recipe-maintainers/mailu
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

chore: upgrade mailu to 2024.06.58, redis to 8.10.1-alpine #7

Closed
autonomic-bot wants to merge 0 commits from upgrade-ee4e727 into main
pull from: upgrade-ee4e727
merge into: :main
Conversation 6 Commits - Files Changed -
+7 -7
autonomic-bot commented 2026-08-15 19:57:01 +00:00
Owner
Copy Link
Copy Source

mailu upgrade: 2024.06.57 → 2024.06.58 (coordinated mailu set) + redis 8.10.0-alpine → 8.10.1-alpine

Image-tag changes (all 6 mailu services move together, as their release is a coordinated multi-image bump):

service image was new
admin ghcr.io/mailu/admin 2024.06.57 2024.06.58
antispam ghcr.io/mailu/rspamd 2024.06.57 2024.06.58
app ghcr.io/mailu/nginx 2024.06.57 2024.06.58
imap ghcr.io/mailu/dovecot 2024.06.57 2024.06.58
smtp ghcr.io/mailu/postfix 2024.06.57 2024.06.58
webmail ghcr.io/mailu/webmail 2024.06.57 2024.06.58
db redis 8.10.0-alpine 8.10.1-alpine
certdumper ldez/traefik-certs-dumper v2.11.4 v2.11.4 (unchanged)

Recipe version label coop-cloud.mailu.version left untouched (operator publishes at the end).

Upstream release notes

  • mailu (admin/antispam/app/imap/smtp/webmail) 2024.06.57→2024.06.58: https://github.com/Mailu/Mailu/releases/tag/2024.06.58 (Fix "Please don't turn CURLOPT_SSL_VERIFYCLIENT off" on modern roundcube; roundcube → 1.6.18). Pure patch, no migrations/breaking changes.
  • redis (db) 8.10.0-alpine→8.10.1-alpine: https://github.com/redis/redis/releases/tag/8.10.1 — SECURITY release (CVE-2026-62356 CMSketch RDB heap OOB write; TLS client-cert auth bypass via embedded NUL in CN; use-after-free in blocked-client list; Vector Sets OOB/UAF fixes; malicious RDB SLOT_INFO memory corruption/RCE).
  • certdumper: no change (v2.11.4 already latest).

Operator notes

  • No migrations, no breaking changes, no new/renamed config. Straightforward patch/security bump.
  • Mailu is a cache/redis store — the redis 8.10.1 security patch is applied to the cache store.
  • Advisory scan: 1 CVE fixed by this upgrade (redis CVE-2026-62356).

Recommended release command (run after merge):

abra recipe release mailu -z

(-z = patch: both changes are patch/security point releases, no breaking changes.)

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

# mailu upgrade: 2024.06.57 → 2024.06.58 (coordinated mailu set) + redis 8.10.0-alpine → 8.10.1-alpine Image-tag changes (all 6 mailu services move together, as their release is a coordinated multi-image bump): | service | image | was | new | |---------|-------|-----|-----| | admin | ghcr.io/mailu/admin | 2024.06.57 | 2024.06.58 | | antispam | ghcr.io/mailu/rspamd | 2024.06.57 | 2024.06.58 | | app | ghcr.io/mailu/nginx | 2024.06.57 | 2024.06.58 | | imap | ghcr.io/mailu/dovecot | 2024.06.57 | 2024.06.58 | | smtp | ghcr.io/mailu/postfix | 2024.06.57 | 2024.06.58 | | webmail | ghcr.io/mailu/webmail | 2024.06.57 | 2024.06.58 | | db | redis | 8.10.0-alpine | 8.10.1-alpine | | certdumper | ldez/traefik-certs-dumper | v2.11.4 | v2.11.4 (unchanged) | Recipe version label `coop-cloud.mailu.version` left untouched (operator publishes at the end). **Upstream release notes** - mailu (admin/antispam/app/imap/smtp/webmail) 2024.06.57→2024.06.58: https://github.com/Mailu/Mailu/releases/tag/2024.06.58 (Fix "Please don't turn CURLOPT_SSL_VERIFYCLIENT off" on modern roundcube; roundcube → 1.6.18). Pure patch, no migrations/breaking changes. - redis (db) 8.10.0-alpine→8.10.1-alpine: https://github.com/redis/redis/releases/tag/8.10.1 — SECURITY release (CVE-2026-62356 CMSketch RDB heap OOB write; TLS client-cert auth bypass via embedded NUL in CN; use-after-free in blocked-client list; Vector Sets OOB/UAF fixes; malicious RDB SLOT_INFO memory corruption/RCE). - certdumper: no change (v2.11.4 already latest). **Operator notes** - No migrations, no breaking changes, no new/renamed config. Straightforward patch/security bump. - Mailu is a cache/redis store — the redis 8.10.1 security patch is applied to the cache store. - Advisory scan: 1 CVE fixed by this upgrade (redis CVE-2026-62356). **Recommended release command** (run after merge): ``` abra recipe release mailu -z ``` (-z = patch: both changes are patch/security point releases, no breaking changes.) Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-08-15 19:57:01 +00:00
chore: upgrade mailu to 2024.06.58
cc-ci/testme cc-ci: success
Details
ee4e7270c8
autonomic-bot requested review from trav 2026-08-15 19:57:01 +00:00
autonomic-bot requested review from notplants 2026-08-15 19:57:01 +00:00
autonomic-bot commented 2026-08-15 19:57:10 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-08-15 19:57:34 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — mailu @ ee4e7270 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1274

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `mailu` @ `ee4e7270` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1274 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1274) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot commented 2026-08-15 20:06:38 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-08-15 20:06:54 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — mailu @ ee4e7270 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1275

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `mailu` @ `ee4e7270` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1275 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1275) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade mailu to 2024.06.58 to chore: upgrade mailu to 2024.06.58, redis to 8.10.1-alpine 2026-08-21 03:21:13 +00:00
autonomic-bot added 1 commit 2026-08-21 03:21:13 +00:00
chore: upgrade mailu to 2024.06.58, redis to 8.10.1-alpine
cc-ci/testme cc-ci: success
Details
6edc435e32
autonomic-bot commented 2026-08-21 03:21:39 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-08-21 03:21:47 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — mailu @ 6edc435e ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1297

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `mailu` @ `6edc435e` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1297 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1297) · [dashboard](https://ci.commoninternet.net/)
trav closed this pull request 2026-08-24 16:42:33 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/mailu#7