release 2.8.13

• Changes
  • new haraka-plugin-limit #1785
    • replaces plugin/limit, plugin/rate_limit, and haraka-plugin-outbound-rate-limit
  • p0f: skip on private IPs (normally empty) #1758
  • spf: skip for outbound when context != myself #1763
  • redis: plugins using redis can inherit redis config #1777
  • redis: replace plugins/redis with haraka-plugin-redis #1786
  • lint: require space before function declaration #1784
  • lint: added eslint:recommended #1790
  • logger: remove logger.colorize code for legacy node versions
• New Features
  • redis: add redis_subscribe_pattern() #1766
  • queue/discard: add ENV that permits discarding #1791
• Improvements
  • rspamd: improve response parsing #1770
  • restore Windows testing to working state #1755
  • elasticsearch: use UTC dates for index creation #1771
  • tls: fix dhparam usage example syntax #1774
  • typo: logerr -> logerror #1776
  • when generating long DKIM keys, include a BIND compatible folded key #1775
  • in haraka-test-fixtures, access results via fixtures.results #1783
  • integration test: end to end server testing #1791
• Bug Fixes
  • spf: restore functionality for relay context=myself #1759
  • rate_limit:if incr creates a new record, assure it has a TTL #1781
  • tls: do not create a top level secureContext #1787
  • dnswl: swap lines to fix missing inherited methods #1793
  • dnswl: fix config loader callback syntax #1794
  • tests/plugins: unset process.env.HARAKA to avoid side effects that interfere with other tests
  • remove auth_flat_file sample auth user #1796

release 2.8.12

• Changes
  • plugin/karma -> npm packaged haraka-plugin-karma #1747
  • update generic-pool 2.4.2 -> 2.5.0
• New Features
  • Added option to bypass SpamAssassin headers' merge #1745
• Improvements
  • reduce severity of debug message #1744
  • fix misleading entries in config/tls.ini #1734
  • Misc. performance improvements #1738
  • set tls.sessionIdContext property (for Thunderbird compat) #1740
• Bug Fixes
  • Swap lines to avoid clobbering response array #1743

release 2.8.11

• Changes
  • rename core_require to haraka_require #1708
  • move log.syslog to haraka-plugin-syslog #1698
  • remove tls.ini loading and is_no_tls_host to net_utils #1690
  • replace ./utils with npm packaged haraka-utils #1720
  • require node 4
  • karma: add .top TLD scoring #1714
• New Features
  • Implement OCSP Stapling #1724
• Improvements
  • show help for npm packaged plugins included in core #1698
  • use tls.connect for client #1682
  • bring port 465 SMTPS TLS config support on par with STARTTLS #1667
  • use tls.connect instead of createSecurePair #1678
  • redis: improve error handling in tests #
  • replace / path seperators with path.* for cross platform compat #1713
• Bug Fixes
  • dkim_sign: per-domain key finding fixed #1707
  • Rspamd: restore spam report header #1702
  • auth/vpopmail: do not toString() when null #1695
  • fix outbound to avoid recursive reading key/cert after refactoring #1692
  • tls: fix option servername (not hostname) #1728
  • correct Auth-Results cleaning #1726
  • fix results for connection.remote_host and NXDOMAIN #1716

v2.8.10

• Changes
  • use standard npm syntax for lint and tests #1646
  • remove ./net_utils to haraka-net-utils #1644
  • remove incorrect and unused spf.hello_host #1635
  • remove rogue DENYSOFT copy-pasta error #1634
  • update async to v2 #1545
  • remove plugin/dir support from base haraka #1668
    • use node_modules_dir support instead
  • use TLSSocket instead of createSecurePair #1672
  • refactor plugins/tls #1670
  • moved watch plugin to npm as haraka-plugin-watch #1657
  • normalize proxy properties #1650
• New Features
  • added connection.remote.is_private boolean #1648
  • added additional TLS options (@typingArtist) #1651
  • added wildcard boolean support to config loader #1680
  • tls: allow multiple key and cert parameters for RSA+ECDSA #1663
  • permit specifying haraka plugins w/o haraka-plugin- prefix #1645
    • in config/plugins and resultstore
• Improvements
  • connection.geoip replaced by haraka-plugin-geoip #1645
  • connection.asn replaced by haraka-plugin-asn #1645
  • permit specifying npm packaged plugins w/o haraka-plugin prefix #1647
  • normalized connection properties #1547, #1577
  • Rspamd: fix spambar for negative scores #1630
  • set connection.remote.is_private early
    • replace calls to net_utils with remote.is_private test
• Bug Fixes
  • Tidy-up graceful shutdown and fix for non-cluster mode #1639
  • Fix data.headers plugin crash #1641
  • Fix access plugin crash #1640
  • Minor DKIM fix #1642
  • do not set TLS timer if timeout=0 #1632
  • do not overwrite config/host_list on install #1637
  • correct smtp_forward cfg for multiple rcpts #1680
  • fix TLS timeout errors #1665

