54 Releases 58 Tags

RSS Feed

• v27.1-rc.12 246784673c

  Compare

  v27.1-rc.12 Pre-Release

  jcoffey-dev released this 2026-11-07 01:31:46 +00:00 | 0 commits to main since this release

  The twelfth release candidate of the 27.1 series: 27.1-rc.11 with one fix.

  Certificates

  • A renewal created through the API replaces the queued one. Creating a certificate renewal task with x:Task/set, or a DNS task that renews the certificate afterwards, now clears the domain's queued renewals first, as saving the domain already did. Before, a client could start a second renewal that queued itself again after every run. A second renewal for the same domain in one request is refused. (inbuxa-admin #167, #308)

  Before you upgrade

  Nothing to do. Run this with inbuxa-admin 27.1-rc.8, which can order a certificate for names you choose and order one again after a failure, and inbuxa-webmail 27.1-rc.3.

  Everything in 27.1-rc.11 is here too. inbuxa Relay ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.12 and as static binaries with .sig files; run it with the server release of the same version.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.12, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    379 B

    2026-11-07 02:21:55 +00:00
  • inbuxa-linux-amd64.tar.gz
    51 MiB

    2026-11-07 02:21:47 +00:00
  • inbuxa-linux-arm64.tar.gz
    47 MiB

    2026-11-07 02:21:51 +00:00
  • inbuxa-relay-aarch64-linux-musl
    6.3 MiB

    2026-11-07 02:21:54 +00:00
  • inbuxa-relay-aarch64-linux-musl.sig
    239 B

    2026-11-07 02:22:32 +00:00
  • inbuxa-relay-x86_64-linux-musl
    8.0 MiB

    2026-11-07 02:21:53 +00:00
  • inbuxa-relay-x86_64-linux-musl.sig
    238 B

    2026-11-07 02:22:32 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.11 3933c87784

  Compare

  v27.1-rc.11 Pre-Release

  jcoffey-dev released this 2026-11-06 22:48:28 +00:00 | 4 commits to main since this release

  The eleventh release candidate of the 27.1 series: 27.1-rc.10 with two fixes.

  Calendars

  • A recurring event that starts in UTC keeps its zone. A series whose start is written in UTC, as a JMAP timeZone of Etc/UTC is stored, came back in the zone of whoever asked: read from America/Phoenix, an 18:00 UTC weekly event came back as 01:00 UTC the next day, and its occurrences were labeled America/Phoenix. Series in a named zone, floating series and one-off events were already right. Series stored before this are read correctly too, with no reindex. (#303, #305)

  DNS and certificates

  • Automatic DNS can publish nothing. A domain that only needs its DNS host to answer DNS-01 challenges can now leave every record type off. Before, the list needed at least one type, so a certificate-only domain had to publish something it didn't want. Saving a domain with nothing to publish no longer queues a DNS task that can only fail. (#304, #306)

  Before you upgrade

  Nothing to do. If you used the workaround for DNS-01 without records (only TLS-RPT ticked, no report address), you can untick it. Run this with inbuxa-admin 27.1-rc.7, whose DNS wizard lets you connect a domain with no records to publish, and inbuxa-webmail 27.1-rc.3.

  Everything in 27.1-rc.10 is here too. inbuxa Relay ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.11 and as static binaries with .sig files; run it with the server release of the same version.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.11, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    379 B

    2026-11-06 23:37:21 +00:00
  • inbuxa-linux-amd64.tar.gz
    51 MiB

    2026-11-06 23:37:10 +00:00
  • inbuxa-linux-arm64.tar.gz
    47 MiB

    2026-11-06 23:37:16 +00:00
  • inbuxa-relay-aarch64-linux-musl
    6.3 MiB

    2026-11-06 23:37:20 +00:00
  • inbuxa-relay-aarch64-linux-musl.sig
    239 B

    2026-11-06 23:37:54 +00:00
  • inbuxa-relay-x86_64-linux-musl
    8.0 MiB

    2026-11-06 23:37:19 +00:00
  • inbuxa-relay-x86_64-linux-musl.sig
    238 B

    2026-11-06 23:37:54 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.10 75a114b0d9

  Compare

  v27.1-rc.10 Pre-Release

  jcoffey-dev released this 2026-11-06 19:32:48 +00:00 | 10 commits to main since this release

  The tenth release candidate of the 27.1 series: 27.1-rc.9 with clearer wording for two settings. Nothing in the server's behavior changes.

