What's Changed
Important
This update addresses several security-related issues in mailcow. We strongly recommend updating your mailcow instance as soon as possible.
Updates and Security
- [Rspamd] update to 4.1.4 by @FreddleSpl0it in #7386
- Fix nginx CVE-2026-42533 by @SYNLINQ in #7358
- Update actions/stale action to v11 by @renovate[bot] in #7375
- Hardening mailcow by @FreddleSpl0it in #7387
Fixes
- fix: restore subject display in quarantine overview by @oidipos in #7367
- [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set by @smpaz7467 in #7343
- [Web] fix add/time_limited_alias silently discarding requests and validity by @smpaz7467 in #7345
- [Web] return sender_acl in get/mailbox API by @smpaz7467 in #7348
- fix: cors allowed origins settings validation by @fallmo in #7333
- [Web] harden CORS origin matching and add Vary: Origin by @FreddleSpl0it in #7385
- [Web] Move mailcow update check to server side by @FreddleSpl0it in #7388
- [Web] Create default mailbox template with eas and dav access by @FreddleSpl0it in #7389
- [ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain by @FreddleSpl0it in #7390
New Contributors
- @oidipos made their first contribution in #7367
- @smpaz7467 made their first contribution in #7343
- @fallmo made their first contribution in #7333
Full Changelog: 2026-07...2026-07a
Contributors
renovate, oidipos, and 4 other contributors