A critical security vulnerability was reported on CPython 3.14.7, so
every image built on the shared python-uv base must run 3.14.8. The
requires-python floor of backend and mta-in is raised accordingly so
an older interpreter can no longer be used by mistake.
uv is bumped to 0.12.24 because 0.12.13 does not know the 3.14.8
download and the base image build failed.
Local parts are ASCII-folded — never str.lower(), which maps U+212A onto "k"
and would resolve a look-alike to someone else's mailbox — for everything we
own or resolve: mailbox lookup, login identity, inbound recipients. Domains
are IDNA-canonicalized. Addresses we merely carry, in contacts and MIME
headers, keep the case they were typed or received in. core.mda.addresses is
the single policy, held in place by a pylint checker and an eslint rule that
ban hand-rolled '@' splits and Unicode case folding.
Migration 0035 folds existing rows and reports the collisions it will not
merge on its own. Also drops mta-out, and adds dual RSA+ECDSA certificates,
per-refusal logging and an mta_session correlation claim to mta-in.
Notably, we try to reduce disk usage by standardizind on common
base Docker images. We also improve node_modules by reducing
duplicate dependencies and install speed.