  Settings

  • Additional Hostnames is now Certificate Hostnames, and says what it does. A list there replaces the default names instead of adding to them, so the certificate covers the domain itself only if you list it. The description now says what an empty list gets: the wildcard and the domain with a DNS challenge, otherwise the standard service names under the domain. It also says how a name is read: one without a dot gets the domain added, one with a dot is used as written. The property and saved configs are unchanged. (#291, #299)
  • Allow Directory Queries says what it does to sharing. Since 27.1-rc.8 the setting also decides who a regular user can look up and share with. With it off, the default, that's only accounts they already have a connection to. The description and the generated reference page now say so. (#301)

  Reporting security issues

  You can now report a vulnerability privately through Report a vulnerability on the GitHub copy's Security tab, as well as by email. SECURITY.md has both. (#300)

  Before you upgrade

  Nothing to do. Run this with inbuxa-admin 27.1-rc.6, whose certificates guide keeps a domain's own Certificate Hostnames, and inbuxa-webmail 27.1-rc.3.

  Everything in 27.1-rc.9 is here too. inbuxa Relay ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.10 and as static binaries with .sig files; run it with the server release of the same version.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.10, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    379 B

    2026-11-06 20:20:45 +00:00
  • inbuxa-linux-amd64.tar.gz
    51 MiB

    2026-11-06 20:20:39 +00:00
  • inbuxa-linux-arm64.tar.gz
    47 MiB

    2026-11-06 20:20:41 +00:00
  • inbuxa-relay-aarch64-linux-musl
    6.3 MiB

    2026-11-06 20:20:45 +00:00
  • inbuxa-relay-aarch64-linux-musl.sig
    239 B

    2026-11-06 20:21:14 +00:00
  • inbuxa-relay-x86_64-linux-musl
    8.0 MiB

    2026-11-06 20:20:43 +00:00
  • inbuxa-relay-x86_64-linux-musl.sig
    238 B

    2026-11-06 20:21:14 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.9 7792ccd240

  Compare

  v27.1-rc.9 Pre-Release

  jcoffey-dev released this 2026-11-06 07:09:57 +00:00 | 18 commits to main since this release

  The ninth release candidate of the 27.1 series: 27.1-rc.8 with certificate and DNS fixes, paging fixes for two query methods, and fuller milter traces.

  Certificates and DNS

  • CAA records are off by default. A domain with automatic certificates and automatic DNS used to publish a CAA record at its apex, tied to this server's ACME account. CAA covers every name under the domain, so another ACME client there, like certbot on a web server, would be refused at its next renewal. New domains now leave CAA off; the field explains when to turn it on. DNS-PERSIST-01 providers publish their _validation-persist record whether or not CAA is on. (#294)
  • Changing a domain's names orders a certificate right away. Editing Additional Hostnames, the ACME provider or the domain name on a domain already on ACME used to wait for the next renewal, about 60 days out. Saving now orders a certificate when the names it covers change, and a domain keeps a single queued renewal. (#295)

  Fixes

  • x:MaskedEmail/query and x:ArchivedItem/query page correctly. A request with a position past the first page returned the first page again and ignored limit. Both now honor position, anchor and limit. The masked email fix and its test are Stefan's, thanks Stefan. (#296)
  • Milter replies show in delivery traces. When a milter rejects with its own reply, the trace now records the SMTP code and text the client was sent, not just "Reply code". SMTP replies don't change. Stefan's patch again. (#293)

  Before you upgrade

  Existing domains keep the records they publish today, CAA included. If another ACME client issues certificates for names under a domain that inbuxa publishes CAA for, untick CAA in that domain's DNS settings, then delete the record at your DNS provider: unticking it doesn't remove a record that's already published. Check with dig CAA example.com.

