v2.5.1

Security

Upgrade if you run middleware.SPF.

v2.5.0 pins blitiri.com.ar/go/spf v1.5.1. The bump to v1.6.0 landed four
hours after that tag, so a consumer of v2.5.0 still reads the old library. This
release carries it.

v1.6.0 corrects four faults of the reader of a record:

• The count of the DNS lookups was off by one, and the check of the void
  lookups took the wrong number. RFC 7208 section 4.6.4 caps both. That cap
  is what holds the record of a sender from turning one message into a long run
  of queries.

• A ptr term counted its lookups wrong when a record named the term more
  than once.

• A ptr term matched a name against the address under test loosely, and
  it read a subdomain where it had to read the name itself. Such a match gives
  a pass to a sender that the record does not name.

• A macro that never ends, and an a or mx field with no domain, both read
  as valid.

middleware.SPF calls spf.CheckHostWithSender with the address, the HELO
name and the sender of the session. A client names all three, and the record
comes from the domain of the sender, so the reader stands on input of the
network.

Changed

• go.mod names toolchain go1.27.1. The go directive stays at 1.25.0,
  which is the lowest version that builds this module. A consumer on Go 1.25
  reads that line alone and sees no change: the toolchain line of a dependency
  does not reach the module that requires it.

Nothing else moves

go doc -all gives the same declarations at v2.5.0 and at this tag, 106 for
the package, 43 for middleware and 31 for smtptest. The two other commits
of the range add the daily security scan and the Go: Security Audit check of
a pull request, and neither reaches a consumer.

The changelog carries
the whole text of each entry.