v0.4.2

What's Changed

• ollama-bump: only move the pin forward, and actually check the PR that does it by @Yoshiofthewire in #140
• build: pin Ollama per architecture so arm64 can build at all by @Yoshiofthewire in #141
• perf: stop sending 13 MiB of message bodies to render one by @Yoshiofthewire in #142
• docs(relay): the daily budget does not guard a provider bill by @Yoshiofthewire in #143
• docs: the one-time move from a locally built install to published images by @Yoshiofthewire in #144
• fix(contacts): one name variant no longer vetoes a whole merge group by @Yoshiofthewire in #145
• feat(api): publish the newest Linux client release to paired devices by @Yoshiofthewire in #146
• perf(read): stop paying for a full mailbox refetch on every delete by @Yoshiofthewire in #147
• fix(imap): file mail into the account's real folders, not invented ones by @Yoshiofthewire in #148
• Encrypt UnifiedPush payloads (RFC 8291), and let push-MFA follow by @Yoshiofthewire in #149
• Rename the pairing button to "Pair this device" by @Yoshiofthewire in #151
• chore(deps): bump pinned Ollama to 0.33.0 by @github-actions[bot] in #150
• chore(deps): bump dompurify from 3.4.13 to 3.4.14 in /frontend in the frontend-runtime group by @dependabot[bot] in #152
• chore(deps): bump the go-modules group in /backend with 2 updates by @dependabot[bot] in #153
• chore(deps): bump the frontend-tooling group across 1 directory with 4 updates by @dependabot[bot] in #154
• chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the github-actions group by @dependabot[bot] in #155
• fix: 6 verified findings (agentfixer 1/4) by @Yoshiofthewire in #156
• fix: 7 audit findings, plus the SSO link revocation and step-up reworked from review by @Yoshiofthewire in #157
• docs: add the Apple column to the compatibility matrix, and correct two wrong rows by @Yoshiofthewire in #158
• security(sso): pin the SSO account-takeover chain with probe tests by @Yoshiofthewire in #159
• Update Buy Me a Coffee username in FUNDING.yml by @Yoshiofthewire in #160
• Fix formatting for Buy Me a Coffee username by @Yoshiofthewire in #161
• Updated Relay Servers to allow for movement off of Cloudflare in the … by @Yoshiofthewire in #164
• feat: preload displayed inbox bodies by @Yoshiofthewire in #166
• Allow opt-in review account pairing by @Yoshiofthewire in #167
• allow opt-in review account pairing by @Yoshiofthewire in #168
• chore(deps): bump pinned Ollama to 0.33.2 by @github-actions[bot] in #169
• chore(deps): bump react-router from 8.3.0 to 8.3.1 in /frontend in the frontend-runtime group by @dependabot[bot] in #170
• chore(deps): bump the frontend-tooling group in /frontend with 3 updates by @dependabot[bot] in #171
• feat: get-the-apps page and sidebar polish by @Yoshiofthewire in #172
• fix: use public backend module path by @Yoshiofthewire in #173
• Adopt ky-primitives for passwords, TOTP and recovery codes by @Yoshiofthewire in #175
• chore(deps): bump pinned Ollama to 0.33.3 by @github-actions[bot] in #174
• feat: add sealed backups and shared JSON logs by @Yoshiofthewire in #176
• fix: compact the backup page by @Yoshiofthewire in #177
• fix: allow backups without optional tuning file by @Yoshiofthewire in #178
• chore(deps): bump dompurify from 3.4.14 to 3.4.15 in /frontend in the frontend-runtime group by @dependabot[bot] in #179
• chore(deps): bump the frontend-tooling group in /frontend with 3 updates by @dependabot[bot] in #180
• chore(deps): bump the go-modules group in /backend with 7 updates by @dependabot[bot] in #181
• chore(deps): bump pinned Ollama to 0.34.0 by @github-actions[bot] in #182
• Admin mailbox assignment: instance defaults, per-user credentials, optional lock by @Yoshiofthewire in #183
• feat(pgp): encrypted attachments in browser-encrypted mail by @Yoshiofthewire in #184
• feat(pgp): encrypt drafts and compose snapshots for client-custody keys by @Yoshiofthewire in #185
• feat(mailcache): encrypted rows no longer make the mailbox cold by @Yoshiofthewire in #186
• feat(pgp): real sign-only mail as RFC 3156 multipart/signed by @Yoshiofthewire in #187
