CHANGES-202605.md: add entry for trusteddomainproject#406 (report attachment filename)

Author: thegushi

CHANGES-202605.md

@@ -82,6 +82,7 @@ Significant gaps between the generated aggregate report XML and RFC 7489 require
 - **RFC 2822 date format in aggregate report body**: The `"generated at"` line in aggregate report email bodies previously used `localtime()`, producing a locale-dependent string with no timezone. Now uses `strftime("%a, %e %b %Y %H:%M:%S %z (%Z)", localtime())`, matching RFC 2822 day-month-year ordering and the format already used for the report's `Date:` header. (#388; written by Juri Haberland for openSUSE, submitted by Dirk Stöcker)
 - **UTC timezone enforced in `opendmarc-expire` and `db/schema.mysql`**: `opendmarc-expire` now issues `SET TIME_ZONE='+00:00'` immediately after connecting to the database, ensuring timestamp arithmetic is consistent regardless of the server's local timezone setting. `db/schema.mysql` includes the same statement for new installations. A `db/update-db-schema.mysql` migration script is provided to upgrade existing 1.4.2 databases. (#390; written by Juri Haberland for openSUSE, submitted by Dirk Stöcker)
 - **`Content-Description` headers added to failure report MIME parts**: The milter-generated AFRF failure report now includes RFC 2183 `Content-Description` headers on each MIME part (`Notification`, `DMARC failure report`, `Failed message headers`), improving compatibility with webmail clients that use these labels to display or filter parts. Covers both the direct `ReportCommand` path and `opendmarc-reports --forensic` (which is a pass-through). (#380; written by Juri Haberland for openSUSE, submitted by Dirk Stöcker)
+- **Aggregate report attachment filename included full spool path**: The `Content-Disposition` attachment filename used the full filesystem path of the temporary report file (e.g. `_var_db_opendmarc_reporter.example!domain.example!...xml.gz`) instead of the bare filename. `File::Basename` was already imported; `basename()` is now applied. (#406)
 - **External RUA destination verification via `_report._dmarc` DNS lookup**: `opendmarc-reports` now implements RFC 9990 §4 / RFC 9991 §5 external destination verification before sending aggregate reports. For each cross-domain `mailto:` RUA address, queries `<from-domain>._report._dmarc.<dest-domain>` for a `v=DMARC1` TXT record, with a wildcard fallback. Fails open on SERVFAIL/timeout. Same-org addresses are accepted without a DNS query, using a built-in PSL reader (`load_psl`/`get_org_domain`) that reads the same `public_suffix_list.dat` file the milter uses, falling back to a two-label heuristic when no PSL is configured. Also adds: `!NNNk` size-limit suffix parsing for RUA URIs; a delivery-failure notice when a report exceeds a declared size limit; and `parse_rua_uri()` for unified URI validation. Closes the gap noted in issue #371 — the existing verification in libopendmarc covers only the milter path. (#392; written by Juri Haberland for openSUSE, submitted by Dirk Stöcker)
 
 ---