chore(deps): update all non-major updates

renovate-bot commented

2026-10-26 12:04:27 +00:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
binwiederhier/ntfy (source)		minor	`v2.34.0` → `v2.35.0`
docker.io/pgsty/silo (source)		patch	`RELEASE.2026-10-18T00-00-00Z` → `RELEASE.2026-10-26T00-00-00Z`
ghcr.io/alexta69/metube		patch	`2026.10.25` → `2026.10.27`
ghcr.io/bookorbit/bookorbit		minor	`3.5.0` → `3.6.0`
ghcr.io/bulwarkmail/webmail		minor	`1.17.2` → `1.19.1`
ghcr.io/calibrain/shelfmark-lite		minor	`v1.5.1` → `v1.6.0`
ghcr.io/coder/coder		patch	`v2.38.2` → `v2.38.5`
ghcr.io/mastodon/mastodon		patch	`v4.7.3` → `v4.7.4`
ghcr.io/matrix-org/matrix-hookshot		minor	`7.5.0` → `7.6.0`
ghcr.io/recyclarr/recyclarr		patch	`8.8.0` → `8.8.1`
hoppscotch/hoppscotch-frontend		minor	`2026.9.0` → `2026.10.0`
plexinc/pms-docker (source)		patch	`1.43.5.11029-6bf8af3f0` → `1.43.5.11079-b3b13e506`
proxmox (source)	required_provider	minor	`~> 0.118` → `~> 0.119`
sealed-secrets		minor	`2.20.0` → `2.22.0`
searxng/searxng (source)		patch	`2026.10.25-54ca1d9cf` → `2026.10.30-ffa88e3ba`
twinproduction/gatus		minor	`v5.37.0` → `v5.38.0`
vectorim/element-web		patch	`v1.12.32` → `v1.12.33`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

binwiederhier/ntfy

`v2.35.0`

Compare Source

This release keeps what a user already spent when their tier changes, and makes a tier's daily email limit a hard cap. It also fixes intermittent 403s under concurrent requests from the same IP, and the Matrix push gateway storing messages under a protected topic on SQLite.

Security:

Reject Matrix push gateway requests whose push key does not name a valid topic. Publishing strips NUL bytes and invalid UTF-8 from the topic after authorization, so an anonymous push key like /sec%00ret was authorized against an unmatched topic and then stored under the protected topic secret (SQLite only; on PostgreSQL the request was denied; thanks to Efe Çam for reporting)

Features:

A tier change (an upgrade, a downgrade, or a tier edited in place) applies on the user's next request and keeps what was already spent; before, it refilled the request, email and attachment bandwidth limits (#2104, #2105)
A tier's daily email limit is a hard cap; before, the tier's email burst came on top of it, so a user could send more emails a day than the tier allows

Bug fixes + maintenance:

Fix intermittent 403s and panics in the account handlers under concurrent requests from the same IP: a login or logout could change the user under another request, so a request with valid credentials was treated as anonymous, or the other way around. Every request now gets its own visitor (#1051, #2113, #2118, thanks to @ivanetinajero for reporting)
A tier with a daily email limit of zero sends no emails; before, it could still send the server's email burst (visitor-email-limit-burst)
An attachment upload rejected at a size limit is no longer charged to the attachment bandwidth limit for the part that went over
Rate limits live in one shared limit service, keyed by ip:<prefix> or user:<id>, instead of in each visitor, which uses less memory per visitor and takes a global lock off the request path
Accept terabyte units (e.g. 1T) in size settings such as attachment and tier limits, matching how sizes are displayed (#2078, thanks to @cangen185-sudo for the contribution)

pgsty/silo (docker.io/pgsty/silo)

`vRELEASE.2026-10-26T00-00-00Z`

Compare Source

Package version: 20261026000000.0.0; published from source c3ad836aed0d.
Artifacts are listed in the GitHub release.
The coordinated English release notes
and Chinese release notes
cover all components, upgrade guidance, and validation scope.

Fix LDAP login for long normalized DNs without hiding unreadable IAM
revocation records. Only length errors for valid keys with an ASCII path
component over 255 bytes are treated as absent; long-DN writes still fail.
Thanks to @910patin for the original fix and
reproduction in #250.
Build the server and standalone debugging tools with Go 1.27.3 and refresh
Go dependencies, including silo-pkg v3.15.2, mcli 2026102
and upstream minio-go 320af050c445 for multipart, read/seek,
batch-delete and bucket-replication removal fixes. Retain output-format and NetBSD compatibility selections.
Embed Console v2.5.1 source fff1618d9abb, including its GUI update,
diagnostic WebSocket closing handshake, complete health-report decoding,
group-membership preservation, OIDC group permissions, TLS-proxy session
cookies, credential exports and accessibility fixes.
Bundle mcli 2026102 in container builds, the verified client installer and
Helm client jobs. Include client identity isolation, resync status and rate
fixes, and bounded batch-status fallback. Scripts must handle the additive
batch pending state and nonzero exits for partial resync mutations.
Read current bucket inventory in account-info responses so Console refreshes
immediately reflect successful creation and deletion. This management endpoint
now performs a live list instead of returning a cached inventory.
Restore the native built-in policy immediately after resetting an override.
Peer and etcd notifications reload committed state, so delayed delete events
preserve subsequent edits. Keep deletion revisions, policy-in-use checks and
custom-policy deletion behavior; storage failures retain the previous policy.
Reload policies without holding the authentication-cache lock, retain IAM
write ordering and publish replacements only after a complete successful load.
Propagate cancellation through IAM/KMS and SSE-S3 decryption without shortening
the caller's policy-query deadline.
Preserve authoritative copies when a multi-pool delete or bulk cleanup fails,
choose an available pool for a new delete marker, and keep tier data referenced
by surviving copies. This does not introduce strict cross-pool read recovery.
Preserve remote tier data when lifecycle expiry only adds a delete marker,
including non-null versions in suspended buckets. Forward FULL_OBJECT
checksum type for multipart replicas. Thanks to
@botdeniska for these lifecycle, replication
and multi-pool deletion contributions.
Preserve Kafka's default broker protocol 2.1 and terminal-width behavior;
fix legacy DARE v1 key unsealing and verify DARE v1/v2 and MinKMS TLS compatibility.
Forward storage RPC delete options, including the previous data directory
needed by overwrite rollback. Preserve existing drive/RPC timeouts, request
cancellation, object locking, read-quorum and healing behavior.
Update bundled curl to 8.23.0 and require patched static libraries. Apply
Red Hat's compromised-CA mitigation;
the root blocklist also rejects legitimate chains under the affected roots.
Ship Windows platform archives as ZIP; Linux and macOS retain tar.gz.

