v30.1

Notifuse/notifusev30.1May 12, 2026by pierre-b

AI Summary

This release addresses a security vulnerability in OpenTelemetry, updates dependencies, and introduces a breaking change to SMTP authentication when TLS is explicitly disabled.

Key Highlights

Security: CVE-2026-29181 fix (go.opentelemetry.io/otel to v1.41.0)
Deps: gomjml bumped to v0.12.0
Breaking: SMTP auth with SMTP_USE_TLS=false now uses PLAIN-NOENC explicitly

Breaking Changes

SMTP auth with SMTP_USE_TLS=false now uses PLAIN-NOENC instead of SMTPAuthAutoDiscover - operators using relays requiring SCRAM/CRAM-MD5 must enable TLS

Full Release Notes

- **Security**: Bumped `go.opentelemetry.io/otel` to v1.41.0 in `telemetry/go.mod` (CVE-2026-29181).
- **Deps**: Bumped `gomjml` to v0.12.0.

### Breaking Changes

- **SMTP auth with `SMTP_USE_TLS=false`**: When TLS is explicitly disabled, the SMTP client now uses `PLAIN-NOENC` (go-mail's `SMTPAuthPlainNoEnc`) explicitly instead of `SMTPAuthAutoDiscover`. Previously, go-mail's auto-discover refused `PLAIN`/`LOGIN` over an unencrypted connection (only `SCRAM-SHA-*` and `CRAM-MD5` were tried), and `SMTPAuthPlain` itself also refused unencrypted connections at the AUTH step. `PLAIN-NOENC` bypasses both gates while sending the standard `AUTH PLAIN` command on the wire, so any server that advertises `AUTH PLAIN` (e.g. local maddy/Mailpit relays) accepts it. Operators who have set `SMTP_USE_TLS=false` have already accepted plaintext credential transit, so forcing `PLAIN` aligns with their stated intent. **Action**: none if your relay accepts `PLAIN`. If your relay only accepts `SCRAM`/`CRAM-MD5`, you must enable TLS (`SMTP_USE_TLS=true`) — auto-discover continues to apply when TLS is on.