Lees weergave

1.6

What's Changed

New Features 🎉

Bug Fixes 🛠

Other ⚙️

New Contributors

Full Changelog: 1.5...1.6

  •  

Distribution Release: Manjaro Linux 26.1.0

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Philip Müller has announced the release of Manjaro Linux 26, the new stable build of the project's set of rolling-release distributions with a choice of GNOME, KDE Plasma and Xfce desktops. This release updates the GNOME desktop to version 50 and KDE Plasma to version 6.7: "Manjaro 26.1....
  •  

Tokyo Game Show 2026

We're excited to share that, for the very first time in SCS Software's history, we'll be attending the Tokyo Game Show 2026! We can't wait to meet our community in Japan and be part of one of the world's most iconic gaming events as it celebrates an incredible milestone.

This year's edition of Tokyo Game Show is especially significant, marking the event's 30th anniversary. To celebrate this special occasion, TGS 2026 will take place over five full days, from September 17th to 21st, bringing together leading publishers, exciting upcoming games, and countless attractions for visitors from around the world.

You'll be able to find us in Hall 09, Booth E86, where our colleagues from SCS will be exhibiting in a compact booth made possible with the support of our friends at Neon Noroshi. Whether you're a longtime fan of our games or discovering them for the first time, we'd love for you to stop by, say hello, and experience what we've been working on.

During the first two days, the Tokyo Game Show is dedicated to gaming industry professionals, while the final three days are open to the public. Throughout the event, visitors will have the opportunity to get behind the wheel and try several of our upcoming projects, including the Iceland DLC for Euro Truck Simulator 2, as well as the upcoming British Columbia and South Dakota map expansions for American Truck Simulator.

We're also doing everything we can to bring playable demonstrations of our upcoming Road Trip and Coaches projects to Tokyo Game Show, along with a PlayStation 5 version of Euro Truck Simulator 2. While we're not quite ready to make any promises, our teams are working hard behind the scenes, and we hope to give visitors an early hands-on look at these exciting new experiences.

We're especially happy to share that Japanese-speaking visitors will be able to communicate with our team comfortably, as language interpreters will be available at our booth throughout the event. We hope this will make it even easier for everyone to ask questions, chat with us, and enjoy their time at our exhibit.

If you're planning to attend Tokyo Game Show 2026, we'd love to see you there! Be sure to stop by Hall 09, Booth E86, try out our latest projects, meet the team, and share your passion for trucking with us. We look forward to welcoming you to our very first Tokyo Game Show!

  •  

v4.3.1

Coolify v4.3.1

Features

  • Added persistent “Changes pending” warnings to the desktop and mobile navigation bars, including change counts and direct access to configuration differences.

Fixes

  • Ensured HTTP Basic Auth updates made through the Applications API regenerated managed deployment labels while preserving custom labels (#11196, closed #11191).
  • Fixed a 500 error on volume backup pages when database backup execution logs were present (#11210).
  • Removed duplicate borders from CPU and memory metrics tooltips (#11213, closed #11212).
  • Repaired environment and project settings page headers (#11204).
  • Corrected the German password-reset email translation (#9680).
  • Updated error pages to use the correct Coolify-branded background glow.

Improvements

  • Redesigned terminal target selection and improved filtering and mobile controls (#11203).

What's Changed

  • fix(release): preserve tags when publishing draft releases by @andrasbacsai in #11199
  • feat(workflows): add pull request branch management workflow by @ShadowArcanist in #11193
  • fix(lang): correct german translation for password reset email by @EchterTimo in #9680
  • fix(ui): remove duplicate metrics tooltip border by @nexmoe in #11213
  • fix(models): add datetime cast for finished_at in ScheduledDatabaseBackupExecution by @ejscheepers in #11210
  • fix(ui): environment settings broken header & project settings header by @yk-sgr in #11204
  • fix(ui): terminal page design by @yk-sgr in #11203
  • fix(api): regenerate basic auth labels after updates by @drewmt in #11196

