Mailcow (Security-)Updates

🏖️🐮 Mooly 2026 | Postfix 3.10.12, Rspamd 4.1.0 & Nginx 1.30.3 Latest
@FreddleSpl0it FreddleSpl0it released this yesterday 2026-07
What's Changed
Update RSPAMD version to 4.1.0 in Dockerfile by @dragoangel in #7172
[Rspamd] Migrate metadata_exporter to multipart formatter by @FreddleSpl0it in #7283
Refresh SOGo view after mailbox activation by @ibobgunardi in #7277
Fix force_tfa not available in mailbox template #7216 by @Snafu in #7275
[SOGo] Update to 5.12.9 by @goodygh in #7267
Escape generated password in mobileconfig by @mkuron in #7212
[Nignx] Update to 1.30.3 by @FreddleSpl0it in #7305
postfix: migrate from bookworm to trixie by @DerLinkman in #7323
Update dependency composer/composer to v2.10.2 by @renovate[bot] in #7312
Update devops-infra/action-pull-request action to v1.2.1 by @renovate[bot] in #7258
Update actions/stale action to v10.4.0 by @renovate[bot] in #7322
Update devops-infra/action-pull-request action to v1.4.0 by @renovate[bot] in #7321
Update dependency php/pecl-mail-mailparse to v3.2.0 by @renovate[bot] in #7189
Update dependency composer/composer to v2.10.1 by @renovate[bot] in #7193
Update alpine Docker tag to v3.24 by @renovate[bot] in #7280
Update actions/checkout action to v7 by @renovate[bot] in #7300
Update devops-infra/action-pull-request action to v1.3.0 by @renovate[bot] in #7272
[Postfix] update postscreen_access.cidr by @milkmaker in #7269
[Postfix] update postscreen_access.cidr by @milkmaker in #7311
Translations update from Weblate by @milkmaker in #7262
Translations update from Weblate by @milkmaker in #7263
Translations update from Weblate by @milkmaker in #7302
ui, fail2ban fix german ban_list_info translation by @goodygh in #7265
Refined wording for displaying of active settings on quarantine page. by @ralfbergs in #7326
New Contributors
@ibobgunardi made their first contribution in #7277
@Snafu made their first contribution in #7275
@ralfbergs made their first contribution in #7326
Full Changelog: 2026-05c...2026-07

🏖️🐮 Mooly 2026 | Postfix 3.10.12, Rspamd 4.1.0 & Nginx 1.30.3 - Revision A
Latest

 FreddleSpl0it released this 29 minutes ago
2026-07a
489db90
What's Changed
Important
This update addresses several security-related issues in mailcow. We strongly recommend updating your mailcow instance as soon as possible.
Updates and Security
[Rspamd] update to 4.1.4 by @FreddleSpl0it in #7386
Fix nginx CVE-2026-42533 by @SYNLINQ in #7358
Update actions/stale action to v11 by @renovate[bot] in #7375
Hardening mailcow by @FreddleSpl0it in #7387
Fixes
fix: restore subject display in quarantine overview by @oidipos in #7367
[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set by @smpaz7467 in #7343
[Web] fix add/time_limited_alias silently discarding requests and validity by @smpaz7467 in #7345
[Web] return sender_acl in get/mailbox API by @smpaz7467 in #7348
fix: cors allowed origins settings validation by @fallmo in #7333
[Web] harden CORS origin matching and add Vary: Origin by @FreddleSpl0it in #7385
[Web] Move mailcow update check to server side by @FreddleSpl0it in #7388
[Web] Create default mailbox template with eas and dav access by @FreddleSpl0it in #7389
[ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain by @FreddleSpl0it in #7390