• feat(pgp): default signing and show unsigned mail by @Yoshiofthewire in #188
• feat: store and test PGP recovery copies by @Yoshiofthewire in #189
• docs: design PGP key lifecycle by @Yoshiofthewire in #190
• feat: read historical PGP keyrings by @Yoshiofthewire in #191
• feat: guard PGP writes by revision by @Yoshiofthewire in #192
• pgp: guard browser writes with their source revision by @Yoshiofthewire in #193
• feat: prepare atomic PGP keyring storage by @Yoshiofthewire in #194
• feat: prepare complete keyring recovery by @Yoshiofthewire in #195
• feat: preserve keyrings across password changes by @Yoshiofthewire in #196
• feat: restore matching complete keyring backups by @Yoshiofthewire in #197
• feat: store verified complete keyring recovery by @Yoshiofthewire in #198
• feat(pgp): prepare device-envelope v3 by @Yoshiofthewire in #199
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #200
• feat(pgp): advertise device envelope support by @Yoshiofthewire in #201
• sso: back-channel logout and session identity (KySignOn D1 #1) by @Yoshiofthewire in #202
• sso: versioned directory desired state from KySignOn (D1 #2) by @Yoshiofthewire in #203
• sso: KySignOn app roles and session role ceiling (D1 #3) by @Yoshiofthewire in #204
• sso: action-bound KySignOn re-authentication for SSO sessions (D1 #4) by @Yoshiofthewire in #205
• chore(deps): bump the go-modules group in /backend with 2 updates by @dependabot[bot] in #206
• chore(deps): bump the frontend-runtime group in /frontend with 2 updates by @dependabot[bot] in #207
• chore(deps): bump vite from 8.2.2 to 8.3.0 in /frontend in the frontend-tooling group by @dependabot[bot] in #208
• sso: keep the password step-up for generic-provider SSO sessions by @Yoshiofthewire in #209
• rename: move module and image namespace to Busnes-app by @Yoshiofthewire in #211
• pgp: device-envelope v3 delivery, generation-aware acknowledgement, stale-device send gate by @Yoshiofthewire in #210
• rename: review follow-ups (attestation identity, CI coordinate check, recorded history) by @Yoshiofthewire in #213
• pgp: browser v3 device enrollment for converted accounts, stale device rows by @Yoshiofthewire in #212
• rename: state that the old GHCR namespace is untrusted by @Yoshiofthewire in #214
• chore(deps): bump pinned Ollama to 0.34.1 by @github-actions[bot] in #215
• fix: restore PGP device enrollment after v3 rollout by @Yoshiofthewire in #216
• chore(deps): bump pinned Ollama to 0.34.2 by @github-actions[bot] in #217
• Adopt Busnes theme defaults and shared product icons by @Yoshiofthewire in #225
• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #224
• chore(deps): bump the frontend-tooling group in /frontend with 2 updates by @dependabot[bot] in #223
• Align KyPost workspace navigation with Busnes UI by @Yoshiofthewire in #226
• chore(deps): bump react-router from 8.3.1 to 8.4.0 in /frontend in the frontend-runtime group across 1 directory by @dependabot[bot] in #222
• chore(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0 in /backend in the go-modules group by @dependabot[bot] in #221
• chore(deps): bump pinned Ollama to 0.34.3 by @github-actions[bot] in #220
• use versioned ky-ui tokens in KyPost by @Yoshiofthewire in #227
• Adopt shared UI foundation and verify responsive KyPost by @Yoshiofthewire in #228
• ui: theme SSO button and refresh device key before enrollment by @Yoshiofthewire in #230
• chore(deps): bump pinned Ollama to 0.34.4 by @github-actions[bot] in #229
• Fix send-as verification; always queue notifications for app pull by @Yoshiofthewire in #231
• Add shared health endpoint for kyPulse monitoring by @Yoshiofthewire in #234
• chore(deps): bump the frontend-tooling group in /frontend with 3 updates by @dependabot[bot] in #237
• chore(deps): bump the frontend-runtime group in /frontend with 2 updates by @dependabot[bot] in #236
• feat: pre-sort mail by headers and contacts by @Yoshiofthewire in #239
• docs: shorten the classifier prompt by @Yoshiofthewire in #242
