Starstruk Logo MarkStarstruk

2026-07a

gitbutlerapp/gitbutler2026-07aJul 30, 2026by FreddleSpl0it

AI Summary

This release prioritizes security hardening and bug fixes for the mailcow stack, addressing CVEs in Nginx and Rspamd while improving API functionality and web interface usability.

Key Highlights

  • Security updates for Rspamd (4.1.4) and Nginx (1.30.3) addressing CVE-2026-42533
  • Hardening of CORS origin matching and mailcow security settings
  • Fixes for subject display in quarantine, CORS validation, and alias handling
  • Creation of default mailbox templates with EAS and DAV access

New Features

  • Create default mailbox template with eas and dav access
  • Skip mta-sts certificate request when MTA-STS is not active for a domain
  • Move mailcow update check to server side

Full Release Notes

## What's Changed

### Important
This update addresses several security-related issues in mailcow. We strongly recommend updating your mailcow instance as soon as possible.

### Updates and Security
* [Rspamd] update to 4.1.4 by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7386
* Fix nginx CVE-2026-42533 by @SYNLINQ in https://github.com/mailcow/mailcow-dockerized/pull/7358
* Update actions/stale action to v11 by @renovate[bot] in https://github.com/mailcow/mailcow-dockerized/pull/7375
* Hardening mailcow by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7387

### Fixes
* fix: restore subject display in quarantine overview by @oidipos in https://github.com/mailcow/mailcow-dockerized/pull/7367
* [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7343
* [Web] fix add/time_limited_alias silently discarding requests and validity by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7345
* [Web] return sender_acl in get/mailbox API by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7348
* fix: cors allowed origins settings validation by @fallmo in https://github.com/mailcow/mailcow-dockerized/pull/7333
* [Web] harden CORS origin matching and add Vary: Origin by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7385
* [Web] Move mailcow update check to server side by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7388
* [Web] Create default mailbox template with eas and dav access by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7389
* [ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7390

## New Contributors
* @oidipos made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7367
* @smpaz7467 made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7343
* @fallmo made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7333

**Full Changelog**: https://github.com/mailcow/mailcow-dockerized/compare/2026-07...2026-07a