@push.rocks/smartmta 11.1.0 → 13.0.0

package/changelog.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 2026-10-15 - 13.0.0
+
+### Breaking Changes
+
+- `baseLogger` is now a `@push.rocks/smartlog` 5 `Smartlog` instance (was 4.x); embedders that pass it where a smartlog 4 `Smartlog` is typed must move to smartlog 5. `addLogDestination()` still takes any `ILogDestination`.
+- The Linux `mailer-bin` binaries are renamed from `dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64` to `dist_rust/mailer-bin_linux_amd64_musl` and `dist_rust/mailer-bin_linux_arm64_musl`, and the package ships `native-notices/` instead of `notices/` and `third-party-notices.md`. Anything that copies or runs the binaries by their old names, or reads the old notice files, must move to the new paths.
+
+### Features
+
+- Raw outbound delivery can relay the received bytes unsigned, for a backup MX that forwards third parties' mail to the primary and must neither sign nor re-sign it. Only an explicit `RustSecurityBridge.sendRawEmail({ signing: 'unsignedRelay' })` without `dkim` material selects it; the options are typed as `TSmtpSendRawOptions`, the union of `ISmtpSendRawOptions` (`signing?: 'dkim'` with required `dkim`) and `ISmtpSendRawUnsignedRelayOptions`, exported with `TSmtpRawSigningMode`. Without the opt-in a raw send still requires DKIM material and is refused exactly as before; Rust also refuses an unsigned relay that carries a `dkim` key (even null) and any unknown or null `signing` mode, all before SMTP. The relay sends the bytes exactly as received, so they keep the original sender's own `DKIM-Signature` and smartmta adds none; an empty `envelopeFrom` relays a bounce as `MAIL FROM:<>`, and `outboundAuthenticationCaptureId` stays available. `sendRawOutboundEmail()` and the durable raw queue always send `signing: 'dkim'`, nothing about the mode is stored in the queue, and submission, route actions and configuration cannot reach it. `smartMtaCapabilities.explicitUnsignedRawRelay` advertises it.
+
+### Fixes
+
+- The Rust SMTP client refuses an envelope sender or recipient that contains CR, LF or NUL, which would otherwise end the MAIL FROM or RCPT TO command and inject further SMTP commands. The check runs before a connection is opened, and again wherever an address becomes command text (`MAIL FROM`, `RCPT TO` and the pipelined batch), so nothing is sent for such an envelope. The refusal is a permanent `SmtpDeliveryError` with `errorType: 'envelope'`, `retryable: false` and phase `mail_from` or `rcpt_to`; the address appears escaped in the message and transcript. `sendRawOutboundEmail()` and `enqueueRawEmail()` already rejected CR and LF in such addresses in TypeScript; direct `RustSecurityBridge.sendEmail`/`sendRawEmail` callers were not protected. The empty reverse-path `MAIL FROM:<>` is unchanged.
+- `mailer-bin` is built for static musl instead of static glibc and ships its third-party notices next to the binary (`<binary>.third-party-notices.json` and `.txt`, generated by `@git.zone/tsrust` from the committed `native-notices/`), so `@git.zone/tssea` can embed it as a single-executable sidecar. `RustSecurityBridge` resolves the `_musl` names on Linux. Static glibc and its LGPL relinking obligation are gone. rustls now uses ring only: `tokio-rustls` no longer enables its default `aws_lc_rs` feature, so AWS-LC (never linked into `mailer-bin`) is no longer compiled or listed in the notices.
+- Move `@push.rocks/smartlog` to ^5.0.1, which drops Deno from its runtime types and moves to the Deno-free `@push.rocks/smartrequest` 6 and `@push.rocks/smartconsole` 3; smartmta logs with `runtime: 'node'` and needs no other change.
+- Move `@push.rocks/smartmail` to ^3.1.2, which moves to `@push.rocks/smartdns` 10 and `@push.rocks/smartrequest` 6.0.1. The production dependency tree now holds a single `@push.rocks/smartrust` (2.6.0, the first release that finds Rust binaries embedded in a Node.js single-executable application) and a single `@push.rocks/smartrequest` (6.0.1).
+
+### Maintenance
+
+- Release tooling: `@git.zone/cli` 9.1.0 (tooling)
+
+## 2026-10-15 - 12.0.0
+
+### Breaking Changes
+
+- Inbound messages are parsed with `@push.rocks/smartmail` (postal-mime) instead of `mailparser`, and `Email.headers` changes with it: values are the raw field values as written (unfolded; a repeated field joins its values with `, `) instead of mailparser's interpreted forms. mailparser's derived keys are gone: `priority` (now the message's own `x-priority`/`importance` fields) and `list` (now `list-id`, `list-unsubscribe` and the other `list-*` fields), and structured fields such as `dkim-signature` and `list-*` carry their text instead of `[object Object]`. A route whose `match.headers` names `priority` or `list` no longer matches; name the raw field instead.
+
+### Fixes
+
+- Scoped authenticated senders can no longer place an out-of-scope identity in the header From. Every mailbox of every From field is now checked, with groups flattened into their members and repeated From fields all kept; before, a group (`From: Board: ceo@victim.test;`) or a second From field after an out-of-scope first one was accepted. A From field that yields no mailbox (an empty group, or an encoded word in place of the address), a message whose first line is a `From :` field (which an mbox reader drops as a postmark) and an unreadable header section are now refused with 553. A message without any From field is still accepted, because its sender is the scope-checked envelope MAIL FROM.
+- `Email.from` is the first mailbox of the From fields in message order, groups flattened, and falls back to the envelope MAIL FROM only when no From field yields a mailbox; before, a repeated From field gave the last one and a group gave the envelope sender.
+- The text of a message that carries only HTML is derived by smartmail's `htmlToText`: headings are no longer upper-cased, and a message whose HTML body sits in a `multipart/related` part (an inline image next to it) gets its text too instead of an empty one.
+- Inline images keep their `cid:` link in `Email.html`, and their attachment carries the `contentId` the link names, instead of the image being copied into the HTML as a `data:` URI.
+- Header To and Cc (used when the envelope has no recipients) include the members of a group; mailparser's addresses left them out.
+- A quoted local part keeps its quotes in the From mailboxes the sender scope is checked against (`"john doe"@one.test`), as the address is written.
+- Removes `mailparser` and its `nodemailer` / `deepmerge-ts` advisory subtree from the runtime dependencies; `@push.rocks/smartmail` moves to ^3.1.0.
+
+### Maintenance
+
+- release tooling: @git.zone/cli 9.0.1, @git.zone/tsrust 4.6.0
+
 ## 2026-10-14 - 11.1.0
 
 ### Features