Storage timeouts retain their existing meaning: a returned timeout does not
prove that the underlying disk operation stopped or that a write did not
commit. Late commits or delayed rollback can affect newer writes; stale reads
remain possible after partial failures, lease loss or network partitions. This
release does not provide distributed fencing or repair previously inconsistent
objects.

These source changes are not included in the published 2026101 artifacts.

bulwarkmail/webmail (ghcr.io/bulwarkmail/webmail)

`v1.19.1`

Compare Source

1.19.1 shows a card above booking, shipping and order mail, with the times, tracking and status that matter, and can put a booking in the calendar and keep it up to date. Mail that passes DMARC shows the sender's BIMI logo as its icon. Archiving, moving and reporting spam from an open message now follow "Return to list", archiving in unread first opens the next unread message, and a shared mailbox sends through its own identity. Plugins can forward a message to an address the user allowed and print a page they made, and new mail plays the Involved sound by default.

Thank you for your donations:

You? Become a sponsor!

One-time

@systemflair
@bultester
Anonymous
Anonymous
Anonymous

Monthly

Changes

Notifications: New mail plays the Involved sound by default instead of the beep. If you never picked a sound you get Involved too; a sound you chose stays
Appearance: List rows are no longer tinted with their first tag's colour by default. If you turned "Tint list rows by tag color" on yourself it stays on

Features

Mail: Booking, shipping and order mail that carries schema.org markup gets a card above the message: route and local times for flights, trains and buses, check-in and check-out for hotels, rental cars, events and restaurants, tracking for parcels and status for orders, with copy buttons and links that show where they lead. Flights, hotels and the other bookings can be added to a calendar you pick; a later mail about the same booking offers to update the event and a cancellation to remove it. Apple Wallet boarding passes and event tickets attached to a mail give the same cards. Cards appear only when the receiving server verified the sender's domain, never for forwarded mail, and everything is read in the browser without contacting airlines or carriers. Admins can turn them off under Policy
Mail: Mail that passes DMARC for its From domain shows the sender's BIMI logo as the sender icon, with a check mark beside the name when a Verified Mark or Common Mark Certificate backs it. Bulwark checks the record and the certificate itself, since Stalwart doesn't do BIMI. A contact photo still comes first, and logos follow the sender icons setting and stay off when third-party traffic is turned off. Admins can limit logos to certificate-backed ones with "Require a mark certificate" or BIMI_REQUIRE_CERTIFICATE
Mail: Expanded message headers in Mountain View have Reply all next to Reply (#1404, thanks @pcatapan)
Accessibility: Each preset on the Accessibility page shows a small picture of what it changes
Admin: On Stalwart 1.0, Auto-configure OAuth also registers a client for Bulwark Mobile, so the app signs in as a first-party client and gets the account security settings (#1459, thanks @Chaoskjell44)
Admin: The marketplace shows the changelog of every version an update brings, not only the newest, and a rollback lists what it undoes
Plugins: api.email.forward forwards a message with its attachments, from team mailboxes too, under the new email:forward permission. The user allows each address once, and can see and remove allowed addresses in Settings > Add-ons. A forward goes through the same checks and undo delay as a normal send
Plugins: api.ui.print prints a page the plugin made, such as a readable invoice, without scripts or network access. The UI kit has a Table for line items and totals, and admin settings of type string can ask for a multi-line box with multiline: true

Fixes

Mail: Archiving, moving or reporting the open message as spam returns to the list when "Return to list after delete, archive, move or mark unread" is on, in Mountain View too (#1458, thanks @cmess0822)
Mail: Archiving in unread first opens the next unread message instead of the first read one (#1453, thanks @ottsch)
Mail: Search results can be moved into the folder that is open (#1452, thanks @sandrobraendli)
Mail: A message sent from a shared mailbox uses that mailbox's identity for its From address, so the server no longer takes the envelope sender from one of your own identities (#1450, thanks @robinbohnen)
Mail: Mountain View no longer offers Reply on drafts and scheduled messages in a conversation (#1404)
Mail: Quick reply asks the same questions as the composer before sending: unfilled placeholders, a forgotten attachment and "Confirm before sending"
Mail: The delivery report of a bounce or read receipt no longer shows as an attachment chip in the list or goes along when the message is forwarded
Mail: The message list no longer jumps back while you scroll, the quick actions on the open message hide once the pointer leaves it, and a one-digit unread count stays next to the folder's total
Mail: When two accounts have the same name, the account switcher shows the address as the title
Themes: Unread mail stands out in Flat fields with a tint and a bar beside the avatar
Settings: The density sample leaves out the preview line while "Show preview text" is off, and the search filter panel's button says Search instead of Done
Sidebar: The gear and plus buttons in the header no longer run into the folder row below, and demo mode shows as a plain row instead of a tinted box
Accessibility: With reduce motion, menus open in place instead of flashing in the corner first
Plugins: Badges show on message rows drawn before the plugin started, and dev plugins whose dependencies only declare main or reach for Node built-ins now bundle
Server: npm start listens on the HOSTNAME and PORT from .env.local (#1441, thanks @garceri)
Demo: Replies sent in demo mode show in the conversation they answer, and the personal demo account has contact photos

`v1.19.0`

Compare Source

1.19.0 gives admins an Organisation area: signatures, disclaimers and template libraries per domain or group, external mail warnings, idle and session time limits, settings locked to a value, and one switch that stops all traffic to third-party services. On Stalwart 1.0, group mailboxes share tags and templates, a colleague can be made a delegate in one step, and mail deleted for good can be recovered from Stalwart's archive. A new Accessibility page in Settings has presets, text size and spacing, reading aids for mail and keyboard options, and the app was gone through with screen readers, the keyboard, contrast themes and large text. A usability pass made dialogs, menus, wording and phone layouts work the same way in Mail, Calendar, Contacts and Files, and added Undo for most mail actions, a Files trash and printing. Thai is a new language.

