Rspamd Files

Incompatible changes

• GPT: The condition callback now returns only a boolean; request content generation moved into gpt_check
• Workers: Ship explicit allow_file_and_shm_inputs = true defaults for the normal, controller and proxy workers (the default becomes false in the next major release)

Features

• Fuzzy: Share sender facts (SPF, DKIM, DMARC, PTR state, recipient bucket, TLS) with storages over encrypted rules
• PDF: Font-aware text extraction — decode simple font text via the font's /Encoding (Annex D base encodings and /Differences overrides) and parse /ToUnicode CMaps to decode composite (Type0) fonts
• Elastic: Structured fuzzy match results and message size in the schema

Bug fixes

• Protocol: Gate File/Path/Shm message sources behind allow_file_and_shm_inputs — previously any TCP client could have arbitrary files parsed
• Controller: Rate limit authentication failures per source (max_auth_failures)
• Fuzzy: Per-key forbidden_ids now replaces the default set instead of adding to it; apply the per-key ACL to delayed v1 replies; skip unknown wire extension types instead of rejecting the whole command; do not share extensions for authenticated senders, own networks or plain text rules
• Neural: Bound static_embed word extraction with max_words and drop the quadratic subject prepend; fuse over the provider slot range so one missing provider does not discard the rest
• PDF: Keep TJ positioning gaps out of the character code stream; keep inline /Resources dictionaries so page fonts are visible; store CMap codes with their byte width to avoid collisions; refuse a CMap that inherits from another instead of returning partial text; drop the font-blind ligature substitution
• Charsets: Keep computed text parts raw and resolve CED charset names through the alias table; restrict the EUC-TW misnomer aliases to CED output
• Hyperscan: Make the cache usable with a Redis backend (replica reads, null replies, maps read after fork); do not fetch a database that is already installed
• URLs: Treat a schemeless email href as mailto, not HTTP userinfo (spurious URL_USER_PASSWORD); do not drop flagless URLs when all flags are included
• Symcache: Stamp slow-rule start under the same condition it is measured, eliminating phantom slow-rule warnings
• Hfilter: Compare HELO addresses against the connecting IP, ignoring transient lookup failures
• Mime: Unwind every boundary level when returning from nested parts in all lua_mime rewriters
• ARC: Score ARC_ALLOW_TRUSTED at most once
• History: Clear all rows on reset in both the legacy ring buffer and the Redis backend; WebUI search now covers symbol option values
• Lua: Fix logger format string and argument mismatches

Full changelog: https://github.com/rspamd/rspamd/compare/4.1.4...4.1.5