  Run this with inbuxa-admin 27.1-rc.5, whose DNS guide leaves CAA off and lists each DNS provider's description, and inbuxa-webmail 27.1-rc.3.

  Everything in 27.1-rc.8 is here too, the directory fix, journal report format, inbuxa Relay and migrations included. inbuxa Relay ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.9 and as static binaries with .sig files; run it with the server release of the same version.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.9, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    379 B

    2026-11-06 08:04:02 +00:00
  • inbuxa-linux-amd64.tar.gz
    51 MiB

    2026-11-06 08:03:55 +00:00
  • inbuxa-linux-arm64.tar.gz
    47 MiB

    2026-11-06 08:03:59 +00:00
  • inbuxa-relay-aarch64-linux-musl
    6.3 MiB

    2026-11-06 08:04:02 +00:00
  • inbuxa-relay-aarch64-linux-musl.sig
    238 B

    2026-11-06 08:04:39 +00:00
  • inbuxa-relay-x86_64-linux-musl
    8.0 MiB

    2026-11-06 08:04:00 +00:00
  • inbuxa-relay-x86_64-linux-musl.sig
    237 B

    2026-11-06 08:04:39 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.8 906ec63874

  Compare

  v27.1-rc.8 Pre-Release

  jcoffey-dev released this 2026-11-04 04:44:50 +00:00 | 30 commits to main since this release

  The eighth release candidate of the 27.1 series: 27.1-rc.6 with one security fix and a new journal report format. 27.1-rc.7 was tagged with the security fix, but its build failed and it was never published, so this is the first release you can install with that fix.

  Security

  • Allow Directory Queries now does what it says. With the setting off, which is the default, regular users could still list and look up the other accounts on their server. Now listing and searching are refused over JMAP and WebDAV. A regular user can only look up the accounts they already have a connection to: their own, their groups, people who shared with them, and people on their own shares. Sharing follows the same rule on JMAP, WebDAV and IMAP. (#282, #283)

  Journal reports

  Journal reports now follow a public specification, the journal report format. A report is a multipart/report with a summary for people, an envelope part for programs with one line per recipient, and the message byte for byte.

  Before you upgrade

  Allow Directory Queries

  If you're on the default, regular users lose these when you upgrade:

  • directory suggestions in compose (addresses they type still send)
  • picking anyone they have no connection to in the share dialog
  • free/busy for people who haven't shared with them
  • starting a share with someone new, in any client

  People already on a share keep it, and it can still be changed or removed.

  To keep all of that, turn on Settings › Sharing › Allow Directory Queries. With it on, nothing changes. Accounts allowed to list accounts aren't affected either way.

  An IMAP connection keeps the settings it started with, so a change to this setting reaches it when it reconnects.

  Journal reports

  This matters if you send journals to an outside archive, or read reports with a script.

  • Scripts should read the new envelope part, not the summary. The summary's wording isn't fixed.
  • The Bcc line is now Not in To or Cc, and addressed=not-in-headers in the envelope part. It never proved a blind copy: a list's post arriving for a subscriber looks the same.
  • Reports to an archive now declare BODY=8BITMIME or BODY=BINARYMIME. A server that can't take the message unchanged doesn't get that report, which most often means a message with lines past 998 bytes and a server without BINARYMIME. The report stays in the built-in journal and shows as an archive failure on the journal.

  Reports already stored keep the layout they were written in.

  Run this with inbuxa-webmail 27.1-rc.3, which shows names on shares and explains missing free/busy when the setting is off.

  Everything in 27.1-rc.6 is here too, inbuxa Relay and migrations included. inbuxa Relay ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.8 and as static binaries with .sig files; run it with the server release of the same version.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.8, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    379 B

    2026-11-04 05:32:15 +00:00
  • inbuxa-linux-amd64.tar.gz
    51 MiB

    2026-11-04 05:32:09 +00:00
  • inbuxa-linux-arm64.tar.gz
    47 MiB

    2026-11-04 05:32:12 +00:00
  • inbuxa-relay-aarch64-linux-musl
    6.3 MiB

    2026-11-04 05:32:15 +00:00
  • inbuxa-relay-aarch64-linux-musl.sig
    238 B

    2026-11-04 05:32:50 +00:00
  • inbuxa-relay-x86_64-linux-musl
    8.0 MiB

    2026-11-04 05:32:14 +00:00
  • inbuxa-relay-x86_64-linux-musl.sig
    237 B

    2026-11-04 05:32:50 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.7 26f545d1f0

  Compare

  v27.1-rc.7 Pre-Release

  jcoffey-dev released this 2026-11-02 02:27:40 +00:00 | 37 commits to main since this release

  This build failed and no image was published. Use 27.1-rc.8, which has everything here.

