This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+6 more
Affected surfaces
Summary
AI summaryFixed automatic reply sieve compilation failures when account display names contain special characters.
Full changelog
Changelog :mailbox:
-
Fix automatic replies (vacation) failing to compile when the account display name contains special characters such as
@; the sieve:fromnow uses a quoted RFC 5322 display name, and all user-controlled fields rendered into the script are escaped (\,",$) to prevent sieve injection. -
This release was triggered by PR/Issue 3983.
-
The release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
Update
The main version X.Y (e.g. 1.9) will always reflect the latest version of the branch. To update your Mailu installation simply pull the latest images `docker compose pull && docker compose up -d`.
The pinned version X.Y.Z (e.g. 1.9.1) is not updated. It is pinned to the commit that was used for creating this release. You can use a pinned version to make sure your Mailu installation is not suddenly updated when recreating containers. The pinned version allows the user to manually update. It also allows to go back to a previous pinned version.
Security Fixes
- Prevented sieve injection by quoting RFC 5322 display names and escaping `\`, `"`, `$` in user‑controlled fields
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]