Update github actions to also build a build for PHP 8.4 (as well as 7.4) (the PHP 8.4 build will have an updated spomky-labs/otphp library fixing the 2 CVEs mentioned in 4.0.4)
(This is near identical to the 4.0.2 release, but as that didn't build on github - I deleted it, fixed the token formatting and static analysis issues and created a new version/release)
Thank you to everyone for your various contributions 😄
improve password recovery if TOTP is active (see #1032, thanks @drunken-sod)
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [postfixadmin/postfixadmin](https://github.com/postfixadmin/postfixadmin) | major | `3.3.15` → `4.0.5` |
---
### Release Notes
<details>
<summary>postfixadmin/postfixadmin (postfixadmin/postfixadmin)</summary>
### [`v4.0.5`](https://github.com/postfixadmin/postfixadmin/releases/tag/v4.0.5): Postfixadmin v4.0.5
[Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.4...v4.0.5)
#### What's Changed
- Handle expired sessions for invalid tokens by [@​TrapoSAMA](https://github.com/TrapoSAMA) in [#​1055](https://github.com/postfixadmin/postfixadmin/pull/1055)
- Update github actions to also build a build for PHP 8.4 (as well as 7.4) (the PHP 8.4 build will have an updated spomky-labs/otphp library fixing the 2 CVEs mentioned in 4.0.4)
**Full Changelog**: <https://github.com/postfixadmin/postfixadmin/compare/v4.0.4...v4.0.5>
### [`v4.0.4`](https://github.com/postfixadmin/postfixadmin/releases/tag/v4.0.4): Postfixadmin 4.0.4
[Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.3...v4.0.4)
**Full Changelog**: <https://github.com/postfixadmin/postfixadmin/compare/v4.0.3...v4.0.4>
- Add the github actions workflow to build a .tar.gz on release, assume PHP 7.4 (see [#​999](https://github.com/postfixadmin/postfixadmin/issues/999) and [#​1026](https://github.com/postfixadmin/postfixadmin/issues/1026) see [`225a55d`](https://github.com/postfixadmin/postfixadmin/commit/225a55d5d9ca43d2abce07917e3e201f0d2f5d2b)).
- Update composer.json to ignore two security alerts from spomky-labs/otphp - PKSA-qv5y-crcz-9nxw and PKSA-kbc7-dq62-pt7d
- TOTP is disabled by default in PostfixAdmin (see config.inc.php)
- spomky-labs/otphp have not released a PHP 7.4 compatible version with a fix
- Installations running PHP8.1 or higher can run "composer update" to install a fixed version of this package.
- see <https://github.com/Spomky-Labs/otphp/security/advisories/GHSA-2jx3-65f3-xr8r> (moderate)
- see <https://github.com/Spomky-Labs/otphp/security/advisories/GHSA-g7m4-839x-ch6v> (moderate)
### [`v4.0.3`](https://github.com/postfixadmin/postfixadmin/releases/tag/v4.0.3): Postfixadmin 4.0.3
[Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.2...v4.0.3)
### Postfixadmin 4.0.3
(This is near identical to the 4.0.2 release, but as that didn't build on github - I deleted it, fixed the token formatting and static analysis issues and created a new version/release)
Thank you to everyone for your various contributions 😄
- improve password recovery if TOTP is active (see [#​1032](https://github.com/postfixadmin/postfixadmin/issues/1032), thanks [@​drunken-sod](https://github.com/drunken-sod))
- improve install.sh ( see [#​965](https://github.com/postfixadmin/postfixadmin/issues/965), thanks [@​TigerP](https://github.com/TigerP))
- improve docs ( PHP version requirement consistency )
- Include domain in link to create new alias (backport for 4.0, see [#​977](https://github.com/postfixadmin/postfixadmin/issues/977), thanks [@​csware](https://github.com/csware))
- Check for address validity before checking domain existence (backport 4.0) (see [#​975](https://github.com/postfixadmin/postfixadmin/issues/975), thanks [@​csware](https://github.com/csware))
- Remove redundant charset in MySQL connection (see [#​970](https://github.com/postfixadmin/postfixadmin/issues/970), thanks [@​csware](https://github.com/csware))
- Improve error handling if vendor/autoloaderphp doesn't exist
- Add build against PHP 8.5
