Installation

• Bundle libmariadb.dll with the installation (#479)
• Support for passing in the password during install (#570)
• Installer now propagates a non-zero exit code when DBSetup fails

Stability fixes

• Addressed race conditions during IMAP communication
• Fixed a file received over SMTP being left open
• Fixed memory leak when reloading and checking event scripts
• Upgraded to OpenSSL 3.5.8

Other

• Documentation refresh

• Experimental support for MariaDB Connector (C). To use, put libmariadb.dll in hMailServer\Bin. hMailServer will prefer it over libmysql.dll if both exists.
• IMAP improvements
  • Removed the ImapAuthAllowPlainText legacy option
  • Fixed invalid "Recent" count in IMAP notifications
  • Fixed FETCH not honoring the start.size partial-fetch clause
• DKIM improvements
  • DKIM signatures for domain aliases
  • DKIM-sign all email sent from a domain, not just per-account
  • Fixed signing failure for messages >10MB
  • DKIM verification when the published DNS record is a CNAME
  • Signing for NDR/bounce messages
• Optional X-Original-Rcpt-To header for incoming mail.
• IMAP improvements: RFC 6154 support - LIST extension for Special-Use Mailboxes (\Sent, \Drafts, \Junk, \Trash, etc.), including auto-creation of special-use folders on account creation.
• Security: TLS 1.3 support added
• Security: OpenSSL upgraded to 3.5.7
• 64-bit only. Support for x86/32-bit dropped.

Features

• Added configurable alerts when scheduled database backups missed a set number of days. #11433 closed #11425.
• Streamed S3-only volume archives directly to S3 so those backups no longer needed temporary local disk space. #11642
• Added an instance setting for the CDN URL used to serve stored images such as profile avatars and project icons.

Improvements

• Refreshed the UI with WCAG-compliant contrast, a unified surface system, a full-height settings rail, and a rebuilt mobile navigation drawer. #11659 closed #11532.
• Preserved in-progress domain edits across refreshes, stacked domain rows on small screens, and moved preview deployment settings onto the Previews page.
• Paginated service backup history, showed S3 destination details, disabled Backup Now unless the database was running, added search on server resources, and let operators enable Sentinel from its logs page.

Fixes

• Allowed General application settings to be saved when an existing domain used a wildcard. #11683 closed #11641.
• Prevented duplicate Coolify Cloud subscription checkouts and recovered subscriptions after missed or out-of-order Stripe webhooks. #11666
• Preserved PATH in terminal sessions so SSH proxy commands such as cloudflared worked. #11638 closed #11611.
• Stopped the persistent storage PR suffix dropdown from clipping inside the volumes table. #11637 closed #11605.
• Returned scheduled task execution duration as a JSON number so the CLI could parse listings. #11636 closed #11616.
• Persisted S3 storage settings when creating a new volume backup schedule. #11635 closed #11627.
• Cleaned up preview deployments when a pull request closed after its base branch changed. #11634 closed #11609.
• Persisted the Make publicly available setting for service databases. #11633 closed #11345.
• Restored webhook delivery for always-send notifications, including SSL renewal, API token expiry, server force-enable/disable, and Hetzner deletion failures. #11528 closed #11507.
• Raised nginx request header buffers so large Cookie headers no longer returned HTTP 400 before reaching Coolify. #11404 closed #11403.
• Kept modal contents intact across Livewire re-renders instead of dropping the body and leaving a click-blocking overlay. #11294
• Routed Docker Compose domains using each service's ports, stored explicit ports as overrides through the API, and stopped multi-service Compose domains from inheriting the application port.
• Applied the same domain validation rules to the service API as the UI, including wildcards and oversized URLs.
• Limited instance public IP DNS hints to the localhost server so remote servers showed their own addresses.
• Preserved shell negation in sudo-wrapped commands on servers that use a non-root SSH user.
• Deferred inspection of PostgreSQL custom-format backup archives to pg_restore so valid dumps were not rejected.

What's Changed

• fix(notifications): add missing toWebhook methods to notifications by @ousamabenyounes in #11528
• fix(docker): raise nginx request header buffers above the 8k default by @bosund in #11404
• fix(service): persist service database public access by @peaklabs-dev in #11633
• fix(ui): keep modal content across re-renders by @devrim-1283 in #11294
• fix(storage): persist S3 settings for new volume backups by @andrasbacsai in #11635
• fix(terminal): preserve PATH for SSH proxy commands by @andrasbacsai in #11638
• fix(api): return task execution duration as float by @andrasbacsai in #11636
• fix(webhooks): handle closed PRs after base branch changes by @andrasbacsai in #11634
• fix(storage): prevent PR suffix dropdown clipping by @andrasbacsai in #11637
• feat(backups): stream S3-only volume archives directly by @andrasbacsai in #11642
• feat(backups): alert when scheduled backups are missing by @andrasbacsai in #11433
• fix(stripe): prevent duplicate subscription checkouts by @andrasbacsai in #11666
• feat(ui): WCAG contrast pass, neutral oklch surface system, and mobile nav overhaul by @adiologydev in #11659
• fix(application): allow general saves with wildcard domains by @andrasbacsai in #11683

New Contributors

• @ousamabenyounes made their first contribution in #11528
• @bosund made their first contribution in #11404

Full Changelog: v4.3.17...v4.3.18

Postfix stable release 3.11.7 and legacy releases 3.10.14, 3.9.15, 3.8.21, 3.7.23, 3.6.21, 3.5.28

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.7.html]

This release addresses medium-impact problems that need to be fixed as some enable remote DOS or policy bypass.

The fixes below, and more, are also released in the unstable version postfix-3.12-20260902.

In addition to updated releases for the supported Postfix versions 3.8-3.11, releases will also be available for the out-of-support Postfix versions 3.5-3.7. NOTE: these do not include the patches for out-of-support Postfix versions that have been issued for "large SMTP inputs (June 2026)", and for "TLSA parsing (June 2026)". Those patches still need to be applied.

These defects were found by "Qualys assisted by Claude Mythos Preview", and by "OpenAI Security"; three date from 20 or more years ago.

SMTP smuggling:

• Bug (introduced: Postfix 3.9, date: 20240106) SMTP smuggling was still possible with smtpd_proxy_filter (disabled by default) when the after-filter SMTP server used the default policy settings "smtpd_forbid_bare_newline_exclusions = $mynetworks" and "smtpd_forbid_bare_newline = normalize". Reported by OpenAI Security. Fix by Wietse.

  As suggested by OpenAI Security, eliminate stray CR characters from the smtpd_proxy_filter input stream. The before-proxy-filter SMTP server already eliminated stray LF.