Oct 02, 2016

2.8.9 - Oct 02, 2016

Note this release contains a major security fix for those using the attachments plugin. Previous versions of this plugin allowed remote code execution using specially crafted zip files. Users are urged to upgrade as soon as possible.

• Changes
• New Features
  • Support outbound.pool_timeout of 0 to effectively disable pooling. #1561
  • Added never_add_headers option to rspamd plugin. #1562
  • rcpt_to.routes URI format w/ LMTP support #1568
• Improvements
  • The delay_deny plugin now has a whitelist mode (vs blacklist). #1564
  • Don't show the private key in logs for dkim_sign. #1565
  • update geoip for compat with newer ES (#1622)
  • drop node 0.10 testing / official support (#1621)
  • watch plugin displays UUIDs as URL (#1624)
  • Catch errors on header decode in rfc2231 #1599
  • Attachment plugin updates (#1606)
  • add outbound.ini pool_timeout example setting #1584
• Bug Fixes
  • Fixed some small documentation issues. #1573, #1616, #1612
  • Fixed AUTH PLAIN when it spreads over two lines. #1550
  • Fixed dkim_verify calling next() too soon. #1566
  • Fixed bugs with outbound pools who shutdown before we QUIT. #1561, #1572
  • outbound issues #1615, #1603
  • Fixed adding/removing headers in rspamd plugin. #1562
  • Fixed process_title not shutting down. #1560
  • fix a spurious error emitted by p0f (#1623)
  • fix header version hiding (#1617)
  • messagestream returns destination (#1610)
  • plugins.getdenyfn now passed 3rd params arg (#1591)
  • Fix scope of spf logdebug (#1598)
  • fix rabbitmq deliveryMode bug (#1594)
  • fix dkim_sign TypeError with null mail_from.host (#1592)
  • fix dkim_sign attempting to lower an undefined (#1587)

July 20, 2016

• Changes
  • removed UPGRADE.doc to wiki
• Improvements
  • support + wildcard in aliases plugin #1531
  • Support dkim_sign with outbound.send_email() #1512
  • spf: always check remote IP, then public IP if != pass #1528
  • spf: diplay IP used for SPF eval #1528
• Bug Fixes
  • handle missing wss section in http.ini #1542
  • fix leak on socket write error #1541
  • add results property to outbound transaction #1535
  • don't unref unref'd wss server #1521

v2.8.7

2.8.7 - Jun 18, 2016

• Changes
  • Fix geoip test
• Improvements
  • Allow alias plugin to explode to a list of aliases
  • Support IPv6 literals in HELO tests (#1507 thanks @gramakri)
  • Make ldap plugin use the modified address if a rcpt hook
    changes it (#1501 thanks @darkpixel)
• Bug Fixes
  • Fix loading plugins as npm modules (#1513)
  • More DKIM fixes (#1506 thanks @zllovesuki)
  • Fix the long failing host-pool-timer test (#1508)
  • Fix clean shutdown of redis with new shutdown code
    (#1504 and #1502 thanks @darkpixel)
  • More fixes to clean shutdown (#1503)

v2.8.6

• Bug Fixes
  • Fix loading under Node v4 which sends a blank message
  • Fix quit (SIGINT) when running without nodes=

Release 2.8.5

• Changes
  • The connection object is now passed to get_plain_passwd. Older
    modules should continue to work as-is.
  • The reseed_rng plugin now just uses the Crypto module from core.
    Though it seems this plugin should be irrelevant with newer versions
    of node.js
• New Features
  • Outbound mail now uses pooled connections, only sending a QUIT
    message if the connection has been idle for a while.
• Improvements
  • Shut down and reload (via haraka -c <path> --graceful) is now
    graceful - allowing current connections to finish and plugins
    to clean up before ending.
• Bug Fixes
  • Bind maxmind version to ignore API change (#1492)
  • Fix encodings when banners are used (#1477)
  • Various DKIM fixes (#1495)

v2.8.4

• Bug Fixes
  • Fix plugin loading override when installed (#1471)