Thank you for your donations:

You? Become a sponsor!

One-time

@systemflair
@bultester
Anonymous
Anonymous
Anonymous

Monthly

Changes

Accessibility: Text size is now a share of the text size set in the browser, from 87.5% to 200%, instead of a fixed 14, 16 or 18 px, and small text everywhere follows it. The Animations switch is now Reduce motion, which follows the system unless you set it

Features

Organisation: The admin panel has an Organisation area where the user policy applies to everyone, a domain or a group. Admins can lock any setting to a chosen value or only preset it, accessibility options included, and export and import the whole policy as one file; an import names the locks and defaults it changes. Users see "Set by your organisation" next to a locked setting
Organisation: Admins can set an organisation signature with placeholders for each user's name, address, company, job title, department and phone numbers, per domain or group, and lock it so it replaces everyone's own signature. Users fill in their details once under Settings > Account. Lines whose details are empty are left out (#908, thanks @chutescarabee7)
Organisation: Admins can add a legal disclaimer that goes below every message when it is sent, never into drafts, and is shown read-only in the composer
Organisation: Admins can give every user a library of templates, per domain or group, that users pick under "Organisation" in the template picker and can copy but not change
Templates: On Stalwart 1.0, members of a group mailbox share team templates, and users' own templates are kept in their account so they follow them to every browser. Templates already in a browser move over on the first sign-in. Admins can lock team templates or leave users only the organisation and team templates
Tags: On Stalwart 1.0, members of a group mailbox see the same tag names and colors on its mail, in the list, the tag picker, the sidebar and the unified inbox. They edit them under Settings > Folders & tags, where tags already on the group's mail can be given a name. Admins can lock the list per domain or group, for example so only team leads change it (#470, #1310, thanks @andrei-miron and @HOLOEYE-JZ)
Organisation: Admins can label mail from outside the organisation with an "External" chip and have users confirm before sending to or inviting external recipients (composer, quick reply and meeting invitations), per domain or group. Partner domains and contacts count as internal. This replaces the External Mail Warning plugin, whose safe domains can be imported. Plugins can read api.host.features.externalSenderLabel and externalRecipientWarning
Organisation: Admins can sign users out after a time without activity or a fixed time after sign-in, per domain or group. A countdown with "Stay signed in" comes first, open and minimised messages and quick replies are saved as drafts, and the login page says why
Delegates: Settings > Sharing gives a colleague read, or read and write, access to all mail folders or just the Inbox, calendars and contacts in one step, lists who has access to what, and removes access everywhere at once. Admins can hide it per domain or group and limit every share dialog to read access on Organisation > Sharing
Recover deleted items: On Stalwart Enterprise with archiving turned on, users bring back mail they deleted for good under Settings > Recover deleted items, or from a link in Trash when there is something to recover. Restored mail goes back to the Inbox unread. Admins can limit how many days back it lists or hide it per domain or group (#1319, thanks @svandive)
Privacy: One switch, NO_THIRD_PARTY_TRAFFIC or Organisation > Security, stops every connection to services outside your own servers: telemetry, the version check, the built-in push relay, the official extension directory, sender icons, MyMemory translation, map links, OpenPGP key lookups and remote pictures in mail. Plugins that need network access don't run, and the page's CSP allows only the hosts you configured. Push registrations move to your own relay. The admin page lists what stays reachable (#903, thanks @rickgoud)
Team inbox: The new official Team inbox plugin lets members of a team mailbox assign messages to each other, mark them done, and filter by "Assigned to me" and "Open"
Plugins: Plugins can add keyword filters to the message list, shown as chips above it, put icons on row badges, show actions only in team mailboxes or for some keywords, change several keywords in one step, see the user's own account and which mailboxes are team mailboxes, and keep a small shared value in a team mailbox on Stalwart 1.0. Looking people up in the directory needs the new directory:read permission. Plugins can no longer set $draft, $junk, $notjunk or $phishing
Plugins: api.ui.openPage moves the tab to one of the plugin's own pages (#1406, thanks @HOLOEYE-JZ). A plugin's search result snippet can mark what matched (#1418, thanks @HOLOEYE-JZ), and the results block holds its place while a plugin is still searching (#1419, thanks @HOLOEYE-JZ)
Accessibility: Settings has an Accessibility page. Presets for screen readers, low vision, dyslexia, focus, keyboard and motor, motion and seizure safety, and deaf and hard of hearing users change several options at once and can be undone. Alt+Shift+A opens text size, contrast, motion and the presets from anywhere, and a button in the navigation bar can do the same
Accessibility: Text can use Atkinson Hyperlegible Next, Lexend or OpenDyslexic, with more line, letter, word and paragraph spacing. More contrast works on any theme, and transparency can be reduced, links underlined, the focus outline made thicker and the pointer made larger
Accessibility: Reading aids for mail: a reader view in the app's font, spacing and colours, read aloud with the browser's voice while highlighting what it reads, a reading mask that dims all but a band of lines, animated images paused behind a play button, HTML mail as plain text by default or per message, lines of about 80 characters, wide mail scaled down to the pane, HTML mail in the app's font and colours, and message bodies at the chosen text size