• Bug (introduced: Postfix 3.11, date: 20250917): SMTP smuggling was possible with smtpd_proxy_filter (disabled by default) when the before-filter SMTP server added a "Require-TLS-ESMTP: yes" message header, due to implementation edge cases. Adding this header is enabled with the "requiretls_esmtp_header = yes" default setting. Reported by OpenAI Security. Fix by Wietse.

Server crashes and panic()s:

• Bug (defect introduced: Postfix 3.0, date: 20140707): null pointer read error after receiving MAIL FROM, RCPT TO, and VRFY with an UTF8 address but no SMTPUTF8 parameter. This requires "smtputf8_enable = yes" (the default) and "strict_smtputf8 = yes" (not default). With this, the SMTP server did an unnecessary MAIL FROM reset without RCPT TO reset. A crafted remote SMTP client could then send a DATA command and crash a Postfix SMTP server process with a null pointer read error. Reported by Wonyoung Jung (정원영).

Other bugs

• Bug (defect introduced: Postfix 3.4, date: 20180303): the MySQL client setting "tls_verify_cert = yes" had no effect with Oracle MySQL 8 and later. Report and fix by OpenAI Security.

• Bug (defect introduced: Postfix-beta, date: 19990119): the pipe(8) delivery agent deleted a command-line argument if the argument contained $user AND $user expanded to an empty string, breaking the positional order of arguments. This was a workaround for a problem that hopefully no longer exists. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.3, date: 20050323): the SMTP client enhanced status code parser could process stale data when a remote SMTP server sent a three-digit reply. Reported by Qualys, assisted by Claude Mythos Preview.

TLS

• Isolation: stamp Postfix SMTP server TLS session tickets with their master.cf service name. With this, an SMTP server defined in master.cf will no longer accept tickets issued by a different SMTP server defined in the same master.cf file. Fix by OpenAI security.

Configuration safety

• The postmap and postalias commands now log a warning when creating a root-owned database file in a directory that is not owned by root. They log that the database source file, indexed file(s), and parent directory should have the same owner, to prevent a privilege-escalation attack. Problem reported by OpenAI Security, remediation strategy (don't break production deployment) by Wietse.

Read after free, memory over-read

• Bug (introduced: Postfix 2.3, date: 20060629): a malicious Milter or attacker-in-the-middle could trigger a null-terminated heap memory overread in the SMTP daemon while formatting a malformed multiline response. Fix from OpenAI Security adopted with minor changes.

• Bug (defect introduced: Postfix 3.0, date: 20141117): in the postqueue command don't free() text before logging a fatal error message. Reported by Qualys, assisted by Claude Mythos Preview.

• Code hygiene: in the SMTP client protocol engine, evaluate a RETURN() macro argument before freeing resources. Reported by Qualys, assisted by Claude Mythos Preview.

Code hardening (defense in depth, prevention)

• (Postfix 3.11) Hardening: in the non-BerkeleyDB migration service, delay the decision between running postmap or postalias until after the database file/directory owner/permission checks. The benefit from making the decision early (better error messages) was not worth the risk. Qualys, assisted by Claude Mythos Preview.

• (Postfix 3.11) Hardened the database parent directory permission checks for automatic re-indexing with the non-Berkeley-DB migration service.

• Hardening command-line email submission: the postdrop command now disallows null and line-break characters in queue file envelope records (line-break characters in non-envelope queue file records are already neutralized by default with "cleanup_replace_stray_cr_lf = yes").

  The new constraint not only eliminates line-break injection into local mailbox files as reported by OpenAI Security, but also prevents other forms of misuse. Later, this constraint may be moved into the Postfix core. Fix by Wietse.

• Shut up nagging from multiple AIs and harden the virtual delivery agent against an evil (LDAP or SQL) database.

• Code hygiene: myrealloc(ptr, 0) still resulted in a panic. Reported by Qualys, assisted by Claude Mythos Preview. Also adopt a mystrndup() fix from Postfix 3.12.

Other:

• Portability: OpenBSD does not define NS_INT16SZ. Brad Smith.

You can find the updated Postfix source code on the mirrors listed at https://www.postfix.org/.

[0.16.21] - 2026-09-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

• Sieve: Messages generated by user scripts are DKIM signed through the new SieveUserInterpreter.dkimSignDomain setting, which defaults to the account's own domain.

Fixed

• JMAP:
  • CalendarEvent/set requests that ask for scheduling messages are rejected with a forbidden error when the account cannot send them.
  • Calendar/get and AddressBook/get return every property when the properties argument is omitted or null.
  • EventSource ping events advertise the interval in seconds rather than milliseconds.
  • Calendar synthetic ids returned when expanding recurrences identify an occurrence by its recurrence id.
• IMAP: Every command in a pipelined STATUS or FETCH batch receives its tagged completion, instead of the first failing command dropping the responses for all commands queued behind it.
• WebDAV: Accounts without a storage quota no longer advertise a 4 GiB limit in DAV:quota-available-bytes.
• MTA: Inbound DMARC and TLS aggregate reports that a reporter sends more than once are imported again as a duplicate entry.
• Spam filter: Domain and URL blocklists are queried only for text written as a link.
• iTIP: Detaching an occurrence that the recurrence rule already generates is sent as a METHOD:REQUEST carrying the RECURRENCE-ID instead of a METHOD:ADD.
• Sieve: fileinto :specialuse and specialuse_exists accept special-use attributes in the \Trash form.
• LDAP: Active Directory servers that answer an unauthenticated bind (a non-empty DN with a zero-length password) with success no longer authenticate accounts without a password.
• Network: Listeners bound to the unspecified IPv6 address ([::]) fall back to IPv4 when socket creation fails with EPROTONOSUPPORT.
• OpenTelemetry: log exporter does not include the parent span's attributes.

Check binary attestation here

New major features

Media-over-QUIC

• support forwarding streams (#6145)

API

• add /paths/static-sources/get endpoint (#6177) this allows to obtain details about static sources.
• add type-specific properties to forward destinations (#6178)
• add type-specific properties to static sources (#6184)

