poste.io 2.5.16 → 2.5.21
4 releases · 0 breaking changes · 6 security fixes · 0 advisories fixed
6security0breaking0deprecated1feature10fix
Breaking changes
None in the release notes.
Security changes
- security Roundcube 1.7.5 in 2.5.21
- security webmail: users can change their password in Roundcube in 2.5.21
- security security upgrade to PHP 8.2.35 in 2.5.20
- security Roundcube 1.7.4 (webmail database is migrated on first start, no way back to 1.6) in 2.5.19
- security webmail serves only the Roundcube entry points in 2.5.19
- security Roundcube 1.6.19 in 2.5.17
Every release in between
securityRoundcube 1.7.5
securitywebmail: users can change their password in Roundcube
otherDISABLE_WEBMAIL_ADMIN_LINKS=TRUE hides the Administration and client setup links in webmail
fixfix a full mailbox rejecting the message for all recipients - now only the full mailbox bounces
securitysecurity upgrade to PHP 8.2.35
otherPHP session.upload_progress is disabled
securityRoundcube 1.7.4 (webmail database is migrated on first start, no way back to 1.6)
otherfile permissions in the image are now set at build time
securitywebmail serves only the Roundcube entry points
fixfix spam learning from the Junk folder - moving mail to/from Junk now trains rspamd and affects classification
fixfix temporary files of reported spam/ham left in /tmp
fixfix "503 Bad sequence of commands" shown in the delivery log for accepted messages
fixfix system alerts not delivered to internal-only mailboxes
fixfix DMARC reports page failing on malformed reports or many reports
fixfix connection diagnostics staying grey on PHP 8.5
fixfix low inodes notice shown when only disk space was low
fixadministration: fix layout regressions after the move to Bootstrap 5
securityRoundcube 1.6.19
othermaximum message size can now be set up to 2 GB; nginx and php-fpm limits follow that setting instead of staying at 100 MB, so large attachments finally reach webmail
otherLet's encrypt: renewal is due once less than a third of the certificate lifetime is left, and the CA's own renewal info (ARI) overrides that when available
fixLet's encrypt: fix renewals that took the slow path - valid authorizations are no longer re-challenged, the order is polled instead of re-POSTed, badNonce is retried, and the certificate download has a timeout
otherLet's encrypt: the issuing log is no longer deleted by the run that writes it
otherLet's encrypt: a failed renewal alerts after three attempts in a row, not the first
featureLet's encrypt: new certificates use P-256 keys and the private key is written with 0600
otherremote monitoring: the health endpoint answers 200 even when a check is critical, so a monitoring system reads the body instead of a transport error
otherremote monitoring: the heartbeat is sent at a fixed offset from the start of the measurement
otherremote monitoring: every stage of a heartbeat run is traced
otheradministration moved from Bootstrap 3 to Bootstrap 5
otherconsole entrypoints drop to the mail user when started as root, so they stop leaving root-owned logs and caches behind