v1.0.4

[1.0.4] - 2026-09-10

Added

Changed

• HTTP and JMAP connections are pinned to the account that authenticated them.
• HTTP and JMAP routing identifiers are split on routing.master_user_separators.
• A backend authentication failure now counts towards listener.max_auth_attempts.

Fixed

• A backend authentication failure no longer leaves the client bridged to the backend unparsed.
• POST /connections/kick now covers HTTP and JMAP sessions, including upgraded WebSocket bridges.
• POST /connections/delay now covers HTTP and JMAP logins.
• A rejected SASL response is no longer re-parsed as a command, which charged two authentication failures for one client mistake and could drop a command pipelined behind it.
• An empty routing identifier is no longer treated as an account, so it is neither registered nor used to pin an HTTP connection.
• A backend leg rejected at authentication is now closed with the protocol's logout command instead of having its socket dropped.

---

Check binary attestation here