  The seventh release candidate of the 27.1 series: 27.1-rc.6 with one security fix.

  Security

  • Allow Directory Queries now does what it says. With the setting off, which is the default, regular users could still list and look up the other accounts on their server. Now listing and searching are refused over JMAP and WebDAV. A regular user can only look up the accounts they already have a connection to: their own, their groups, people who shared with them, and people on their own shares. Sharing follows the same rule on JMAP, WebDAV and IMAP. (#282, #283)

  Before you upgrade

  If you're on the default, regular users lose these when you upgrade:

  • directory suggestions in compose (addresses they type still send)
  • picking anyone they have no connection to in the share dialog
  • free/busy for people who haven't shared with them
  • starting a share with someone new, in any client

  People already on a share keep it, and it can still be changed or removed.

  To keep all of that, turn on Settings › Sharing › Allow Directory Queries. With it on, nothing changes. Accounts allowed to list accounts aren't affected either way.

  An IMAP connection keeps the settings it started with, so a change to this setting reaches it when it reconnects.

  Run this with inbuxa-webmail 27.1-rc.3, which shows names on shares and explains missing free/busy when the setting is off.

  Everything in 27.1-rc.6 is here too, inbuxa Relay and migrations included. inbuxa Relay ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.7 and as static binaries with .sig files; run it with the server release of the same version.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.7, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.6 2ccf0695af

  Compare

  v27.1-rc.6 Pre-Release

  jcoffey-dev released this 2026-10-31 06:32:41 +00:00 | 45 commits to main since this release

  The sixth release candidate of the 27.1 series: 27.1-rc.5 with one fix. It has no security fixes.

  Fixed

  • A new server where a role was made in recovery mode before its first normal start never got the built-in roles, the default Authentication settings or the new-install privacy defaults, so every account was refused with 403. Recovery mode on a server with no roles now leaves a note, and the first normal start seeds them when there are no roles or the note is there. A server that has started normally before is unchanged. (#265)

  Everything in 27.1-rc.5 is here too, inbuxa Relay and migrations included. inbuxa Relay ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.6 and as static binaries with .sig files; run it with the server release of the same version.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.6, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    379 B

    2026-10-31 07:21:53 +00:00
  • inbuxa-linux-amd64.tar.gz
    51 MiB

    2026-10-31 07:21:46 +00:00
  • inbuxa-linux-arm64.tar.gz
    47 MiB

    2026-10-31 07:21:50 +00:00
  • inbuxa-relay-aarch64-linux-musl
    6.3 MiB

    2026-10-31 07:21:52 +00:00
  • inbuxa-relay-aarch64-linux-musl.sig
    238 B

    2026-10-31 07:22:21 +00:00
  • inbuxa-relay-x86_64-linux-musl
    8.0 MiB

    2026-10-31 07:21:51 +00:00
  • inbuxa-relay-x86_64-linux-musl.sig
    237 B

    2026-10-31 07:22:20 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.5 928bc12831

  Compare

  v27.1-rc.5 Pre-Release

  jcoffey-dev released this 2026-10-31 05:18:55 +00:00 | 49 commits to main since this release

  The fifth release candidate of the 27.1 series. It brings inbuxa Relay, a small relay for a public machine, and moving a domain in from inbuxa Admin. It has no security fixes.

  inbuxa Relay

  A small relay that takes mail in on port 25 for your server, and can send its mail on, so the server itself never opens a mail port to the internet. Your server dials out to it, and you manage it from inbuxa Admin, under Settings › Mail flow › Sending › Relays.