Fixes and improvements

General

• add --validate-conf flag (#5549) (#6140)
• use internal/core/VERSION as single source of truth to get version (#6119)
• httpp: propagate Flush() through the response writer wrappers (#6126) handlerLogger's responseRecorder and handlerWriteTimeout's writeTimeoutWriter both wrap http.ResponseWriter but implement neither http.Flusher nor Unwrap(). Any handler that flushes mid-response has that flush silently dropped, and its output only reaches the client when the handler returns. That defeats the stated purpose of writeTimeoutWriter, whose own comment says it exists so one can "write long responses, splitted in chunks, without causing timeouts": the deadline is reset per Write(), but nothing ever leaves the buffer until the end. Found while adding a server-sent-events endpoint: events written and flushed at t=0.4s onlyreached the client at t=2.2s, when the handler returned. Adding Flush() plus Unwrap() (so http.ResponseController can reach through) fixes both. The new test drives a real listener throughboth wrappers and reads while the handler is still blocked, so it fails on the current code by hitting the read deadline.
• support setting read buffer size on macOS (#6128) (#6131)
• drop support for Debian Bullseye (#6137) Bullseye reached EOL on 31st august 2026.
• emit "closed" log message when a server is closed (#6152)
• fix external command exit code reporting on non-Windows platforms (#6155)
• conf: support YAML version directives (#6157)
• metrics: add 'pos' property to forward_dests (#6183)
• metrics: deprecate the 'remoteAddr' property (#6174) Metrics are meant to provide aggregate statistics, not per-peer properties, that can be accessed through the API. The property is still served to keep backward compatibility.
• metrics: add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
• metrics, pprof: set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
• always-available: support disabling recording when the source is offline (#6182) Add alwaysAvailableRecorded parameter that controls whether recording happens during offline periods for always-available paths. When set to false, recording only starts when a real source is connected. Co-authored-by: Abdulrahman Nashaat abdelrahmanndev@gmail.com
• allow sources and forward destinations with an empty password (#6193) Restore the behavior introduced in #395 and accidentally reverted by #5779, which factored the RTMP/HLS credential check into validateURL() and applied it to RTSP sources too. A username with an explicitly empty password is valid per RFC 3986 and is required by some legacy cameras whose password cannot be set. It is now accepted for every scheme handled by validateURL(), including forward destinations. A username without password or a password without username is still rejected,with a clearer error message pointing to the right syntax.
• fix wrong validation of HTTP allowed origins (#6198) An allowed origin with wildcards was making the server accept origins with a different scheme. This is fixed.
• fix HTTP allowed origins dots being interpreter as any character (#6199) A dot in an HTTP allowed origin now requires a corresponding dot in an incoming origin.
• serve Origin: Vary header with Access-Control-Allow-Origin (#6200) This prevents CDNs from caching the Access-Control-Allow-Origin header regardless of the origin.
• stop returning wildcard in Access-Control-Allow-Origin (#6201) if domain is allowed, return the domain, otherwise nothing.
• pmp4, fmp4: stop validating inbound H264/H265 SPS (bluenviron/mediacommon#366) Validating SPS adds latency and is generally redundant.
• pmp4, fmp4: do not accept empty H264/H265 parameters (bluenviron/mediacommon#367)
• h265: fix DTS extraction of streams with temporal sub-layers (bluenviron/mediacommon#368) The picture-type switches in the H265 DTS extractor accepted only TRAIL_N/TRAIL_R/RASL_N/RASL_R, so an access unit whose slices are TSA_N/TSA_R/STSA_N/STSA_R (Rec. ITU-T H.265, table 7-1, types 2-5) fell through to "access unit doesn't contain an IDR or non-IDR NALU" and the stream could never be recorded. TSA and STSA pictures use the same slice segment header syntax as TRAIL pictures, so handle them in the same way. Co-authored-by: aler9 46489434+aler9@users.noreply.github.com

API

• add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
• set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
• deprecate 'conf' field of forward destinations (#6175) configuration is already available through the confName property of the path.
• refactor endpoint names (#6172) group endpoints by category (i.e. /hls/muxers, /hls/sessions), rename /forward/* into /forward-dests/*, use kebab-case. Backward compatibility is preserved by still serving old endpoints.

Media-Over-QUIC

• rename boolean header fields (#6148) rename Properties into HasProperties, FirstObject into IsFirstObject
• add shared Conn interface (#6149)
• close server streams when no longer in use (#6151) Explicitly close bidirectional and unidirectional streams that were previously keep open for the entire duration of the session. Note that closing a stream in QUIC/WebTransport means telling the peer that "we are not sending data anymore", while still allowing inbound data.
• add shared client (#6150)
• impose a 100MB limit on reordered bytes per session (#6194) previously, the limit was per-track. This decreases the probability of incurring in an out-of-memory situations.

RTSP

• redact credentials in logs (#6158)
• demux MPEG-TS from static source pull (#6181) When rtspDemuxMpegts is set, a pulled single MP2T track is demuxed into elementary streams, matching RTSP publishers, so HLS can attach. Co-authored-by: remreaygan remreaygan@gmail.com Co-authored-by: aler9 46489434+aler9@users.noreply.github.com
• support setting read buffer size on macOS (#6128) (bluenviron/gortsplib#1143)
• client: ignore invalid source IPs in SETUP responses (bluenviron/gortsplib#1070) (bluenviron/gortsplib#1145)
• fix decoding and encoding fragmented MPEG-4 audio packets (bluenviron/gortsplib#1150) The AU-size field was set incorrectly in subsequent fragments.
• stop validating inbound H264/H265 SPS (bluenviron/gortsplib#1151) Validating SPS adds latency and is generally redundant.
• Support SDES (RFC 4568) SRTP key exchange for RTSP/RTSPS sources (bluenviron/gortsplib#1148)
• rtpklv: do not reuse buffer of returned KLV units (bluenviron/gortsplib#1154) Decode() returns a slice that points to the decoder's internal buffer, and the next call to Decode() overwrites that same array in place. A caller that holds the previous unit - for instance while it is being recorded or forwarded on another goroutine - ends up reading the bytes of the next unit, or a torn mix of both when the sizes differ. Clear the buffer instead of truncating it, so each unit gets its own array. This is what the h264, h265, av1, vp8 andmpeg1video decoders already do, at the cost of one allocation per unit.
• auth: support qop=auth in digest client (bluenviron/gortsplib#1074) (bluenviron/gortsplib#1155) The client never looked at the qop directive of a digest challenge and always computed the legacy RFC 2069 response, so servers that require qop="auth" - as most RFC 7616 implementations do - rejected every request with a 401. Parse qop in WWW-Authenticate, and when the server offers "auth", send qop, cnonce and nc and compute the response as H(HA1:nonce:nc:cnonce:qop:HA2) (RFC 7616, section 3.4.1). The nonce count increases at every request, as required. Challenges without qop keep the previous behavior. auth-int is not implemented. Also copy the opaque value of the challenge into the Authorization header, which RFC 7616 section 3.3 says the client should return unchanged. Co-authored-by: aler9 46489434+aler9@users.noreply.github.com
• client: remove Content-Length from HTTP tunnel GET request (bluenviron/gortsplib#1158)
• rtpav1: do not set Y/Z bits when no OBU bytes were written (bluenviron/gortsplib#1153) When the remaining space in a packet is too small to hold any byte of thenext OBU, the encoder writes nothing but still marks the current packet with Y=1 and the following one with Z=1. The AV1 RTP payload format (v1.0, section 4.4) requires both bits to be 0 unless an OBU element is actually fragmented across the two packets. Receivers that honor the bits therefore join two complete OBUs into one: this happens with the decoder in this package, with pion/rtp and with ffmpeg. It is reachable whenever an earlier OBU leaves exactly 0 free bytes (or 0-2 when the next OBU is size-prefixed), so it affects streams that are repacketized, e.g. non-RTSP sources read over RTSP in mediamtx. Co-authored-by: aler9 46489434+aler9@users.noreply.github.com

