Validate package name breaks with capitalize letters

fcastilloec · May 6, 2026, 4:39pm

Description

The new checks for package name don’t allow for capitalize letters, which has broken many themes I had installed.

To Reproduce…

Steps to reproduce the behavior:

Install a theme that has any letter capitalized in its name
See error

Expected Behavior

Capitalized letters in the theme name should not prevent installation

Setup

OS and Version: Ubuntu 24.04
- Installation Method: .deb
Mailspring Version: 1.21.0

Additional Context

The following commit added checks to the package name to prevent some attacks, but allowing capitalized letters shouldn’t introduce any errors and keep backwards compatibility:

github.com/Foundry376/Mailspring

Add package name validation to prevent path traversal attacks (#2698)

committed 06:40PM - 01 May 26 UTC

bengotow

+66 -11

* Harden plugin loading against path traversal and silent RCE - Validate packag…e name against /^[a-z0-9._-]+$/ in Package and reject invalid names during discovery and installPackageFromPath, preventing a malicious package.json#name like "../foo" from causing cpSync to write outside configDir/packages/. - Flip the install trust dialog so Cancel is the default button; Enter no longer approves an untrusted plugin install. - Honor core.disabledPackages for all plugins, not just isOptional ones, so users have a kill switch for any package. * Address PR review: fix seed config regression and cpSync error path - Drop send-and-archive and main-calendar from the dot-mailspring seed disabledPackages list. They are non-optional core features (composer send-action, calendar window) that the previous isOptional() gate was silently letting load despite being listed; with disabledPackages now honored universally, fresh installs would lose both features. - Wrap cpSync + Package construction in a try/catch in installPackageFromPath so failures (existing destination, permission errors, etc.) route through the install callback instead of throwing past it. Best-effort cleanup of any partial copy left behind. * Update package-manager.ts --------- Co-authored-by: Claude <noreply@anthropic.com>

mimavox · May 17, 2026, 4:31pm

Same issue on Ubuntu 26.04

bengotow · May 21, 2026, 3:20am

Good news — this is fixed in v1.21.1 (released May 19, 2026)! The package name validation regex has been updated to accept uppercase letters, so themes with capital letters in their package or folder name will install and load correctly again. Please update and let us know if you’re still seeing any issues.

Thanks for tracking down the exact commit — that was extremely helpful.