Accessibility: Calendar, tag and folder colours can use a colour-blind-safe palette, and names can show next to colours: a tag's letter in its dot and the calendar's name on events
Accessibility: Large targets make buttons, menu items, rows and switches 44 px. Simple mode shows one column and, if wanted, a paged message list. Submenus, previews and the rail peek can open only on click, and tags, filter rules, apps, accounts and Pro tabs can be reordered without dragging
Accessibility: Single-key shortcuts can be turned off. Every app has landmarks, a page heading, skip links and F6 to move between panes, and ? opens the keyboard shortcuts of the app you are in
Accessibility: Screen readers are told when a folder or search has loaded, how much new mail came, when a draft is saved and when the connection drops, and toasts are read out, errors assertively. Toasts stay while focused, Alt+Shift+N jumps to the newest, and the notification duration also covers undo toasts, errors and reminders. Visual alerts flash the tab title slowly, and plugin notifications stay off the desktop during do not disturb
Accessibility: Plain language gives simpler English and German wording for sign-in, errors and Settings. Technical terms in Settings and the admin area get short explanations that work with keyboard, touch and screen readers
Accessibility: Optional confirmations before deleting, archiving and sending, a prompt for alt text when an image goes into a message, an accessible example message in the template picker, and a default font and size for new messages
Admin: Links to an accessibility statement, a barrier report, help, Easy Read and sign language show on the login page, in the settings sidebar and in the account menu when set with ACCESSIBILITY_STATEMENT_URL, ACCESSIBILITY_FEEDBACK_URL, HELP_URL, EASY_READ_URL and SIGN_LANGUAGE_URL
Admin: OAUTH_REVOKE_ON_SIGN_OUT=false keeps the refresh token valid on sign-out, so Stalwart 1.0 keeps Bulwark in the user's connected applications and doesn't ask for consent again (#1388, thanks @Beckid)
Login: LOGIN_USERNAME_PLACEHOLDER sets the placeholder of the login email field (#1423, thanks @DerFolder)
Login: The SSO-only login page offers "Remember me", and the box decides for every single sign-on path (#1437, thanks @marketstead-dave)
Setup: The setup wizard shows in the browser's language, in all 29 languages
Mail: Ctrl+Z or z undoes the last mail actions, newest first, marking read or unread, stars and tags included. Delete to Trash, archive, move, spam report and remove from folder offer Undo in their toast, also after a move to another account and in lists that mix accounts
Mail: Scheduled messages can be cancelled back into Drafts and rescheduled in the Schedule send dialog. "This morning" and "This afternoon" are offered as schedule times while they are still ahead (#1390, thanks @PoltoS)
Mail: Before sending, Bulwark warns about unfilled placeholders such as [Your name], in every app language, and about unfinished text. The warning can be turned off
Mail: Attachments can be saved to Files from the message, from shared and group mailboxes too
Mail: The list header has a Sort menu and the folder's actions, and the filter panel is simpler, with on/off toggles, date and size ranges and every field in view
Mail: A click anywhere beside a row's avatar or checkbox ticks it (#1381, thanks @mmomjian)
Mail: A message whose sender check failed shows a warning shield instead of the sender icon
Composer: Quoted reply history collapses behind an ellipsis (#1405, thanks @pcatapan)
Composer: A recipient chip's menu moves it between To, Cc and Bcc, and the tag and template pickers can make a new tag or open the template manager
Command palette: Mail's commands (reply, archive, delete, move, read state, spam, go to a folder), Calendar's, Contacts' and Files' commands, plugin pages, account switching and "search everything" are in the palette. Apps can add their own commands
Print: Print or Ctrl+P prints a clean copy of the page instead of the app shell: the calendar's month, week, day, agenda, tasks and single events, and contact lists, contacts, groups and directory entries
Calendar: Events can be searched from the toolbar, with / and from the command palette
Calendar: Light event colours show events tinted with a colour bar, as in Outlook
Calendar: A cancellation mail offers to remove the cancelled meeting from the calendar (#1425, thanks @chutescarabee7)
Calendar: Dragging or resizing a repeating event asks which occurrences move, and the move can be undone. A single click on a month day or the all-day row opens the quick editor for an all-day event, and Shift+F10 opens an event's menu
Contacts: Address books and contact categories can be deleted in Settings, and contacts move with Move to…
Files: Deleted files go to a trash with Restore, Delete permanently and Empty trash. Files and folders move with Move to… and a folder picker, a folder downloads as a zip built in the browser with progress and cancel, and images and other files open in one preview with ←/→ to the next file
Files: With a document editor configured, "New file" also creates Word, Excel, PowerPoint, OpenDocument and (where the editor edits PDFs) PDF files and opens them in the editor. It offers the formats the editor can edit; admins can narrow the list with WOPI_NEW_FILE_FORMATS and add their own blank templates, or other formats, with WOPI_TEMPLATE_DIR (#1393, thanks @Monarobase)
Files: The Files settings sync with the other settings, with export, reset and a one-time move from this device
Phone: Every app's phone header has notifications, the command palette and the account avatar, and Contacts gets a create button and long-press menus like Mail and Files
i18n: Thai (#1379, thanks @phumiphat2201)

