[0.16.20] - 2026-08-30

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• System for Cross-domain Identity Management (SCIM) v2 (Enterprise):
  • Core Schema (RFC 7643)
  • Protocol (RFC 7644)
  • Cursor-Based Pagination (RFC 9865)
  • Interoperability Profile (draft-zollner-scim-interop-profile)
  • IPSIE lifecycle profile (draft-schreiber-scim-ipsie-profile)
• JMAP: CalendarEvent/set support for updating and deleting synthetic ids (#2925).
• Calendar:
  • Conference links in calendar invites and email alarms.
  • Translations for Arabic, Brazilian Portuguese, Bulgarian, Chinese Simplified, Chinese Traditional, Croatian, Czech, Finnish, Hebrew, Hindi, Hungarian, Indonesian, Japanese, Korean, Lithuanian, Norwegian Bokmål, Persian, Romanian, Russian, Slovak, Slovenian, Thai, Turkish, Ukrainian and Vietnamese.

Changed

• Calendar: Updated HTTP RSVP page.

Fixed

• DANE:
  • TLSA records are looked up whenever the MX RRset is signed, even when the MX host's own zone is not.
  • Mandatory DANE failures are permanent rather than temporary, bouncing messages that should be delayed.
  • Valid but unusable TLSA records fall back to the configured TLS strategy, permitting cleartext delivery where TLS is required.
• S3: Fix outdated upstream af-south-1 region configuration.
• Setup wizard: SQL directories set to use the main data store are now validated against the data store being configured.
• CardDAV: Delete default address book id when deleting the default address book.
• Redis: Sentinel deployments configured with rediss:// URLs now connect to the master over TLS instead of silently falling back to cleartext.
• Email: Generated Message-ID headers use the hostname of the node that built the message instead of the configured server hostname.
• MTA:
  • Do not send DMARC reports to local domains.
  • Messages addressed to an inboundReportAddresses match are only discarded when they actually contain a report (#1088).
• Directory: Impersonation using the recovery admin fails when the impersonated account has not logged in before (LDAP and SQL directories).
• WebUI: Failed logins open the browser's native credential prompt.
• Cluster: Expired node id leases are released periodically rather than only during startup, so entries for removed nodes no longer remain Stale or Inactive indefinitely.

Check binary attestation here

New uNmINeD development snapshot is available for download!

Changes:

• (Isometric) Moved isometric settings to a separate tab
• (Isometric) Added gamma and contrast settings (brighter and more vibrant images)
• (Isometric) Added water transparency and depth fading settings
• (Isometric) Biome blending is now ON by default
• (Isometric) Fixed rendering queue cancellation
• (Isometric) Fixed high IO pressure during rendering
• (Isometric) Rendering speed optimizations

Screenshot:

New uNmINeD development snapshot is available for download!

Changes:

• Improved Java Edition datapack error handling and logging
• (Isometric) Speed optimizations
• (Isometric) Ambient occlusion shading now works at chunk borders
• (Isometric) Added water transparency
• (Isometric) Added support for waterlogged blocks
• (Isometric) Added support for transparent textures
• (Isometric) Added biome tint blending

Transparent water and smooth biome borders:

You can install pre-built binaries from https://repo.dovecot.org/

Docker images can be found at https://hub.docker.com/r/dovecot/dovecot

Please review https://doc.dovecot.org/2.4.4/installation/upgrade/2.3-to-2.4.html and https://doc.dovecot.org/2.4.4/installation/installation.html.

Important

There are experimental features in 2.4, one is enabled with --enable-experimental-mail-utf8, and another with --enable-experimental-imap4rev2, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config.

Critical bug fixes

• CVE-2026-27852: Messages with a huge number of From/To/Cc/etc email addresses
  could result in excessive memory usage.
• CVE-2026-33263: Submission: Login service crashes with panic once
  mail_max_userip_connections limit is reached.
• CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly
  escape dots following a bare \r in message bodies, potentially allowing
  spoofed emails via malicious end-of-DATA injection.
• CVE-2026-33606: Mail content stored by a user can be crafted so that it is
  interpreted as dsync protocol commands when an administrator later runs dsync
  with the stream protocol, for example during a migration.
• CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage.
• CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU
  processing a single email with a massive number of Message-IDs in References
  header.
• CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might
  crash it.
• CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU
  processing emails with a large number of specially crafted Message-IDs in
  References header. The fix requires a new dovecot.index.thread file format,
  which is enabled only after setting dovecot_storage_version or newer. This
  rebuilds the index, so it will cause some extra CPU usage and extra
  metacache disk IO usage. It shouldn't cause (much) extra object storage IO,
  because all the fields should be coming from dovecot.index.cache.
• CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker
  could send mails into a victim's mailbox and observe network traffic to
  determine whether a secret message matched a known string by comparing
  compressed response sizes (a CRIME-style attack). The fix resets the
  compression dictionary after each IMAP command, preventing information from
  leaking between commands.
• CVE-2026-40205: If multiple OAUTH scopes were required, then
  this could have been only partially enforced with certain
  configurations.
• CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb
  fields without the "forward_" prefix which allows connections from
  trusted networks to set nopasswd field which allows to skip the
  authentication.
• CVE-2026-42391: Pre-login IMAP ID command could have used excessive
  amount of memory, causing the process to become killed and disconnecting
  all the other IMAP connections being proxied by the process. Or
  alternatively it could have caused excessive CPU usage, slowing down
  all the other IMAP connections being proxied by the process.
• CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH
  can result in an untagged NO response containing uninitialized memory,
  potentially leaking sensitive data.
• CVE-2026-42393: Doveadm password length or API key length could still
  be determined via timing based attacks.
• CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks
  could have been used to cause login processes to crash.
• CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked
  in the active Sieve binary. Switching to a different active binary
  could have been used to reset (bypass) the resource usage.
• CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive
  memory usage in imap-login process, possibly making it reach vsz_limit
  and kill all the connections being served by the process. Fixed by
  disabling COMPRESS command with all other compression algorithms than
  the standard DEFLATE.
• CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens.
  Now it requires all scopes.
• CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length
  frames crashes imap or imap-login process.

