Tags

- Do not require SSL/TLS/STARTTLS for submission-relay and submission services; those are the downstream connections anyway which may be protected by the underlying infrastructure (e.g. istio), so enforcing this is not necessary; the SSL for incoming connections from the Internet is still required

- Enable the `editheader` sieve extension

- Introduce the "probe" script for K8s probes

- Bump to Dovecot v2.3.21

- Allow to define the full endpoint URL for the auth-policy server
- Breaking change: the ENV variable renamed from `DOVECOT_AUTH_POLICY_HOST` to `DOVECOT_AUTH_POLICY_ENDPOINT`

- Resolve various security vulnerabilities

- Switch to FTS-Flatcurve as the search plugin
- Build own Dovecot in order to meet Flatcurve's requirements (enable stemmer and textcat)

- BUGFIX: cron did not log to stdout properly

- Fix various CVEs in OpenSSL prior to v3.0.7

- Upgrade to Dovecot v2.3.20 (Pigeon v0.5.20)

- Flagged virtual folder containing all flagged messages (except for messages from Trash)
- Option not to fix the permissions on the /var/mail folder to shorten startup time

- BUGFIX: `login_trusted_networks` should always contain "127.0.0.1" as the Dovecot local proxy needs to present the client IPs
- Resolves security vulnerability CVE-2022-40674

- Resolves security vulnerabilities CVE-2018-25032, CVE-2022-2097, CVE-2022-3209, CVE-2022-29458, CVE-2022-30065, CVE-2022-32081, CVE-2022-32082, CVE-2022-32084, CVE-2022-32089, CVE-2022-32091, CVE-2022-37434

- Change the default VSZ_LIMIT to 1 GB to avoid OOM for certain IMAP mailboxes

- Enable per-user configuration of the "Junk" folder name (or empty, to no "Junk" folder to use at all)

- BUGFIX: missing time units for the `fts_index_timeout` directive

- Limit memory used by the indexer-worker + define timeout for waiting for FTS index to be built during search query