Performance

Mail: Shared accounts' folders load in batched, parallel requests instead of one request per account (#1409, thanks @truesysadmin)
Tags: Tag counts come from one Keyword/get on servers that count keywords (#1399, thanks @lucamzanon), and a hidden tab recounts once it is shown instead of on every push (#1400, thanks @lucamzanon)
Push: The keep-alive echo is skipped while the push stream is live (#1401, thanks @lucamzanon)

Fixes

Accessibility: Every form field, icon button and switch has a name screen readers read out, and password managers can fill the sign-in form. Dialogs, file previews, the document editor, the search palette and plugin dialogs keep the focus inside and give it back when they close
Accessibility: The message list is one Tab stop that screen readers read row by row. The calendar grid and mini calendar work with arrow keys and read events with their date, the contact and files lists move with the keyboard, and menus, grid cells and other roving-focus controls show the focus outline
Accessibility: Text contrast is at least 4.5:1 in every built-in theme, light and dark. Switches, selections and pressed buttons stay visible in Windows contrast themes, small controls have at least a 24 px target, and toasts move away from the focused control
Accessibility: With a large browser text size the message list stays visible next to the reader and cut-off labels wrap, Aurora Glass turns solid when transparency is reduced, and animations inside mail stop with reduce motion
Dialogs: Dialogs share one shell with the close button at the end, Escape, outside click and a discard prompt for typed changes, and their title stays in view while the content scrolls. The app's own dialogs replace browser prompts and confirm boxes, and leaving an editor or admin page with unsaved changes asks first, also on browser Back
Wording: The same action has the same word, icon and place across Mail, Calendar, Contacts, Files and Settings, labels use sentence case, delete prompts say what is lost, and German addresses you formally everywhere
Mail: A message has the same actions in its row menu, the reader's ⋮ and the phone panel. The selection bar has Archive, Report spam and a menu with the rest, the phone conversation view has Archive, Delete, Report spam, Mark as unread and Move, and a swipe archives or deletes a conversation row too
Mail: Delete follows the Delete action setting, archiving a conversation leaves your sent copy in Sent, Undo after Report spam puts the message back, and View source shows the message's real source
Mail: Clearing search filters keeps the open folder (#1430, thanks @creyD), system folder names are translated in advanced search (#1429, thanks @creyD), and a rule run on existing messages reads From, To and Cc conditions on Stalwart (#1424, thanks @creyD)
Mail: A dmarc pass no longer comes with a warning about failed checks (#1403, thanks @Fneufneu), a DKIM pass reported only by header.i counts (#1420, thanks @DerFolder), and invitations from users on your own domains aren't flagged as unverified (#1374, thanks @chlw)
Mail: Failed attachment downloads and partial or failed "Download all" say so (#1426, #1428, thanks @VasilisNtovolos), permanent bulk deletes that partly failed are reconciled (#1384, thanks @VasilisNtovolos), and the attachments of a previewed .eml preview too (#1395, thanks @lucamzanon)
Mail: Conversations show the scheduled status (#1359, thanks @arnauda-gh), folder counts update as soon as a send removes its draft (#1412, thanks @NobinKhan), and a mail sent right after a proxy outage goes out from the account's identity (#1377, thanks @kisaanu)
Mail: Attachment icons in the reader are coloured by file type like in the list, a mail's own overflow no longer adds a second scrollbar, and pushed notifications stay silent during do not disturb
Composer: A send no longer races the autosave (#1394, thanks @lucamzanon), a draft written in another client keeps its paragraph spacing (#1416, thanks @b3rsrk), the footer drops its labels when the composer is narrow (#1375, thanks @rgaliull), and the install card stays off the Send button and remembers "Not now" (#1411, thanks @NobinKhan)
Sign-in: The two-factor prompt shows as the next step instead of an error (#1422, thanks @DerFolder), password and two-factor settings show after a password and code sign-in (#1432, thanks @JamesJosephFinn), Lite on Stalwart no longer opens the browser's login dialog when the access token expired, uploads included (#1396, thanks @robinbohnen), and the account security docs open on bulwarkmail.org (#1387, thanks @DodoLeDev). Every app asks for a fresh two-factor code, not only Mail
Calendar: Default alerts get account-wide unique ids (#1435, thanks @rich0), a shared calendar shows the colour the server gives it (#1414, thanks @chodid), and one account's tasks stay out of another's task list (#1380, thanks @HOLOEYE-JZ)
Calendar: Week and day view fill with the visible hours and mark events that run past them, a saved event comes into view, short events open on click, and events you can't change offer no Edit, Delete, drag or resize
Contacts: Exports are valid vCard 4.0 (#1407, thanks @motofix), escaped colons in imported vCard notes are decoded (#1438, thanks @tacky6775), and a new or duplicated contact shows after saving
Files: Files list on Stalwart 1.0 when the account holds more nodes than one request returns (#1385, thanks @IchiganCS), and Back closes a preview or the document editor instead of leaving Files
Plugins: Full-height app pages fill the page (#1357, thanks @yontani), and search stops waiting for plugin results when it fails
Right-to-left: In Arabic, Hebrew and Persian, arrows, panels, drawers and the phone sidebar are mirrored, events sit on the right day, and senders, subjects and event titles keep their own text direction
Phone: Tour steps open the screen they point at, toasts sit above the bottom bars and can be swiped away, and calendar, contact and settings rows put their actions behind a ⋮ menu
Build: The production build's type check stays within 2 GB of memory (#1431, thanks @bagasme)
Demo: Switching demo accounts no longer crashes, and forwarding as attachment, export, view source and file previews work in the demo

`v1.18.0`

Compare Source

1.18.0 works with Stalwart 1.0, released today, as well as with 0.16. Sign-in, calendars, contacts, files and sending were adapted to what changed in 1.0, and a Stalwart that was moved from 0.16 to 1.0 with Stalwart's migration tool keeps working with the same open tabs. It also fixes the findings of a security review of the whole webmail, more places where an action in a view that mixes accounts could hit another account's message with the same id, and a series of calendar bugs around repeating events. Plugins can show their own search results and a count on their buttons, quick reply can be turned off, and a new device offers to restore your saved account list.

Thank you for your donations:

You? Become a sponsor!

One-time

@bultester
Anonymous
Anonymous
Anonymous
Anonymous

Monthly

Upgrading to Stalwart 1.0

After moving Stalwart to 1.0, run Auto-configure OAuth once on the admin Authentication page. It registers Bulwark with Stalwart as a first-party client. Without it, mail, contacts, calendars and files work, but the account security settings (password, two-factor, app passwords) are not available, and single sign-on through Stalwart needs the registered client
Stalwart 1.0 can't be installed over 0.16: its migration tool (stalwart-migrate) copies the data into a new store. Ids and sync state are kept, so Bulwark carries on without reloading anything, but OAuth tokens are not migrated: everyone who signed in with single sign-on, or with a password and a two-factor code, signs in again. Keep the server's public URL the same
Admin sessions are signed out once by this update, and they now also end when you sign out or change the admin password

