v2.10.5

• fix: bytes shadowing, ws rate-limit guard, notifier TOCTOU, POP3 STORE check, WSP response guards - on-data-mx.js: rename local 'bytes' to 'responseSize' to avoid shadowing the imported bytes() function (TypeError crash in webhook error path) - api-websocket-handler.js: wrap _checkRateLimit Redis pipeline in try/catch with optional chaining; return true (allow) on failure to prevent blocking all WebSocket upgrades when Redis is unavailable - get-attachments.js: wrap JSON.parse on split('}')[0] in try/catch to prevent crash on malformed bodystructure data - imap-notifier.js: replace TOCTOU read-then-decrement on concurrent connection counter with atomic Lua script that floors at 0 - on-close.js: same TOCTOU fix for MX/SMTP/ManageSieve concurrent connection counter using atomic Lua script - pop3/on-update.js: inspect onStorePromise result for _storeError before proceeding to EXPUNGE; log and skip if STORE failed - create-websocket-as-promised.js: add .unref() to ping interval to prevent blocking process exit - retry-client.js: move clearTimeout to finally block to prevent timer leak on error path - attachment-storage.js: add Array.isArray guard after WSP response before for-of iteration to prevent TypeError on non-array - imap/on-move.js: guard response.sourceUid with Array.isArray and optional chaining to prevent TypeError when WSP returns unexpected shape - app/controllers/api/v1/messages.js: add Array.isArray guards on all WSP stmt/pluck/all responses before .map() and .length access af42ca1
• fix: welcome-mailbox pug template, Array.isArray guards, notifier try/catch a2d1b6b
• chore: sync locales 4877c4e
• fix: WSP pattern fix, welcome email overhaul, Tangerine DNS migration 08f9a4c
• fix: db fixes, welcome email To field fix 8eca8b2
• fix(imap): separate error/success paths in on-store fn() callback 6626581

---

v2.10.4...v2.10.5