Export jobs: removed unsupported characters such as “#” from directory names during RAW export without user filters, preventing compatibility issues with certain cloud storage providers
• Export diagnostics: increased logging verbosity to simplify troubleshooting and provide more detailed visibility into export operations
• Export with folder structure: fixed handling of folder names containing slashes by replacing them with underscores, ensuring correct directory creation during export
• Indexing engine optimization: increased the frequency of index optimization processes to prevent excessive accumulation of index chunks and maintain stable performance over time
• Reindex jobs: show more configuration details during execution, including source Archiver volume and start/end time range of emails to be reindexed
• Microsoft 365 external addresses: excluded external addresses from user listings and removed them from directory service user history to avoid inconsistencies
• Purgeable space: immediately updates customer purgeable space after applying retention rules to always show current information
• Google Cloud Storage volumes: improved handling of bucket access control settings, including compatibility with configurations such as Uniform Bucket-Level Access, ensuring correct adapter initialization
• Concurrent export jobs: cloud appliances can now execute up to two export jobs in parallel, improving throughput and operational efficiency
• Multiple connector sync notification: enhanced the notification related to multiple connector synchronization for the same user by adding contextual details, including whether the issue occurred within the last 48 hours
• Multiple connector sync notification: notifications are now automatically resolved and closed once the synchronization conflict is no longer present
• IMAP connector: improved guidance for CSV credential import, providing clearer instructions on how to structure files for efficient Archiver ingestion and integration
• IMAP connector: improved memory efficiency when syncing mailboxes with large volumes of deleted emails, preventing potential crashes during synchronization
• Reports: enhanced the descriptions displayed before report generation to provide users with a clear understanding of what data and information will be included in the report
• Appliance installation wizard: after completion, now explicitly shows the default credentials (user admin, password admin) before redirecting to the login screen and strongly recommends changing them immediately for security purposes
• Archiver cache: automatically retries ZIP downloads when a storage fetch fails, reducing UI errors caused by corrupted cached archives
• Folder structure API: folders are now automatically sorted by name
• Email deletion: removed the 24-hour restriction on manual deletion when legal hold rules are active; emails can now be deleted unless explicitly protected by a matching legal hold rule

Breaking changes

• Connectors: removed the “connector statistics” panel that previously displayed counts of new, moved, deleted, and expired emails at connector and user level. This information is no longer available in the UI and must now be accessed through the dedicated connector report
• Email search: removed the option to jump directly to the last page of search results. Navigation is now limited to standard pagination controls
• Legacy API: removed the deprecated endpoint /api/v1/mail previously used for search operations. This API was already deprecated in version v23.6. Please note this API had some aliases: /api/v1/mail/s, /api/v1/mail/all, /api/v1/mail/search, /api/v1/mail/advanced_custom_search
• Protocol number filter: the protocol number filter has been removed from the advanced filters panel and is now available through full-text search patterns. Any saved searches using this filter must be modified before upgrading
• Email search filters: the “archived before” and “archived after” filters have been moved from the advanced filters panel to a dedicated date filters panel. While functionally unchanged, this impacts saved searches: any saved configurations using these filters must be removed before upgrading
• Search API: removed the undefinedDateSearchEnabled parameter from the /api/v1/search_new endpoint. Equivalent behavior must now be implemented using the dateFrom and dateTo parameters
• Google Cloud Storage volumes: support for object-level ACL configurations has been removed. The system now relies exclusively on Uniform Bucket-Level Access, in line with Google Cloud Storage deprecations. Existing volumes using legacy ACL-based configurations must be migrated to UBLA to remain functional

Deprecation notice

• Saved search API: the endpoint /api/v1/administration/saved_search has been deprecated and is scheduled for removal in future releases. It should be replaced with /api/v1/administration/saved_search/v2, introduced in version v24.1, which provides the updated and supported implementation. Existing integrations should be migrated in advance to avoid service disruptions when the legacy endpoint is removed

How to upgrade

To apply this update, navigate to Settings > System > General where you can choose to install the new version immediately or schedule the upgrade for the upcoming night.