New Contributors

Full Changelog: v4.3.0...v4.3.1

  •  

Minecraft 26.3-snapshot-8 (snapshot) Released

26.3 Snapshot 8 (known as 26.3-snapshot-8 in the launcher) is the eighth snapshot for Java Edition 26.3, released on August 12, 2026, which adds invite codes for Realms, renames a few explorer maps, and fixes bugs. Full changelog: https://minecraft.wiki/Java_Edition_26.3-snapshot-8
  •  

v4.3.0

Let us know what you think about the new UI here: #11195

Breaking Changes

  • Team members with the Member role became read-only. They could still view team resources and configuration, but could no longer create, update, delete, deploy, start, stop, or otherwise modify resources. Review team roles and promote users who still require write access (v4.2.0).
  • State-changing API endpoints began requiring POST; legacy GET requests now return 405 Method Not Allowed. This affected /enable, /disable, /deploy, server validation, application/database/service lifecycle actions, and service-application lifecycle actions (v4.2.0).
  • Changed proxy router names for Compose services containing dots or hyphens to use a stable suffix; custom references to previous router names must be updated (#11040).
  • Removed confirmation dialogs for deploy, redeploy, and force-deploy actions; these actions began immediately when selected (#11023).

Features

  • Added a redesigned interface with clearer navigation, improved domain management, DNS checks, and automatic Cloudflare DNS setup (#11119).
  • Added scheduled backups for persistent volumes and directory mounts, with local or S3-compatible storage, retention controls, on-demand runs, history, and API management (#10946, closed #7701).
  • Added per-domain search engine indexing controls (#10908).
  • Added support for deploying private repositories from self-hosted GitLab instances (#10538).
  • Added diagnostics and deployment controls to the Coolify MCP server (#11000).
  • Added profile pictures backed by local or S3-compatible storage.
  • Added Buzz, Celld, InfluxDB, Stalwart, and Termix one-click services (#11020, #11155, #11103, #10984, #11090).
  • Added an early development preview of the next-generation infrastructure experience (#10987).
  • Added team-member two-factor authentication status to the team view (#11192).

Fixes

  • Fixed S3 storage connections on servers without IPv6 (#11061, closed #11059).
  • Fixed backup uploads to S3 endpoints that also resolved to IPv6 (#11028).
  • Fixed Compose domains and environment variables for service names containing dots or hyphens (#11040, closed #10658).
  • Fixed application duplication, rollback image handling, and protection of sensitive API settings (#11003).
  • Fixed errors after deleting GitHub or GitLab source apps (#11105).
  • Fixed clearing all resource domains so it no longer caused a type error (#11083, closed #11030 and #11079).
  • Fixed www redirects for applications using Traefik.
  • Fixed Firefly III health checks (#10475).
  • Fixed the top bar appearing beneath open service action menus (#11197).

Improvements

  • Simplified new-resource creation with clearer choices and updated icons (#11140).
  • Improved dashboard metrics, status visibility, global search, mobile layouts, accessibility, and theme customization.
  • Combined database and storage backup schedules into one easier-to-manage page.
  • Shared the service template catalog across app nodes and made template downloads more reliable (#11094).
  • Reduced LiteLLM's default resource usage (#10698).
  • Updated SparkyFitness, OpnForm, and Forgejo service templates (#9927, #10600, #10639).
  • Updated Traefik security patch versions and added Traefik 3.7 support (#11029).
  • Updated Cloudflare Tunnel to address two critical security vulnerabilities (#11145).

