[
  {
    "version": "0.3.18",
    "package": "limristem-mail",
    "archive": "limristem-mail.tar.gz",
    "download_url": "https://nightly.limristem.eu/mail/0.3.18/limristem-mail.tar.gz",
    "sha256_url": "https://nightly.limristem.eu/mail/0.3.18/limristem-mail.tar.gz.sha256",
    "signature_url": "https://nightly.limristem.eu/mail/0.3.18/limristem-mail.tar.gz.sig",
    "signing_key_id": "nightly",
    "channel": "nightly",
    "published_at": "2026-08-09T00:00:00Z",
    "notes": "0.3.18: Security and correctness release. Fixes: unauthenticated /contacts/{id}/vcard download; sender spoofing on port 25 (reject_authenticated_sender_login_mismatch); DKIM never signing on subdomain mail hosts (rspamd use_esld); mailbox migration always failing (undefined dest_username); scheduled backup, deliverability report and SRS sync never running (systemd units pointed at scripts/ instead of bin/); backup SHA256SUMS hashing itself so every integrity check failed; broken JMAP and webmail panel handlers; update check always reporting up to date. Hardening: apt removed from sudoers (manage-packages.sh wrapper), root-owned virtualenv, 0640 env files, log-path allowlist in the privileged helper, TOTP replay protection, absolute bearer-token lifetime, SMS OTP throttling, app-password cap, postscreen, TLS cipher policy, Dovecot 2.4 TLS floor, systemd sandbox, nginx login rate limit. DKIM keys are now generated in-process at 2048 bit and no longer require rspamd. JMAP is disabled by default (LIMRISTEM_MAIL_ENABLE_JMAP) as it is incomplete."
  }
]