Please note that after the update process completes, the appliance will automatically reboot to ensure all changes are properly applied and services are restarted with the new version.

Minor updates

v26.5.6407 released on 2026-09-22

• Zimbra connector: fixed cleaning failing with a fatal error when a message queued for deletion had no folder or last log entry, skipping such messages instead
• Delegated access: the user search used when configuring a delegation now also matches users from soft-deleted (decommissioned/migrated) directory services, so a delegation target is no longer missing from the results
• IMAP connector: fixed connector cleaning and worker commands failing to resolve the user, since IMAP connectors have no live directory to query; they now fall back to the cache and historical users like other connector types already did
• Email certificate PDF: now prints the mail id and protocol number

v26.5.6361 released on 2026-09-09

• Let's Encrypt: certificate renewal now refreshes the system CA store and retries once when certbot cannot validate the ACME server's TLS certificate
• Connector synchronization: the dedicated log file of a running connector is now trimmed once it grows past 500MB, preventing the first synchronization of a large mailbox from filling the disk before the log is rotated
• Microsoft 365 journaling: removed the 1000-member limit on group expansion introduced in the previous minor release; the already archived check is now split into chunked index queries, so deduplication works again for company-wide groups without slowing down archiving
• Delegated access: delegations to users whose directory service has been dismissed are now resolved through the directory service history, restoring access to their emails and removing the long delays these lookups caused
• IMAP journaling: messages flagged as deleted are now expunged only when "delete after index" is enabled, so deletions staged by other mail clients on the same mailbox are no longer finalized by Archiver; the expunge is now also performed when the synchronization stops early, leaving no message stuck in a deleted state
• IMAP journaling: emails discarded by an archiving rule are no longer deleted from the journaling mailbox
• Support references: notifications, reports and error messages now point to the new support portal at support.libracyber.com
• SSO login: redirect URLs are now restricted to local paths and http/https addresses, fixing a reflected cross-site scripting through a crafted login link
• SMTP configuration: fixed a command injection in the test endpoint, where the test address was interpolated into a shell command; the address is now validated and the mail log is inspected without a shell
• PST import: the disk selected for an import is now validated against the actual data disks, so neither the uploaded archive nor the temporary import data can be written outside them
• PST import: uploaded archives are no longer extracted inside the upload directory writable by the web server, preventing a privilege escalation through a symlink planted during extraction
• Outlook add-in login: the Exchange authentication metadata URL carried by the identity token is now restricted to https, bounded by a timeout and validated before use, fixing a server-side request forgery reachable without authentication

v26.5.6210 released on 2026-08-26

• IMAP connector: messages are now fetched in bounded batches, so folders holding very large numbers of messages no longer exhaust memory during synchronization
• Microsoft 365 journaling: groups with more than 1000 members are no longer expanded into their individual members, preventing oversized journaling filters and archive lookups
• Microsoft 365 delegations: fixed the managing and managed columns reporting no delegation when the delegated addresses differed only in letter case
• SNMP: the SNMP daemon is now restarted when CPUs are hot added or hot removed, so it no longer reports a stale CPU configuration
• SSO login: fixed the refresh token not being stored after a SAML or OAuth2 login, which logged users out, including Outlook add-in users, as soon as the session token expired
• Sessions: fixed the active sessions list, which could include expired sessions or omit valid ones when the expiration time was evaluated in a different time zone
• Saved searches: the AND/OR combinator of the top level query group is now stored together with the saved search
• Tenant statistics: statistics are no longer computed for tenants that have been permanently deleted
• Tenant deletion: permanent deletion now also removes the connector queue, tenant groups and their members, and the Outlook add-in configuration; failures are now logged and notified
• Cluster: the nightly maintenance check and the SPF table build no longer run on the passive node
• PST export: exports that completed successfully are no longer reported as containing corrupted messages, since the number of failed messages is now read from the export recap instead of being inferred from the tool output
• Folder structure deduplication: removed spurious output buffer warnings from the deduplication maintenance logs
• S3 volumes: added an "Exclude User-Agent from signature" option for generic S3-compatible storages, disabled by default; it must be enabled only on storages that reject requests where x-amz-user-agent is a signed header, such as Dell EMC ECS. Volumes already configured for Dell ECS are updated automatically during the update
• Deferred emails: fixed the tenant selection not being applied to the email list, which could display emails belonging to a tenant other than the selected one
• Microsoft 365 SSO login: fixed the login failing on tenants that enforce multi-factor authentication or conditional access policies, where the authentication ended on an error page instead of signing the user in

