v2.4.2

A patch release of the 2.4 stable line. Upgrade promptly if you run sdbox: 2.4.1 deletes sdbox messages older than a day (#2172). It also carries a Go toolchain security update (see Security).

Before you upgrade

These change what an existing configuration does. Read them against your values first.

• An explicit 0 now means "off" or is refused at startup; a negative value is refused (#2167). Defaults now have one source, so a key you leave out keeps its documented default. A key set to 0 either turns the setting off (68 keys: caches, delays, limits, intervals), or the process refuses to start and names the key (55 keys where "off" makes no sense: bounding timeouts, pool sizes, poll intervals, quota percentages). Director keys that used to read 0 as their default (user_expire, ping_interval, ping_timeout, user_kill_timeout and others) are among the refused ones. The old "negative = off" spellings of seed_poll_interval, backend_expire, max_parallel_moves and session_sync_interval are now 0. lmtp_user_concurrency_limit keeps its 2.4.1 meaning: -1 is unlimited, 0 is refused. components.auth.wait_pool_size never reached the config; the key is components.locks.client.wait_pool_size, and the old one fails the render with a pointer.
• The chart fails the render on a yarilo key name where it reads its own (#2166). Example: components.auth.passdb[0].passwd_file_path is not read; the chart expects passwd_file. Before, such a value was dropped without a word. Explicit 0, false and "" now reach the config instead of falling back to a default.
• quota-status looks recipients up by default (#2166). auth_master_addr now defaults to the release's auth master service. Unknown recipients, full mailboxes and users with a quota_rule get the configured rejection instead of success.
• A static userdb answers only users a passdb knows (#2168). New userdb_static_allow_all_users, default false; set true for the 2.4.1 behaviour. New username_filter on passdb entries (*, ?, !, comma or space separated).

Security

• Go 1.26.9 and golang.org/x/net v0.60.0 for GO-2026-6617, an HTTP/2 HPACK encoder race (#2170). 2.4.1 was built with Go 1.26.8 and x/net v0.59.0.

Fixed

• sdbox: the temporary-file sweep deleted delivered messages (u.*) older than 24 hours on the first open of each folder (#2172, #2173). It now removes only .temp.* files.
• maildir:
  • a reconcile keeps renamed messages and never reuses a uid (#2177);
  • the UID list is locked beside the list, not on the list itself (#2180);
  • a reconcile reads the UID list against its file (#2182);
  • the UID list lock spans the reconcile and the save section (#2185);
  • the list cache holds the descriptor it read through, so a reused inode can no longer hide a row (#2198).
• All formats: the APPEND date reaches storage and survives a rebuild (#2178).
• POP3: honours dbox_reactive_rebuild on the login heal (#2171).
• director:
  • a domain move kicks only the sessions this director holds, which ends a panic (#2188);
  • under the domain policy a sticky entry holds only while it names the domain's backend, so a moved domain is not split (#2194).
• auth: username_filter and the static userdb's allow_all_users (#2168).

Added

• Operator domain move: yarctl director domains move <domain> <backend-ip> and POST /api/director/domains/{domain}/move (#2191).
• Secrets from the environment: the OAuth2 client secret, the policy API header and the policy nonce take ${ENV}, with chart *_secret_ref keys that fill them from a Secret (#2165).
• Metrics: maildir_lock_hold_seconds has 25 ms buckets from 25 to 500 ms (#2189).

Verified

Acceptance run on the sandbox stand, develop a5a94861 (image 2.4.2-dev.1251), 2026-10-11: 23 of 23 criteria passed. That covers smoketest and imaptest on mdbox, maildir and sdbox, disk = index, aged mailboxes surviving an open, the domain move and back, no panics or pod restarts, and zero stopped-naming lines. UID list hold p99 was at most 175 ms.

Every change since 2.4.1: v2.4.1...v2.4.2.