• feat: native sign-on with a KyIdentity device token by @Yoshiofthewire in #240
• chore(deps): bump github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.2 in /backend in the go-modules group by @dependabot[bot] in #235
• fix(auth): hold the directory lock across sign-on and callback provisioning by @Yoshiofthewire in #243
• feat: add on-device embedding sorter by @Yoshiofthewire in #244
• feat: add opt-in incoming mail encryption by @Yoshiofthewire in #247
• chore(deps): bump pinned Ollama to 0.35.0 by @github-actions[bot] in #246
• chore(deps): bump pinned Ollama to 0.35.1 by @github-actions[bot] in #248
• Add guarded native mail and receiving foundations by @Yoshiofthewire in #249
• Reconcile native mailbox reservations and preparation by @Yoshiofthewire in #250
• feat: prove domains before native allocation by @Yoshiofthewire in #251
• fix(backup): preserve native database WAL by @Yoshiofthewire in #252
• fix: quarantine and qualify native restores by @Yoshiofthewire in #253
• Guard native state before cached access by @Yoshiofthewire in #254
• Enable opt-in native mailbox runtime by @Yoshiofthewire in #255
• feat: add opt-in durable native receiving by @Yoshiofthewire in #256
• fix: preserve mail on uncertain SMTP acceptance by @Yoshiofthewire in #257
• feat: protect native domain relay settings by @Yoshiofthewire in #258
• Integrate the qualified native mail stack into main by @Yoshiofthewire in #276
• Distinguish native restore attempts and qualify evidence purpose by @Yoshiofthewire in #277
• Align contribution template with human attestations by @Yoshiofthewire in #278
• Record signed identity evidence for held native restores by @Yoshiofthewire in #280
• Block native authentication during held recovery by @Yoshiofthewire in #281
• Land native authentication quarantine in main by @Yoshiofthewire in #283
• Repair native account authority while restore stays held by @Yoshiofthewire in #284
• Test oversized native WAL backup refusal by @Yoshiofthewire in #285
• fix: bound verified ID token issuance times by @Yoshiofthewire in #286
• fix: fence restored native identity tokens by @Yoshiofthewire in #287
• Test real Android native mail without IMAP by @Yoshiofthewire in #288
• Test SMTP reception through the native mail API by @Yoshiofthewire in #289
• fix: reset volume modes without FOWNER by @Yoshiofthewire in #290
• Retain safe native SMTP failure diagnostics by @Yoshiofthewire in #291
• fix: encode and fold generated MIME subjects by @Yoshiofthewire in #292
• Add private Rspamd sidecar to native receiving by @Yoshiofthewire in #294
• Add private Cloudflare receiving qualification pilot by @Yoshiofthewire in #296
• feat: offer verification codes for copying in webmail by @Yoshiofthewire in #299
• docs: set receiving profiles and continuous design by @Yoshiofthewire in #298
• chore(deps): bump source-map-js from 1.2.1 to 1.2.2 in /frontend by @dependabot[bot] in #297
• docs: specify native addressing model v2 by @Yoshiofthewire in #300
• deps: raise the relay workers' undici override and pin sharp by @Yoshiofthewire in #301
• feat: migrate native storage to addressing v2 by @Yoshiofthewire in #302
• feat: give native administrators no mailbox by @Yoshiofthewire in #303
• feat: support several verified native domains by @Yoshiofthewire in #304
• feat: allow re-adding a retired mail domain by @Yoshiofthewire in #305
• feat: manage several mail domains in admin UI by @Yoshiofthewire in #306
• fix: add Message-ID and Date to sent mail by @Yoshiofthewire in #307
• feat: add native aliases and address generations by @Yoshiofthewire in #308
• chore(deps): bump the frontend-tooling group in /frontend with 3 updates by @dependabot[bot] in #318
• feat: import mail from an external IMAP account by @Yoshiofthewire in #320
• Feat/mail import files by @Yoshiofthewire in #322
• feat: continuous Cloudflare publish and pickup by @Yoshiofthewire in #323
• feat: manual sender blocks for native receiving by @Yoshiofthewire in #324
• chore(deps): bump pinned Ollama to 0.40.0 by @github-actions[bot] in #312
