This revision update addresses several security-related issues in mailcow, bumps rspamd to 4.1.4 and fixes CVE-2026-42533 in Nginx. The Nginx CVE was not necessarily critical for mailcow, but we bump it anyway just to be on the safe side. On top of that we fixed a few more bugs.
Moohoo everyone.
Today I want to officially announce my departure from The Infrastructure Company GmbH and thus from the mailcow team as well. Effective May 1st, 2026, I will no longer be part of the team.
The past years have been a formative time for me both professionally and personally. Together with the community, contributors, and users, we were able to continuously develop and stabilize mailcow into the solution it is today. The countless deployments, discussions, issues, pull requests, and critical feedback have made the project even stronger.
If you are using Docker Compose v5, please make sure that you first apply these small fixes in order to prevent the update.sh script from failing:
| |
Without this, the update script will tell you, that your docker compose version is unsupported, even if you are using v5.
This is due to a small typo in the version check that has been fixed but may need to be applied manually if you are on Docker Compose v5 already.
https://github.com/mailcow/mailcow-dockerized/compare/2025-09b...2025-09c
Moohoo, dear community!
With the release of Debian 13 (Trixie), the question arises for you as administrators: How can you perform a smooth dist-upgrade from Debian 12 (Bookworm) – especially on systems running mailcow?
A commonly overlooked pitfall: Exim.