  • While its link to your server is up, your server decides on each message during the sender's session: your spam filter, directory and rules answer at the door.
  • While the link is down, it holds mail for your addresses, encrypted to your server's key, and passes it on once the link is back.
  • Outgoing mail goes through it with DKIM signed by your server, DANE and MTA-STS.
  • Your server publishes its MX and SPF records where it manages a domain's DNS, and orders its certificate by DNS-01.
  • Upgrades from inbuxa Admin take a signed release.
  • Hardening: a list of who may dial the link, replacing the link CA without a new join, and the relay keys wrapped under a key file (INBUXA_RELAY_KEY_FILE).

  It ships from this tag as registry.coffeylabs.org/inbuxa/inbuxa-relay:27.1-rc.5 (linux/amd64, linux/arm64), and as static binaries inbuxa-relay-x86_64-linux-musl and inbuxa-relay-aarch64-linux-musl, each with a .sig file by the inbuxa release key. Run it with the server release of the same version. Docs: https://docs.inbuxa.org/run/relay/

  Migrations

  An administrator can move a domain in from another server under Management › Directory › Migrations in inbuxa Admin, from IMAP, JMAP, Microsoft 365 or Google Workspace: preview, move, final pass, and the new accounts' passwords once. The server runs the bundled inbuxa-migrate 27.1-rc.8. It needs the new Run migrations permission, which only the Administrator role has.

  Changed

  • The store now carries inbuxa's own store version. A store marked by a newer release is refused before anything writes to it, with a message pointing at that release or the pre-upgrade backup.
  • A store brought over from Stalwart 0.16 has upstream's web interface switched off the first time inbuxa opens it, so it is no longer served at /admin. The log says how to switch it back on.

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.5, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    379 B

    2026-10-31 06:06:27 +00:00
  • inbuxa-linux-amd64.tar.gz
    51 MiB

    2026-10-31 06:06:18 +00:00
  • inbuxa-linux-arm64.tar.gz
    47 MiB

    2026-10-31 06:06:24 +00:00
  • inbuxa-relay-aarch64-linux-musl
    6.3 MiB

    2026-10-31 06:06:26 +00:00
  • inbuxa-relay-aarch64-linux-musl.sig
    238 B

    2026-10-31 06:06:56 +00:00
  • inbuxa-relay-x86_64-linux-musl
    8.0 MiB

    2026-10-31 06:06:25 +00:00
  • inbuxa-relay-x86_64-linux-musl.sig
    237 B

    2026-10-31 06:06:56 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v27.1-rc.4 731f5fe6de

  Compare

  v27.1-rc.4 Pre-Release

  jcoffey-dev released this 2026-10-29 20:47:19 +00:00 | 123 commits to main since this release

  The fourth release candidate of the 27.1 series. It has no security fixes. It fixes bugs in Sieve filters, IMAP pipelining and file deletion.

  Fixed

  • Sieve: an out-of-office reply (vacation) and Sieve notify answered mail sent by programs: mail with an Auto-Submitted header other than no, other autoresponders included (RFC 3834). They now stay silent for it. The out-of-office replies set up in the webmail go through the same code.
  • Sieve: string depended on the order of its keys. string :is "a" ["a", "b"] was false while ["b", "a"] was true. A test is now true when any key matches.
  • Sieve: date :regex and currentdate :regex compared the date as a wildcard pattern, so a regular expression such as "^20[0-9]{2}$" never matched. They now compare it as a regular expression.
  • IMAP: a SELECT pipelined with the FETCH or STORE after it got BAD No mailbox is selected for those commands. Each command is now checked when it runs. A FETCH pipelined after UNSELECT, CLOSE or UNAUTHENTICATE is now refused with BAD. Before, it closed the connection.
  • Files: the task that keeps a deleted file for undelete could wait up to five minutes on a quiet server. Deleting a file now starts it at once (WebDAV DELETE, COPY or MOVE over a file, and JMAP FileNode/set).

  Container image: registry.coffeylabs.org/inbuxa/inbuxa-server:27.1-rc.4, also tagged :27.1-rc. :latest stays on 2026.x until 27.1 ships.

