← Back to home
Comparison · Comms

Mailu vs Pixelfed

A side-by-side editorial comparison of Mailu and Pixelfed — release velocity, themes, recent moves, and the top alternatives to consider.

Mailu vs Pixelfed: at a glance

FeatureMailuPixelfed
SectorCommsComms
Velocity score5.05.0
Sparks · 30d00
Top themesmaintenance-branch, roundcube, cve-patching, self-hosted-mailfediverse, activitypub, photo-sharing, security
Last editorial update2mo ago3d ago
WebsiteVisit →Visit →

What is Mailu?

Mailu ships one pinned release per issue, and most of them are Roundcube's.

The 2024.06 branch releases on demand: an issue or PR comes in, a pinned version goes out, and the changelog is one or two lines. Four of the six most recent releases are webmail-driven — three Roundcube bumps in this window alone, the latest to 1.6.18 clearing a TLS-configuration warning, an earlier one to 1.6.17 closing two CVEs. The remainder are Mailu's own code: an X-Forwarded-By header fix tied to a published advisory, sieve field escaping that repaired autoreplies and closed an injection path, and two admin-UI form flow corrections.

Read the full Mailu trajectory →

What is Pixelfed?

Pixelfed 0.15.2 ships the PHP RCE patches and turns cached timelines on for everyone.

Pixelfed v0.15.2 is an urgent security update: Docker images pick up the patched PHP for this month's two remote code execution CVEs and are rebuilt with updated CAs after the eMudhra compromise. It also makes cached timelines the default, removing two experimental flags, and bundles timeline and WebFinger fixes.

Read the full Pixelfed trajectory →

Mailu vs Pixelfed: editorial side-by-side

M
Mailu
COMMS
5.0

Mailu ships one pinned release per issue, and most of them are Roundcube's.

◆ Current state

The 2024.06 branch releases on demand: an issue or PR comes in, a pinned version goes out, and the changelog is one or two lines. Four of the six most recent releases are webmail-driven — three Roundcube bumps in this window alone, the latest to 1.6.18 clearing a TLS-configuration warning, an earlier one to 1.6.17 closing two CVEs. The remainder are Mailu's own code: an X-Forwarded-By header fix tied to a published advisory, sieve field escaping that repaired autoreplies and closed an injection path, and two admin-UI form flow corrections.

◆ Where it's heading

This is a maintenance branch behaving exactly as a maintenance branch should, and the pinned-version model is the product: operators get upstream security work packaged and tagged without tracking Roundcube themselves. The security items divide cleanly — most arrive from bundled components, a minority from Mailu's own code, and the project patches both on the same cadence. Nothing in this window suggests new capability is being developed on this branch.

◆ Prediction

Expect the next release to follow the same trigger: a Roundcube advisory or a client compatibility report producing a single-line changelog and a new pinned tag. Any feature work would be happening on the main version, which this feed does not cover.

P5.0

Pixelfed 0.15.2 ships the PHP RCE patches and turns cached timelines on for everyone.

◆ Current state

Pixelfed v0.15.2 is an urgent security update: Docker images pick up the patched PHP for this month's two remote code execution CVEs and are rebuilt with updated CAs after the eMudhra compromise. It also makes cached timelines the default, removing two experimental flags, and bundles timeline and WebFinger fixes.

◆ Where it's heading

Pixelfed has moved quickly through 0.14.5 and 0.15 with federation fixes and new APIs, and now an upstream security patch. The notes say heavy refactoring will continue toward a Nuxt-based web UI, so the near term is more churn in the front end.

◆ Prediction

Expect more 0.15.x patches for regressions from the refactor, with the Nuxt web UI as the next visible milestone.

Alternatives to Mailu and Pixelfed

Other Comms products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Mailu or Pixelfed.

See all Mailu alternatives → · See all Pixelfed alternatives →

Recent activity from Mailu and Pixelfed

Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.

  1. 7d agoPixelfedv0.15.2 - Security Update: PHP RCE + CA Update Compromise
  2. 11d agoPixelfedv0.15.1 - Fix Languages regression
  3. 16d agoPixelfedPixelfed 0.15 RC adds account-delete API, drops PHP 8.3
  4. 22d agoPixelfedPixelfed 0.14.5 RC fixes boost federation, adds FEP-6757
  5. 1mo agoPixelfedv0.12.12
  6. 2mo agoMailuRoundcube 1.6.18 bump clears a TLS-config warning
  7. 3mo agoMailuAutoconfig fix for modern K-9 Mail
  8. 3mo agoMailuRoundcube 1.6.17 closes two CVEs
  9. 3mo agoMailuSets X-Forwarded-By in response to a GHSA advisory
  10. 3mo agoMailuAdmin UI keeps form values on failed submit
  11. 4mo agoMailuEscapes sieve fields, fixing autoreplies with special characters

Frequently asked questions

What is the difference between Mailu and Pixelfed?

They serve adjacent needs but don't currently overlap on shipped themes. Mailu and Pixelfed are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.

Is Mailu better than Pixelfed?

Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Mailu and Pixelfed are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). For your specific use case, the alternatives sections above list other Comms products to evaluate alongside.

What are the best alternatives to Mailu?

Top Mailu alternatives in Comms are ranked by recent ship velocity. Browse the "Mailu alternatives" section above for the current picks, or visit /alternatives/mailu for the full list with editorial commentary on each.

What are the best alternatives to Pixelfed?

Top Pixelfed alternatives in Comms are ranked by recent ship velocity. Browse the "Pixelfed alternatives" section above for the current picks, or visit /alternatives/pixelfed for the full list with editorial commentary on each.