Changes

• auth: SIGHUP no longer flushes the passdb cache and SIGUSR2 no longer
  logs cache statistics. Use "doveadm auth cache flush" and the new
  "doveadm auth cache status" instead.
• auth: The OTP authentication mechanism, the {OTP} password scheme and
  the passdb set-credentials support have been removed. They were
  unmaintained and unused. This also drops the passdb_sql_update_query
  setting.
• config: doveconf no longer prints a flat global setting when a
  top-level named filter overrides the same setting.
• doveadm: The doveadm protocol has been bumped to v1.4. The server uses
  the newer multiplex stream format with clients supporting it. Older
  clients keep working unchanged.
• imap: Change imap_compress_on_proxy default to yes.
• lib-dict-extra: Increase dict client request timeout from 30s to 65s,
  so it stays above the SQL/Cassandra query timeout.
• lib-http: HTTP requests are now parsed strictly: obsolete line folding
  (obs-fold) and a bare LF line terminator are rejected. Both are
  request desynchronization/smuggling risks. HTTP responses are still
  parsed leniently.
• lib-storage: A '~' in a mailbox name is now escaped only when it is at
  the beginning of the mailbox name, not at the beginning of every
  hierarchy part. Directories written by older versions are migrated
  automatically while listing mailboxes.
• lib-var-expand: Add %{time:unix} provider and the epoch, from_epoch,
  date, iso8601 and escape filters. Deprecates the old time providers.
• lib-var-expand: The safe filter must now be the last filter in the
  chain.
• master: Increase the timeout after config reload before killing still
  running old processes from 6s to 35s, so that lib-master can stop them
  gracefully first.

New features

• config: Support heredoc syntax for multi-line setting values:
  key = <<EOD ... EOD. doveconf now outputs inline SET_FILE contents
  (e.g. ssl_ca) using heredoc instead of the "inline:" prefix. The
  "inline:" form is still accepted.
• configure: Build imap-hibernate also when only kqueue notify is
  available.
• doveadm: Add "doveadm auth cache status" command, with --reset for
  clearing the counters.
• doveadm: dump - List all supported dump types, and print the key type
  also for KEM and unsupported keys.
• fts-flatcurve: Add support for phrase searching. This fixes false
  positives where the searched words existed, but not as a phrase.
• fts-flatcurve: Delete the FTS index directory also when a Maildir
  mailbox is deleted.
• imap: Add [THROTTLED] response code to tagged replies when a plugin
  has throttled the command.
• last-login: Add last_login_dict_fields setting for updating multiple
  dictionary fields at login.
• lib-dcrypt: Add ML-KEM-512/768/1024 support with OpenSSL 3.
• lib-dcrypt: Support AEAD with Dovecot key encryption.
• lib-settings: Expand %{variables} also in strlist and boollist keys.
• lib-sql: sqlite - Add sqlite_busy_timeout setting, default 1s.
• login-common: Log the destination also when a proxy connection fails.
• quota: Update quota-clone also when "doveadm quota recalc" is run.

