volker.raschek/postfixadmin-docker
1
0 Fork 0
Code Issues 1 Pull Requests 3 Actions 3 Projects Releases Wiki Activity

chore(deps): update dependency postfixadmin/postfixadmin to v4 #107

Open
CSRBot wants to merge 1 commits from renovate/postfixadmin-postfixadmin-4.x into master
pull from: renovate/postfixadmin-postfixadmin-4.x
merge into: volker.raschek:master
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-09-15 14:19:17 +02:00
Collaborator
Copy link
Copy source

This PR contains the following updates:

Package Update Change
postfixadmin/postfixadmin major 3.3.15 → 4.0.6

Release Notes

postfixadmin/postfixadmin (postfixadmin/postfixadmin)

v4.0.6: Postfixadmin v4.0.6

Compare Source

What's Changed

Full Changelog: https://github.com/postfixadmin/postfixadmin/compare/v4.0.5...v4.0.6

v4.0.5: Postfixadmin v4.0.5

Compare Source

What's Changed

  • Handle expired sessions for invalid tokens by @​TrapoSAMA in #​1055
  • Update github actions to also build a build for PHP 8.4 (as well as 7.4) (the PHP 8.4 build will have an updated spomky-labs/otphp library fixing the 2 CVEs mentioned in 4.0.4)

Full Changelog: https://github.com/postfixadmin/postfixadmin/compare/v4.0.4...v4.0.5

v4.0.4: Postfixadmin 4.0.4

Compare Source

Full Changelog: https://github.com/postfixadmin/postfixadmin/compare/v4.0.3...v4.0.4

v4.0.3: Postfixadmin 4.0.3

Compare Source

Postfixadmin 4.0.3

(This is near identical to the 4.0.2 release, but as that didn't build on github - I deleted it, fixed the token formatting and static analysis issues and created a new version/release)

Thank you to everyone for your various contributions 😄

  • improve password recovery if TOTP is active (see #​1032, thanks @​drunken-sod)
  • improve install.sh ( see #​965, thanks @​TigerP)
  • improve docs ( PHP version requirement consistency )
  • Include domain in link to create new alias (backport for 4.0, see #​977, thanks @​csware)
  • Check for address validity before checking domain existence (backport 4.0) (see #​975, thanks @​csware)
  • Remove redundant charset in MySQL connection (see #​970, thanks @​csware)
  • Improve error handling if vendor/autoloaderphp doesn't exist
  • Add build against PHP 8.5
  • admin global search - restrict to domains the admin type has access to (see #​947, thanks @​lukasdebaum)
  • update composer.json (move mysql/sqlite3 extensions to suggest block, see #​942, thanks @​rimvisit)
  • update install.sh to be less bash-y (see #​940, thanks @​kuzmos)
  • update github actions (remove deprecation warning #​983, thanks @​csware)

v4.0.2

Compare Source

v4.0.1

Compare Source

  • Translation fixes (thanks @​cboltz)
    • Fix db setup with table prefix for some of the TOTP tables (thanks @​cboltz)
    • Fix relative path for admins / totp page (thanks @​cboltz)

v4.0.0

Compare Source

v3.3.16: Postfixadmin 3.3.16

Compare Source

  • Correct PHP requirement to >= 7.2 - it seems we've managed to lose support for PHP 7.0 somehow (Smarty,PHPUnit), possibly related to #​541.
    • Make PHP session cookies more secure (add samesite, httponly and perhaps secure flags) - see #​903, thanks @​gitblacker
    • Upgrade moment.js library used by bootstrap - includes fix for Regex DoS issues - see #​902, thanks @​gitblacker
    • Add (lax) Content-Security-Policy HTTP header (see common.php) - see #​905, thanks @​gitblacker
    • Add sqlite3 to Debian control dependency list - see #​909, thanks @​marner2
    • Exclude the "ALL" domain from the Postfix SQL queries - see #​916, thanks @​Ramalama2