- admin global search - restrict to domains the admin type has access to (see [#​947](https://github.com/postfixadmin/postfixadmin/issues/947), thanks [@​lukasdebaum](https://github.com/lukasdebaum))
- update composer.json (move mysql/sqlite3 extensions to suggest block, see [#​942](https://github.com/postfixadmin/postfixadmin/issues/942), thanks [@​rimvisit](https://github.com/rimvisit))
- update install.sh to be less bash-y (see [#​940](https://github.com/postfixadmin/postfixadmin/issues/940), thanks [@​kuzmos](https://github.com/kuzmos))
- update github actions (remove deprecation warning [#​983](https://github.com/postfixadmin/postfixadmin/issues/983), thanks [@​csware](https://github.com/csware))
### [`v4.0.2`](https://github.com/postfixadmin/postfixadmin/compare/v4.0.1...v4.0.2)
[Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.1...v4.0.2)
### [`v4.0.1`](https://github.com/postfixadmin/postfixadmin/blob/HEAD/CHANGELOG.TXT#Version-401-20250912)
[Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.0...v4.0.1)
- Translation fixes (thanks [@​cboltz](https://github.com/cboltz))
- Fix db setup with table prefix for some of the TOTP tables (thanks [@​cboltz](https://github.com/cboltz))
- Fix relative path for admins / totp page (thanks [@​cboltz](https://github.com/cboltz))
### [`v4.0.0`](https://github.com/postfixadmin/postfixadmin/compare/v3.3.16...v4.0.0)
[Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v3.3.16...v4.0.0)
### [`v3.3.16`](https://github.com/postfixadmin/postfixadmin/releases/tag/postfixadmin-3.3.16): Postfixadmin 3.3.16
[Compare Source](https://github.com/postfixadmin/postfixadmin/compare/postfixadmin-3.3.15...v3.3.16)
- Correct PHP requirement to >= 7.2 - it seems we've managed to lose support for PHP 7.0 somehow (Smarty,PHPUnit), possibly related to [#​541](https://github.com/postfixadmin/postfixadmin/pull/541).
- Make PHP session cookies more secure (add samesite, httponly and perhaps secure flags) - see [#​903](https://github.com/postfixadmin/postfixadmin/issues/903), thanks [@​gitblacker](https://github.com/gitblacker)
- Upgrade moment.js library used by bootstrap - includes fix for Regex DoS issues - see [#​902](https://github.com/postfixadmin/postfixadmin/issues/902), thanks [@​gitblacker](https://github.com/gitblacker)
- Add (lax) Content-Security-Policy HTTP header (see common.php) - see [#​905](https://github.com/postfixadmin/postfixadmin/issues/905), thanks [@​gitblacker](https://github.com/gitblacker)
- Add sqlite3 to Debian control dependency list - see [#​909](https://github.com/postfixadmin/postfixadmin/issues/909), thanks [@​marner2](https://github.com/marner2)
- Exclude the "ALL" domain from the Postfix SQL queries - see [#​916](https://github.com/postfixadmin/postfixadmin/issues/916), thanks [@​Ramalama2](https://github.com/Ramalama2)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC44Ny4xIiwidXBkYXRlZEluVmVyIjoiNDQuODcuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
volker.raschek
was assigned by CSRBot2026-09-15 14:19:20 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
3.3.15→4.0.5Release Notes
postfixadmin/postfixadmin (postfixadmin/postfixadmin)
v4.0.5: Postfixadmin v4.0.5Compare Source
What's Changed
Full Changelog: https://github.com/postfixadmin/postfixadmin/compare/v4.0.4...v4.0.5
v4.0.4: Postfixadmin 4.0.4Compare Source
Full Changelog: https://github.com/postfixadmin/postfixadmin/compare/v4.0.3...v4.0.4
225a55d).v4.0.3: Postfixadmin 4.0.3Compare Source
Postfixadmin 4.0.3
(This is near identical to the 4.0.2 release, but as that didn't build on github - I deleted it, fixed the token formatting and static analysis issues and created a new version/release)
Thank you to everyone for your various contributions 😄
v4.0.2Compare Source
v4.0.1Compare Source
v4.0.0Compare Source
v3.3.16: Postfixadmin 3.3.16Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
bad6d2398bto3a090b1a473a090b1a47toa12e77e9bfView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.