Bug fixes

• Fix building on systems with a signed 32-bit time_t.
• Fix building with Lua when LUA_LIBS contains linker flags such as -L.
• anvil: Fix busy loop eating CPU after an admin socket connection was
  disconnected.
• auth: Fix authentication failing after a password change when the
  passdb cache entry was verified by an auth worker.
• auth: Fix the credentials scheme of one passdb leaking into the next
  one during a multi-passdb lookup.
• auth: oauth2 - Fix losing userdb_* fields during OAUTHBEARER
  authentication.
• auth: passwd-file - Fix %{passdb:...} and %{userdb:...} expansion
  returning garbage or crashing.
• config: Fix crash in "doveconf -f" for a filter that includes a @group.
• config: Fix crash when including a default @group into a filter.
• config: Fix hiding secrets in doveconf output.
• config: Fix startup failures with some settings containing %{variables}.
• configure: Fix BUILD_IMAP_HIBERNATE detection.
• doc: solr-schema-9.xml - Add the mandatory tokenizer class attribute.
• doveadm: compress-connect - Fix writing server input to a non-blocking
  stdout.
• doveadm: fs delete - Fix crash with concurrent async deletes.
• doveconf: Fix bogus "Multiple settings matched" error when stdout is
  redirected to a file that already has content.
• dsync: Fix truncating a mailbox attribute value when it is compared to
  the local one, e.g. truncating a Sieve script.
• dsync: backup - Mailbox attributes changed or created only in the
  destination are now reverted or deleted.
• fts-flatcurve: Ignore index directory entries that vanish during
  iteration.
• fts: Don't run FTS optimize on forced resync.
• fts: build-mail - Fix accessing Content-Type header buffer out of
  bounds.
• imap-login, pop3-login: Tolerate SASL continuations "+" without a
  trailing space when proxying authentication.
• imap: Don't report FETCH output stream errors as
  "BUG: Unknown internal error".
• imap: Fix hibernation always failing on FreeBSD.
• imap: Fix panic on GETMETADATA with an invalid UTF-8 mailbox pattern.
• imapc: Don't send SEEEN/UNSEEN to the remote server when private
  indexes are used.
• imapc: Fix SEARCH results pointing at wrong messages after an untagged
  EXPUNGE.
• imapc: Fix SORT returning an empty result when search criteria were
  used.
• imapc: Fix crash when copying a mail that was already expunged in the
  source mailbox.
• imapc: Fix stale SEARCH/SORT results after a STORE in the same
  session.
• imapc: Honor imapc_features=no-search also for SORT.
• imapc: Properly handle search criteria that can be sent to remote server.
• lib-dcrypt: Don't panic on key algorithms the backend doesn't support.
• lib-dcrypt: Fix x9.62 ECDSA signatures randomly failing verification.
• lib-dict-backend: cdb - Fix use-after-free of the returned key.
• lib-dns-client: Fix handling of a disconnect initiated by the
  dns-client service.
• lib-fs: Fix panic in fs_write_stream_abort(), e.g. when the disk is
  full during FTS indexing.
• lib-index: Fix "File is already open" error when appending to the
  transaction log while another process is rotating it. This showed up
  as "NO [SERVERBUG] Internal error occurred." without any logging.
• lib-ldap: Fall back to system default CA paths, needed for OpenLDAP
  built against GnuTLS.
• lib-mail: istream-binary-converter - Fix heap use-after-free with a
  bodyless MIME part.
• lib-mail: message-parser - Fix out of bounds read with an empty
  preamble, fix skipping the epilogue boundary line, and degrade to a
  re-parse instead of panicking with an inconsistent cached MIME tree.
• lib-master: Fix kick reason when the KICK-USER-SIGNAL command arrives
  late, which logged "Killed with signal 15" instead of "User kicked".
• lib-oauth2: jwt - Fix use-after-realloc, guard against an empty body
  segment and percent-encode bare "." and ".." identifiers.
• lib-program-client: Fix panic upon irregular termination.
• lib-settings: Fix sorting of the settings history, which caused
  changed defaults and renames to be ignored once a plugin registered
  its own history, if dovecot_config_version has been set to greater
  than 2.4.0.
• lib-smtp: Fix assert with an empty broken localpart.
• lib-smtp: xclient - Reject an invalid HELO parameter with 501.
• lib-sql: pgsql - Fix binary field values for rows after the first.
  This mainly affected dict-sql maps with hexblob fields.
• lib-ssl-iostream: Fix crash at process exit with OpenSSL 4.0.
• lib-storage: Don't log an error when the client resets the connection
  while saving a mail.
• lib-storage: Fix crash when reverting a failed mailbox deletion.
• lib-storage: Fix decoded size calculation for base64 attachments,
  which could delete the cache record of a mail with a detached
  attachment.
• lib-storage: Fix handling escaped mailbox names in the mailbox list
  index.
• lib-storage: Fix rewriting non-NFC subscriptions with mUTF-7 storage
  names, which caused repeated rename errors.
• lib-storage: Fix searching flags when the view is not up to date. This
  broke e.g. a pipelined UID STORE +FLAGS \Deleted followed by UID
  EXPUNGE.
• lib-storage: Fix the mailbox vsize header not being repaired when it
  is corrupted, causing wrong mailbox sizes to be reported.
• lib-storage: thread - Fix panic when running IMAP THREAD in multiple
  connections in parallel.
• lib-var-expand: Reject an empty separator in the index filter, which
  caused an infinite loop.
• lib: Fix crash and out of bounds reads when decoding IDN addresses.
  Reachable only with the experimental mail UTF-8 support enabled.
• lib: ioloop - Fix panic and delayed timeouts when time moves forwards.
• lib: ostream-multiplex - Fix stalls, busy loops and a panic when
  streaming data through a multiplexed connection, e.g. IMAP FETCH
  through a login proxy or TLS connections.
• login-common: Fix connection hanging if an ostream write failed. This
  happened at least with HAProxy health check connections.
• login-common: Fix real_remote_ip being looked up incorrectly.
• login-common: Reject proxy credentials with ASCII control characters.
• login-proxy: Fix "doveadm kick" for proxied connections in
  high-security mode, and log "Kicked by admin" as the reason.
• maildir: Fix random SEARCH failures when another session concurrently
  expunges mails.
• quota: Fix maildir quota dropping to zero after IMAP MOVE or REPLACE.
• submission-login: proxy - Fix crash and unbounded memory usage with a
  multi-line or malformed AUTH reply from the backend.

Fixes

• Fixed standalone Docker destination setup on non-Swarm servers by creating networks with Docker's default bridge driver instead of the Swarm-only overlay driver.

Full Changelog: v4.3.13...v4.3.14

Features

• Added a one-click Executor service template with persistent storage and health checks (#11530).

Improvements

• Served profile avatars and project icons directly from configured S3 storage or an optional CDN, with local routes as a fallback.

Fixes

• Fixed missing service logos in global search and the service catalog by retrying a remote source before showing the default icon.
• Gave Sentinel startup migrations enough time to finish before Docker health checks could restart the container.
• Fixed stale Livewire keys and refresh races that could leave domain, storage, file, log, proxy, and scheduled job controls unresponsive after list changes.
• Preserved PostgreSQL init script identity when files were renamed.
• Rejected single-label hostnames in application and service domains while continuing to accept IP addresses.
• Preserved custom application container names during consistent deployments and removed containers left under legacy generated names.
• Fixed navigation after deleting or converting services, backups, scheduled tasks, sources, storage, and destinations.

What's Changed

• feat(services): add Executor one-click deployment template by @andrasbacsai in #11530

Full Changelog: v4.3.12...v4.3.13

The Asterisk Development Team would like to announce
the release of asterisk-22.11.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.11.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.11.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.11.0

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 16
• Issues Resolved: 28
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
the release of asterisk-23.5.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.5.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.5.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.5.0

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 16
• Issues Resolved: 28
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
the release of asterisk-20.21.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.21.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.21.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.21.0

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 16
• Issues Resolved: 28
• Security Advisories Resolved: 0

New uNmINeD development snapshot is available for download!

