LoginSign Up
← Back to all sparks
M

Mailu

COMMS
Velocity5.0

Self-hosted mail server suite with webmail and admin interface

mailu.io ↗

Mailu ships one pinned release per issue, and most of them are Roundcube's.

maintenance-branchroundcubecve-patchingself-hosted-mailpinned-releases
◆Current state
The 2024.06 branch releases on demand: an issue or PR comes in, a pinned version goes out, and the changelog is one or two lines. Four of the six most recent releases are webmail-driven — three Roundcube bumps in this window alone, the latest to 1.6.18 clearing a TLS-configuration warning, an earlier one to 1.6.17 closing two CVEs. The remainder are Mailu's own code: an X-Forwarded-By header fix tied to a published advisory, sieve field escaping that repaired autoreplies and closed an injection path, and two admin-UI form flow corrections.
◆Where it's heading
This is a maintenance branch behaving exactly as a maintenance branch should, and the pinned-version model is the product: operators get upstream security work packaged and tagged without tracking Roundcube themselves. The security items divide cleanly — most arrive from bundled components, a minority from Mailu's own code, and the project patches both on the same cadence. Nothing in this window suggests new capability is being developed on this branch.
◆Prediction
Expect the next release to follow the same trigger: a Roundcube advisory or a client compatibility report producing a single-line changelog and a new pinned tag. Any feature work would be happening on the main version, which this feed does not cover.

◆Recent moves

  1. 6d ago

    Roundcube 1.6.18 bump clears a TLS-config warning

    Roundcube moves to 1.6.18, clearing the modern-Roundcube complaint about CURLOPT_SSL_VERIFYCLIENT being disabled. The third webmail bump in this window and the clearest illustration of what the pinned-release model buys: upstream moves, Mailu tags, the operator pulls.

    View source ↗
  2. 23d ago

    Autoconfig fix for modern K-9 Mail

    A one-line client compatibility fix so K-9 Mail can autoconfigure against a Mailu instance. Representative of the branch: one issue in, one pinned release out.

    View source ↗
  3. 25d ago

    Roundcube 1.6.17 closes two CVEs

    The third Roundcube bump in this window, again driven by disclosed CVEs rather than by anything Mailu wanted from the webmail. Admins get the fix without tracking upstream themselves, which is most of what the pinned-release model is for.

    View source ↗
  4. 1mo ago

    Sets X-Forwarded-By in response to a GHSA advisory

    A header fix tied to a published security advisory against Mailu's own code rather than a bundled component. One of the few releases here where the project is patching itself.

    View source ↗
  5. 1mo ago

    Admin UI keeps form values on failed submit

    Two admin-UI flow fixes: forced password change redirects to the intended destination, and the Create User form retains entered values on a validation error. Small quality-of-life work for operators.

    View source ↗
  6. 1mo ago

    Escapes sieve fields, fixing autoreplies with special characters

    Vacation autoreplies failed to compile when a display name contained characters like @, and the fix escapes all user-controlled fields rendered into the sieve script. A broken feature repaired and a sieve-injection path closed in the same change.

    View source ↗