What’s changed. What to check.
A source-grounded summary of recent changes and what they mean for operators and integrations.
Checked 22 October 2026 at a3e6809. The upstream README still labels the project v0.1.0 beta; GitHub has no published releases or tags. These changes are not a new numbered release or a downloadable release binary.
Configuration and upgrades
Explicit config paths must exist, and relative paths resolve against the config’s directory. Run config check to reject unknown YAML keys. Normal loading only warns about them. Newer database schemas are refused by older binaries; SIGHUP reloads manual TLS certificates, while other configuration changes need a restart.
Mail delivery and client protocols
Recent work covers SMTP connection limits and graceful DATA draining, cached parallel RBL lookups, IMAP session/IDLE handling, POP3 maildrop locking and Sieve delivery. Outbound MTA-STS enforce policies prohibit plaintext fallback. Stock DANE remains advisory; IMAP4rev2, CONDSTORE and QRESYNC are not advertised.
API and integrations
Dedicated mail endpoints handle message reading, flags, drafts and moves. Lists support pagination, flagged/unread filters and qualified message IDs. Admin clients should handle last-admin conflicts (409), throttling (429 with Retry-After) and quota failures (507). Queue retries use POST on the queue item, not an invented retry subroute. Webhooks persist registrations, sign deliveries and retry with backoff.
Account security and operations
Login lockouts, TOTP attempt limits, session revocation and expiring API tokens harden account access. Forwarded audit IPs require a trusted proxy. MCP refuses non-loopback binding without an explicit auth token. CLI backups require a stopped server, and restore output is staged in restore_temp/ for inspection.
Observability and documented scope
Optional OpenTelemetry tracing and authentication-cache metrics accompany the existing Prometheus endpoint. Metrics and /healthz use the metrics listener; /health and /health/ready use the web listener. Web/API/admin listeners still need an HTTPS proxy. MCP queue tools, Contacts and some settings/profile screens remain incomplete.
This summary combines the upstream Unreleased notes, including audit rounds 141–220, with the current implementation. Where older prose differs, the linked source snapshot controls. See the full upstream changelog and current limitations.