Loomio Files

• Fix: Vulnerable dependencies blocked Haraka mail-relay image builds. Updated email authentication and HTTP libraries now pass the production dependency audit
• Fix: Malformed or duplicate From headers could avoid authentication failure handling. Messages sent to group email addresses with these headers are now held for approval

Email authentication

The mail relay used vulnerable Nodemailer address parsing and Undici HTTP libraries, causing its image build to fail the dependency audit. This release upgrades Mailauth to 8.0.4, Nodemailer to 10.2.1, and Undici to patched versions. See the Nodemailer address parsing advisory and Undici HTTP response handling advisory.

The older integration could omit authentication failures for malformed or duplicate From headers. The relay now uses Mailauth's combined authentication API, preserving sender validity checks through DMARC evaluation and reporting invalid senders as authentication failures. Group-addressed messages with these failures follow the existing sender approval process. Forwarded messages can still authenticate through aligned DKIM when SPF fails.

Upgrading

Update both the application and Haraka mail-relay images using the Upgrading Loomio guide.

See the full changelog.