Maddy
maddy's latest release is a security fix, five months after its last feature work.
A side-by-side editorial comparison of Roundcube and Subsplash — release velocity, themes, recent moves, and the top alternatives to consider.
| Feature | Roundcube | Subsplash |
|---|---|---|
| Sector | Comms | Comms |
| Velocity score | 5.0 | 2.5 |
| Sparks · 30d | 0 | 0 |
| Top themes | webmail, security, lts-maintenance, imap | church-platform, workflow-automation, people-management, giving-management |
| Last editorial update | 15h ago | 1h ago |
| Website | Visit → | — |
Roundcube's October release patches 13 more holes on both branches at once.
Roundcube shipped 1.7.5 and 1.6.20 on 19 October, again as a matched pair, fixing IMAP command injection via the _uid parameter, mail header injection in bounce and reply paths, a session object-injection primitive, ImageMagick limits bypasses, an SSRF filter bypass via NAT64 and several remote-content blocking bypasses. It is the fifth paired security release since June.
Subsplash gives church staff notes on every person and every Workflow card.
Subsplash runs giving, media, people and workflow tools for churches. Late September brought notes on People profiles and Workflow cards, board search and hide-completed checklists in Workflows, gift totals and recurring-gift status in Giving, and timestamped share links for media. October added multi-select actions on People.
Roundcube shipped 1.7.5 and 1.6.20 on 19 October, again as a matched pair, fixing IMAP command injection via the _uid parameter, mail header injection in bounce and reply paths, a session object-injection primitive, ImageMagick limits bypasses, an SSRF filter bypass via NAT64 and several remote-content blocking bypasses. It is the fifth paired security release since June.
Monthly security releases on both the 1.7 and LTS 1.6 lines have become the product's main output, driven by outside researchers. Several fixes revisit earlier ones, such as CSS-escape blocking bypasses fixed 'again', which suggests the content-sanitising code is still being mapped.
Another paired 1.7.x and 1.6.x security release in about a month is the pattern; feature work isn't visible in these entries.
Subsplash runs giving, media, people and workflow tools for churches. Late September brought notes on People profiles and Workflow cards, board search and hide-completed checklists in Workflows, gift totals and recurring-gift status in Giving, and timestamped share links for media. October added multi-select actions on People.
The platform is filling in the record-keeping that church staff did in other tools: notes, handoffs, follow-ups and giving totals now live next to the person or card. Workflows keeps getting features for busy boards and team handoffs. The releases are practical and incremental rather than new product lines.
Expect Workflows and People to keep converging, for example notes or tasks shared between a person and their cards. The entries say nothing new about the AI features mentioned earlier in the year.
Other Comms products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Roundcube or Subsplash.
maddy's latest release is a security fix, five months after its last feature work.
Grain adds consent controls and rule-based privacy as its meeting data reaches more AI tools.
Converse.js 14.0.1 fixes OMEMO:2 group decryption broken by Chromium 153.
Element Classic now asks its own users to move to Element X, if their server opts in.
Brosix follows its communities launch with a referral push and a private-room how-to.
VerneMQ follows its year-in-the-making 2.2.0 with a quick round of subscription fixes.
See all Roundcube alternatives → · See all Subsplash alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Roundcube is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Roundcube is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Comms products to evaluate alongside.
Top Roundcube alternatives in Comms are ranked by recent ship velocity. Browse the "Roundcube alternatives" section above for the current picks, or visit /alternatives/roundcube for the full list with editorial commentary on each.
Top Subsplash alternatives in Comms are ranked by recent ship velocity. Browse the "Subsplash alternatives" section above for the current picks, or visit /alternatives/subsplash for the full list with editorial commentary on each.