Security

Plugins: /api/plugin-approval-status refuses plugin packages while user plugins, plugin uploads or their review are turned off. Any signed-in user could fill the admin's review queue and the data directory with packages (GHSA-qc44-275p-gqw9, thanks @oguzyilmaznet)
Sidebar apps: With COOKIE_SECURE=true, the unprefixed sidebar-app cookie is no longer trusted behind a TLS proxy that sends no X-Forwarded-Proto, so a sibling subdomain can't add origins to the page's frame-src (GHSA-cjm9-m826-mh78, thanks @oguzyilmaznet)
Sign-in: A stored credential that the mail server refused (password changed, app password revoked) is not sent again for an hour, and a global cap stops a loop of them, so a stale session can't get the webmail's address banned by Stalwart for every user. Server-side calls forward the client address (GHSA-g6c7-r7wq-xrm2, thanks @oguzyilmaznet)
Multi-account: More actions name both the login and the account. Removing a login whose folder was open, the Scheduled list, contacts in shared address books or another login, plugin moves, single-message archive and delete, the replied/forwarded flags, scheduled badges and Undo for a signed-out login could act on another account's message, contact or submission with the same id (GHSA-8x23-qw3w-mhrx)
Sign-in: On a server that reports a bare login name, a token sign-in could claim that name on any domain and reach the synced settings and stored plugin credentials of that address
Sign-in: A password and two-factor sign-in to a server you typed went to the default server when custom servers are allowed, and the password sign-in followed a mail server's redirect to another host with the password
Sign-in: A password and two-factor sign-in without "Remember me" ends with the browser session instead of staying signed in for 30 days
Mail: A link in a printed message can't redirect the webmail tab, links in conversation messages go through the same link check as the reader, a winmail.dat part whose type a browser would drop is downloaded instead of opened, and an unquoted cid: image no longer hides the rest of the message
Mail: Outlook-style replies (plugin) no longer load the quoted message's remote images
Calendar: Only a counter proposal from one of the meeting's participants can be applied to your meeting; anyone who knew its UID could propose a new time or place to all attendees
Admin: config.json, the admin password hash and the setup token are written readable only by the app's user, a synced settings file can no longer pass as an admin session, and the setup wizard refuses a session secret under 32 characters
Server: Request bodies over 10 MB are no longer buffered for every path before routing (only WebDAV uploads, the plugin proxy and office saves take more, and cap it themselves), answers from a mail server you picked are read up to a size limit, and the app files in the Docker image are read-only for the user it runs as
Dependencies: undici 7.30.1 (GHSA-xjj6-f33q-929c)

Features

Stalwart 1.0: Calendars, tasks, contact photos, files, free/busy, sending past Stalwart 1.0's submission limit, phrase search, and its rules for keywords, file names and time zones work on 1.0 as on 0.16. Bulwark Lite installs as a Stalwart 1.0 Application
Plugins: Plugins can show their own results in search and open the message a result names (#1336, #1338, thanks @HOLOEYE-JZ), and show a count on their buttons (#1345, thanks @HOLOEYE-JZ). email.get, email.getRaw and email.getAttachment take an optional account id, and summaries carry it
Accounts: A new device offers to restore the saved account list (#1363, thanks @lucamzanon)
Mail: Quick reply below messages can be turned off in Settings (#1370, thanks @maxhaomh)
Mountain View: The inbox splits into Unread and Everything else, and attachment and code chips look like Gmail's
Server: iCal subscriptions and other server-side fetches go through the outbound proxy when NODE_USE_ENV_PROXY=1 is set. Bulwark still checks the address itself and asks the proxy for exactly that address (#1367, thanks @Jan0oo)

Fixes

Sign-in: Password and two-factor sign-in, Bulwark Lite and phone pairing work on Stalwart 1.0, single sign-on asks for mail, contacts, calendar and file access there, and a background account signed in with OAuth renews its own token instead of the active account's (#989, thanks @Almost-Senseless-Coder)
Sign-in: Signing out of one login switches to the remaining one when it was signed in before the page loaded, instead of signing out of all, and an OAuth account that can't be restored has its refresh token cleared
Mail: Bulk archive in the unified inbox creates each account's Archive, and a group account's year and month archive folders are reused
Mail: The unified inbox shows new mail of a group or shared account and of another signed-in login without a click (#1350, thanks @ClapsAndJiggles), and message links open the message of the account they name (#1351, thanks @ClapsAndJiggles)
Mail: The list keeps loading older mail when the server sent no total (#1364, thanks @inceblog), inline images whose part name is a path show (#1371, #1373, thanks @motofix), and Outlook-style HTML quotes without a border are kept (#1355, thanks @maxhaomh)
Mail: Sent paragraphs keep the spacing the composer shows (#1340, thanks @arnauda-gh), replies to deeply nested quotes and mails full of blockquotes no longer freeze the page, and attachment names drop direction-override characters everywhere
Sending: "Send now" of a group identity's delayed mail no longer drops it back into Drafts, own and group scheduled mail stay apart, a send refused for some recipients says so, and a held reply from a Pro compose tab still marks the original as answered
Calendar: The open calendar updates and reminders fire on time when events change elsewhere (#1349, thanks @ClapsAndJiggles), events sit and resize at their clock time on DST change days (#1348, thanks @ClapsAndJiggles), a calendar added later follows the server's visibility (#1372, thanks @somus), a colour from the system colour dialog is applied (#1366, thanks @chodid), and hiding every calendar sticks
Calendar: Editing, moving, splitting and answering repeating events keeps their changed and cancelled occurrences, organizer and answers, and asks attendees again only when the time changes
Calendar: A subscribed feed's changes to events it still carries are applied, meeting replies are checked against the attendee who answers, exported events keep emoji and names with a colon, and the Calendar Agenda shows all-day events on their day west of the server
Contacts: Photos, UIDs and group members are kept on Stalwart 1.0, and a closed directory says so instead of reporting a failed refresh
Files: Folders and uploads work on Stalwart 1.0, symlinks show as links, shared folders sit under "Shared with me", and files copy between your drive and shared drives
Push: Mail in an account shared into another signed-in login gets its notification again, previews work when the webmail reaches Stalwart on an internal address, and two logins with the same account id get a plain notification instead of the wrong preview
Lite: A replayed deep link keeps its query parameters (#1352, thanks @ClapsAndJiggles)
Admin: The allowed frame ancestors saved in the dashboard reach the header, and setup.sh asks again for a pasted session secret under 32 characters
Accessibility: The rail's Mail entry is named "Mail" for screen readers, not its unread count
i18n: Missing Estonian strings and the quick reply setting are translated, and the German account-list restore prompt addresses you formally

calibrain/shelfmark (ghcr.io/calibrain/shelfmark-lite)

`v1.6.0`: : Tightening the Bolts

Compare Source

This one is mostly about the stuff you only notice when it goes wrong. Downloads that hang around instead of finishing, secrets that end up in a log line, a stuck coordinator that still reports healthy. There is one new feature, Jackett as a release source, and the rest is fixes, cleanup and dependency bumps.