RTMP

• reader: support empty H264 configs (#6132) (bluenviron/gortmplib#118)
• writer: fix crash in case of invalid H264/H265 parameters (bluenviron/gortmplib#122)
• reader: do not accept empty H264/H265 parameters (bluenviron/gortmplib#121)
• server: always strip auth parameters from URL (bluenviron/gortmplib#76) (bluenviron/gortmplib#123)

HLS

• validate hlsSegmentCount according to the HLS variant (#6154)

WebRTC

• Register RTX for incoming video tracks (#6125)
• fix deprecated webrtcICEServers parser for IPv6 hosts; (#5932)

RPI Camera

• drop support for Debian Bullseye (bluenviron/mediamtx-rpicamera#119) Bullseye reached EOL on 31st august 2026.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.85.0 to v0.88.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.3 to v2.4.4
• github.com/bluenviron/gortmplib updated from v1.0.1 to v1.0.2
• github.com/bluenviron/gortsplib/v5 updated from v5.6.4 to v5.6.5
• github.com/bluenviron/mediacommon/v2 updated from v2.9.3 to v2.9.4
• github.com/matthewhartstonge/argon2 updated from v1.5.6 to v1.5.7
• github.com/pion/webrtc/v4 updated from v4.2.18 to v4.2.19
• github.com/quic-go/quic-go updated from v0.61.0 to v0.62.0
• github.com/quic-go/webtransport-go updated from v0.12.0 to v0.13.0
• github.com/stretchr/testify updated from v1.12.0 to v1.12.1
• github.com/dunglas/httpsfv updated from v1.1.0 to v1.1.1
• github.com/pion/stun/v3 updated from v3.1.6 to v3.1.7
• github.com/pion/turn/v5 updated from v5.0.12 to v5.0.13
• gopkg.in/yaml.v3 removed
• go.yaml.in/yaml/v3 v3.0.5 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.8.0 to v2.9.0
• hls.js updated from v1.7.0 to v1.7.2

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes

• Corrected notification and deployment log links to use the configured instance URL. #11623
• Cleaned up orphaned helper containers when helper images used unqualified names, nested registry paths, tags, or digests. #11540 closed #11511.
• Preserved Docker restart policies when applications, previews, databases, and service applications were stopped without removing their containers.
• Fixed type errors when stopping applications and adding scheduled tasks.
• Kept Docker Compose domains in sync when noindex settings changed.
• Prevented removed Docker Compose service domains from being regenerated by magic service URL variables.
• Preserved generated Compose variables during bulk environment variable replacement and reported blocked deletions correctly.
• Cleared stale Traefik version data after proxies stopped or changed.
• Prevented invalid repository URLs from producing malformed commit links.

Improvements

• Removed app-only restart-limit enforcement from database resources so databases continued to follow their configured Docker restart behavior.
• Made missing required environment variables directly accessible from a service's disabled Deploy action.
• Hid Coolify-managed Compose variables from the developer environment variable view to prevent accidental edits.

What's Changed

• fix: build notification and deployment log links from the instance url by @peaklabs-dev in #11623
• fix(docker): reap orphaned helper containers regardless of registry by @kashik0i in #11540

New Contributors

• @kashik0i made their first contribution in #11540

Full Changelog: v4.3.16...v4.3.17

VIENNA, Austria – September 04, 2026 – Proxmox Server Solutions today announced that Proxmox Virtual Environment has been officially certified under the Omnissa® Horizon Ready Hypervisor program. The certification confirms compatibility between Proxmox VE and Omnissa Horizon in Manual Provisioning Mode, allowing organizations running Proxmox VE to deploy Omnissa Horizon, Omnissa’s digital work platform for virtual desktops, applications, and end-user devices, for centralized desktop and application delivery on their existing infrastructure.

With official Horizon support, organizations can now run their Omnissa virtual desktops directly on Proxmox VE, reducing infrastructure costs without compromising on performance. By combining Proxmox VE's open-source hypervisor with Omnissa Horizon's enterprise management capabilities, organizations gain a flexible, cost-effective desktop virtualization solution built on infrastructure they already run.

Proxmox VE is also listed in the Horizon Ready Hypervisor program as a certified third-party hypervisor supporting NVIDIA® vGPU. This enables IT teams to allocate physical GPU resources across multiple virtual machines, delivering high-performance graphics workloads within Horizon virtual desktop deployments.

Verified configurations and deployment requirements are available in the Omnissa Horizon Ready Hypervisor Compatibility Guide at https://interopmatrix.omnissa.com/Compatibility/hypervisors

###

About Proxmox Virtual Environment
Powering over 2.3 million hosts globally, Proxmox Virtual Environment is a complete open-source platform for enterprise virtualization and hyper-converged infrastructure. It natively unifies KVM virtualization, LXC containers, software-defined storage, and networking on a single platform. Alongside its dedicated Backup Server and Datacenter Manager, the Proxmox ecosystem eliminates multi-site complexity as well as dependency on proprietary stacks. Backed by a global community of over 225,000 members, the platform serves as a scalable, cost-effective foundation for modern data centers.

About Proxmox Server Solutions GmbH
Proxmox Server Solutions provides powerful, intuitive open-source server software that guarantees vendor independence and minimizes total cost of ownership. Enterprises of all sizes rely on the company’s reliable vendor support, certified training services, and a global network of 3,000 integration partners to ensure business continuity. More than 60,000 enterprises worldwide hold active Proxmox support plans to secure their mission-critical IT. Established in 2005, Proxmox Server Solutions GmbH is headquartered in Vienna, Austria, with its subsidiary Proxmox North America Inc. based in Kingston, Ontario. 

Media contact: Daniela Häsler, Proxmox Server Solutions GmbH, press@proxmox.com

nginx-1.31.5 mainline version has been released, featuring control API, predicate locations, and the ngx_http_json_module module.

Fixes

• Corrected internal routing and proxy labels for Docker Compose applications and previews to use each service's configured port, with the application port as a fallback.
• Restored the unsaved-changes indicator when switching label management to manual mode by updating Livewire. (#11612, closes #11265)
• Routed Telegram alerts for outdated Traefik versions to the configured topic instead of the main chat. (#11526)
• Corrected the file and directory deletion confirmation text. (#11541)

Improvements

• Ran stuck-resource cleanup in the background at 03:17 each day so it no longer blocked other scheduled tasks.
• Displayed the API token's one-time visibility warning directly beside the generated token.