Changes:

• Right click menu items now work in isometric mode
• Fixed isometric block rotation mismatches (mushroom blocks, logs)
• Fixed isometric tile rendering failures (broken in 0.20.4)
• Fixed isometric tile pixel alignment glitches (sometimes there was an one pixel gap between tiles)

Fixes

• Applied authentication rate limits per real client behind reverse proxies and Cloudflare, preventing visitors from sharing one rate-limit bucket (#11515).
• Reset a server's unreachable counter after a successful connection check, preventing stale failures and false unreachable alerts (#11417, closes #11416).
• Corrected placeholder alignment in code editor fields (#11514, closes #11420).
• Queued Cloud registration verification emails with retries, making delivery more reliable.

What's Changed

• fix(server): reset unreachable_count after successful connection check by @mrcleanandfresh in #11417
• fix(ui): monaco editor placeholder alignment by @peaklabs-dev in #11514
• fix(auth): rate limit by proxy-aware client IP by @peaklabs-dev in #11515

New Contributors

• @mrcleanandfresh made their first contribution in #11417

Full Changelog: v4.3.11...v4.3.12

New uNmINeD development snapshot is available for download!

Changes:

• Optimizations for isometric mode (more speed, reduced memory usage)
• Isometric mode is now available from zoom 1:1 to 16:1
• Fixed KeyNotFoundException when rendering zoom-out tiles for web

Features

• Added asynchronous DNS validation for application and service domains.
• Added one-click service templates for HashiCorp Vault and Obsidian LiveSync CouchDB.

Fixes

• Restored proxy connections to project networks after host reboots (#11476, fixes #11436).
• Applied custom Docker options when applications used custom container names, honored selected rollback tags, and respected Compose stop grace periods (#11479, #11480, #11498).
• Restored custom-format PostgreSQL backups with pg_restore (#11481, fixes #11459).
• Removed persistent volumes when deleting application previews (#11455, fixes #11441).
• Made Docker cleanup safe to retry and prevented missing resources from failing deletion (#11463).
• Fixed registry pushes by updating the helper image's Docker CLI, Compose, and Buildx versions (#11461, fixes #11437).
• Fixed service log lookup when Docker label values contained commas (#11477, fixes #11454).
• Allowed system-wide GitHub Apps to work across teams and accepted Coolify CUIDs when updating their private keys through the API (#11453, #11468).
• Allowed teams with unused private keys or system-wide Git sources to be deleted without removing shared sources (#11499, #11500, fixes #11494).
• Restored clickable commit links in deployment logs (#11495, fixes #11482).
• Cleared stale Traefik branch-upgrade warnings after the suggested branch was applied (#11496, fixes #11490).
• Kept private-key edit dialogs working after multiple keys were deleted (#11497, fixes #11487).
• Fixed terminal container selection when identical container names existed on different servers.
• Refreshed service configuration after required environment variables changed.
• Redacted dotted GitHub tokens from exported logs and prevented wide tables from overflowing their containers.

Improvements

• Showed a toast with retry guidance when infrastructure-related Livewire requests failed.
• Distinguished proxy restarts from proxy updates in server status indicators.
• Made stuck-resource cleanup scalable, scheduled it automatically, and made resource deletion metadata updates atomic.

New Contributors

• @erick260392 made their first contribution in #11468
• @iamomiid made their first contribution in #11479

Full Changelog: v4.3.10...v4.3.11

MariaDB Server maintenance releases are here!
On August 24, we released updates for our four currently maintained Long Term Support series:
As usual, these maintenance releases include bug fixes, stability improvements, and ongoing work across MariaDB Server. …

Continue reading \"MariaDB Server 12.3, 11.8, 11.4 and 10.11 – Q3 2026 Maintenance Releases, and Goodbye 10.6\"

MariaDB Server 12.3, 11.8, 11.4 and 10.11 – Q3 2026 Maintenance Releases, and Goodbye 10.6 appeared first on MariaDB.org

New uNmINeD development snapshot is available for download!

Changes:

• Bedrock LevelDB log file reader optimizations (speedup for worlds with large log files)
• Isometric mode optimizations (huge speedup, less memory usage)
• Isometric mode now uses the block filter settings
• Added support for Java Edition default blockstates (from 26.3-snapshot-7)
• Upgraded to .NET 11 (preview.7)

Default blockstates

Minecraft Java Edition from version 26.3-snapshot-7 does not store blockstate properties in the world save files when referencing a default blockstate. This caused these blockstates to render incorrectly.

uNmINeD now uses a configuration file config/vanilla.defaultblockstates.java.txt to resolve default vanilla blockstate properties. If it encounters a blockstate reference without properties, it will use the default properties from the configuration file.

The configuration file only contains default blockstate information for vanilla blocks. A mod will be available later that will allow you to generate a blockstate configuration file for modded worlds.

[0.16.19] - 2026-08-24

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• WebUI: oauthClientId setting in Application, which allows the WebUI to use a different OAuth client than the default.
• Sieve: env.spam.score and env.spam.is_spam variables, which expose the spam filter result to system scripts running at the DATA stage.
• CalDAV: vCardVersion setting in AddressBook, which allows the default vCard version to be specified when the client does not request a specific version.

Changed

• MySQL & MariaDB: Key columns are now VARBINARY(255) with a full-length primary key instead of TINYBLOB. Note: Existing deployments should run, once per table, for each of the tables a, d, e, f, g, h, j, k, l, m, n, o, p, q, r, s, t, u, w, x and y the command ALTER TABLE a MODIFY k VARBINARY(255) NOT NULL;.

