2026-05c (Release: 26th May 2026)
This update fixes CVE-2026-33278 in unbound and bumps Nginx to version 1.30.2.
🐝🐮 Mooay 2026 | Just Another Security Update - Revision C
👋 DerLinkman Leaves the Mailcow Team
Moohoo everyone.
Today I want to officially announce my departure from The Infrastructure Company GmbH and thus from the mailcow team as well. Effective May 1st, 2026, I will no longer be part of the team.
The past years have been a formative time for me both professionally and personally. Together with the community, contributors, and users, we were able to continuously develop and stabilize mailcow into the solution it is today. The countless deployments, discussions, issues, pull requests, and critical feedback have made the project even stronger.
🍀🐮 Moorch 2026 | Forced 2FA, DNS-01, SOGo & Rspamd Updates - Revision B
🐄🛡️ January 2026 Update | Limited EAS/DAV Access and Restricted Alias Sending
🎄🐮 Moocember 2025 | Just Another Bugfix Update - Revision A
Warning
If you are using Docker Compose v5, please make sure that you first apply these small fixes in order to prevent the update.sh script from failing:
| |
Without this, the update script will tell you, that your docker compose version is unsupported, even if you are using v5.
This is due to a small typo in the version check that has been fixed but may need to be applied manually if you are on Docker Compose v5 already.
🎃🐄 Mooctober 2025 Update | Rspamd 3.13.2 and Redis Security Update
🍂🐄 Mootember Update 2025 | MTA-STS Support, SOGo 5.12.3, Rspamd 3.12.1, and More - Revision A
2025-09c (Revision C Release from 7th October 2025)
Changes
- [SOGo][Web] SOGo URL Encryption support ➡️ PR #6758
- [Nginx] do not invert ENABLE_IPV6 ➡️ PR #6762
- [Web] Remove Port from HTTP_HOST ➡️ PR #6760
- [Web] Allow wildcard subdomains for MTA-STS ➡️ PR #6759
- [Web] set cookie SameSite attribute to Lax ➡️ PR #6766
- [Web] Rename PHP Cookie to MCSESSID ➡️ PR #6767
- Update GitHub’s issue template ➡️ PR #6772
- Clearer message to install required tool, e.g. jq ➡️ PR #6764
- Make domain description field readonly when no ACL ➡️ PR #6789
- Show “Never” by default if no last-modified date saved ➡️ PR #6788
- Hide relayhosts when ACL does not allow ➡️ PR #6787
- Fix several SQL statements ➡️ PR #6786
- Fixed wrong footer escaping for certain characters ➡️ PR #6782
- Rename password fields for AppPasswords same way for consistency ➡️ PR #6781
- Fixed password complexity check for AppPasswords creation/edit ➡️ PR #6780
- Remove debug console.log calls ➡️ PR #6779
- Enable HTTPS redirect by default on new setups ➡️ PR #6777
- [Helpers] Fix cold-standby digits in compose project names and inclusion of docker-compose.override.yml ➡️ PR #6800
- Fix enabling of ipv6 when updating ➡️ PR #6791
- Update variable name for prometheus-exporter security token ➡️ PR #6776
- Fixed typo in lang de-de ➡️ PR #6765
- Fix typos in config by ➡️ PR #6792
- chore(deps): update actions/stale action to v10.1.0 ➡️ PR #6806
- [Postfix] update postscreen_access.cidr ➡️ PR #6801
- Translations update from Weblate ➡️ PR #6771
- Translations update from Weblate ➡️ PR #6794
- Translations update from Weblate ➡️ PR #6785
- Translations update from Weblate ➡️ PR #6790
- Translations update from Weblate ➡️ PR #6793
- Translations update from Weblate ➡️ PR #6743
- Translations update from Weblate ➡️ PR #6749
Full Changelog
https://github.com/mailcow/mailcow-dockerized/compare/2025-09b...2025-09c
Quick Guide: Upgrading Debian 12 to Debian 13 for Mailcow Servers
Moohoo, dear community!
With the release of Debian 13 (Trixie), the question arises for you as administrators: How can you perform a smooth dist-upgrade from Debian 12 (Bookworm) – especially on systems running mailcow?
A commonly overlooked pitfall: Exim.