What's Changed

• fix: update livewire to fix wire:dirty reactivity by @peaklabs-dev in #11612
• fix(ui): typo on storage delete modal by @ShadowArcanist in #11541
• fix(notifications): send traefik outdated alerts to the correct topic id by @DiyRex in #11526

Full Changelog: v4.3.15...v4.3.16

nginx-1.31.5 mainline version has been released, featuring control API, predicate locations, and the ngx_http_json_module.

Features

• Added per-domain internal port overrides for applications, Docker Compose services, and preview deployments across Traefik and Caddy. Public domain URLs remained portless, while the UI showed effective ports and warned about unrecognized ports. (#11594)
• Consolidated service database, volume, and directory backups into one page with schedule editing, on-demand runs, combined history, live status, downloads, and imports. (#11574)
• Added domain management and DNS status checks for preview deployments.

Fixes

• Blocked read-only team members from directly invoking protected Livewire mutations for credentials, servers, applications, databases, and security resources. (#11596)
• Preserved every application domain in COOLIFY_URL and COOLIFY_FQDN, including multi-domain configurations with ports. (#11527, fixes #10824)
• Kept stopped containers visible after they reached their restart limit, prevented further automatic restarts, and added retry deployment and container removal actions. (#11566, closes #10624, #10906, and #11521)
• Rejected invalid build-time environment variable names before builds started and reported the offending key with rename guidance. (#11575)
• Prevented unauthorized users from receiving stored private keys and GitHub App secrets in Livewire state.
• Restricted web terminal SSH commands to approved hosts, keys, ports, and options.
• Preserved existing domains when switching an application to Docker Compose and waited for confirmation before loading its Compose file.
• Redirected immediately after resource deletion while cleanup continued after the response.

Improvements

• Improved the Docker Compose editor layout on mobile screens.
• Warned before removing a port required by a service domain.
• Warned that full PostgreSQL restores could overwrite administrator passwords.
• Reduced the remotely callable Livewire API and kept authorization checks on user-facing write actions. (#11578)

What's Changed

• fix(deployments): keep every domain intact in COOLIFY_URL and COOLIFY… by @DiyRex in #11527
• fix(applications): persist restart limit state for stopped containers by @andrasbacsai in #11566
• feat(backups): unify service backup management by @andrasbacsai in #11574
• Validate build-time environment variable names before writing the build .env file by @andrasbacsai in #11575
• refactor(livewire): make data-sync helpers private by @andrasbacsai in #11578
• feat(domains): support per-domain internal port overrides by @andrasbacsai in #11594
• fix(livewire): authorize exposed resource mutations by @andrasbacsai in #11596

New Contributors

• @DiyRex made their first contribution in #11527

Full Changelog: v4.3.14...v4.3.15

Global round-the-clock vendor-direct support for Proxmox Virtual Environment, Proxmox Backup Server, and Proxmox Datacenter Manager goes live October 19, 2026. A new Kingston, Ontario subsidiary provides localized sales, administrative, and business-hours technical support across all North American time zones.

VIENNA, Austria, and KINGSTON, Ontario, Canada – September 02, 2026 – Proxmox Server Solutions GmbH today announced the expansion of its enterprise support to 24/7 coverage, effective October 19, 2026, alongside the launch of Proxmox North America Inc., a new subsidiary headquartered in Kingston, Ontario, Canada.

The 24/7 expansion follows sustained growth in Proxmox's installed base, now exceeding 2.3 million active Proxmox Virtual Environment servers worldwide and increasing demand across cloud, healthcare, government, finance, and enterprise sectors for continuous, direct-from-vendor support coverage. With Proxmox's global engineering and support organization having scaled substantially over recent years, 2026 is the right moment to extend the support offering to around-the-clock availability without compromising the engineering depth that customers expect from Proxmox.

The Canadian hub complements this global capability with a dedicated local presence for North America. A team of Proxmox infrastructure experts handles sales, contract administration, procurement support, and business-hours technical assistance across all North American time zones.

Bill Hughes, appointed CEO of Proxmox North America Inc., has spent over a decade in the open-source infrastructure and enterprise IT space, working closely with both vendors and end customers to deploy large-scale virtualization solutions.

"This is a natural next step," said Tim Marx, COO of Proxmox Server Solutions GmbH. "Our support team has grown significantly over the last few years, and the demand from customers across sectors including cloud, healthcare, government, education, finance has been consistent: they want direct, vendor-backed, around-the-clock support that doesn't depend on someone's local business hours. Making 24/7 a standard part of our enterprise offering is the logical move. It removes one of the last reasons organizations hesitate to put open-source infrastructure at the core of their production stack."

"The Kingston team is an integrated part of the global Proxmox support organization," said Bill Hughes, CEO of Proxmox North America Inc. It provides North American customers with a local entity for procurement and contracts, a team on your clock for day-to-day engagements across Eastern through Pacific, and a direct line into the same engineering bench that supports Proxmox globally."

24/7 Enterprise Support

Starting October 19, 2026, Proxmox's enterprise support offering expands to continuous, around-the-clock coverage for all customers worldwide:

• Access to Proxmox enterprise engineers across every time zone, 24 hours a day, 7 days a week.
• Covers Proxmox Virtual Environment, Proxmox Backup Server, and Proxmox Datacenter Manager, including offline updates and key activation for regulated, air-gapped environments.
• Delivered directly by Proxmox global engineering team.

Availability by tier:

• Premium: 24/7 coverage is included in the existing plan from day one, with unlimited support tickets, 2-hour prioritized response, and SLA-backed escalation workflows for critical and production-outage requests.
• Standard: 24/7 access opens during a subsequent onboarding window in Q4 2026.
• Basic: No change to the existing SLA. Proxmox's global support team now works beyond Austrian business hours, with local teams handling non-critical cases during their own business windows. Basic subscribers in all regions will see noticeably shorter real-world round-trip times as a result.

Proxmox North America Inc.

• The Canadian hub handles the day-to-day commercial and operational work that benefits from a local presence:
  Sales & account management for US and Canadian customers and partners, during local business hours.
• Business-hours technical support across Eastern, Central, Mountain, and Pacific time zones.
• Contract administration, invoicing, and procurement support in USD and CAD under a common-law legal framework.
• Partner enablement: certified reseller support, joint pre-sales engagements and co-delivery of local services.
• Certified training and expert guidance.

The team operates within Proxmox's global support and engineering organization headquartered in Vienna, Austria, which continues to drive product development and the global roadmap.

Global continuity and frictionless transition for existing clients and partners

• Current contracts remain valid, and North American customers may transfer to Proxmox North America Inc. at their next renewal in 2027. No immediate action required.
• Proxmox will accelerate investment in its certified reseller network across North America, making it significantly easier for regional channel partners to procure Proxmox support plans and bundle them with local services.
• Product development and core engineering remain based at Proxmox's Vienna headquarters, with continued investment in the team driving Proxmox's global roadmap from Europe.