• Feat/cf continuous worker by @Yoshiofthewire in #325
• feat: manual sender blocks for native receiving (#324 to main) by @Yoshiofthewire in #326
• feat: automatic escalating sender blocks for Maddy receiving by @Yoshiofthewire in #327
• feat: manage sender blocks from Server tab by @Yoshiofthewire in #328
• chore(deps): bump the go-modules group in /backend with 2 updates by @dependabot[bot] in #319
• feat: back up mail data through restic bulk snapshots by @Yoshiofthewire in #329
• feat: 5 GiB mailbox quotas with a drive reserve by @Yoshiofthewire in #330
• feat: refuse provisioning below restore release floors by @Yoshiofthewire in #331
• feat: record restore qualification for hold release by @Yoshiofthewire in #332
• feat: report native restore release readiness by @Yoshiofthewire in #333
• feat: release a native restore hold behind an explicit flag by @Yoshiofthewire in #334
• feat: native restore hold release (#334 to main) by @Yoshiofthewire in #335
• fix: accept a concurrent refresh of the same domain proof by @Yoshiofthewire in #336
• fix: refuse mail to a disabled extra mailbox as an unknown recipient by @Yoshiofthewire in #337
• fix: wrong step-up password and KySignOn popup confirmation by @Yoshiofthewire in #338
• feat: switch between mailboxes in webmail by @Yoshiofthewire in #339
• fix: switcher and dialog layout; move mail import and export to Security by @Yoshiofthewire in #340
• feat: show mail domains as a table by @Yoshiofthewire in #341
• fix: wait for SQLite locks in read-only mailbox validation by @Yoshiofthewire in #342
• feat: choose the mailbox from a dropdown by @Yoshiofthewire in #343
• fix: simplify the mailbox storage layout by @Yoshiofthewire in #344
• Add repeatable installer setup and prerequisite diagnostics by @Yoshiofthewire in #346
• fix: answer oversize contacts sync body with 413 by @Yoshiofthewire in #347
• feat: page older inbox mail with before= by @Yoshiofthewire in #348
• feat: thread replies via replyToMessageId by @Yoshiofthewire in #352
• feat: expose calendar invite parts as attachments by @Yoshiofthewire in #353
• feat: send calendar RSVPs as iTIP REPLY parts by @Yoshiofthewire in #354
• ci: add OpenSSF Scorecard workflow by @Yoshiofthewire in #357
• chore: standard Go bump method by @Yoshiofthewire in #358
• ci: bump govulncheck to v1.9.0 (v1.1.4 panics on Go 1.27.2) by @Yoshiofthewire in #372
• chore(deps): Bump golang from 1.26.9 to 1.27.0 by @dependabot[bot] in #365
• chore(deps): Bump the npm-build group across 1 directory with 2 updates by @dependabot[bot] in #361
• chore(ci): Bump actions/setup-node from 7.0.0 to 7.1.0 in the actions group across 1 directory by @dependabot[bot] in #362
• chore(deps): Bump node from 26.5.0-slim to 26.10.0-slim by @dependabot[bot] in #363
• chore(deps): Bump debian from 328d164 to eb593cf by @dependabot[bot] in #364
• chore(deps): Bump the go group in /backend with 2 updates by @dependabot[bot] in #360
• chore(deps): bump pinned Ollama to 0.40.1 by @github-actions[bot] in #366
• chore: land inbox API stack (#349–#352) on main by @Yoshiofthewire in #355
• ci: pin Go CI tools in tools/go.mod so Dependabot bumps them by @Yoshiofthewire in #359
• fix(backend): mailcache lock, SSRF client leak by @Yoshiofthewire in #367
• fix(poller): handle UIDVALIDITY changes; typed classifier errors by @Yoshiofthewire in #369
• feat(users)!: retire scrypt; Argon2id is the only password hash by @Yoshiofthewire in #373
• refactor(frontend): move compose out of App.tsx by @Yoshiofthewire in #374
• refactor(backend): dead code, logging API, stdlib crypto by @Yoshiofthewire in #376
• chore: land calendar RSVP (#354) on main by @Yoshiofthewire in #356
• fix(auth): step-up for user/SSO admin routes; per-IP lockout no longer refunded by @Yoshiofthewire in #368
• fix(frontend): stale-response races, sandboxed print, lint gate by @Yoshiofthewire in #370
• chore: compose env passthrough, untrack artifacts, shellcheck, README split by @Yoshiofthewire in #371
• refactor(poller): split tickMailbox; share user paths by @Yoshiofthewire in #375
