The documentation for imap_urlauth_host says:

Warning

URLAUTH in current versions of Dovecot is broken in several ways. This will be fixed in the future, but activating URLAUTH support on production systems is not recommended.

In what ways is it broken? Is anyone actually working on fixing it?

Andy