The first release run stopped at govulncheck: go.mod named 1.26.5, so
the workflow built with it, and 1.26.5 carries four standard-library
vulnerabilities the tool reaches (net/url GO-2026-6218, crypto/tls
GO-2026-6090, encoding/asn1 GO-2026-5972, net/http GO-2026-5026), all
fixed in 1.26.6. 1.26.8 is the current patch release; govulncheck is
clean on it, and it is also the minimum for building from source.
deploy stands up Stalwart 0.16, ihasmail and (for a mail host) Caddy as a
compose project: completes Stalwart's bootstrap over x:Bootstrap, links
ihasmail over the private network, requests certificates for both Caddy
(TLS-ALPN-01) and Stalwart (HTTP-01 through Caddy), makes the auto-ban safe
behind the proxy, and proves the link by signing in through the webmail.
--local gives a loopback-only pair. certs retries Stalwart's certificate;
destroy removes a deployment.
e2e/public.sh runs the whole mail-host path against Pebble with no
internet involved.
jcoffey-dev