Fixed

• ACME:
  • Order and authorization failures are never logged, so an order rejected by the CA.
  • An order rejected by the CA marks the renewal task as permanently failed.
• CalDAV:
  • Attendee addresses whose mailto: URI percent-encodes a full name-addr are silently dropped from the scheduling snapshot.
  • Attendees whose calendar user address cannot be parsed should be flagged with SCHEDULE-STATUS=3.7.
  • The RSVP link in an iMIP invitation stamps PARTSTAT on the organizer's copy of the event only, leaving a local attendee's own copy at NEEDS-ACTION and sending the organizer no reply.
  • MKCALENDAR, MKCOL and PROPPATCH store the display name, description, time zone and the other per-user properties under the authenticated account rather than the account that owns the collection.
• Directory:
  • An empty column, attribute or claim returned by an external directory is synchronized as an empty string rather than a missing value.
  • /api/discover splits the account name on @ without accounting for the % master user separator or the recovery administrator.
• FoundationDB: Older chunked entries are not deleted.
• IMAP: SETACL and DELETEACL fail to resolve an identifier spelled with uppercase characters.
• iMIP: Invitations, replies and cancellations reference a TZID parameter with no matching VTIMEZONE component whenever the event was stored without one.
• JMAP:
  • AddressBook/get: A new account's default address book is never recorded.
  • Email/get and Email/parse with fetchAllBodyValues return body values only for the parts listed in textBody or htmlBody, omitting every other text/* part in bodyStructure.
  • Email/set writes display names as an RFC 2047 encoded-word wrapped in a quoted-string, which RFC 2047 forbids.
  • Mailbox/set, AddressBook/set and Calendar/set store isSubscribed and the other per-user properties under the authenticated account rather than the account named in the request.
  • Principal/query returns no results when the name or email filter is spelled with uppercase characters.
  • FileNode/set: File nodes created over JMAP are returned with a <D:href> holding the raw name over WebDAV.
• Meilisearch:
  • Queries return at most 1000 results, as the maxTotalHits pagination setting is left at the Meilisearch default.
  • Searches combining several terms return documents that match only some of them.
  • A task confirmation timeout is reported as a success when failOnTimeout is disabled.
• Import: --import always aborts with the target database already containing data in the key range being imported.
• MTA:
  • A domain catchAllAddress pointing to a mailing list or a sub-addressed mailbox is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
  • is_local_address() and is_local_domain() expression functions do not match an address or domain spelled with uppercase characters.
  • Relay routes are rejected with host resolves loopback address, which prevents relaying through a local proxy or tunnel.
• MySQL, MariaDB & PostgreSQL: Range scans, range deletions and store purges run as a single unbounded statement, so on servers that enforce a statement timeout they abort on large accounts and tasks such as account deletion can never complete.
• Network: local_port and local_ip report the address Stalwart is bound to rather than the address the client connected to when the connection arrives through a trusted proxy.
• Task manager:
  • totalDeadline is not enforced on tasks that fail with a specific retry time.
  • Indexing tasks are dropped after maxAttempts failures, so a search store that is unavailable or overloaded leaves messages permanently missing from the index.
  • Indexing tasks are dropped when the document metadata read returns no data, which can happen on SQL read replicas that have not yet caught up with the primary.
  • The DNS management task republishes the DKIM records of retired keys that the DKIM rotation task had already removed from the zone.
• Sieve: spamtest returns only 1 or 10 (and spamtest :percent only 0 or 100), so scripts cannot act on intermediate spam scores.
• Spam filter: MIME_BAD is tagged whenever the declared Content-Type of an attachment is not byte identical to the type detected from its magic bytes.

Check binary attestation here

Features

• Added configurable SMTP EHLO domains for instance and team email delivery (#11398, closes #11388).
• Added API endpoints for viewing and updating instance-wide SMTP and Resend settings.
• Added manual upgrade controls to the Updates page and mobile navigation.

Fixes

• Applied the configured sender name and address to SMTP, Resend, test, transactional, and password-reset emails (#11393, closes #6073).
• Respected disabled SMTP encryption in test emails (#11384, closes #5877 and #6442).
• Prevented Proton SMTP from folding long From headers (#11400, closes #11380).
• Restricted API token visibility and revocation to the active team, and stopped expiration warnings for users who had left that team (#11396, closes #11390).
• Persisted the target image and version before container recreation so upgrades kept the installed version aligned (#11401, closes #11389).
• Restored generated Caddy labels for applications with configured domains (#11397, closes #11394).
• Allowed domains to be added to services with an empty Compose environment section (#11407, closes #11381).
• Marked failed or timed-out Docker cleanup executions as finished and recorded their errors (#11408, closes #11383).
• Required explicit confirmation before invitation magic links were redeemed, preventing link scanners and previews from consuming invitations (#11413, closes #11375).
• Aligned team-scoped API responses and project access checks across sources, servers, projects, and environments (#11405).
• Prevented newly introduced static settings from appearing as pending deployment changes after upgrades (#11430, closes #11426).
• Completed local resource deletion even when remote Docker or backup cleanup failed.
• Made team membership, invitation, token revocation, and source deletion changes roll back safely when part of the operation failed.
• Released page scroll locking before destructive confirmation actions ran, preventing stuck interfaces.

Improvements

• Preserved the current page and query parameters when switching teams.
• Showed warnings for pending proxy updates and unavailable Sentinel instances in server status indicators.
• Limited team deletion to owners, assigned an owner to existing ownerless teams, and made blocking resources easier to find from the danger zone.

Full Changelog: v4.3.9...v4.3.10

New uNmINeD development snapshot is available for download!

Changes:

• (GUI) Added two additional zoom levels to isometric mode, now it works from 4:1 to 16:1
• (CLI) Added webp-format (lossless, lossy), webp-method (0..6) and webp-quality (0..100) command line parameters to web export
• Fixed default webp format, now it’s lossless instead of lossy
• Fixed sulfur caves, dappled forest and nether colors/tints
• Fixed Java local player GUID parsing
• Fixed water block levels in isometric mode

The isometric mode is not yet optimized for speed, and isometric map tiles are not yet cached. Future releases will be faster.

The Asterisk Development Team would like to announce
release candidate 2 of asterisk-23.5.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.5.0-rc2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.5.0-rc2

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.5.0-rc2

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

• George Joseph: (1)

Issue and Commit Detail:

Closed Issues:

• 2085: [bug]: res_http_websocket: SEGV if we're a server and receive a PONG frame

Commits By Author:

• George Joseph (1):

  • res_http_websocket: Check for client before handling PONG frames.

