My home mail server has been the canary for Thunderbird’s custom OAuth support for about a year. Every few weeks, the desktop client pops a warning asking me to re-enter my password, even though nothing has changed on the server. Version 156 is the first release where that warning has stopped, and the fix happened quietly enough that I almost missed it. If you run your own mail, the September release is worth reading about even if you do not plan to install it today.
A short history of the warning
I have been running a small Nextcloud mail server at home since 2024. The setup is intentionally boring: Dovecot for IMAP, Postfix for SMTP, and a half-finished spam classifier I keep promising myself I will finish. Thunderbird on Pop!_OS has been my desktop client the entire time. It worked, with one persistent papercut.
About a year ago, Thunderbird started warning me that password authentication was deprecated. The warning was not wrong, technically. It was annoying because the password still worked, the connection was still encrypted, and my server still accepted the login. The warning was a polite heads-up that the client expected me to do the OAuth dance eventually.
The OAuth dance, for a self hosted mail server, is not a small thing. You register an application with your identity provider. You pick an issuer ID (a URL that identifies your provider to the OAuth flow). You generate a client secret (a long random string that proves the app is the one you registered). You paste both into Thunderbird’s account setup. You click the authorize button. You confirm the token on a web page. You wait. You hope it works on the first try.
Most of my attempts over the past year ended in step six. Thunderbird would refuse the token, claim the issuer URL was wrong, or quietly fail in a way that left me guessing what was actually wrong. I would shrug, fall back to password auth, and ignore the warning for another month.
What 156 actually changed
The September release added extended custom OAuth support to POP3, alongside the IMAP support that already existed. POP3 is the protocol that downloads mail from a server to your client and removes it from the server. IMAP is the protocol that keeps mail on the server and lets multiple clients see the same state. Both matter for self hosted setups, and both were partially broken under the old flow.
The fix I noticed is narrower than the headline suggests. Thunderbird still does not ship a one-click “OAuth my self hosted server” button. What it now does is accept the issuer URL and client secret on POP3 accounts, where it used to refuse. That is a small change in surface area and a large change in practice for anyone who runs a small mail server.
I tested it on my own setup last weekend. The process took about ten minutes, mostly because I had to dig out my issuer ID from a config file I had not touched in six months. After that, the warning has not come back. That is the whole win. No ceremony, no parade, no release announcement.
If you have been avoiding 156 because the changelog read like a protocol-fix release, the changelog is accurate and that is exactly why it matters. The boring fixes are the ones that close papercuts.
The Exchange fix you might have skipped
If you also happen to run Thunderbird against a work Exchange account, 156 fixes a related bug that blocked custom OAuth setup on Exchange entirely. That bug had been quietly annoying Exchange users since the 154 release opened the OAuth path for Microsoft 365 via Microsoft Graph (the API Microsoft uses to expose 365 data to third party apps). The two halves were not talking to each other until 156.
The practical impact for someone who runs both a personal and a work account is one fewer reason to keep a separate browser tab open for the same inbox you already have on your desktop. For anyone whose organization runs on premise Exchange without OAuth at all, this release changes nothing. The narrowness is the point: it fixes the case that was broken and leaves the case that was never going to work alone.
What else is in the release, briefly
Around the OAuth fixes, the release also touches OpenPGP (a standard for encrypting email end to end), calendar handling, attachment reliability, and enterprise policy enforcement. None of those are headline features. All of them are the kind of patch that makes the client feel like it is cooperating with you on a Tuesday afternoon rather than slowly decaying around you.
POP3 and IMAP handling both got reliability improvements that should make day-to-day mail feel a little less fragile. The extension pack and the main binary were updated in lockstep, so USB passthrough and disk encryption keep working without extra steps. The minimum macOS version is still 10.15 and the minimum Windows version is still 10, which keeps older hardware in the conversation a year after the previous release.
Linux packaging is still the bottleneck
The release was officially cut on September 15, 2026, and that is when the upstream code went live. Most Linux users will not see 156 in their package manager for some time after that. Each distro has its own schedule and its own policy for how aggressively to roll out new versions of a desktop application.
Packaging windows, by distro family, based on past release patterns:
- Rolling release distros pick it up within hours of the upstream cut.
- Ubuntu and Fedora typically land it inside a week or two for non-LTS spins.
- Debian stable users should expect several weeks of waiting, sometimes longer.
- Arch-based distros pull the new build almost immediately after the maintainer signs off.
For anyone who cannot wait, the AppImage from the Thunderbird site is a self-contained executable that runs without installing anything. It has been my fallback for the past two years when a specific fix was blocking me and the rest of the system could wait.
AppImage users should know it does not update itself. You have to remember to grab a new build each month. For most people that is fine. For anyone running Thunderbird on a dozen shared workstations, the AppImage is a chore.
Trade-offs
This release is not free. The OAuth flow still requires you to know what an issuer ID is, what a client secret looks like, and where your identity provider’s configuration page lives. If you have never set up OAuth before, expect to spend an hour reading your provider’s docs and clicking around in menus you do not recognize.
Linux packaging remains the single biggest wildcard. If you are on a stable distro like Debian or an Ubuntu LTS, you may be waiting weeks for the package to land. The AppImage is the workaround, but it shifts the maintenance burden from your distro’s maintainers to you.
The narrow Exchange fix is also a trade-off. If your organization runs on premise Exchange without OAuth, this release does nothing for you. The on premise path is a different project, and waiting for a future release that addresses it is the only honest option.
Finally, the smaller protocol fixes are scattered across POP3, IMAP, OpenPGP, and SMTP. Any one of them could regress in a future maintenance update. Update through your distro first, fall back to the AppImage if you need a fix today, and treat the upgrade as a quiet reliability improvement rather than a feature drop.
What I would tell past me
Three things, if I could send a message back to the version of me that was staring at a Thunderbird auth failure at midnight last year.
- Configure OAuth on every self hosted account you run, even if password auth still works. The warnings stop, and the configuration survives monthly updates without re-entry.
- Update through your distro first, and only fall back to the AppImage when a specific fix is blocking you and the rest of the system can wait.
- Keep the issuer ID and client secret in a password manager entry, not a sticky note. The OAuth flow survives a Thunderbird reinstall if you have both values handy.
- Stop keeping a separate browser tab open for the work Exchange account. The fix in 156 closes the gap, and the second browser tab is no longer necessary once you update.
For anyone running Thunderbird on Linux and nursing a misbehaving account, this is the version where most of that pain should finally quiet down. One small release, a lot of small wins, and exactly the kind of quiet reliability work that keeps an open source email client worth using every single day.