LoginSign Up
← Back to all sparks
M

Mailu

COMMS
Velocity5.0

Self-hosted mail server suite with webmail and admin interface

mailu.io ↗

A mail server whose entire visible output is patching other people's code.

self-hosted-emaildockersecurity-patchesroundcubemaintenance-branch
◆Current state
Mailu is a self-hosted mail suite shipped as a Docker compose stack, and the 2024.06.x branch shown here is its maintenance line. Every release in the window is a single-issue patch — a Roundcube bump, a CVE fix, an autoconfig tweak. The cadence looks high at ten pinned releases in five months, but each carries one change.
◆Where it's heading
Most of what Mailu ships is downstream maintenance of its bundled components, Roundcube above all, which drove three of these ten releases. The project's own work here is defensive: escaping user-controlled fields in generated sieve scripts, setting X-Forwarded-By, adapting to Microsoft's new autodiscover. This is a product in steady-state operation, where the release notes track what upstream broke rather than what Mailu decided to build.
◆Prediction
The next pinned release will most likely be another Roundcube or Alpine bump, since component upgrades triggered half the releases here. These entries say nothing about what is happening on the main branch.

◆Recent moves

  1. 5d ago

    Autoconfig fix for modern K-9 Mail

    A one-line client compatibility fix so K-9 Mail can autoconfigure against a Mailu instance. Representative of the branch: one issue in, one pinned release out.

    View source ↗
  2. 7d ago

    Roundcube 1.6.17 closes two CVEs

    The third Roundcube bump in this window, again driven by disclosed CVEs rather than by anything Mailu wanted from the webmail. Admins get the fix without tracking upstream themselves, which is most of what the pinned-release model is for.

    View source ↗
  3. 12d ago

    Sets X-Forwarded-By in response to a GHSA advisory

    A header fix tied to a published security advisory against Mailu's own code rather than a bundled component. One of the few releases here where the project is patching itself.

    View source ↗
  4. 26d ago

    Admin UI keeps form values on failed submit

    Two admin-UI flow fixes: forced password change redirects to the intended destination, and the Create User form retains entered values on a validation error. Small quality-of-life work for operators.

    View source ↗
  5. 1mo ago

    Escapes sieve fields, fixing autoreplies with special characters

    Vacation autoreplies failed to compile when a display name contained characters like @, and the fix escapes all user-controlled fields rendered into the sieve script. A broken feature repaired and a sieve-injection path closed in the same change.

    View source ↗
  6. 2mo ago

    Roundcube 1.6.16 and carddav 5.1.3 close CVE-2026-49217

    Another bundled-component upgrade carrying a CVE fix, this time with the carddav plugin pulled along. The pattern of Roundcube setting Mailu's release schedule is the clearest signal in this window.

    View source ↗