Commit List:

• res_http_websocket: Check for client before handling PONG frames.

Commit Details:

res_http_websocket: Check for client before handling PONG frames.

Author: George Joseph
Date: 2026-08-13

websocket_handled_pong_or_close() now checks that session->client is valid
before trying to check missed_pong_count.

Resolves: #2085

The Asterisk Development Team would like to announce
release candidate 2 of asterisk-20.21.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.21.0-rc2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.21.0-rc2

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.21.0-rc2

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

• George Joseph: (1)

Issue and Commit Detail:

Closed Issues:

• 2085: [bug]: res_http_websocket: SEGV if we're a server and receive a PONG frame

Commits By Author:

• George Joseph (1):

  • res_http_websocket: Check for client before handling PONG frames.

Commit List:

• res_http_websocket: Check for client before handling PONG frames.

Commit Details:

res_http_websocket: Check for client before handling PONG frames.

Author: George Joseph
Date: 2026-08-13

websocket_handled_pong_or_close() now checks that session->client is valid
before trying to check missed_pong_count.

Resolves: #2085

The Asterisk Development Team would like to announce
release candidate 2 of asterisk-22.11.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.11.0-rc2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.11.0-rc2

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.11.0-rc2

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

• George Joseph: (1)

Issue and Commit Detail:

Closed Issues:

• 2085: [bug]: res_http_websocket: SEGV if we're a server and receive a PONG frame

Commits By Author:

• George Joseph (1):

  • res_http_websocket: Check for client before handling PONG frames.

Commit List:

• res_http_websocket: Check for client before handling PONG frames.

Commit Details:

res_http_websocket: Check for client before handling PONG frames.

Author: George Joseph
Date: 2026-08-13

websocket_handled_pong_or_close() now checks that session->client is valid
before trying to check missed_pong_count.

Resolves: #2085

nginx-1.31.4 mainline version has been released.

Release candidate

This is the first release candidate for Coolify v4.4. It is intended for testing and validation before the stable v4.4 release.

Do not use this release candidate in production without appropriate testing. Please report regressions through GitHub Issues.

Changes in next

These notes include only changes currently unique to next compared with main.

OpenID Connect and authentication

• Added first-class OpenID Connect (OIDC) authentication, including discovery, JWKS signing-key resolution, token validation, PKCE support, and identity linking.
• Added OIDC configuration and registration-policy controls to instance settings.
• Added an option to automatically join OIDC users to the root team.
• Improved OAuth login handling and profile indication for SSO accounts.

Integration tokens

• Added team-scoped integration-token management under Security settings.
• Added create, edit, permission, and authorization handling for integration tokens.

Settings and server management

• Improved email-provider configuration and enforced mutually exclusive provider selection.
• Added notification-channel enable/disable handling for Discord, email, Pushover, Slack, Telegram, and webhooks.
• Improved Docker prerequisite and package installation, including Alpine Linux package handling.
• Improved log-drain toggle rollback behavior and SSH multiplexing controls.

Additional improvements

• Improved settings navigation and action-button state handling.
• Updated bundled service templates.
• Added broader automated coverage for OIDC, OAuth registration, integration tokens, email providers, server packages, and related settings.

Comparison: main...next

Features

• Added an instance setting to control forced HTTPS redirects for the dashboard.

Fixes

• Prevented DNS validation from hanging on unresponsive resolvers by adding five-second query timeouts (#11378, closes #11351).
• Preserved active deployments when shared SSH multiplexing connections were refreshed or cleaned up (#11377, closes #11372).
• Restored GitLab push and merge-request deployments that could fail with an HTTP 500 response (#11284, closes #11262).
• Allowed long-running volume backups to run for up to ten hours while preserving custom timeouts on existing schedules (#11358, closes #11273).
• Prevented SSL-enabled database containers from being left stopped during certificate ownership repair and container replacement (#11315, #11352, closes #11312).
• Prevented OAuth provider settings from being erased when OAuth settings were re-seeded (#8210).
• Enforced team-scoped authorization for scheduled tasks, preventing cross-team access and execution (#11239, closes #11238).
• Prevented large bind-mounted files and oversized remote output from exhausting memory while services, tasks, logs, volumes, and configuration were read (#10960).
• Made upgrades recover correctly when status data was temporarily unavailable after restart (#11350, closes #11347).
• Prevented stuck container removal from blocking deployments; cleanup was deferred and retried instead.
• Enabled compression for the dashboard over HTTPS (#10828, closes #10802).
• Corrected S3 error email links so they pointed to the configured instance instead of localhost (#8633).
• Fixed highlighted-button, spinner, and keyboard-shortcut contrast across custom themes (#11279).
• Fixed account menus remaining open after clicking outside an expanded Appearance panel (#11374, closes #11373).
• Centered icon tooltips over their triggers (#11382).

Improvements

• Surfaced pending proxy configuration and outdated Traefik states with actionable warning indicators.
• Made server warnings clearer, improved deployment-log scrolling, and corrected spacing in database backup settings.
• Clarified proxy-label generation choices (#11362).
• Clarified that saving Sentinel settings restarted Sentinel.
• Made database and OAuth seed operations transactional to preserve existing data when seeding failed (#11360).

