chore(master): release 2.74.0

[github-actions]

🤖 I have created a release beep boop

2.74.0 (2026-07-23)

This release adds per-account compatibility and TLS controls for connecting to non-standard IMAP and SMTP servers, and makes outbound delivery safer: internal errors can no longer cause queued messages to be silently discarded.

Highlights:

• New account settings. Accounts can opt out of IMAP4rev2 for servers whose IMAP4rev2 support misbehaves, and can allow invalid TLS certificates on a per-account basis - for both the IMAP and SMTP connection - instead of relying on the global "ignoreMailCertErrors" setting.
• No more lost outbound mail on internal errors. Delivery permanence is now decided by the actual SMTP response, not by internal status codes, so an RPC timeout or worker restart during a send is retried instead of discarding the queued message. Transient 4xx rejections such as greylisting are also retried instead of being dropped on the first attempt.
• Token minting is gated. While no admin password is set, access tokens can no longer be minted anonymously: the admin UI route requires an authenticated session and the API route refuses unauthenticated callers. The documented headless provisioning flows keep working.
• More resilient IMAP sync. Folders that are listed by the server but reject SELECT (for example Dovecot shared-namespace roots) are parked instead of repeatedly tearing down the whole connection, and servers that drop connections shortly after login no longer trigger rapid reconnect loops.
• Hardened build and setup. The Docker image ships the previously missing root-level CLI modules and is smoke tested before it is published, and the setup script creates production secret files owner-only.
• Dependency updates, including ImapFlow 1.5.0.

Features

• imap: add a per-account IMAP4rev2 opt-out and account-level TLS certificate override (59764fd)
• ui: add the account-level invalid-certificate override to the SMTP settings as well (7d1b9e4)

Bug Fixes

• ci: give the Docker builds a cache backend and smoke test by digest (4554d90)
• ci: smoke-test the image before publishing and harden the allowlist test (c285fcb)
• deps: update dependencies (3370f0a)
• deps: update dependencies (e1256b2)
• deps: update dependencies (imapflow 1.5.0) (8cc45ac)
• docker: ship the root-level CLI modules in the image (a63cb4e)
• gitignore: cover every local env file, not just the exact name (16124d5)
• imap: park phantom folders and throttle short-lived-connection reconnects (da97da3)
• imap: store the connection error response as text, not as a parsed object (3cf8d2e)
• setup: create production secret files owner-only (52f0527)
• submit: retry transient 4xx SMTP rejections and gate token minting on the request principal (1688c86)
• submit: stop discarding queued mail on non-SMTP 5xx errors (f80f475)
• test: provision scope-test tokens as a trusted local caller (20ca781)
• tokens: refuse to mint an access token before an admin password is set (ff3dd47)

Performance Improvements

• docker: cache the dependency install and smoke test the CLI in the image (e275733)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v2.74.0

🌻