[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/devture/exim-relay	patch	4.99.5-r0-2 → 4.99.5-r0-4

---

Release Notes

devture/exim-relay (ghcr.io/devture/exim-relay)

v4.99.5-r0-4

Compare Source

v4.99.5-r0-3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve the Exim relay image update from 4.99.5-r0-2 to 4.99.5-r0-4 unchanged. Upstream adds opt-in inbound AUTH/TLS and updates Alpine to 3.24.4; the existing internal relay configuration remains compatible. Isolated image configuration, trusted-client SMTP and spool checks passed, and the supplied source CI reports PHP/frontend success. No deprecations or migration debt were identified in this update; live delivery, provider authentication and existing production queues were not exercised.

Agent-assessed risk: Low. The existing relay defaults and integration remain compatible in isolated tests, but actual external delivery and production spool continuity were not tested.

Evidence (8 items)

• Local check: git diff eecee152777a8665525375703ddbf23ffc81ddfd...refs/artidezi/inputs/source-pr; git merge-base; git diff --check — Merge base equals recorded target eecee15. Only compose.prod.yml image tag changes; whitespace check passes. No newer-target integration delta exists. Working tree remains clean.
• Upstream diff: source — Official GitHub compare API shows optional inbound SMTP AUTH/TLS addition (a39ebda) and Alpine 3.24.3 to 3.24.4 (2f00256). Existing outbound LOGIN/PLAIN client settings remain intact. No removals or deprecations found.
• Documentation: source — Inbound TLS needs certificate and key files; inbound AUTH needs a users file and normally TLS. Repository mounts only the spool and provides none of these files, so these features remain disabled. Image retains uid/gid 100:101, port 8025, private-network relay defaults and spool path.
• Local check: docker compose --env-file /dev/null -f /tmp/artidezi-compose-prod.yml config --format json (candidate file extracted with git show) — PASS with synthetic HOSTNAME/SMARTHOST/SMTP credentials: expected candidate image, user 100:101, sender-verification setting and /var/spool/exim mount. No deployment .env files read; standalone mailer service checked, stack not started.
• Local check: docker pull ghcr.io/devture/exim-relay:4.99.5-r0-4; docker run --rm --network none --user 100:101 [synthetic mailer environment] ghcr.io/devture/exim-relay:4.99.5-r0-4 exim -bV — PASS: candidate image pulled and Exim configuration parsed using repository UID/GID and synthetic smarthost credentials.
• Local check: docker run --rm -i --network none --user 100:101 [synthetic mailer environment] ghcr.io/devture/exim-relay:4.99.5-r0-4 exim -bh 172.20.0.2 — PASS: EHLO, MAIL FROM and RCPT TO simulation accepted trusted client; AUTH/STARTTLS not advertised without optional files. QUIT before DATA; no mail submitted. Network disabled, TEST-NET smarthost used.
• Local check: docker run --rm --network none --user 100:101 --tmpfs /var/spool/exim:uid=100,gid=101,mode=0750 [synthetic mailer environment] ghcr.io/devture/exim-relay:4.99.5-r0-4 sh -ec 'touch /var/spool/exim/fixture; exim -bP spool_directory daemon_smtp_ports tls_advertise_hosts' — PASS: isolated fresh spool writable by service user; spool path /var/spool/exim and listener 8025 retained. Existing deployment queues not accessed.
• Evidence: Supplied source CI snapshot for 0aa4183c7bc16e1be00bca39f8a1d2099c57035d — Reports successful php and frontend checks. These are supplied forge evidence, not locally rerun Composer/PHPStan/style/lint/type/build checks; unaffected application suites were not duplicated. Controller must refresh forge checks.

Assessed source 0aa4183c7bc16e1be00bca39f8a1d2099c57035d.