What's Changed

• feat: add configurable Horizon dashboard access by @SelimSalihovic in #9354
• fix(upgrade): handle missing status after restart by @andrasbacsai in #11350
• fix(databases): redirect stdin for the SSL cert chown by @MarkosTech in #11315
• fix: compress dashboard over HTTPS by @Prains in #10828
• fix(notification): update storage email link in S3 error by @NrwPlay in #8633
• fix(databases): chown SSL certs before container replacement by @andrasbacsai in #11352
• fix(ui): improve highlighted button and spinner contrast by @fsioni in #11279
• fix(webhook): restore GitLab source deployments by @drewmt in #11284
• fix(services): avoid loading bind-mount file contents by @andrasbacsai in #10960
• fix(backups): support long-running volume backups by @andrasbacsai in #11358
• fix(security): enforce team-scoped authorization for scheduled tasks by @HelgeSverre in #11239
• fix(oauth): prevent data loss during OAuth settings re-seed by @ryzenixx in #8210
• fix: wrap seeders in db transactions by @peaklabs-dev in #11360
• chore(ui): improve clarity of generate proxy label options by @peaklabs-dev in #11362
• fix(ui): close account menu on outside click when appearance is expanded by @rohittiwari-dev in #11374
• fix(ui): center icon tooltips over their trigger by @peaklabs-dev in #11382
• fix(ssh): preserve sessions when recycling mux connections by @andrasbacsai in #11377
• fix(dns): time out validation queries after five seconds by @andrasbacsai in #11378

New Contributors

• @SelimSalihovic made their first contribution in #9354
• @MarkosTech made their first contribution in #11315
• @Prains made their first contribution in #10828
• @NrwPlay made their first contribution in #8633
• @fsioni made their first contribution in #11279
• @HelgeSverre made their first contribution in #11239
• @ryzenixx made their first contribution in #8210

Full Changelog: v4.3.8...v4.3.9

Fixes and improvements

General

• prevent spamming of 'stream is closed' error during shutdown (#6062)
• impose a minimum value to clock rate of always-available tracks (#6086) Clock rates below 10 caused the emission of empty samples. Fix the issue by imposing a minimum value of 8khz, that rises to 22khz in case of AAC.
• fix race condition during sub-stream creation (#6075) (#6095) When a stream with always-available turned on switches from offline to online, or from a publisher to another, the reader mutex was not acquired during writing of codec parameters. This is now fixed.
• restore ability to run the server in a read-only file system (#6098) This was temporarily lost after the introduction of the native MoQ QUIC listener.
• fix deadlock when changing configuration through file and API (#6077) (#6101) When changing configuration in parallel by editing the configuration file and calling the API, the server could get into a deadlock that prevented any further action. This is fixed.
• change default value of authHTTPExclude (#6103) by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.
• add destFingerprint parameter (#6106) this allows to validate self-signed certificates of forward destinations.
• pmp4: fix panic in case of bad input (bluenviron/mediacommon#354) the stsc box was not checked properly. This is now fixed.
• pmp4: fix panic in case of bad input (bluenviron/mediacommon#355) The parser was not checking that the MP4 was properly sending addresses of samples, resulting in samples with invalid addresses. This is now fixed.
• pmp4, fmp4: do not emit empty payloads (bluenviron/mediacommon#353)

API

• redact password in responses (#6110) passwords are not exposed anymore through the API. They can only be set, not read.

Media-Over-QUIC

• support pulling streams from other servers (#6111)
• do not accept empty payloads (#6085)
• limit maximum amount of published tracks (#6087) this prevents clients from consuming an excessive amount of memory.
• make /moq URL suffix optional (#6107) In order to establish a MoQ session with WebTransport, a /moq suffix was required until now. This is now optional in order to allow connecting to the server with the standard MoQ URL format.
• impose maximum size on pending reordered bytes (#6112) Decrease the maximum memory that clients can take by imposing a maximum size of 100MB on the pending reordered bytes.

RTSP

• accept relative digest URI (bluenviron/gortsplib#1118) RFC 2617 section 3.2.2 allows the digest URI to be either an absolute URI or a relative path. Some clients use the latter, which was rejected with "wrong URL" since urlMatches only accepted an exact match against the absolute request URL.
• send initial RTCP sender report without waiting for a period (bluenviron/gortsplib#1052) (bluenviron/gortsplib#1111) (bluenviron/gortsplib#1120) Reports were emitted only on the ticker, so the first one arrived Period after Initialize (10s by default) and later still when no RTP packet had been sent by that first tick, since report() returns nil until then and the next opportunity is another Period away.
• ensure that decoders can produce only output that does not crash encoders (bluenviron/gortsplib#1123)
• discard empty Opus and G722 RTP packets (bluenviron/gortsplib#1131)
• improve error message when setting read buffer fails (bluenviron/gortsplib#1133)
• server: fix race condition when recording (bluenviron/gortsplib#1134) state was not protected.

RTMP

• inform about authentication failures (#5657) (#6072) Reply with NetStream.Play.Failed or NetStream.Publish.Unauthorized when a client is not authorized to play or publish. This makes clients like OBS to stop recreating the connection in case of authentication failures.

• reader: do not emit empty frames (bluenviron/gortmplib#106)

• parse video PTS delta as signed (bluenviron/gortmplib#88)
  HLS

• prefer hls.js on iOS too (#6090) In the embedded HLS reader, use hls.js on iOS, that was previously disabled due to compatibility issues that should have been solved.

• unlock the session-in-query+iOS combination (#6088) this was previously blocked because the session in query was meant to be dynamic, therefore incompatible with static playlists required by iOS. It is not anymore, so we can support that.

• stop using cookies with plain HTTP (#6089) in case of plain HTTP, fall back to query parameters, which are safer than HTTP cookies because they are not shared between different pages/domains, although they are visible in the URL.

WebRTC

• support forwarding streams (#6099)
• fix warning when IPv6 is disabled (#5733) (#6048)
• improve performance by ignoring mDNS candidates (#4963) (#6064) mDNS candidates sometimes require a large CPU portion, they are not involved in any connectivity method mentioned in the documentation, they work in local networks only.

SRT

• apply UDP read buffer size from configuration (#6069) Use upstream datarhei/gosrt's ListenerControl config field (datarhei/gosrt#144) to set SO_RCVBUF on the SRT listener's UDP socket.