What's Changed

New Contributors

Full Changelog: v4.2.0...v4.3.0

  •  

v5.52.0

5.52.0 (2026-08-12)

🚀 New feature

  • record MCP actions in audit logs (#27151)
  • i18n: add locale codes for Corsican (#27099)
  • server: enhance Koa app configuration with proxy settings (#26409)

🔥 Bug fix

  • typescript pipeline issue (99a723d024)
  • admin: dedupe react-dnd in the admin bundle (#27217)
  • admin: address filter entries by position so duplicate filter chips behave (#27188)
  • content-manager: merge query populate paths to preserve nested populate (#27236)
  • content-type-builder: editing relations removes inverse field conditions (#27226)
  • content-type-builder: clear stale validation errors when the form data is replaced (#27222)
  • data-transfer: skip orphaned links and isolate FK failures on restore (#26852)
  • permissions: skip unregistered RBAC conditions during ability generation (#27282)
  • strapi: allowlist Vite optimizeDeps.exclude for plugin UI kits (#27264)
  • upload: refresh folder header count on upload & delete (CMS-1563) (#27231)
  • upload: guard cache-buster on signed URLs in new-ML AssetCropEditor (#27228)
  • upload: target current asset in drawer actions (#27259)
  • upload: keep infinite scroll loading when the sentinel stays visible (CMS-1562) (#27230)

⚙️ Chore

  • release v5.51.2 update develop (101643bcfb)
  • bump design system version (#27292)
  • cloud-cli: migrate unit tests from jest to vitest (#27218)
  • database: replace umzug with internal migration runner (#26824)
  • deps: bump ip-address from 10.2.0 to 10.4.0 (#27238)
  • deps: bump ws from 8.21.1 to 8.21.2 (#27239)
  • deps: bump hono from 4.12.27 to 4.13.0 (#27243)
  • deps: bump prettier from 3.3.3 to 3.6.2 (#27244)
  • deps: bump direct deps and yarn dedupe (#27291)
  • deps: bump nanoid from 3.3.16 to 3.3.18 (#27329)
  • permissions: migrate unit tests from jest to vitest (#27219)
  • sentry: migrate unit tests from jest to vitest (#27252)
  • tooling: add admin translation verification (#26960)
  • upload-aws-s3: migrate unit tests from jest to vitest (#27216)

💅 Enhancement

  • utils: memoize private attributes in sanitizeOutput (#27140)
  • utils: stop using a thrown Error to test for boolean-like populate keys (#27234)
  • utils: memoize scope decisions and keep the relation visitor sync (#27145)

🚨 Security

  • deps: bump @modelcontextprotocol/sdk to 1.30.0 (#27301)
  • upload: bump sharp to 0.35.3 for libvips CVEs (#27255)

❤️ Thank You

  •  

Extended Stable Update for Desktop

The Extended Stable channel has been updated to 150.0.7871.230 for Windows and Mac which will roll out over the coming days/weeks.

A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista
Google Chrome
  •  

Stable Channel Update for Desktop

The Stable channel has been updated to 151.0.7922.137/.138 for Windows and Mac and 151.0.7922.137 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log 

Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 5 security fixes. Please see the Chrome Security Page for more information.

[$500][535000102] High CVE-2026-19556: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-07-15
[N/A][534867485] High CVE-2026-19557: Use after free in TabStrip. Reported by Google on 2026-07-14
[N/A][536676756] High CVE-2026-19558: Use after free in Extensions. Reported by @bean5oup on 2026-07-20
[N/A][540100588] High CVE-2026-19559: Use after free in HTML. Reported by Google on 2026-07-28
[N/A][540482895] High CVE-2026-19560: Use after free in Blink. Reported by WinD39 - Huynh Dinh Vu on 2026-07-30

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.


Daniel Yip

Google Chrome

  •  

South Dakota: Gameplay Preview

Today, we're excited to share a brand-new gameplay preview from our upcoming South Dakota DLC for American Truck Simulator! Get a closer look at some of the beautiful roads, landmarks, and industries our map team has been recreating.

In the gameplay preview below, you'll follow a journey that begins in the Black Hills before passing by the scenic Pactola Lake and crossing the Spring Creek Memorial Bridge. Along the way, we'll drive through several settlements, including the beautiful city of Hot Springs and part of the historic town of Deadwood, before completing our delivery at a wood processing depot.