###

About Proxmox Server Solutions GmbH
Proxmox Server Solutions GmbH provides powerful, intuitive open-source server software that guarantees vendor independence and minimizes total cost of ownership. Enterprises of all sizes rely on the company’s reliable vendor support, certified training services, and a global network of 3,000+ integration partners to ensure business continuity. More than 60,000 enterprises worldwide hold active Proxmox support plans to secure their mission-critical IT. Established in 2005, Proxmox Server Solutions GmbH is headquartered in Vienna, Austria, with its subsidiary Proxmox North America Inc. based in Kingston, Ontario.

About Proxmox North America Inc.
Proxmox North America Inc. is the North American subsidiary of Proxmox Server Solutions GmbH, headquartered in Kingston, Ontario, Canada. It provides localized sales, enterprise technical support across North American business hours, certified training, contract administration, and consulting for Proxmox solutions across the United States and Canada. The team operates as part of Proxmox's global technical enterprise support organization.

Contact: Proxmox Server Solutions GmbH, press@proxmox.com

nginx-1.31.5 mainline version has been released, featuring control API, predicate locations, and the ngx_http_json_module.

njs-1.0.1 version has been released, with fixes for access control bypass vulnerability in js_access (CVE-2026-18329), worker process crash vulnerability in ngx.fetch() (CVE-2026-78222), and heap buffer overflow vulnerability in xml.exclusiveC14n() (CVE-2026-78689).

New uNmINeD development snapshot is available for download!

Changes:

• Fixed support for Bedrock worlds with missing LevelDB log file
• Added support for Bedrock sections without biome information
• (Isometric) Added horizontal and vertical north directions (using cabinet projection)
• (Isometric) Speed and memory optimizations
• (Isometric) Fixed broken north direction buttons (broken in 0.20.7)

Cabinet projection:

[0.16.20] - 2026-08-30

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• System for Cross-domain Identity Management (SCIM) v2 (Enterprise):
  • Core Schema (RFC 7643)
  • Protocol (RFC 7644)
  • Cursor-Based Pagination (RFC 9865)
  • Interoperability Profile (draft-zollner-scim-interop-profile)
  • IPSIE lifecycle profile (draft-schreiber-scim-ipsie-profile)
• JMAP: CalendarEvent/set support for updating and deleting synthetic ids (#2925).
• Calendar:
  • Conference links in calendar invites and email alarms.
  • Translations for Arabic, Brazilian Portuguese, Bulgarian, Chinese Simplified, Chinese Traditional, Croatian, Czech, Finnish, Hebrew, Hindi, Hungarian, Indonesian, Japanese, Korean, Lithuanian, Norwegian Bokmål, Persian, Romanian, Russian, Slovak, Slovenian, Thai, Turkish, Ukrainian and Vietnamese.

Changed

• Calendar: Updated HTTP RSVP page.

Fixed

• DANE:
  • TLSA records are looked up whenever the MX RRset is signed, even when the MX host's own zone is not.
  • Mandatory DANE failures are permanent rather than temporary, bouncing messages that should be delayed.
  • Valid but unusable TLSA records fall back to the configured TLS strategy, permitting cleartext delivery where TLS is required.
• S3: Fix outdated upstream af-south-1 region configuration.
• Setup wizard: SQL directories set to use the main data store are now validated against the data store being configured.
• CardDAV: Delete default address book id when deleting the default address book.
• Redis: Sentinel deployments configured with rediss:// URLs now connect to the master over TLS instead of silently falling back to cleartext.
• Email: Generated Message-ID headers use the hostname of the node that built the message instead of the configured server hostname.
• MTA:
  • Do not send DMARC reports to local domains.
  • Messages addressed to an inboundReportAddresses match are only discarded when they actually contain a report (#1088).
• Directory: Impersonation using the recovery admin fails when the impersonated account has not logged in before (LDAP and SQL directories).
• WebUI: Failed logins open the browser's native credential prompt.
• Cluster: Expired node id leases are released periodically rather than only during startup, so entries for removed nodes no longer remain Stale or Inactive indefinitely.

Check binary attestation here

New uNmINeD development snapshot is available for download!

Changes:

• (Isometric) Moved isometric settings to a separate tab
• (Isometric) Added gamma and contrast settings (brighter and more vibrant images)
• (Isometric) Added water transparency and depth fading settings
• (Isometric) Biome blending is now ON by default
• (Isometric) Fixed rendering queue cancellation
• (Isometric) Fixed high IO pressure during rendering
• (Isometric) Rendering speed optimizations

Screenshot:

New uNmINeD development snapshot is available for download!

Changes:

• Improved Java Edition datapack error handling and logging
• (Isometric) Speed optimizations
• (Isometric) Ambient occlusion shading now works at chunk borders
• (Isometric) Added water transparency
• (Isometric) Added support for waterlogged blocks
• (Isometric) Added support for transparent textures
• (Isometric) Added biome tint blending

Transparent water and smooth biome borders:

You can install pre-built binaries from https://repo.dovecot.org/

Docker images can be found at https://hub.docker.com/r/dovecot/dovecot

Please review https://doc.dovecot.org/2.4.4/installation/upgrade/2.3-to-2.4.html and https://doc.dovecot.org/2.4.4/installation/installation.html.

Important

There are experimental features in 2.4, one is enabled with --enable-experimental-mail-utf8, and another with --enable-experimental-imap4rev2, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config.

Critical bug fixes

• CVE-2026-27852: Messages with a huge number of From/To/Cc/etc email addresses
  could result in excessive memory usage.
• CVE-2026-33263: Submission: Login service crashes with panic once
  mail_max_userip_connections limit is reached.
• CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly
  escape dots following a bare \r in message bodies, potentially allowing
  spoofed emails via malicious end-of-DATA injection.
• CVE-2026-33606: Mail content stored by a user can be crafted so that it is
  interpreted as dsync protocol commands when an administrator later runs dsync
  with the stream protocol, for example during a migration.
• CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage.
• CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU
  processing a single email with a massive number of Message-IDs in References
  header.
• CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might
  crash it.
• CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU
  processing emails with a large number of specially crafted Message-IDs in
  References header. The fix requires a new dovecot.index.thread file format,
  which is enabled only after setting dovecot_storage_version or newer. This
  rebuilds the index, so it will cause some extra CPU usage and extra
  metacache disk IO usage. It shouldn't cause (much) extra object storage IO,
  because all the fields should be coming from dovecot.index.cache.
• CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker
  could send mails into a victim's mailbox and observe network traffic to
  determine whether a secret message matched a known string by comparing
  compressed response sizes (a CRIME-style attack). The fix resets the
  compression dictionary after each IMAP command, preventing information from
  leaking between commands.
• CVE-2026-40205: If multiple OAUTH scopes were required, then
  this could have been only partially enforced with certain
  configurations.
• CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb
  fields without the "forward_" prefix which allows connections from
  trusted networks to set nopasswd field which allows to skip the
  authentication.
• CVE-2026-42391: Pre-login IMAP ID command could have used excessive
  amount of memory, causing the process to become killed and disconnecting
  all the other IMAP connections being proxied by the process. Or
  alternatively it could have caused excessive CPU usage, slowing down
  all the other IMAP connections being proxied by the process.
• CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH
  can result in an untagged NO response containing uninitialized memory,
  potentially leaking sensitive data.
• CVE-2026-42393: Doveadm password length or API key length could still
  be determined via timing based attacks.
• CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks
  could have been used to cause login processes to crash.
• CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked
  in the active Sieve binary. Switching to a different active binary
  could have been used to reset (bypass) the resource usage.
• CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive
  memory usage in imap-login process, possibly making it reach vsz_limit
  and kill all the connections being served by the process. Fixed by
  disabling COMPRESS command with all other compression algorithms than
  the standard DEFLATE.
• CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens.
  Now it requires all scopes.
• CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length
  frames crashes imap or imap-login process.

