Merge #4020

4020: alpine-3.20.10 (backport #4019) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

Upgrade alpine to 3.20.10

### Related issue(s)
- closes #4018

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
<hr>This is an automatic backport of pull request #4019 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>

Merge #4017

4017: Roundcube 1.6.15 (backport #4016) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

update roundcube to 1.6.15

### Related issue(s)
- closes #4015 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
<hr>This is an automatic backport of pull request #4016 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

Merge #4008

4008: roundcube 1.6.14 (backport #4007) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

Upgrade to roundcube 1.6.14

### Related issue(s)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
<hr>This is an automatic backport of pull request #4007 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

Merge #4003

4003: Deal with the new microsoft autodiscover (backport #4002) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

Deal with the new microsoft autodiscover

### Related issue(s)
- closes #3961 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
<hr>This is an automatic backport of pull request #4002 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

Merge #3981

3981: Ensure we let expired certs be renewed (backport #3980) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

Ensure we let expired certs be renewed

### Related issue(s)
- closes #3979 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
<hr>This is an automatic backport of pull request #3980 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

Merge #3964

3964: Roundcube 1.6.12 (backport #3963) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix
## What does this PR do?

Upgrade Roundcube to 1.6.12 (fix an XSS)

### Related issue(s)
-

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.<hr>This is an automatic backport of pull request #3963 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

Merge #3941

3941: Reenable nginx request buffering to fix roundcube (backport) r=nextgens a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Re-enable nginx request buffering to fix roundcube

### Related issue(s)
- closes #3913 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

Merge #3931

3931: Fixes around non-blocking I/O in the thread manager (backport #3927) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

Attempts to fix an issue around blocking I/O in `start.py`. Currently, if a process crashes leaving a zombie thread, `start.py` will use 100% CPU on two threads (trying to read stdout/stderr). This can be reproduced by starting a vanilla Mailu, and running `killall dovecot` (can be outside the container); Dovecot always leaves one zombie thread on crash/exit, so the container *never* restarts. My patch fixes this.

This is related to (closes #3852), although I haven't been able to create a repro for that exact case. Nonetheless, I added `errors='replace'` to the popen invocation, as it should prevent mangling the log output. I've seen a couple more issues that are likely related, but can't find them now.

**Important note**: Despite my efforts, `mailu-front` still seems to connect to the old dovecot process, which renders the UI unusable (webmail throws me into a redirect loop). Restarting `mailu-front` frees up the defunct dovecot process and fixes the application - I suppose someone should look into detecting this condition and restarting `mailu-front` if it happens. Unfortunately, I'm not sure how to approach this.
<hr>This is an automatic backport of pull request #3927 done by [Mergify](https://mergify.com).

Co-authored-by: sdomi <dominique.liberda@initos.com>

Merge #3909

3909: Fix passphrase changed errors in snappymail (backport #3907) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

Fix "passphrase changed" errors in snappymail; tell it to encrypt data against the email address instead of the transient token used by SSO.

You may need to run the following for the error message to disappear completely
   ``find webmail/_data_/_default_/storage/ -name .cryptkey -delete``

### Related issue(s)
- closes #3906 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
<hr>This is an automatic backport of pull request #3907 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

Merge #3905

3905: Upgrade Tika to fix CVE-2025-54988 (backport #3904) r=mergify[bot] a=mergify[bot]

## What type of PR?

bug-fix

## What does this PR do?

Upgrade Tika to fix CVE-2025-54988 ; Current stable is v3.2.2 ... we pin latest as we have a poor record of keeping up with upstream and the interface we use ought to be stable.

You will need to run setup again for the fix to be applied.

This is defence in depth (very low risk on docker deployments).

### Related issue(s)
- closes #3903

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
<hr>This is an automatic backport of pull request #3904 done by [Mergify](https://mergify.com).

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>