This route is just a small preview of what South Dakota has to offer, featuring winding mountain roads, charming communities, and diverse scenery. Whether you're taking in the views or making deliveries across the state, there's plenty to discover behind the wheel.

We hope you enjoy this gameplay preview and the stunning scenery South Dakota has to offer. As always, please keep in mind that everything you see is still a work in progress and subject to change during development.

If you like what you see, be sure to add the South Dakota DLC to your Steam Wishlist. Don't forget to follow us on TwitterFacebookInstagramBluesky, and YouTube, or sign up for our newsletter. Until next time, happy haulin'!

  •  

Paint.NET 5.2 Alpha (build 9719)

This new alpha build introduces 8 new effects, fixes some crashes and other glitches, fixes compatibility with some old plugins, and adds some debugging options to assist with the WINE effort.

You can read more about 5.2 and what it includes by reading the release notes for the first alpha.

The new effects will be discussed more in the final release notes for 5.2, when the time comes, but here are some previews for now. Each new effect is also available for plugins to use in their Direct2D effect graphs.

Original Image

image.png

Linocut

image.png

Mosaic

image.png image.png

Pointillism

image.png

Stained Glass

image.png

Ordered Dither

image.png

Spherize
(This isn’t actually a very good image to use for showcasing this effect. I’ll have a better example for the final release notes.)

image.png

Waves

Here are several examples for this one, which has many different modes you can experiment with:

image.png image.png image.png image.png

Halftone

image.png

Change Log

Changes since 5.2 Alpha (build 9688):

  • New effect: Artistic -> Linocut
  • New effect: Artistic -> Mosaic
  • New effect: Artistic -> Pointillism
  • New effect: Artistic -> Stained Glass
  • New effect: Color -> Ordered Dither
  • New effect: Distort -> Spherize
  • New effect: Distort -> Waves
  • New effect: Stylize -> Halftone
  • Fixed a crash when trying to use horizontal scrolling in the Unsaved Changes dialog
  • Fixed image tabs rendering with a black background
  • Fixed compatibility with the legacy plugins “ImPDF Open/Save”, “Chop Up And Save,” and “TR’s Paste Frame”
  • Fixed the UI setting “Auto-select nearest visible layer after hiding a layer” (it was doing nothing)
  • Optimized performance of render target buffer clearing when Advanced Color is not enabled
  • Fixed some RNG in the Frosted Glass effect
  • Added extension methods on IFileTypesServiceFactory for plugin developers: LoadFileAsDocument, TryLoadFileAsDocument, LoadFileAsBitmap, and TryLoadFileAsBitmap.
  • Fixed the input assignments of the Direct2D DisplacementMapEffect wrapper (it was assigning “input” to “displacement”)
  • Removed the /disableCompositionSwapChain command-line parameter
  • Added the following command-line parameters to assist with the WINE effort: /disableUIAnimation, /disableComposition, /disableWin11DisplayInformation, and /wine (which is equivalent to the previous 3 together)
  • Added ControlInfoPropertyNames.AutoPopulateFileTypes, which when set to true on a FileChooser-typed property will cause it to be auto-populated with all FileTypes (built-ins and plugins) (thanks @toe_head2001!)

Download and Install

This build is available via the built-in updater as long as you have opted-in to pre-release updates. From within Settings -> Updates, enable “Also check for pre-release (beta) versions of paint.net” and then click on the Check Now button. You can also use the links below to download an offline installer or portable ZIP.

image.png

You can also ⬇ download the installer here (for any supported CPU and OS), which is also where you can find downloads for offline installers, portable ZIPs, and deployable MSIs.

  •  

12.0 RC5

🚀 Jellyfin Web 12.0 RC5

We are pleased to announce the fifth release candidate preview release of Jellyfin 12.0!

This is a preview release, intended for those interested in testing 12.0 before it's final public release. We welcome testers to help find as many bugs as we can before the final release.