Changes

• auth: SIGHUP no longer flushes the passdb cache and SIGUSR2 no longer
  logs cache statistics. Use "doveadm auth cache flush" and the new
  "doveadm auth cache status" instead.
• auth: The OTP authentication mechanism, the {OTP} password scheme and
  the passdb set-credentials support have been removed. They were
  unmaintained and unused. This also drops the passdb_sql_update_query
  setting.
• config: doveconf no longer prints a flat global setting when a
  top-level named filter overrides the same setting.
• doveadm: The doveadm protocol has been bumped to v1.4. The server uses
  the newer multiplex stream format with clients supporting it. Older
  clients keep working unchanged.
• imap: Change imap_compress_on_proxy default to yes.
• lib-dict-extra: Increase dict client request timeout from 30s to 65s,
  so it stays above the SQL/Cassandra query timeout.
• lib-http: HTTP requests are now parsed strictly: obsolete line folding
  (obs-fold) and a bare LF line terminator are rejected. Both are
  request desynchronization/smuggling risks. HTTP responses are still
  parsed leniently.
• lib-storage: A '~' in a mailbox name is now escaped only when it is at
  the beginning of the mailbox name, not at the beginning of every
  hierarchy part. Directories written by older versions are migrated
  automatically while listing mailboxes.
• lib-var-expand: Add %{time:unix} provider and the epoch, from_epoch,
  date, iso8601 and escape filters. Deprecates the old time providers.
• lib-var-expand: The safe filter must now be the last filter in the
  chain.
• master: Increase the timeout after config reload before killing still
  running old processes from 6s to 35s, so that lib-master can stop them
  gracefully first.

New features

• config: Support heredoc syntax for multi-line setting values:
  key = <<EOD ... EOD. doveconf now outputs inline SET_FILE contents
  (e.g. ssl_ca) using heredoc instead of the "inline:" prefix. The
  "inline:" form is still accepted.
• configure: Build imap-hibernate also when only kqueue notify is
  available.
• doveadm: Add "doveadm auth cache status" command, with --reset for
  clearing the counters.
• doveadm: dump - List all supported dump types, and print the key type
  also for KEM and unsupported keys.
• fts-flatcurve: Add support for phrase searching. This fixes false
  positives where the searched words existed, but not as a phrase.
• fts-flatcurve: Delete the FTS index directory also when a Maildir
  mailbox is deleted.
• imap: Add [THROTTLED] response code to tagged replies when a plugin
  has throttled the command.
• last-login: Add last_login_dict_fields setting for updating multiple
  dictionary fields at login.
• lib-dcrypt: Add ML-KEM-512/768/1024 support with OpenSSL 3.
• lib-dcrypt: Support AEAD with Dovecot key encryption.
• lib-settings: Expand %{variables} also in strlist and boollist keys.
• lib-sql: sqlite - Add sqlite_busy_timeout setting, default 1s.
• login-common: Log the destination also when a proxy connection fails.
• quota: Update quota-clone also when "doveadm quota recalc" is run.