New

Jackett is now a release source, next to Prowlarr. It searches Jackett's Torznab endpoints (the all aggregate, or the indexers you pick) and uses the same torrent client settings you already have. Thanks @amura11 (#1521)

Downloads that finish when they should

A finished torrent in the wrong directory is handed on instead of waiting out the whole timeout (#1573)
qBittorrent 5's stopped states and forced metadata downloads are understood now (#1570), and a torrent is only imported once every listed file is on disk (#1577)
A change in a torrent's swarm note no longer resets the stall timer (#1572)
Retrying a download takes the URL from the release cache only (#1597), and a provider named alongside a source gets the record policy applied (#1598)
slskd gets one more try when it answers a batch enqueue with a 500 (#1590)
Webshare clears the "Resolving" status once the download starts. Thanks @misko903 (#1575)
The seed settings only show for qBittorrent, the one client they apply to (#1574)

Louder when something breaks, quieter about what it knows

/api/health now reports a stopped download coordinator and returns 503, so the container shows unhealthy instead of everything sitting at "Queued" forever (#1568)
Credentials, tokens and links are kept out of logs, status messages and error responses, with one shared module doing the masking (#1571, #1578, #1593, #1562)
The OIDC login shows the issuer guidance when the provider's claims are rejected (#1603)

Smaller fixes

A library match works on the full title when the search title is only the series (#1587)
Notification routes explain what applies on a user's own page (#1588), and the table row keys are simpler. Thanks @joshft91 (#1583)
A book requested from a Hardcover search card keeps its series, so the {Series} folder and custom script payload are no longer empty. Thanks @joeRob2468 for tracing it (#1589)
The Hardcover scheduler survives an unreadable interval and shares one history connection per sync (#1569)

The image

Chromium is now 156.0.8078.73 (#1601, #1614)
The unused selenium-manager binaries are no longer shipped (#1615)
Python 3.14.9 and a round of Python, npm and GitHub Actions dependency bumps

Under the hood and docs

The stats, onboarding and settings routes moved out of main.py into their own modules, with no change in behaviour (#1563, #1594, #1595)
The supported formats list has one lookup instead of several copies (#1576)
The docs were checked against the code and brought up to date: the readme feature lists, the environment variable reference, and the plugin guides (#1564, #1565, #1566, #1567)

Full Changelog: https://github.com/calibrain/shelfmark/compare/v1.5.1...v1.6.0

coder/coder (ghcr.io/coder/coder)

`v2.38.5`

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

Confine read_skill_file reads to the skill directory (#31462, cc97c21)
Database: Lock the workspaces row when claiming a prebuild (#31518, 97b58bc) (@dylanhuff-at-coder)

Compare: v2.38.4...v2.38.5

Container image

docker pull ghcr.io/coder/coder:v2.38.5

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

`v2.38.4`

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

fix(scripts/release): promote stable on immutable releases (#30745, 5f7f094)
Documentation: Refresh release calendar and install versions for the 2026-10-19 patches (release/2.38) (#31035, 63d102d)
Server: Bound push response body read and add client timeout (#31129, a7bd712)
fix(scripts/releaser): use the v-prefixed image tag in release notes (#31032, 9654866)
Keep new API keys within the caller's scopes and allow list (#30256, 3ee54b4)
Allow fixing stale parameters when the active version is required (#30660, 5ed6bd7)
Bump coder/tailscale to bound DERP dup client sendHistory (#31248, 1df049b) (@dylanhuff-at-coder)
Require SSH permission to fetch external agent credentials (#31388, d16b1ca) (@dylanhuff-at-coder)

Compare: v2.38.3...v2.38.4

Container image

docker pull ghcr.io/coder/coder:v2.38.4

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

`v2.38.3`

Compare Source

Changelog

[!NOTE]
This is a mainline Coder release. We advise enterprise customers without a staging environment to install our latest stable release while we refine this version. Learn more about our Release Schedule.

Bug fixes

Bump Go to 1.26.10 and terraform to 1.16.7 (backport 2.38) (#31302, 5bb296e)

Tests

Server: Renew the expired TLS test certificate (#30922, fd5da16)

Chores

Bump github.com/andybalholm/brotli to v1.2.7 (#31231, 8c9d948) (@Shelnutt2)

Compare: v2.38.2...v2.38.3

Container image

docker pull ghcr.io/coder/coder:2.38.3

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

matrix-org/matrix-hookshot (ghcr.io/matrix-org/matrix-hookshot)

`v7.6.0`

Compare Source

Features

Serve the compiled OpenProject element-web module in docker under /modules/v1/static/openproject.js. (#1399)

Bugfixes

Fix integrations tests failing to due an improper test setup. (#1404)

Internal Changes

Update matrix-bot-sdk / matrix-appservice-bridge to latest versions. (#1370)
Support Node 26, and drop support for Node 22. (#1370)
Refactor the OpenProject element-web plugin module to use the MVVM pattern. (#1402)
Refactor the OpenProject element-web plugin module to use CSS instead of the styled components package. (#1405)
Update rustls-webpki and webpki-root-certs to stop trusting compromised eMudhra intermediate certificates (RUSTSEC-2026-0382, RUSTSEC-2026-0383). (#1441)
Update the base Node.js images to address the following high/medium/low CVE's CVE-2026-105482,
CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074,
CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073.

recyclarr/recyclarr (ghcr.io/recyclarr/recyclarr)

`v8.8.1`

Compare Source

Fixed

Sync: Every Radarr sync failed when Radarr 7 uses OIDC login. Sync also no longer fails when
Sonarr or Radarr reports a setting value that Recyclarr does not know yet
Sync: When Sonarr or Radarr sends a reply Recyclarr cannot read, the error now says what failed
instead of showing only HTTP 200
Sync: On Sonarr v5, the progress table kept showing a spinner for quality sizes after sync
finished, and failed syncs could be reported as successful in notifications

bpg/terraform-provider-proxmox (proxmox)

