@push.rocks/smartmta 12.0.0 → 13.0.1

package/changelog.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 2026-10-15 - 13.0.1
+
+### Fixes
+
+- Inbound SMTP DATA keeps the CRLF that ends the message's last line (RFC 5321 §4.1.1.4: the first CRLF of `<CRLF>.<CRLF>` belongs to the message); since 5220ee0 the Rust DATA reader removed it as part of the terminator. The `rawMessage` handed to `onAcceptEnvelope`/`onMessageData` gains those two bytes and is now the exact received message (dot-stuffing removed), so received mail can be passed unchanged to `sendRawEmail({ signing: 'unsignedRelay' })`, `sendRawOutboundEmail()` and `enqueueRawEmail()`, which refused it before for a missing final CRLF. DKIM, SPF and DMARC verdicts, parsed `Email` fields and the SIZE limit are unchanged. Consumers that appended a CRLF themselves must stop (CoreMail).
+- A message larger than `maxMessageSize` is now read to its end-of-data marker and then refused with 552, and the session continues. Before, the 552 was sent as soon as the limit was crossed and the rest of the message was read as SMTP commands, so lines in an oversized body (`RSET`, `MAIL FROM`, `RCPT TO`, `DATA` and a further message) were executed.
+- Commands pipelined behind the end-of-data marker in the same segment (RFC 2920), such as `.<CRLF>QUIT<CRLF>` or the next transaction's `MAIL FROM`/`RCPT TO`/`DATA`, are answered in order. Before, the DATA reader discarded every byte after the marker in the chunk it had read, and the client waited for replies that never came.
+
+## 2026-10-15 - 13.0.0
+
+### Breaking Changes
+
+- `baseLogger` is now a `@push.rocks/smartlog` 5 `Smartlog` instance (was 4.x); embedders that pass it where a smartlog 4 `Smartlog` is typed must move to smartlog 5. `addLogDestination()` still takes any `ILogDestination`.
+- The Linux `mailer-bin` binaries are renamed from `dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64` to `dist_rust/mailer-bin_linux_amd64_musl` and `dist_rust/mailer-bin_linux_arm64_musl`, and the package ships `native-notices/` instead of `notices/` and `third-party-notices.md`. Anything that copies or runs the binaries by their old names, or reads the old notice files, must move to the new paths.
+
+### Features
+
+- Raw outbound delivery can relay the received bytes unsigned, for a backup MX that forwards third parties' mail to the primary and must neither sign nor re-sign it. Only an explicit `RustSecurityBridge.sendRawEmail({ signing: 'unsignedRelay' })` without `dkim` material selects it; the options are typed as `TSmtpSendRawOptions`, the union of `ISmtpSendRawOptions` (`signing?: 'dkim'` with required `dkim`) and `ISmtpSendRawUnsignedRelayOptions`, exported with `TSmtpRawSigningMode`. Without the opt-in a raw send still requires DKIM material and is refused exactly as before; Rust also refuses an unsigned relay that carries a `dkim` key (even null) and any unknown or null `signing` mode, all before SMTP. The relay sends the bytes exactly as received, so they keep the original sender's own `DKIM-Signature` and smartmta adds none; an empty `envelopeFrom` relays a bounce as `MAIL FROM:<>`, and `outboundAuthenticationCaptureId` stays available. `sendRawOutboundEmail()` and the durable raw queue always send `signing: 'dkim'`, nothing about the mode is stored in the queue, and submission, route actions and configuration cannot reach it. `smartMtaCapabilities.explicitUnsignedRawRelay` advertises it.
+
+### Fixes
+
+- The Rust SMTP client refuses an envelope sender or recipient that contains CR, LF or NUL, which would otherwise end the MAIL FROM or RCPT TO command and inject further SMTP commands. The check runs before a connection is opened, and again wherever an address becomes command text (`MAIL FROM`, `RCPT TO` and the pipelined batch), so nothing is sent for such an envelope. The refusal is a permanent `SmtpDeliveryError` with `errorType: 'envelope'`, `retryable: false` and phase `mail_from` or `rcpt_to`; the address appears escaped in the message and transcript. `sendRawOutboundEmail()` and `enqueueRawEmail()` already rejected CR and LF in such addresses in TypeScript; direct `RustSecurityBridge.sendEmail`/`sendRawEmail` callers were not protected. The empty reverse-path `MAIL FROM:<>` is unchanged.
+- `mailer-bin` is built for static musl instead of static glibc and ships its third-party notices next to the binary (`<binary>.third-party-notices.json` and `.txt`, generated by `@git.zone/tsrust` from the committed `native-notices/`), so `@git.zone/tssea` can embed it as a single-executable sidecar. `RustSecurityBridge` resolves the `_musl` names on Linux. Static glibc and its LGPL relinking obligation are gone. rustls now uses ring only: `tokio-rustls` no longer enables its default `aws_lc_rs` feature, so AWS-LC (never linked into `mailer-bin`) is no longer compiled or listed in the notices.
+- Move `@push.rocks/smartlog` to ^5.0.1, which drops Deno from its runtime types and moves to the Deno-free `@push.rocks/smartrequest` 6 and `@push.rocks/smartconsole` 3; smartmta logs with `runtime: 'node'` and needs no other change.
+- Move `@push.rocks/smartmail` to ^3.1.2, which moves to `@push.rocks/smartdns` 10 and `@push.rocks/smartrequest` 6.0.1. The production dependency tree now holds a single `@push.rocks/smartrust` (2.6.0, the first release that finds Rust binaries embedded in a Node.js single-executable application) and a single `@push.rocks/smartrequest` (6.0.1).
+
+### Maintenance
+
+- Release tooling: `@git.zone/cli` 9.1.0 (tooling)
+
 ## 2026-10-15 - 12.0.0
 
 ### Breaking Changes