v1.1.2

Added

• Link safety. unoMail can download a list of known phishing domains
  (Phishing Army by default), refresh it in the background and keep it on
  disk. The built-in filter scores incoming mail that links to a listed
  domain, and the web client marks such links and asks before opening them.
  Link hosts are checked through your own server only.
• Tracking parameter removal. Tracking parameters are stripped from links
  in shown, quoted and forwarded messages, using clean-url's parameter list
  by default.
• Both features are configured under Server settings > Link safety.

Security

• Fair connection limits. Before, the web listener refused everyone once
  512 connections were open (128 per network), so four addresses holding idle
  connections could lock out the web client, JMAP, DAV and ACME HTTP-01. The
  mail ports had the same weakness at 1024 connections (20 per IPv6 /64).
  Each listener now has its own slots. When a listener is full, a new
  connection takes the oldest connection of the group holding the most slots,
  as long as that group holds clearly more than the newcomer's group. Groups
  are IPv4 addresses and IPv6 /48s. A session whose slot is given away ends.
• Summary cards only from authenticated senders. Cards were made from the
  From domain without checking it, so a forged bill from a domain without
  DMARC enforcement could show a "Pay bill" card with the forger's link. A
  card now needs one of: a DMARC pass, a DKIM signature aligned with the From
  domain, a signed-in local sender, or a source the operator trusts. Mail from
  trusted networks and relays is marked on arrival with
  X-Unomail-Trusted-Source, a header only the server may write. Mail that
  users store themselves (imports, APPEND) makes no cards.
• /metrics behind an untrusted proxy. When a reverse proxy on the same
  host was not listed in UNOMAIL_TRUSTED_PROXIES, every client looked like
  loopback. As a result, /metrics was open to the internet without a token
  and all clients shared one login limit. Requests relayed by such a proxy no
  longer reach /metrics, and the server logs the misconfiguration at startup
  and on the first relayed request.
• SSO account linking. With "Only accept addresses the provider reports as
  verified" turned off, the first identity naming an address claimed its
  mailbox, including an administrator's mailbox. An administrator mailbox is
  now linked only through a verified address. Every unverified link is
  recorded in the audit log, and the setting shows a warning when it is turned
  off.

Deployment

• Base images in the Dockerfile are pinned by digest, so a re-pushed tag
  can't change a build. Renovate updates the digests.
• The example docker-compose.yml follows the 1.1 release line instead of
  latest, so moving to a new minor version is a deliberate step.
• Releases are documented as signed annotated tags, and the release workflow
  warns about unsigned tags.
• Changes to CI, the container and dependency files now require maintainer
  review (.github/CODEOWNERS).