  Downloads

  • SHA256SUMS
    184 B

    2026-10-29 22:02:24 +00:00
  • inbuxa-linux-amd64.tar.gz
    49 MiB

    2026-10-29 22:02:19 +00:00
  • inbuxa-linux-arm64.tar.gz
    46 MiB

    2026-10-29 22:02:23 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2026.10.29.1 932b032e78

  Compare

  INBUXA 2026.10.29.1 Stable

  jcoffey-dev released this 2026-10-29 13:42:54 +00:00 | 150 commits to main since this release

  This release fixes 7 security issues we found in our own review of the server, all medium. All versions up to and
  including 2026.10.29, and 27.1-rc.1 to 27.1-rc.2, are affected. Please upgrade.

  Some fixes change behavior that operators, clients or users can notice. Read "Behavior changes" before upgrading.

  Security

  Medium

  • OpenID Connect directories: tokens issued to other applications could sign in (GHSA-v3gv-4j87-3mg2)
  • OpenID Connect directories: opaque tokens from any application could sign in (GHSA-2p7h-9hv3-4292)
  • Calendars: one calendar object could cost tens of seconds of CPU to expand (GHSA-pw47-x75c-v45r)
  • IMAP: one session could start an unbounded number of operations at once (GHSA-6x5j-v349-9v79)
  • Sieve: a script's CPU limit did not count the message it scanned (GHSA-whf3-4g3x-w7r6)
  • Sign-in: bearer tokens were offered and accepted on unencrypted connections (GHSA-5phc-xg42-vp24)
  • OpenID Connect directories: provider responses were read without a size limit (GHSA-6hcw-cw8m-jcx7)

  Behavior changes

  Sign-in and tokens

  • OAuth bearer sign-in (OAUTHBEARER, XOAUTH2) now always needs TLS in IMAP, POP3, ManageSieve and SMTP submission.
    On unencrypted connections those mechanisms are no longer offered or accepted, even with plain-text sign-in
    allowed. A proxy that terminates TLS has to report it through the proxy protocol. Password sign-in is unchanged.
  • New OpenID Connect directories must set a required audience (the client ID registered for this server). Existing
    directories without one keep working, log a warning each time they load, and appear on the Security to-do list; a
    later release will require it. An audience, once set, can't be removed.
  • OpenID Connect directories have a new opaque-token setting: reject, check by token introspection (RFC 7662, with a
    client ID and secret), or accept on the user info endpoint's word. New directories reject opaque tokens unless an
    introspection endpoint is set. Existing directories keep accepting them through user info, as before; set the
    policy to close the hole.
  • Responses from an OpenID Connect provider larger than 1 MiB are refused. A token without a key ID is checked
    against freshly fetched provider keys when the cached ones don't verify it, so a key rotation no longer breaks such
    tokens until a reload.

  Mail and calendars

  • IMAP: a session runs at most four read operations at once, and commands that change mail or the session run one at
    a time in the order sent. A NOOP or LOGOUT sent during a long FETCH answers after it.
  • Sieve: the CPU limit (max_cpu_cycles) also counts the message bytes that tests scan. Every 64 KiB compared, times
    the number of keys, costs one instruction, so a user's script can scan about 300 MiB per message by default. A
    script that goes over stops with the usual CPU-limit error and the message is kept. Scripts running many
    body :raw tests on very large messages hit the limit sooner.
  • Calendars: recurrence expansion has one work limit per calendar object (about 50 ms). Objects whose rules use it
    up are still stored with the instances found so far, and the server logs a calendar rule expansion error. Rare
    rules written in a costly form (for example a daily event written as an every-minute rule) expand fewer instances.

  Advisories: https://github.com/inbuxa/inbuxa-server/security/advisories

  Downloads

  • SHA256SUMS
    184 B

    2026-10-29 14:52:34 +00:00
  • inbuxa-linux-amd64.tar.gz
    49 MiB

    2026-10-29 14:50:20 +00:00
  • inbuxa-linux-arm64.tar.gz
    46 MiB

    2026-10-29 14:52:34 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)