As always, please ensure you stop your Jellyfin server and take a full backup before upgrading!

A note about versioning

Starting with this release, we are dropping the preceding 10. from our versioning. Thus, 10.11.x -> [10.]12.x = 12.x. The reason is simple: at this point in the project, we don't envision a hard break in the API like we planned way back in the early days, and this version scheme was causing a lot of confusion amongst users about what a "major" release was. For more information, please see the RC1 release notes.

What's new?

The main goal of this release has been performance. 10.11.0 dropped a major backend rewrite, and while it was broadly functional, it had a lot of rough edges. This release seeks to polish out most of those rough edges and bring better performance to all users.

There are many other small fixes, improvements, changes, and translations. See our draft release notes here or below for the full list of pull requests. You can also view the Server side changelog here.

Note: You must be on Jellyfin 10.10.7+ or 10.11.x (ideally, 10.11.11) before upgrading! If you are not, the upgrade will fail. Ensure you upgrade to one of these versions first!

Note: The initial load of Jellyfin 12.x will run a few migrations and will take several minutes. Please be patient and do not interrupt the process. You can leverage the (newly improved!) startup UI on your local network to see specific progress, or off-network to see general progress, by visiting the server URL in your web browser during startup.

Note: If you install the RC, you should disable all external plugins and reinstall using the unstable plugin repository, or plugins may fail to load and cause unintended side effects.

Installing

This preview release is distributed in all our traditional forms, though not automatically via our Apt repository or latest tag.

  • For all non-Docker environments, you can find the files for manual download in our repository by selecting "Stable Preview" for your OS.
  • For Docker, you can pull the 12.0-rc5 or preview tags.

What's Changed (since v12.0-rc4)

New Contributors

Full Changelog: v12.0-rc4...v12.0-rc5

  •  

12.0 RC5

🚀 Jellyfin Server 12.0 RC5

We are pleased to announce the fifth release candidate preview release of Jellyfin 12.0!

This is a preview release, intended for those interested in testing 12.0 before its final public release. We welcome testers to help find as many bugs as we can before the final release.

As always, please ensure you stop your Jellyfin server and take a full backup before upgrading!

A note about versioning

Starting with this release, we are dropping the preceding 10. from our versioning. Thus, 10.11.x -> [10.]12.x = 12.x. The reason is simple: at this point in the project, we don't envision a hard break in the API like we planned way back in the early days, and this version scheme was causing a lot of confusion amongst users about what a "major" release was. For more information, please see the RC1 release notes.

What's new?

The main goal of this release has been performance. 10.11.0 dropped a major backend rewrite, and while it was broadly functional, it had a lot of rough edges. This release seeks to polish out most of those rough edges and bring better performance to all users.

There are many other small fixes, improvements, changes, and translations. See our draft release notes here or below for the full list of pull requests. You can also view the Web side changelog here.

Note: You must be on Jellyfin 10.10.7+ or 10.11.x (ideally, 10.11.11) before upgrading! If you are not, the upgrade will fail. Ensure you upgrade to one of these versions first!

Note: The initial load of Jellyfin 12.x will run a few migrations and will take several minutes. Please be patient and do not interrupt the process. You can leverage the (newly improved!) startup UI on your local network to see specific progress, or off-network to see general progress, by visiting the server URL in your web browser during startup.

Note: If you install the RC, you should disable all external plugins and reinstall using the unstable plugin repository, or plugins may fail to load and cause unintended side effects.

Installing

This preview release is distributed in all our traditional forms, though not automatically via our Apt repository or latest tag.

  • For all non-Docker environments, you can find the files for manual download in our repository by selecting "Stable Preview" for your OS.
  • For Docker, you can pull the 12.0-rc5 or preview tags.

What's Changed (since v12.0-rc4)

New Contributors

Full Changelog: v12.0-rc4...v12.0-rc5

  •  

Part-DB 2.15.0

Warning

After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.

