recipe-maintainers/mailu
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

chore: upgrade mailu to 2024.06.68 #11

Open
autonomic-bot wants to merge 1 commits from upgrade-f1e0c6b into main
pull from: upgrade-f1e0c6b
merge into: :main
Conversation 2 Commits 1 Files Changed 1
+6 -6
autonomic-bot commented 2026-11-13 05:11:19 +00:00
Owner
Copy Link
Copy Source

mailu: 2024.06.67 -> 2024.06.68

Security patch release for the Mailu stack. All Mailu services share one image tag and are bumped together.

service image current new
app ghcr.io/mailu/nginx 2024.06.67 2024.06.68
admin ghcr.io/mailu/admin 2024.06.67 2024.06.68
imap ghcr.io/mailu/dovecot 2024.06.67 2024.06.68
smtp ghcr.io/mailu/postfix 2024.06.67 2024.06.68
antispam ghcr.io/mailu/rspamd 2024.06.67 2024.06.68
webmail ghcr.io/mailu/webmail 2024.06.67 2024.06.68

redis is already 8.10.3-alpine on upstream main (bumped upstream in fb245e2), so it is unchanged here. ldez/traefik-certs-dumper:v2.11.4 is current.

Upstream release notes: app/admin/imap/smtp/antispam/webmail 2024.06.67 -> 2024.06.68: https://github.com/Mailu/Mailu/releases/tag/2024.06.68

What the release says

  • Mitigates known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail.
  • No compose/env/config changes and no database migration steps called out upstream (update = pull latest images).

Advisory scan

Deterministic scan reports 2 CVEs fixed by this upgrade: CVE-2026-109618, CVE-2026-109619. One undetermined low (GHSA-phg4-wh78-w97x, a 2020 advisory affecting the 1.6/1.7/master lines with no published fix version) is not counted. No failed sources.

Live verification (before CI)

Deployed the WIP directly on cc-ci as dev-mailu.ci.commoninternet.net with --chaos: all 8 services reached 1/1, the admin service ran its SQLite alembic migrations cleanly, and the stack served through Traefik (HTTP -> HTTPS redirect). The webmail service hit a pre-existing startup race (nginx: [emerg] host not found in set_real_ip_from ..._app) that also occurs on 2024.06.67 and recovered on restart. The dev deploy was torn down afterwards (0 stacks / 0 volumes left).

Release step (operator, after merge)

This PR does NOT bump the recipe version label. Publish with:

abra recipe release mailu -z

Operator action required

None beyond the release above. No breaking changes, config changes, or migrations.

Nothing is merged here; awaiting operator review.

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

## mailu: 2024.06.67 -> 2024.06.68 Security patch release for the Mailu stack. All Mailu services share one image tag and are bumped together. | service | image | current | new | |---------|-------|---------|-----| | app | ghcr.io/mailu/nginx | 2024.06.67 | 2024.06.68 | | admin | ghcr.io/mailu/admin | 2024.06.67 | 2024.06.68 | | imap | ghcr.io/mailu/dovecot | 2024.06.67 | 2024.06.68 | | smtp | ghcr.io/mailu/postfix | 2024.06.67 | 2024.06.68 | | antispam | ghcr.io/mailu/rspamd | 2024.06.67 | 2024.06.68 | | webmail | ghcr.io/mailu/webmail | 2024.06.67 | 2024.06.68 | `redis` is already `8.10.3-alpine` on upstream main (bumped upstream in fb245e2), so it is unchanged here. `ldez/traefik-certs-dumper:v2.11.4` is current. **Upstream release notes:** app/admin/imap/smtp/antispam/webmail 2024.06.67 -> 2024.06.68: https://github.com/Mailu/Mailu/releases/tag/2024.06.68 ### What the release says - Mitigates known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail. - No compose/env/config changes and no database migration steps called out upstream (update = pull latest images). ### Advisory scan Deterministic scan reports **2 CVEs fixed by this upgrade**: CVE-2026-109618, CVE-2026-109619. One undetermined low (GHSA-phg4-wh78-w97x, a 2020 advisory affecting the 1.6/1.7/master lines with no published fix version) is not counted. No failed sources. ### Live verification (before CI) Deployed the WIP directly on cc-ci as `dev-mailu.ci.commoninternet.net` with `--chaos`: all 8 services reached 1/1, the admin service ran its SQLite alembic migrations cleanly, and the stack served through Traefik (HTTP -> HTTPS redirect). The webmail service hit a pre-existing startup race (`nginx: [emerg] host not found in set_real_ip_from ..._app`) that also occurs on 2024.06.67 and recovered on restart. The dev deploy was torn down afterwards (0 stacks / 0 volumes left). ### Release step (operator, after merge) This PR does NOT bump the recipe version label. Publish with: ``` abra recipe release mailu -z ``` ### Operator action required None beyond the release above. No breaking changes, config changes, or migrations. Nothing is merged here; awaiting operator review. CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-11-13 05:11:20 +00:00
chore: upgrade mailu to 2024.06.68
cc-ci/testme cc-ci: success
Details
61d8a8229d
autonomic-bot requested review from trav 2026-11-13 05:11:20 +00:00
autonomic-bot requested review from notplants 2026-11-13 05:11:20 +00:00
autonomic-bot commented 2026-11-13 05:11:30 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-13 05:12:02 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — mailu @ 61d8a822 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `mailu` @ `61d8a822` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/151/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/151) [![level](https://ci.autonomic.zone/runs/151/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/151) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/151) · [dashboard](https://ci.autonomic.zone/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-f1e0c6b:upgrade-f1e0c6b
git checkout upgrade-f1e0c6b
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/mailu#11