mailcow 2026-03 → 2026-10
10 releases · 0 breaking changes · 8 security fixes · 0 advisories fixed
8security0breaking0deprecated4feature16fix
Breaking changes
None in the release notes.
Security changes
- security [PHP] Update base to Alpine 3.24, build PECL extensions from GitHub in 2026-10
- security [SOGo] Update to 5.12.12 in 2026-10
- security [Nginx] Update to 1.30.6 in 2026-10
- security [Rspamd] update to 4.1.4 in 2026-07a
- security Fix nginx CVE-2026-42533 in 2026-07a
- security Update actions/stale action to v11 in 2026-07a
- security Hardening mailcow in 2026-07a
- security fix unbound CVE-2026-33278 in 2026-05c
Every release in between
security[PHP] Update base to Alpine 3.24, build PECL extensions from GitHub
security[SOGo] Update to 5.12.12
security[Nginx] Update to 1.30.6
featureFeat/update UI
otherTranslations update from Weblate
feature[Web] Add ACL + global switch to disable external alias goto
feature[Web] Add show/hide password toggle on login pages
fixFix #7150: passwd-verify.lua wipes auth cache during any nginx outage
fix[Web] use absolute RHS names in generated DNS zonefile
fix[Web] redirect deep links to the matching login page
fix[Web] show external sender addresses regardless of authsource
fix[Web] translate password errors in the forced password change modal
other[Unbound] Update to 1.26.1
other[SOGo] Update to 5.12.11
otherUpdate redis Docker tag to v7.4.11
otherpostfix-tlspol: upgrade to trixie + 1.11.0 update
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr
other[postfix-tlspol] bump to v1.14.0
other[Rspamd] Update to 4.2.1
fixFixed typo (changing RESOVLER to RESOLVER).
other[Postfix] update postscreen_access.cidr
otherUpdate RSPAMD version to 4.1.0 in Dockerfile
other[Rspamd] Migrate metadata_exporter to multipart formatter
otherRefresh SOGo view after mailbox activation
fixFix force_tfa not available in mailbox template #7216
other[SOGo] Update to 5.12.9
otherEscape generated password in mobileconfig
other[Nignx] Update to 1.30.3
otherpostfix: migrate from bookworm to trixie
otherUpdate dependency composer/composer to v2.10.2
otherUpdate devops-infra/action-pull-request action to v1.2.1
otherUpdate actions/stale action to v10.4.0
otherUpdate devops-infra/action-pull-request action to v1.4.0
otherUpdate dependency php/pecl-mail-mailparse to v3.2.0
otherUpdate dependency composer/composer to v2.10.1
otherUpdate alpine Docker tag to v3.24
otherUpdate actions/checkout action to v7
otherUpdate devops-infra/action-pull-request action to v1.3.0
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
otherui, fail2ban fix german ban_list_info translation
otherRefined wording for displaying of active settings on quarantine page.
other[Redis] Update to 7.4.10
other[Clamd] Update to 1.4.6
other[SOGo] Update to 5.12.10
other[Web] Minor hardening across web UI and nginx
other[Dovecot] Remove legacy DeltaChat auto-filing sieve rule
other[Postfix] update postscreen_access.cidr
otherupdate README.md sponsors
otherTranslations update from Weblate
security[Rspamd] update to 4.1.4
securityFix nginx CVE-2026-42533
securityUpdate actions/stale action to v11
securityHardening mailcow
fixfix: restore subject display in quarantine overview
fix[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set
fix[Web] fix add/time_limited_alias silently discarding requests and validity
fix[Web] return sender_acl in get/mailbox API
fixfix: cors allowed origins settings validation
fix[Web] harden CORS origin matching and add Vary: Origin
fix[Web] Move mailcow update check to server side
fix[Web] Create default mailbox template with eas and dav access
fix[ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
other[Web] escape HTML in sieve filter edit view and queue manager
other[Nginx] Update to 1.30.2
securityfix unbound CVE-2026-33278
otherUpdate actions/stale action to v10.3.0
otherTranslations update from Weblate
otherUpdate devops-infra/action-pull-request action to v1.1.2
otherUpdate devops-infra/action-pull-request action to v1.1.3
otherUpdate devops-infra/action-pull-request action to v1.2.0
other[Nginx] Update to 1.30.1
otherescape HTML in quarantine table
otherTranslations update from Weblate
featureAdd Uzbek language
otherUpdate devops-infra/action-pull-request action to v1.1.1
other[SOGo] Update to 5.12.8