v26.5.5966 released on 2026-07-30

• Folder structure deduplication: significantly reduced memory usage while detecting and merging duplicated folders, preventing failures on large mailbox structures
• User impersonation: impersonation now also works for users whose original directory service has been dismissed, by falling back to the currently active directory service
• Export jobs: added automatic retries when reading search results or fetching email content from storage temporarily fails, improving the resilience of long-running exports
• Cluster: added a notification when asynchronous volumes are misaligned on the passive node
• Microsoft 365 username equivalence: the UPN migration now runs only on Microsoft 365 connectors, preventing synchronization and cleaning failures on connectors of other types
• IMAP journaling: fixed the retrieval of an existing listener configuration, so listener details are now correctly displayed
• IMAP connector: credential validation has been reworked to better handle the initial connection with the mail server, making validation more reliable
• IMAP connector: fixed folders being occasionally reported as unparsable during synchronization
• IMAP connector: folders listed by the mail server before their parent folder are now correctly archived once the parent has been read, instead of being silently skipped
• IMAP connector: fixed an outdated mailbox message count that could cause archived emails to be incorrectly reported as deleted by the user
• Email search: fixed the folder filter not being applied as intended when browsing search results
• Appliance migration: re-enabled the migration from v24.1 Archiver in the appliance console menu, which now also rebuilds statistics at the end of the migration
• Appliance upgrade: fixed ownership and permissions of indexing engine data directories on older virtual machines, preventing the indexing engine from failing to start after an update
• Audit log: fixed mailbox credentials being recorded in cleartext when validating connector credentials
• Core services page: viewing and starting services now require the system status permission

v26.5.5892 released on 2026-07-14

• S3 storage: added support for on-prem S3-compatible storages (such as Dell ECS) through a dedicated Signature V4 implementation, resolving HTTP 403 signature-mismatch errors during upload
• Export jobs: during long-running export operations, added a health check that restores the connection to the indexing engine if it is temporarily lost, preventing export failures
• Outlook add-in: improved authentication resilience when Microsoft 365 profile details are incomplete or not yet available, ensuring a smoother login and clearer on-screen messages
• Cluster: improved the cluster promote workflow and status checks, including recovery when the active node is lost
• Cluster: fixed the cluster health check after a reboot, so that restarting a node no longer affects the cluster configuration, which is now correctly preserved
• Indexing engine page: fixed the largest chunk information not always being available
• IMAP journaling: fixed the IMAP journaling listener configuration form, which prevented listeners from being configured correctly

v26.5.5750 released on 2026-06-30

• PST import: added an option to ensure emails are archived for all email addresses involved in the email, even when the same email has already been archived for a subset of users
• IMAP connector: container-only mailboxes are now automatically skipped by detecting the IMAP `\Noselect` flag
• Outlook add-in: improved Microsoft 365 token validation with full cryptographic verification of signature, issuer, audience, and expiration
• Microsoft 365 customer groups: improved synchronization reliability with case-insensitive group matching and enhanced cleanup of stale groups and memberships
• Zimbra connector: draft emails are now skipped, and oversized emails exceeding the maximum supported Archiver size are automatically ignored
• Indexing engine: dashboard now reports the indexing engine as unavailable while it is restarting after an update, preventing searches until it is fully operational
• Indexing engine: optimized email and attachment index maintenance so optimization processes can run independently
• Indexing engine page: now displays the largest indexing engine chunk size to provide better capacity planning information for disk expansion
• Indexing engine: automatically cleans up orphaned temporary chunks left behind by failed index optimization processes
• Certified timestamp page: now displays the TSA signing algorithm used for each timestamp
• Legal and retention: the email list shortcut now opens the corresponding saved search