v36.0

- **Feature**: Transactional email attachments support a per-attachment `content_id` for inline images (e.g. per-recipient QR codes) — set `disposition: "inline"` plus `content_id` and reference the image from the template as `<img src="cid:...">`. Works across all email providers; inline images are assembled in a `multipart/related` MIME subtree on Amazon SES (previously they could show up as dangling attachments in Gmail/Outlook) and the SMTP provider now emits the RFC 2045 angle-bracketed `Content-ID` header that strict clients like Outlook require (#393)
- **Fix**: SMTP connections on port 465 now use implicit TLS (SMTPS). Workspace SMTP integrations, the setup wizard's "Test SMTP Connection", and system emails (magic codes, invitations, alerts) always spoke plaintext-first SMTP — waiting for a greeting that an SMTPS server never sends before negotiating STARTTLS — so a port-465 + TLS configuration hung or timed out. With TLS enabled and port 465, the client now performs the TLS handshake immediately after connecting and skips STARTTLS. TLS on any other port still negotiates STARTTLS, and `use_tls=false` remains plaintext, including on port 465. The TLS handshakes in the raw SMTP sender (both implicit and STARTTLS) are also now bounded by the dial timeout instead of hanging indefinitely on an unresponsive server (#385)
- **Fix**: OIDC sign-in no longer permanently fails with IdPs that omit the `email_verified` claim (Microsoft Entra ID, Cloudflare Access): an absent claim decoded as `false` and rejected every first login. Setting the new env-only `OIDC_ALLOW_UNVERIFIED_EMAIL=true` (default `false`) accepts first logins whose id_token omits the claim; an explicit `email_verified=false` is still always rejected, and the rejection log now names the flag to set (#388)
- **Fix**: Enabling OIDC through the setup wizard persisted `oidc_scopes="openid"` (the wizard has no scopes field), and that stored value overrode the `openid email profile` default at boot — authorize requests then lacked the email/profile scopes, so IdPs returned tokens without an email. The wizard and the settings screen now persist the full default when scopes are left empty, and the v36 system migration heals existing rows still holding the bare legacy value (when a row is healed the server restarts once so the change takes effect immediately) (#389)
- **Feature**: Segments and automation conditions can now target link clicks by broadcast and by URL. A "clicked email" timeline condition can be scoped to a specific broadcast and/or to a clicked link, where the link is matched as a case-insensitive substring of the destination URL (e.g. `/pricing` matches `https://acme.com/pricing?utm_campaign=summer`). This makes segments and automation filters like "clicked the pricing link in the Summer Sale broadcast" possible; it builds on the per-link click data already recorded in `message_history.clicked_links`, so no migration is needed (#339, #311).
- **Fix**: Viewing the contacts of a segment no longer returns a server error. The `segments.contacts` endpoint ordered by a `created_at` column that `contact_segments` does not have, so every request failed; it now orders by `matched_at` (when the contact joined the segment).
- **Fix**: Removed the "Photo URL" option from the automation *contact updated* trigger's field list — contacts have no photo-URL field, so an automation filtered on it could never fire.
- **Fix**: Segment/automation conditions that filter contact-timeline events by a field value now work. The query builder referenced a non-existent `metadata` column on `contact_timeline` (event fields live in the `changes` JSONB as `{field: {old, new}}`), so any such condition failed at SQL execution; it now reads the field's new value from `changes`.
- **Fix / Change**: The contact timeline now records email engagement events in the same dot notation as the rest of the timeline and the webhooks — `email.opened`, `email.clicked`, `email.bounced`, `email.complained`, `email.unsubscribed`, plus `email.sent` and `email.updated` — replacing the old `open_email` / `click_email` / `insert_message_history` / `update_message_history` names. This fixes automations triggered by an email engagement event, which previously never fired because the trigger listened for `email.clicked` while the timeline stored `click_email`. Workspace migration v36 renames existing timeline rows, rewrites stored segment definitions (both the tree and the compiled query) and regenerates the triggers of already-live automations, so segments and automations keep working without needing to be re-saved. The `email.sent` and `email.delivered` options were removed from the automation trigger list — they could never fire, and an `email.sent` trigger would loop an "every time" automation that sends email. (#339)
- **Security**: `golang.org/x/crypto` is pinned to 0.52.0 in both Go modules, closing the SSH-related advisories (12 critical/high) flagged by Dependabot.
- **Fix**: Automation email nodes now display the selected template's name on the canvas for non-marketing templates (e.g. `welcome`). The canvas resolved names from a reference list restricted to `category: 'marketing'`, while the node picker lets you select an email template of any category — so a validly selected non-marketing template fell back to the generic "Template set" label; the reference list is no longer category-restricted (#391).
- **Change**: Mailjet can now only be used as a transactional email provider, not a marketing one, because the Mailjet API overwrites unsubscribe links and breaks Notifuse's unsubscribe links. Newly assigning Mailjet as the marketing provider is rejected at settings-save, and marketing sends are refused at provider resolution — so workspaces that already had Mailjet assigned keep saving unrelated settings normally, but their broadcasts fail with a clear error until they switch the marketing provider.