Important

Since this version Part-DB can enable foreign key checks for SQLite: it is recommend to do this, but it requires some manual intervention. See this announcement on how to do it: #1486

Note

If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8

New Features

  • Added OAuth server capability, for easy and automatic API access to Part-DB without the need to generate an API token by hand. An application can redirect to an Part-DB page, where an user can authorise the access of the external application. This feauture is opt-in and requires some setup by hand.
  • With the OAuth server capability, Part-DB can now be used as an remote MCP connector for AI applications like claude.ai. Just add a custom connector with your Part-DB url, and you can authorize the access via one click. No need for fiddeling with API tokens or config files
  • Allow to enable foreign key checking for sqlite via an env variable. It is recommended to do this, however it requires some manual intervention.
  • Add Docker based development environment by @swdee in #1441
  • Link to update manager from homepage banner update notification

Bug fixes

  • Fixed that orphaned BOMEntries, APITokens and Orderdetails were possible
  • Fix TypeError when tree expand/collapse/search is used before the tree finished loading by @Sebbeben in #1482
  • Require full user authentication, when changing users or groups
  • Fixed problem with MCP Endpoint Host validation

Other changes

  • Updated dependencies
  • Updated KiCad symbols
  • Improved documentation
  • Improved translations
  • Improved code structure

New Contributors

Full Changelog: v2.14.1...v2.15.0

  •  

Distribution Release: SparkyLinux 8.4

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. SparkyLinux is a Debian-based distribution with a variety of desktop editions. The project's latest version, SparkyLinux 8.4, reintroduces 32-bit support for x86 machines. "A year ago, Debian dropped support for 32-bit live/install ISO images, so SparkyLinux dropped it as well. This decision has been reassessed, as it turns....
  •  

2.8.0

Changes from 2.7.4 to 2.8.0:

Updates:

  • Updated LAV Filters to version 0.82-5-g77c25
  • Updated MPC Video Renderer to version 0.10.7.2560

Changes/additions:

  • Settings of SaneAR/VMR-9/EVR-CP/EVR-Sync have been moved and can now be accessed through the button behind the renderer on the Output settings page.
  • Cleaned up the Output settings page and updated the tooltips of the video renderers.
  • It is now possible to provide default settings through HKLM, which are read whenever creating fresh settings profile in HKCU section of Registry.
  • When storing settings in INI file, the history is now split off in a separate file. When the application folder is not writable, the history file is placed in %appdata%\MPC-HC. Also added an advanced option to always use appdata folder.
  • Please note that the Registry is still the preferred location for storing the settings. That has better performance than INI file. Settings backup is as easy as pressing a button here: Options > Miscellaneous > Export
  • Added an advanced option HistoryExcludeFilter to exclude certain content from getting added to recent file history. It is a simple semi-colon separated list of substrings that is matched against the full path or URL.
  • There also is a HistoryExcludeFilterPrivate setting with exact same purpose, which is not exposed through the user interface.
  • Added advanced option to automatically prune history entries older than X days. Defaults to 365, and can be disabled by setting to 0.
  • Added a new Show History entry to recent file menu. This opens a dialog for managing history entries. Allows you to search. Manually remove entries. Clean invalid entries. Clean old entries. Reset position, etc.
  • When opening a selection of files from Explorer, they are now added to playlist in correct alphabetical order.
  • Added "sort by date" option in playlist context menu. Note that all sort actions apply once to current list and do not have effect on future playlist changes.
  • Added advanced option to sort files by date when skipping to next/previous file in folder.
  • Color controls have been moved from options dialog into a new popup dialog. Accessible through the Play menu or hotkey.
  • Advanced settings have now been re-ordered and grouped into categories.
  • Improved performance when using libass for rendering subtitles.
  • Added stack trace to internal (fallback) exception handler.

