DavMail 7.0.0 asks restricted tenants to approve a new Graph scope before shared calendars open

Calendars.ReadWrite.Shared is the part of this release that needs an administrator's approval. It is the scope DavMail now requests to reach shared folders, and in a tenant that restricts app permissions, someone has to approve it or the shared folders stay shut ^[7][8]. Validation is stricter in the other direction too: the token check fails outright when Mail.ReadWrite is missing ^[7].

DavMail is a Java gateway that converts IMAP, SMTP, CalDAV, CardDAV and LDAP into requests Exchange and Office 365 accept ^[1]. "Ever wanted to get rid of Outlook?" the project page asks ^[15].

The major version number matches the contents. 7.0.0 removes a configuration option, flips a sync method to on by default, adds a permission request, and forces a fresh sign-in after a deployment switches from EWS to Graph ^[2]. The removed option is davmail.caldavImpersonate, and DavMail now impersonates the shared mailbox itself when sending a meeting response from a shared calendar ^[9].

Graph took most of the work. Seventy changelog entries carry the Graph label against 18 for EWS ^[3], which is 88 labeled entries in total, roughly 80 percent of them Graph, or close to four Graph entries for every EWS entry ^[4]. The older backend still saw changes: EWS got reworked handling of attendees, organizers, shared calendars and exception occurrences, the single changed instances of a recurring meeting ^[12].

Folder delta sync is the largest change. Instead of listing a whole folder each time a client checks it, DavMail asks Graph only for what changed since the last request and keeps a cached copy ^[5]. It arrived as an opt-in under davmail.graph.deltaSync and now runs by default ^[5], so upgrading puts it in the path for every mailbox. DavMail also caps retries when Microsoft throttles it and copes with a malformed Retry-After header, the field a server uses to say how long a client should wait ^[6].

Two smaller entries will matter to anyone who has cleaned up duplicated calendar events. A new davmail.caldavReadonly=true mode lets clients read calendars without writing back ^[10]. And when the event behind a meeting response has disappeared, DavMail aborts the response, so no second, broken copy gets written ^[11].

Nothing in the changelog Help Net Security summarized is a security fix ^[18]. The upgrade date for 7.0.0 is therefore whatever date the consent request for Calendars.ReadWrite.Shared clears ^[7][8].