poste.io 2.5.20 → 2.5.23
3 releases · 0 breaking changes · 6 security fixes · 0 advisories fixed
6security0breaking0deprecated0feature4fix
Breaking changes
None in the release notes.
Security changes
- security security updates, Roundcube 1.7.6 in 2.5.23
- security Kolab calendar in Roundcube (CalDAV against our DAV), enable with ENABLE_KOLAB_CALENDAR=TRUE in 2.5.23
- security security hardening and fixes in Haraka, administration and container setup in 2.5.23
- security security updates, Node.js v26.13.0 in 2.5.22
- security Roundcube 1.7.5 in 2.5.21
- security webmail: users can change their password in Roundcube in 2.5.21
Every release in between
securitysecurity updates, Roundcube 1.7.6
otherActiveSync: calendar, tasks and contacts sync from DAV (when DAV is enabled), z-push 2.7.7
securityKolab calendar in Roundcube (CalDAV against our DAV), enable with ENABLE_KOLAB_CALENDAR=TRUE
otherSymfony 7.4 LTS, Doctrine ORM 3.7
securitysecurity hardening and fixes in Haraka, administration and container setup
otherActiveSync sends mail as the logged-in user (statistics, limits and sender checks now apply)
otherCLI: poste guard:list and poste guard:unblock <ip> for automatic IP blocks
otherautomatic login blocks last at most one day
fixfix DISABLE_WEBMAIL_ADMIN_LINKS having no effect
fixfix container failing on restart (03-zpush.sh)
fixfix automatic guard and karma pages failing on some stored entries
securitysecurity updates, Node.js v26.13.0
securityRoundcube 1.7.5
securitywebmail: users can change their password in Roundcube
otherDISABLE_WEBMAIL_ADMIN_LINKS=TRUE hides the Administration and client setup links in webmail
fixfix a full mailbox rejecting the message for all recipients - now only the full mailbox bounces