Bug fixes

• Fix building on systems with a signed 32-bit time_t.
• Fix building with Lua when LUA_LIBS contains linker flags such as -L.
• anvil: Fix busy loop eating CPU after an admin socket connection was
  disconnected.
• auth: Fix authentication failing after a password change when the
  passdb cache entry was verified by an auth worker.
• auth: Fix the credentials scheme of one passdb leaking into the next
  one during a multi-passdb lookup.
• auth: oauth2 - Fix losing userdb_* fields during OAUTHBEARER
  authentication.
• auth: passwd-file - Fix %{passdb:...} and %{userdb:...} expansion
  returning garbage or crashing.
• config: Fix crash in "doveconf -f" for a filter that includes a @group.
• config: Fix crash when including a default @group into a filter.
• config: Fix hiding secrets in doveconf output.
• config: Fix startup failures with some settings containing %{variables}.
• configure: Fix BUILD_IMAP_HIBERNATE detection.
• doc: solr-schema-9.xml - Add the mandatory tokenizer class attribute.
• doveadm: compress-connect - Fix writing server input to a non-blocking
  stdout.
• doveadm: fs delete - Fix crash with concurrent async deletes.
• doveconf: Fix bogus "Multiple settings matched" error when stdout is
  redirected to a file that already has content.
• dsync: Fix truncating a mailbox attribute value when it is compared to
  the local one, e.g. truncating a Sieve script.
• dsync: backup - Mailbox attributes changed or created only in the
  destination are now reverted or deleted.
• fts-flatcurve: Ignore index directory entries that vanish during
  iteration.
• fts: Don't run FTS optimize on forced resync.
• fts: build-mail - Fix accessing Content-Type header buffer out of
  bounds.
• imap-login, pop3-login: Tolerate SASL continuations "+" without a
  trailing space when proxying authentication.
• imap: Don't report FETCH output stream errors as
  "BUG: Unknown internal error".
• imap: Fix hibernation always failing on FreeBSD.
• imap: Fix panic on GETMETADATA with an invalid UTF-8 mailbox pattern.
• imapc: Don't send SEEEN/UNSEEN to the remote server when private
  indexes are used.
• imapc: Fix SEARCH results pointing at wrong messages after an untagged
  EXPUNGE.
• imapc: Fix SORT returning an empty result when search criteria were
  used.
• imapc: Fix crash when copying a mail that was already expunged in the
  source mailbox.
• imapc: Fix stale SEARCH/SORT results after a STORE in the same
  session.
• imapc: Honor imapc_features=no-search also for SORT.
• imapc: Properly handle search criteria that can be sent to remote server.
• lib-dcrypt: Don't panic on key algorithms the backend doesn't support.
• lib-dcrypt: Fix x9.62 ECDSA signatures randomly failing verification.
• lib-dict-backend: cdb - Fix use-after-free of the returned key.
• lib-dns-client: Fix handling of a disconnect initiated by the
  dns-client service.
• lib-fs: Fix panic in fs_write_stream_abort(), e.g. when the disk is
  full during FTS indexing.
• lib-index: Fix "File is already open" error when appending to the
  transaction log while another process is rotating it. This showed up
  as "NO [SERVERBUG] Internal error occurred." without any logging.
• lib-ldap: Fall back to system default CA paths, needed for OpenLDAP
  built against GnuTLS.
• lib-mail: istream-binary-converter - Fix heap use-after-free with a
  bodyless MIME part.
• lib-mail: message-parser - Fix out of bounds read with an empty
  preamble, fix skipping the epilogue boundary line, and degrade to a
  re-parse instead of panicking with an inconsistent cached MIME tree.
• lib-master: Fix kick reason when the KICK-USER-SIGNAL command arrives
  late, which logged "Killed with signal 15" instead of "User kicked".
• lib-oauth2: jwt - Fix use-after-realloc, guard against an empty body
  segment and percent-encode bare "." and ".." identifiers.
• lib-program-client: Fix panic upon irregular termination.
• lib-settings: Fix sorting of the settings history, which caused
  changed defaults and renames to be ignored once a plugin registered
  its own history, if dovecot_config_version has been set to greater
  than 2.4.0.
• lib-smtp: Fix assert with an empty broken localpart.
• lib-smtp: xclient - Reject an invalid HELO parameter with 501.
• lib-sql: pgsql - Fix binary field values for rows after the first.
  This mainly affected dict-sql maps with hexblob fields.
• lib-ssl-iostream: Fix crash at process exit with OpenSSL 4.0.
• lib-storage: Don't log an error when the client resets the connection
  while saving a mail.
• lib-storage: Fix crash when reverting a failed mailbox deletion.
• lib-storage: Fix decoded size calculation for base64 attachments,
  which could delete the cache record of a mail with a detached
  attachment.
• lib-storage: Fix handling escaped mailbox names in the mailbox list
  index.
• lib-storage: Fix rewriting non-NFC subscriptions with mUTF-7 storage
  names, which caused repeated rename errors.
• lib-storage: Fix searching flags when the view is not up to date. This
  broke e.g. a pipelined UID STORE +FLAGS \Deleted followed by UID
  EXPUNGE.
• lib-storage: Fix the mailbox vsize header not being repaired when it
  is corrupted, causing wrong mailbox sizes to be reported.
• lib-storage: thread - Fix panic when running IMAP THREAD in multiple
  connections in parallel.
• lib-var-expand: Reject an empty separator in the index filter, which
  caused an infinite loop.
• lib: Fix crash and out of bounds reads when decoding IDN addresses.
  Reachable only with the experimental mail UTF-8 support enabled.
• lib: ioloop - Fix panic and delayed timeouts when time moves forwards.
• lib: ostream-multiplex - Fix stalls, busy loops and a panic when
  streaming data through a multiplexed connection, e.g. IMAP FETCH
  through a login proxy or TLS connections.
• login-common: Fix connection hanging if an ostream write failed. This
  happened at least with HAProxy health check connections.
• login-common: Fix real_remote_ip being looked up incorrectly.
• login-common: Reject proxy credentials with ASCII control characters.
• login-proxy: Fix "doveadm kick" for proxied connections in
  high-security mode, and log "Kicked by admin" as the reason.
• maildir: Fix random SEARCH failures when another session concurrently
  expunges mails.
• quota: Fix maildir quota dropping to zero after IMAP MOVE or REPLACE.
• submission-login: proxy - Fix crash and unbounded memory usage with a
  multi-line or malformed AUTH reply from the backend.

Fixes

• Fixed standalone Docker destination setup on non-Swarm servers by creating networks with Docker's default bridge driver instead of the Swarm-only overlay driver.

Full Changelog: v4.3.13...v4.3.14

Features

• Added a one-click Executor service template with persistent storage and health checks (#11530).

Improvements

• Served profile avatars and project icons directly from configured S3 storage or an optional CDN, with local routes as a fallback.

Fixes

• Fixed missing service logos in global search and the service catalog by retrying a remote source before showing the default icon.
• Gave Sentinel startup migrations enough time to finish before Docker health checks could restart the container.
• Fixed stale Livewire keys and refresh races that could leave domain, storage, file, log, proxy, and scheduled job controls unresponsive after list changes.
• Preserved PostgreSQL init script identity when files were renamed.
• Rejected single-label hostnames in application and service domains while continuing to accept IP addresses.
• Preserved custom application container names during consistent deployments and removed containers left under legacy generated names.
• Fixed navigation after deleting or converting services, backups, scheduled tasks, sources, storage, and destinations.

What's Changed

• feat(services): add Executor one-click deployment template by @andrasbacsai in #11530

Full Changelog: v4.3.12...v4.3.13

The Asterisk Development Team would like to announce
the release of asterisk-22.11.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.11.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.11.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.11.0

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 16
• Issues Resolved: 28
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
the release of asterisk-23.5.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.5.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.5.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.5.0

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 16
• Issues Resolved: 28
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
the release of asterisk-20.21.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.21.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.21.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.21.0

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 16
• Issues Resolved: 28
• Security Advisories Resolved: 0

New uNmINeD development snapshot is available for download!

Changes:

• Right click menu items now work in isometric mode
• Fixed isometric block rotation mismatches (mushroom blocks, logs)
• Fixed isometric tile rendering failures (broken in 0.20.4)
• Fixed isometric tile pixel alignment glitches (sometimes there was an one pixel gap between tiles)

Fixes

• Applied authentication rate limits per real client behind reverse proxies and Cloudflare, preventing visitors from sharing one rate-limit bucket (#11515).
• Reset a server's unreachable counter after a successful connection check, preventing stale failures and false unreachable alerts (#11417, closes #11416).
• Corrected placeholder alignment in code editor fields (#11514, closes #11420).
• Queued Cloud registration verification emails with retries, making delivery more reliable.

What's Changed

• fix(server): reset unreachable_count after successful connection check by @mrcleanandfresh in #11417
• fix(ui): monaco editor placeholder alignment by @peaklabs-dev in #11514
• fix(auth): rate limit by proxy-aware client IP by @peaklabs-dev in #11515

New Contributors

• @mrcleanandfresh made their first contribution in #11417

Full Changelog: v4.3.11...v4.3.12

New uNmINeD development snapshot is available for download!

Changes:

• Optimizations for isometric mode (more speed, reduced memory usage)
• Isometric mode is now available from zoom 1:1 to 16:1
• Fixed KeyNotFoundException when rendering zoom-out tiles for web