This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
ReleasePort's take
Light signalVersion v3.3.1 introduces several bugfixes and a new feature in the conn module while deprecating an email‑address utility.
Why it matters: Bugfixes improve stability of conn results, queue handling, proxy operations, and parsing logs; adding main.postel enhances flexibility; removing @haraka/email-address wrapper requires code updates. Severity scores are uniformly moderate (40).
Summary
AI summaryUpdates conn, refactor, and feat across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
add main.postel option to conn module add main.postel option to conn module Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
add proxy support for SMTPS (port 465) add proxy support for SMTPS (port 465) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Expose fetch to plugins Expose fetch to plugins Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Dependency | Low |
bump many dependencies to latest versions bump many dependencies to latest versions Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Dependency | Low |
update @haraka/eslint-config to version 3 update @haraka/eslint-config to version 3 Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Dependency | Low |
use ~2.1.1 of haraka-utils for position‑aware MAIL/RCPT errors use ~2.1.1 of haraka-utils for position‑aware MAIL/RCPT errors Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Deprecation | Medium |
remove @haraka/email-address wrapper utility remove @haraka/email-address wrapper utility Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
flag soft queue denials in conn results flag soft queue denials in conn results Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
wrap util.createFile in try block to prevent crashes wrap util.createFile in try block to prevent crashes Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
update local and remote results after proxy operation update local and remote results after proxy operation Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
log failures when MFROM or RCPT parsing fails log failures when MFROM or RCPT parsing fails Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Low |
Change package name from Haraka to haraka Change package name from Haraka to haraka Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Refactor | Low |
Use net_utils.endpoint in auth_proxy Use net_utils.endpoint in auth_proxy Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Refactor | Low |
Move endpoint, HostPool, LineSocket to net-utils Move endpoint, HostPool, LineSocket to net-utils Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Refactor | Low |
Move rfc1869, FsyncWriteStream, TimerQueue to haraka-utils Move rfc1869, FsyncWriteStream, TimerQueue to haraka-utils Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Refactor | Low |
Move cram_md5_response to haraka-utils Move cram_md5_response to haraka-utils Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
Full changelog
- fix(conn): flag soft queue denials in results
- feat: expose fetch to plugins
- change: remove @haraka/email-address wrapper #3598
- change: log when MFROM or RCPT fail to parse #3581
- fix: change package name from Haraka to haraka #3596
- fix(haraka): wrap util.createFile in a try #3595
- fix(conn): update local and remote results after proxy #3593
- feat(conn): add main.postel option #3592
- feat: proxy support for smtps (465) #3577
- refactor(auth_proxy): use net_utils.endpoint #3584
- refactor: move endpoint, HostPool, LineSocket to net-utils #3583
- refactor: move rfc1869, FsyncWriteStream, TimerQueue to haraka-utils #3585
- refactor: move cram_md5_response to haraka-utils #3585
- dep(many): bump to latest #3587
- dep(eslint): update @haraka/eslint-config to v3, #3586
- dep(haraka-utils): ~2.1.1 for position-aware MAIL/RCPT address errors
- build: add qlty config and README badge #3588
- test: update to test-fixtures 1.7.0 helpers #3589
Breaking Changes
- Removed @haraka/email-address wrapper (#3598)
- Changed package name from Haraka to haraka (#3596)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]