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [postfixadmin/postfixadmin](https://github.com/postfixadmin/postfixadmin) | major | `3.3.15` → `4.0.6` | --- ### Release Notes <details> <summary>postfixadmin/postfixadmin (postfixadmin/postfixadmin)</summary> ### [`v4.0.6`](https://github.com/postfixadmin/postfixadmin/releases/tag/v4.0.6): Postfixadmin v4.0.6 [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.5...v4.0.6) #### What's Changed - CVE-2026-121551: Escape stored TOTP-exception and application-password descriptions when displaying security lists (backport of [#&#8203;1172](https://github.com/postfixadmin/postfixadmin/issues/1172); see [#&#8203;1185](https://github.com/postfixadmin/postfixadmin/issues/1185) - thanks [@&#8203;carfeii](https://github.com/carfeii), [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)). - Harden getPageBrowser (see [#&#8203;1127](https://github.com/postfixadmin/postfixadmin/issues/1127)) - Silently ignore search requests on password fields - Fix incomplete MFA logins having the ability to change state (see also [#&#8203;1156](https://github.com/postfixadmin/postfixadmin/issues/1156) - thanks Wenhao Wu (Southeast University)) - Avoid passing null into explode() in list-virtual.php (see [#&#8203;1162](https://github.com/postfixadmin/postfixadmin/issues/1162) - thanks [@&#8203;danielsdadm-commits](https://github.com/danielsdadm-commits)) - db\_where\_clause(): fix function name in Exception message (thanks [@&#8203;cboltz](https://github.com/cboltz)) - Use the concise Spanish "MX de respaldo" label for Backup MX in domain lists and forms. - Distinguish undeliverable local alias destinations from external destinations within authorized domains (follow-up to [#&#8203;1152](https://github.com/postfixadmin/postfixadmin/issues/1152), port of [#&#8203;1150](https://github.com/postfixadmin/postfixadmin/issues/1150) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)). - Require reauthentication (current password) before removing TOTP ([#&#8203;1135](https://github.com/postfixadmin/postfixadmin/issues/1135), see [#&#8203;1129](https://github.com/postfixadmin/postfixadmin/issues/1129), [#&#8203;1128](https://github.com/postfixadmin/postfixadmin/issues/1128) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Scope Roundcube TOTP preference updates to the selected user in scripts/examples/sync-roundcubemail-totp.php ([#&#8203;1139](https://github.com/postfixadmin/postfixadmin/issues/1139), port of [#&#8203;1133](https://github.com/postfixadmin/postfixadmin/issues/1133), see [#&#8203;1128](https://github.com/postfixadmin/postfixadmin/issues/1128) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Harden password recovery requests ([#&#8203;1136](https://github.com/postfixadmin/postfixadmin/issues/1136), port of [#&#8203;1130](https://github.com/postfixadmin/postfixadmin/issues/1130), see [#&#8203;1128](https://github.com/postfixadmin/postfixadmin/issues/1128) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Reject password-only XML-RPC authentication requests if TOTP is required ([#&#8203;1137](https://github.com/postfixadmin/postfixadmin/issues/1137), port of [#&#8203;1131](https://github.com/postfixadmin/postfixadmin/issues/1131), see [#&#8203;1128](https://github.com/postfixadmin/postfixadmin/issues/1128) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Escape viewlog output by default ([#&#8203;1140](https://github.com/postfixadmin/postfixadmin/issues/1140), port of [#&#8203;1134](https://github.com/postfixadmin/postfixadmin/issues/1134), see [#&#8203;1128](https://github.com/postfixadmin/postfixadmin/issues/1128) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Improve smtp\_mail() ([#&#8203;1138](https://github.com/postfixadmin/postfixadmin/issues/1138), [#&#8203;1128](https://github.com/postfixadmin/postfixadmin/issues/1128) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Make pacrypt() more tolerant of doveadm output ([#&#8203;1122](https://github.com/postfixadmin/postfixadmin/issues/1122), [#&#8203;1119](https://github.com/postfixadmin/postfixadmin/issues/1119) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Show the configured TOTP status and Reset TOTP action without reserving space for the hidden form ([#&#8203;1167](https://github.com/postfixadmin/postfixadmin/issues/1167), see [#&#8203;1166](https://github.com/postfixadmin/postfixadmin/issues/1166) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Clarify the alias destination status legend ([#&#8203;1152](https://github.com/postfixadmin/postfixadmin/issues/1152), see discussion [#&#8203;886](https://github.com/postfixadmin/postfixadmin/issues/886) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Restore the legacy md5crypt password scheme compatibility ([#&#8203;1126](https://github.com/postfixadmin/postfixadmin/issues/1126), see [#&#8203;1123](https://github.com/postfixadmin/postfixadmin/issues/1123) - thanks [@&#8203;8ctopus](https://github.com/8ctopus), [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Fix password expiration handling: make it optional and disabled by default, 0 means passwords do not expire, show expiration state in mailbox lists / CSV (see [#&#8203;1110](https://github.com/postfixadmin/postfixadmin/issues/1110) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Clarify password expiration units are days (see [#&#8203;1108](https://github.com/postfixadmin/postfixadmin/issues/1108) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Improve TOTP code input semantics (one-time-code / numeric keyboard hints, fix label IDs) (see [#&#8203;1106](https://github.com/postfixadmin/postfixadmin/issues/1106) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Improve error display for mailbox/domain quota validation errors (see [#&#8203;1097](https://github.com/postfixadmin/postfixadmin/issues/1097) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Drop obsolete password\_expiration.sql (see [#&#8203;1099](https://github.com/postfixadmin/postfixadmin/issues/1099) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Update Spanish translations (see [#&#8203;1073](https://github.com/postfixadmin/postfixadmin/issues/1073), [#&#8203;1101](https://github.com/postfixadmin/postfixadmin/issues/1101), [#&#8203;1115](https://github.com/postfixadmin/postfixadmin/issues/1115), [#&#8203;1117](https://github.com/postfixadmin/postfixadmin/issues/1117) and [#&#8203;1171](https://github.com/postfixadmin/postfixadmin/issues/1171) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Fix MySQL upgrade issues from 3.3 (see [#&#8203;1088](https://github.com/postfixadmin/postfixadmin/issues/1088) - thanks [@&#8203;knofte](https://github.com/knofte), [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Fix session / CSRF token issues on first anonymous login (duplicate Cookie headers) (see [#&#8203;1087](https://github.com/postfixadmin/postfixadmin/issues/1087) and [#&#8203;1086](https://github.com/postfixadmin/postfixadmin/issues/1086) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Add documentation for Dovecot 2.4 (see [#&#8203;1076](https://github.com/postfixadmin/postfixadmin/issues/1076) + [#&#8203;1075](https://github.com/postfixadmin/postfixadmin/issues/1075) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Harden mailbox hook scripts (see [#&#8203;1080](https://github.com/postfixadmin/postfixadmin/issues/1080) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Add optional Rspamd DKIM hook examples (see [#&#8203;1081](https://github.com/postfixadmin/postfixadmin/issues/1081) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) - Various UI layout fixes (see [#&#8203;1077](https://github.com/postfixadmin/postfixadmin/issues/1077) - thanks [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA)) **Full Changelog**: <https://github.com/postfixadmin/postfixadmin/compare/v4.0.5...v4.0.6> ### [`v4.0.5`](https://github.com/postfixadmin/postfixadmin/releases/tag/v4.0.5): Postfixadmin v4.0.5 [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.4...v4.0.5) #### What's Changed - Handle expired sessions for invalid tokens by [@&#8203;TrapoSAMA](https://github.com/TrapoSAMA) in [#&#8203;1055](https://github.com/postfixadmin/postfixadmin/pull/1055) - Update github actions to also build a build for PHP 8.4 (as well as 7.4) (the PHP 8.4 build will have an updated spomky-labs/otphp library fixing the 2 CVEs mentioned in 4.0.4) **Full Changelog**: <https://github.com/postfixadmin/postfixadmin/compare/v4.0.4...v4.0.5> ### [`v4.0.4`](https://github.com/postfixadmin/postfixadmin/releases/tag/v4.0.4): Postfixadmin 4.0.4 [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.3...v4.0.4) **Full Changelog**: <https://github.com/postfixadmin/postfixadmin/compare/v4.0.3...v4.0.4> - Add the github actions workflow to build a .tar.gz on release, assume PHP 7.4 (see [#&#8203;999](https://github.com/postfixadmin/postfixadmin/issues/999) and [#&#8203;1026](https://github.com/postfixadmin/postfixadmin/issues/1026) see [`225a55d`](https://github.com/postfixadmin/postfixadmin/commit/225a55d5d9ca43d2abce07917e3e201f0d2f5d2b)). - Update composer.json to ignore two security alerts from spomky-labs/otphp - PKSA-qv5y-crcz-9nxw and PKSA-kbc7-dq62-pt7d - TOTP is disabled by default in PostfixAdmin (see config.inc.php) - spomky-labs/otphp have not released a PHP 7.4 compatible version with a fix - Installations running PHP8.1 or higher can run "composer update" to install a fixed version of this package. - see <https://github.com/Spomky-Labs/otphp/security/advisories/GHSA-2jx3-65f3-xr8r> (moderate) - see <https://github.com/Spomky-Labs/otphp/security/advisories/GHSA-g7m4-839x-ch6v> (moderate) ### [`v4.0.3`](https://github.com/postfixadmin/postfixadmin/releases/tag/v4.0.3): Postfixadmin 4.0.3 [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.2...v4.0.3) ### Postfixadmin 4.0.3 (This is near identical to the 4.0.2 release, but as that didn't build on github - I deleted it, fixed the token formatting and static analysis issues and created a new version/release) Thank you to everyone for your various contributions 😄 - improve password recovery if TOTP is active (see [#&#8203;1032](https://github.com/postfixadmin/postfixadmin/issues/1032), thanks [@&#8203;drunken-sod](https://github.com/drunken-sod)) - improve install.sh ( see [#&#8203;965](https://github.com/postfixadmin/postfixadmin/issues/965), thanks [@&#8203;TigerP](https://github.com/TigerP)) - improve docs ( PHP version requirement consistency ) - Include domain in link to create new alias (backport for 4.0, see [#&#8203;977](https://github.com/postfixadmin/postfixadmin/issues/977), thanks [@&#8203;csware](https://github.com/csware)) - Check for address validity before checking domain existence (backport 4.0) (see [#&#8203;975](https://github.com/postfixadmin/postfixadmin/issues/975), thanks [@&#8203;csware](https://github.com/csware)) - Remove redundant charset in MySQL connection (see [#&#8203;970](https://github.com/postfixadmin/postfixadmin/issues/970), thanks [@&#8203;csware](https://github.com/csware)) - Improve error handling if vendor/autoloaderphp doesn't exist - Add build against PHP 8.5 - admin global search - restrict to domains the admin type has access to (see [#&#8203;947](https://github.com/postfixadmin/postfixadmin/issues/947), thanks [@&#8203;lukasdebaum](https://github.com/lukasdebaum)) - update composer.json (move mysql/sqlite3 extensions to suggest block, see [#&#8203;942](https://github.com/postfixadmin/postfixadmin/issues/942), thanks [@&#8203;rimvisit](https://github.com/rimvisit)) - update install.sh to be less bash-y (see [#&#8203;940](https://github.com/postfixadmin/postfixadmin/issues/940), thanks [@&#8203;kuzmos](https://github.com/kuzmos)) - update github actions (remove deprecation warning [#&#8203;983](https://github.com/postfixadmin/postfixadmin/issues/983), thanks [@&#8203;csware](https://github.com/csware)) ### [`v4.0.2`](https://github.com/postfixadmin/postfixadmin/compare/v4.0.1...v4.0.2) [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.1...v4.0.2) ### [`v4.0.1`](https://github.com/postfixadmin/postfixadmin/blob/HEAD/CHANGELOG.TXT#Version-401-20250912) [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v4.0.0...v4.0.1) - Translation fixes (thanks [@&#8203;cboltz](https://github.com/cboltz)) - Fix db setup with table prefix for some of the TOTP tables (thanks [@&#8203;cboltz](https://github.com/cboltz)) - Fix relative path for admins / totp page (thanks [@&#8203;cboltz](https://github.com/cboltz)) ### [`v4.0.0`](https://github.com/postfixadmin/postfixadmin/compare/v3.3.16...v4.0.0) [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/v3.3.16...v4.0.0) ### [`v3.3.16`](https://github.com/postfixadmin/postfixadmin/releases/tag/postfixadmin-3.3.16): Postfixadmin 3.3.16 [Compare Source](https://github.com/postfixadmin/postfixadmin/compare/postfixadmin-3.3.15...v3.3.16) - Correct PHP requirement to >= 7.2 - it seems we've managed to lose support for PHP 7.0 somehow (Smarty,PHPUnit), possibly related to [#&#8203;541](https://github.com/postfixadmin/postfixadmin/pull/541). - Make PHP session cookies more secure (add samesite, httponly and perhaps secure flags) - see [#&#8203;903](https://github.com/postfixadmin/postfixadmin/issues/903), thanks [@&#8203;gitblacker](https://github.com/gitblacker) - Upgrade moment.js library used by bootstrap - includes fix for Regex DoS issues - see [#&#8203;902](https://github.com/postfixadmin/postfixadmin/issues/902), thanks [@&#8203;gitblacker](https://github.com/gitblacker) - Add (lax) Content-Security-Policy HTTP header (see common.php) - see [#&#8203;905](https://github.com/postfixadmin/postfixadmin/issues/905), thanks [@&#8203;gitblacker](https://github.com/gitblacker) - Add sqlite3 to Debian control dependency list - see [#&#8203;909](https://github.com/postfixadmin/postfixadmin/issues/909), thanks [@&#8203;marner2](https://github.com/marner2) - Exclude the "ALL" domain from the Postfix SQL queries - see [#&#8203;916](https://github.com/postfixadmin/postfixadmin/issues/916), thanks [@&#8203;Ramalama2](https://github.com/Ramalama2) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC44Ny4xIiwidXBkYXRlZEluVmVyIjoiNDQuMTE2LjEiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->
volker.raschek was assigned by CSRBot 2026-09-15 14:19:20 +02:00
CSRBot force-pushed renovate/postfixadmin-postfixadmin-4.x from bad6d2398b to 3a090b1a47 2026-09-15 17:18:11 +02:00 Compare
CSRBot force-pushed renovate/postfixadmin-postfixadmin-4.x from 3a090b1a47 to a12e77e9bf 2026-09-16 15:17:45 +02:00 Compare
CSRBot force-pushed renovate/postfixadmin-postfixadmin-4.x from a12e77e9bf to 08dedae888 2026-10-23 21:03:20 +02:00 Compare
CSRBot force-pushed renovate/postfixadmin-postfixadmin-4.x from 08dedae888 to 3be82e10fe 2026-11-09 18:22:15 +01:00 Compare
CSRBot added 1 commit 2026-11-09 21:13:32 +01:00
chore(deps): update dependency postfixadmin/postfixadmin to v4
Build / build-amd64 (pull_request) Waiting to run
Details
Build / build-arm64 (pull_request) Failing after 2m20s
Details
Lint Markdown files / markdown-lint (pull_request) Successful in 11s
Details
c7ff564e55
CSRBot force-pushed renovate/postfixadmin-postfixadmin-4.x from 3be82e10fe to c7ff564e55 2026-11-09 21:13:32 +01:00 Compare
Some required checks failed
Build / build-amd64 (pull_request) Waiting to run
Details
Build / build-arm64 (pull_request) Failing after 2m20s
Details
Lint Markdown files / markdown-lint (pull_request) Successful in 11s
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/postfixadmin-postfixadmin-4.x:renovate/postfixadmin-postfixadmin-4.x
git checkout renovate/postfixadmin-postfixadmin-4.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 renovate/rebase
Rebase branch on base branch via renovate
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees volker.raschek
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/postfixadmin-docker#107