• mfa: never send a push challenge to UnifiedPush in cleartext by @Yoshiofthewire in #381
• fix(push): never send UnifiedPush in plaintext by @Yoshiofthewire in #382
• chore(deps): Bump node from 26.10.0-slim to 26.11.1-slim by @dependabot[bot] in #377
• chore(deps): Bump golang.org/x/net from 0.59.0 to 0.60.0 in /backend in the go group across 1 directory by @dependabot[bot] in #378
• chore(deps): Bump the relay group across 2 directories with 3 updates by @dependabot[bot] in #384
• chore(deps): stop proposing typescript >=6.1 for frontend/lint by @Yoshiofthewire in #385
• feat(mail): snooze email until a chosen time (#379) by @Yoshiofthewire in #386
• feat(mail): scheduled send (#380) by @Yoshiofthewire in #388
• chore(deps): bump pinned Ollama to 0.40.2 by @github-actions[bot] in #387
• fix(app): wait for background sweepers on shutdown by @Yoshiofthewire in #389
• refactor(frontend): one datetime-local helper by @Yoshiofthewire in #390
• test(scheduled): close scheduled send test gaps by @Yoshiofthewire in #391
• feat(folders): report IMAP special-use role in folder list by @Yoshiofthewire in #392
• feat(setup): capabilities, read-only check, credential files and issuer binding for KyQuickStart by @Yoshiofthewire in #394
• chore(release): 0.4.0 by @Yoshiofthewire in #393
• chore(deps): bump pinned Ollama to 0.40.3 by @github-actions[bot] in #395
• ci: build and test with the image's Go and Node toolchains by @Yoshiofthewire in #396
• fix(security): one trusted client-IP header; CAPTCHA before lockout writes by @Yoshiofthewire in #397
• refactor(api): one keyed token bucket for every request throttle by @Yoshiofthewire in #410
• fix(security): bound IMAP reads and guard account mail dials by @Yoshiofthewire in #398
• fix(auth): require step-up to pair a device or grant push approval by @Yoshiofthewire in #399
• fix(sendas): bind domain proof to the probe itself and keep one owner per address by @Yoshiofthewire in #400
• feat(auth)!: never accept the account password, only authSecret by @Yoshiofthewire in #401
• fix(redaction): catch international PII in the default patterns by @Yoshiofthewire in #402
• fix(sso): bind links to their issuer; admin only from a configured group by @Yoshiofthewire in #403
• fix(contacts): order Autocrypt keys by date and validate every contact key by @Yoshiofthewire in #404
• fix(app): route health restarts through graceful shutdown by @Yoshiofthewire in #405
• fix(config): refuse bad configuration instead of defaulting by @Yoshiofthewire in #406
• refactor(native): admit native mailboxes through one shared function by @Yoshiofthewire in #407
• refactor(netguard): one SSRF dialer and one bounded transport by @Yoshiofthewire in #408
• chore(backend): delete production-unreachable code and gate it in CI by @Yoshiofthewire in #409
• feat(mail): sending quota for every account by @Yoshiofthewire in #416
• ci(security): fix Scorecard workflow and supply-chain findings by @Yoshiofthewire in #417
• test(fuzz): add Go fuzz targets; fix Sieve string quoting by @Yoshiofthewire in #418
• docs: start-to-finish guides for native mail, IMAP and cloudflared by @Yoshiofthewire in #423
• chore(deps): Bump the go group across 1 directory with 3 updates by @dependabot[bot] in #413
• chore(ci): Bump ossf/scorecard-action from 2.4.4 to 2.5.0 in the actions group across 1 directory by @dependabot[bot] in #414
• chore(deps): Bump github.com/Busnes-app/ky-primitives from 0.9.0 to 0.10.0 in /backend in the ky-primitives group across 1 directory by @dependabot[bot] in #419
• chore(deps): Bump vitest from 5.0.3 to 5.0.4 in /frontend in the npm-build group across 1 directory by @dependabot[bot] in #420
• chore(deps): Bump dompurify from 3.4.16 to 3.4.17 in /frontend in the npm-runtime group across 1 directory by @dependabot[bot] in #421
• chore(deps): Bump the relay group across 2 directories with 1 update by @dependabot[bot] in #422
• chore(deps): Bump rspamd/rspamd from 3.14.3 to 4.2.0 by @dependabot[bot] in #415
• release: v0.4.2 by @Yoshiofthewire in #425

Full Changelog: v0.3.0...v0.4.2