Fixes:

  • Fixed an issue where subtitle styles changes were not dynamically applied during segment change in segmented Matroska files with ordered chapters.
  • Fixed an issue where seekbar preview could show wrong edition with playing a Matroska file with multiple video editions.
  • Fixed an issue where video preview was up-side-down in web interface when renderer provided a topdown bitmap.
  • Fixed an issue with EVR-CP that caused still images to not render immediately.
  • Improved long path support in a few file dialogs, such as "Load subtitles".
  • A few other fixes and small improvements.

  •  

v0.16.17

[0.16.17] - 2026-08-10

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • IMAP:
  • WebDAV: Range and If-Range header support on file downloads (RFC 7233) (#2377).
  • Spam filter: url_original expression variable for Url rules.

Changed

  • Memory allocator: Replaced the unmaintained jemallocator crate with tikv-jemallocator (contributed by @checkraisefold).
  • ACME registry: Use description as label property.

Fixed

  • MTA:
    • Certificates for domains publishing an enforcing MTA-STS policy are always validated, even in the fallback TLS strategy.
    • DSN delivery date uses wrong timestamp.
    • FUTURERELEASE HOLDUNTIL uses Unix timestamps instead of RFC 3339 date-times.
  • JMAP:
    • EmailSubmission/query filtering on undoStatus contradicts EmailSubmission/get, reporting held FUTURERELEASE submissions as final instead of pending.
    • EmailSubmission/get requests without an ids argument iterates the wrong index.
  • CardDAV: Accept: text/vcard version negotiation is ignored whenever another parameter such as q or charset follows version=.
  • Calendar: Server-side scheduling messages place the text/calendar part outside the multipart/alternative and disposed as an attachment.
  • Sharing: Accounts holding the impersonate permission never have their ACL grants collected, so shared items are never listed in JMAP sessions, CalDAV/CardDAV discovery or IMAP.
  • IMAP:
    • COPY/MOVE into a shared folder fails with NO [ALREADYEXISTS] when the destination account already holds the message, leaving the message in the source mailbox and clients in a retry loop.
    • BODYSTRUCTURE and ENVELOPE return MIME parameters, Content-Description, subjects and display names as raw UTF-8 even to sessions that never enabled UTF8=ACCEPT.

Check binary attestation here

  •  

Postfix stable release 3.11.6 and legacy releases 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, 3.5.27

Postfix stable release 3.11.6 and legacy releases 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, 3.5.27

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.6.html]

This release addresses medium-impact problems that need to be fixed as some enable remote DOS or policy bypass.

The fixes below, and more, are also released in the unstable version postfix-3.12-20260809.

In addition to updated releases for the supported Postfix versions 3.8-3.11, releases will also be available for the out-of-support Postfix versions 3.5-3.7. NOTE: these do not include the patches for out-of-support Postfix versions that have been issued for "large SMTP inputs (June 2026)", "TLSA parsing (June 2026)", and "SMTP smuggling fixes". Those patches still need to be applied.

These defects were found by Qualys assisted by Claude Mythos Preview, and by OpenAI Security; more than half date from 20 or more years ago. When I implemented Postfix, I knew that there were going to be mistakes. That is the reason why Postfix has its architecture and safety nets. The number of defects may seem large, but considering that they were found in a code base of over 150 thousand lines, the error rate is still lower than what I designed for.

Policy bypass:

  • Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP server resets of MAIL FROM and RCPT TO command state after smtpd_end_of_data_restrictions rejected a message. This resulted in SMTP protocol state desynchronization between the remote SMTP client and the Postfix SMTP server.

    A crafted remote SMTP client could then send RCPT TO and DATA without MAIL FROM, and deliver a second message. Then, smtpd_end_of_data_restrictions skipped check_recipient_access constraints, because a recipient counter was > 1. Reported by OpenAI Security. File: smtpd/smtpd.c.