RPI Camera

• fix crash when secondary stream is enabled (#6060) (#6061)
• prevent invalid MJPEG sizes (#6080) width and height of MJPEG frames must be multiple of 8 and less than 2048, otherwise they cannot be routed with RTP/RTSP.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.83.0 to v0.85.0
• github.com/alecthomas/kong updated from v1.16.0 to v1.16.1
• github.com/asticode/go-astits updated from v1.15.0 to v1.16.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.2 to v2.4.3
• github.com/bluenviron/gortmplib updated from v1.0.0 to v1.0.1
• github.com/bluenviron/gortsplib/v5 updated from v5.6.3 to v5.6.4
• github.com/bluenviron/mediacommon/v2 updated from v2.9.2 to v2.9.3
• github.com/datarhei/gosrt updated from v0.11.0 to v0.11.1-0.20260812091715-a77b40bb4b76
• github.com/pion/ice/v4 updated from v4.4.0 to v4.4.1
• github.com/pion/transport/v4 updated from v4.0.2 to v4.1.0
• github.com/stretchr/testify updated from v1.11.1 to v1.12.0
• golang.org/x/crypto updated from v0.54.0 to v0.55.0
• golang.org/x/net updated from v0.57.0 to v0.58.0
• github.com/davecgh/go-spew removed
• github.com/pion/srtp/v3 updated from v3.0.12 to v3.0.13
• github.com/pmezard/go-difflib removed
• golang.org/x/text updated from v0.40.0 to v0.41.0
• hls.js updated from v1.6.16 to v1.7.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Features

• Added configurable HTTPS redirects for service applications across the dashboard, API, and MCP.

Fixes

• Prevented members from accessing deployment, database, service, and other mutable controls, and clarified disabled control styling.
• Fixed confirmation modal checkboxes that generated malformed Livewire bindings (#11335).
• Kept table page-size dropdowns visible and usable near the bottom of the viewport (#11349, fixes #11336).
• Persisted PostgreSQL public-access changes so they no longer reverted after refreshes or proxy restarts (#11348, fixes #11345).
• Corrected Traefik redirect capture groups and selected the proper Docker network for routed Compose applications and services.
• Reconciled proxy networks from running containers, improving routing when cached resource status was stale.

Improvements

• Made GitHub repository and branch selectors searchable and preselected each repository’s default branch.
• Improved active-deployment indicator contrast with solid surfaces in every state.

What's Changed

• fix(modal): use checkbox ids for Livewire bindings by @andrasbacsai in #11335
• fix(postgresql): persist selected public access state by @andrasbacsai in #11348
• fix(table): keep page-size dropdown within viewport by @andrasbacsai in #11349

Full Changelog: v4.3.7...v4.3.8

[0.16.18] - 2026-08-17

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Reporting: inboundReportMaxSize setting, which bounds the size of a decompressed inbound DMARC or TLS report (default 25MB).
• RocksDB: cacheSize setting, which bounds the total memory shared by the block caches of every column family (default 128MB).

Changed

• ASN & GeoIP: Default data source URLs now point at the ip-location-db GitHub releases, as the previously used npm packages are no longer updated. Existing installations keep their configured URLs and should update them following the ASN and GeoIP documentation.
• JMAP: Identity/get keeps identities in sync with the account's e-mail addresses.
• MTA: Queue scheduler no longer rescans the queue from the earliest pending event and coalesces bursts of delivery completions into a single scan.
• RocksDB:
  • Column families are tuned for the access pattern of the data they hold.
  • Range iteration uses bounded iterators and no longer reads values when only keys were requested.

Fixed

• JMAP:
  • Setting uploadTtl to 1ms triggers panic.
  • CalendarEvent/set does not assign organizerCalendarAddress nor send scheduling messages when an event is created with participants.
  • CalendarEvent/get omits isOrigin when it is listed explicitly in properties.
  • CalendarEventNotification/changes and FileNode/changes reject with cannotCalculateChanges the state that /get returned for an account with no change history.
  • CalendarEvent/set and ContactCard/set do not write a vanished tombstone for the previous CalDAV/CardDAV href when calendarIds or addressBookIds moves an item between collections.
• CalDAV: Attendee addresses that percent-encode a display name into the mailto: URI are queued verbatim.
• Calendar: Recurring events disappear from CalDAV time-range REPORTs and JMAP CalendarEvent/query results a few years after their first occurrence.
• WebDAV:
  • When a file node references a parent folder that no longer exists, any request on a file collection panics.
  • MOVE on a folder honors a Depth header of 0 or 1 instead of always moving the whole subtree.
• MTA:
  • DSN bounces are emitted with a malformed Message-ID wrapped in doubled angle brackets.
  • Delivery to any MX host whose name is an IDN A-label fails permanently.
  • Queue strategy and quota expressions that branch on source never match at enqueue.
  • MTA-STS:
    • Policies in testing mode are enforced, turning any TLS error into a permanent failure.
    • mx patterns published as U-labels never authorize the MX host they name.
  • DMARC:
    • Alignment compares identifiers in their A-label form.
    • External reporting addresses published as U-labels are rejected as unauthorized.
• Spam filter:
  • Some rules misfire on internationalized addresses when the envelope and the headers spell the same domain in different label forms.
  • Punycode labels that do not re-encode to the label they came from are no longer decoded.
• WebPush: Validate push URL and use application/octet-stream as Content-Type for encrypted payloads.
• Directory:
  • Local group membership is cleared when the external directory is configured with a group claim or attribute that it does not return.
  • LDAP: Directories that store aliases as additional values of the primary address attribute provision no aliases.
  • Mail addressed to a domain alias is rejected with 550 Relay not allowed, unless the domain's primary name happened to be resolved earlier and is still cached.
• RocksDB: bufferSize setting was applied to the unused default column family and had no effect.
• Sieve: include statements fail to find system and user global scripts whose name contains uppercase characters.
• Task manager: totalDeadline is measured from the time a task was created instead of its first failed attempt.

Check binary attestation here