    As reported by OpenAI Security, the failure to reset MAIL FROM and RCPT TO state also affected Milter support (added in Postfix 2.3). Here, after a Milter replied with "accept this message" based on the message envelope, and smtpd_end_of_data_restrictions rejected the message, the Postfix SMTP server as before accepted RCPT TO and DATA without MAIL FROM, and smtpd_end_of_data_restrictions as before skipped check_recipient_access constraints for the second message. Under these conditions, the Postfix Milter client remained in the "accept this message" state, skipping Milter policy enforcement for the second message.

Denial of service:

  • Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP server command history memory exhaustion with a large number of very small BDAT requests. Reported by OpenAI security. File: smtpd.c.

  • Bug (defect introduced: Postfix 1.1, date: 20021116): address verification cache poisoning. A local user could use the postdrop command to submit an address verification probe with envelope or message content that Postfix rejected later, resulting in a negative address verification cache entry for that address. On systems that enable address verification, the negative address verification cache entry would force the Postfix SMTP server to reject a message that it should accept (denial of service). Problem reported by OpenAI Security. File: postdrop.c.

Server crashes and panic()s:

  • Bug (defect introduced: Postfix 3.4, date: 20180805): missing SMTP server reset of RCPT TO state, after a BDAT command error. A crafted remote SMTP client could then send a DATA command without MAIL FROM or RCPT TO, and crash a Postfix SMTP daemon process with a null pointer read error. Reported by OpenAI Security. File: smtpd/smtpd.c.

  • Bug (defect introduced: Postfix 2.4, date: 20051222): null pointer read crash while parsing a malformed Dovecot AUTH server response. Reported by Qualys, assisted by Claude Mythos Preview. File: xsasl_dovecot_server.c.

Read after free, uninitialized read, under/over read:

  • Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free in the PSC_CALL_BACK_NOTIFY() macro. This had no effect on program execution, because myfree() wiped memory, and that memory was not yet reused. Problem reported by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.

  • Read after free (no privilege escalation) in debug logging (defect introduced: Postfix 2.2, date: 20050117). Reported by Qualys, assisted by Claude Mythos Preview. File: util/inet_connect.c.

  • Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized memory read in postscreen HaProxy client after remote I/O exception, causing garbage to be logged. Reported by Qualys, assisted by Claude Mythos Preview. File: postscreen_haproxy.c.

  • Latent bug (defect introduced: Postfix 2.7, date: 20090618): uninitialized memory read after dnsblog(8) returns a string that is not an IPv4 address. Reported by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.

  • Bug (defect introduced: before Postfix alpha, date 19970424): the DNS client could read up to two bytes past the end of an MX record, before discovering that the record was too short. This behavior was later copied with SRV records, potentially over-reading up to six bytes. Problem reported by Qualys, assisted by Claude Mythos Preview. File: dns_lookup.c.

  • Bug (defect introduced: Postfix 1,1, date: 20010524): the postsuper command under-read or over-read a very short queue filename. No crash, information leak, or privilege escalation. Reported by Qualys, assisted by Claude Mythos Preview. Files: postsuper.c, mail_queue.h.

Other code hygiene:

  • Bug (defect introduced: before Postfix alpha, date: 19971106): 'int' over-shift, in the queue file record-length parser. Postfix programs do not generate such records, but an attacker could cause postdrop to reject input or panic(). Reported by Qualys, assisted by Claude Mythos Preview. File: record.c.

  • Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive comparison of IPv4 addresses. Reported by Qualys, assisted by Claude Mythos Preview. File: sock_addr.c.

  • Bug (defect introduced: Postfix 1.0, date: 20000928): the fast flush server, used by the SMTP command "ETRN", and by the commands "postqueue -s site" and "postqueue -i queue_id" (and their sendmail(1) equivalents), used the wrong duplicate suppression API, resulting in unnecessary queue scans by the queue manager. Reported by Qualys, assisted by Claude Mythos Preview. File: flush.c.

  • Queue hygiene: the postdrop command accepted the null record type which the rest of Postfix ignores. Reported by OpenAI Security. File: postdrop.c.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

  •  
❌