`v0.119.0`

Compare Source

⚠ BREAKING CHANGES

vm: reject file ids and disk serials that proxmox can't parse (#3234)
ceph: fix pool import by moving storages to proxmox_storage_rbd (#3204)

Bug Fixes

backup: read exclude-path returned as a json array (#3225) (aff2785)
ceph: fix pool import by moving storages to proxmox_storage_rbd (#3204) (41be0a0)
core: keep the exit status in ssh command errors (#3231) (900a296)
file: set file mode and check upload size with sudo ssh users (#3228) (cc3039f)
file: skip the URL metadata query when file_name is set (#3227) (0bccbd1)
vm: reject file ids and disk serials that proxmox can't parse (#3234) (429e833)

Miscellaneous

deps: update image golang (9048d5e → 2920bb1) (#3232) (93430ca)
deps: update module golang.org/x/net (v0.61.0 → v0.62.0) (#3233) (0303c23)

TwiN/gatus (twinproduction/gatus)

`v5.38.0`

Compare Source

What's Changed

feat(alerting): add Resend alerting provider by @geffersonFerraz in #1830
fix(maintenance): validate maintenance windows for external, DNS and SSH endpoints by @anandghegde in #1804
fix(alerting): Redact telegram token from errors on send failure by @hippi345 in #1843
fix(websocket): apply the client timeout to reads and writes by @somaz94 in #1845
fix(ssh): support keyboard-interactive authentication for endpoints and tunnels by @peckto in #1863
fix(security): add comprehensive logging and diagnostics for OIDC (#1802) by @tech00exploere in #1862
fix(jsonpath): support object keys containing dots via quoted accessors by @leotemtem in #1864
fix: Honor minimum-reminder-interval for external endpoints by @yzxcj797 in #1773
chore(alerting): restyle matrix alerts with errors, safe links and escaping by @mazzz1y in #1875

New Contributors

@anandghegde made their first contribution in #1804
@yzxcj797 made their first contribution in #1773
@hippi345 made their first contribution in #1843
@geffersonFerraz made their first contribution in #1830
@somaz94 made their first contribution in #1845
@peckto made their first contribution in #1863
@tech00exploere made their first contribution in #1862
@leotemtem made their first contribution in #1864
@mazzz1y made their first contribution in #1875

Full Changelog: https://github.com/TwiN/gatus/compare/v5.37.0...v5.38.0

element-hq/element-web (vectorim/element-web)

`v1.12.33`

Compare Source

✨ Features

Copy changes for "set up recovery" (#35437). Contributed by @richvdh.
Fix calls respawning from error screen on room switch. (#35470). Contributed by @toger5.
Split ChangeRecoveryKeyBody out of ChangeRecoveryKey (#35403). Contributed by @kaylendog.
Use a dialog to prompt the user about their recovery key when logging out (#35398). Contributed by @kaylendog.
Remove introductory screen from "create recovery key" flow (#35451). Contributed by @richvdh.
Don't allow to skip device verification by default (#35364). Contributed by @mxandreas.
Remodel "Can't confirm" dialog to match designs (#35375). Contributed by @andybalaam.
Drop support for migrating libolm sessions (#35138). Contributed by @Half-Shot.
Update Pill and PillInput design (#35370). Contributed by @florianduros.
Offer 'Sign out' on the identity reset page if there is no other option (#35307). Contributed by @andybalaam.
Put user status below the avatar (#35328). Contributed by @dbkr.

🐛 Bug Fixes

Update Electron to pick up patches (#35573). Contributed by @t3chguy.
Expand the device wildcard when a widget sends an encrypted to-device message (#35183). Contributed by @ara4n.
Keep opening voice-only calls in PiP when the lobby is skipped (#35495). Contributed by @Johennes.
Fix /spoiler command not converting markdown to HTML (#35103). Contributed by @jasonjose007.
Open a call that is already in progress maximised, even for voice (#35443). Contributed by @ara4n.
Fix guest login in oidc flow (#35432). Contributed by @florianduros.
Avoid unhandled promise rejection from CallStore.onReady() (#34861). Contributed by @hughns.
Add border around user profile avatar (#35460). Contributed by @dbkr.
Fix PiP drag bar when displaying over widgets (#35395). Contributed by @mgcm.
Feed thread replies to widgets (#35444). Contributed by @ara4n.
Ensure 'Can't confirm?' is primary only if no other options are available (#35406). Contributed by @andybalaam.
Fix restricted guest module showing excluded UI elements (#35412). Contributed by @florianduros.
Update compound-web to 10.3.1 (#35390). Contributed by @dbkr.
Run DeviceListener rechecks one at a time (#35053). Contributed by @langleyd.
Keep the new timeline at the bottom when its viewport changes height (#35374). Contributed by @langleyd.
Stop writing removed legacy mention rules from the Labs notification settings (#35035). Contributed by @barodeur.
Ellipsise long names in widget picture-in-picture view (#35329). Contributed by @robintown.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

Branch creation
- "after 10pm every weekday,every weekend,before 7am every weekday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [binwiederhier/ntfy](https://ntfy.sh/) ([source](https://github.com/binwiederhier/ntfy)) | | minor | `v2.34.0` → `v2.35.0` | | [docker.io/pgsty/silo](https://silo.pgsty.com) ([source](https://github.com/pgsty/silo)) | | patch | `RELEASE.2026-10-18T00-00-00Z` → `RELEASE.2026-10-26T00-00-00Z` | | ghcr.io/alexta69/metube | | patch | `2026.10.25` → `2026.10.27` | | ghcr.io/bookorbit/bookorbit | | minor | `3.5.0` → `3.6.0` | | [ghcr.io/bulwarkmail/webmail](https://github.com/bulwarkmail/webmail) | | minor | `1.17.2` → `1.19.1` | | [ghcr.io/calibrain/shelfmark-lite](https://github.com/calibrain/shelfmark) | | minor | `v1.5.1` → `v1.6.0` | | [ghcr.io/coder/coder](https://github.com/coder/coder) | | patch | `v2.38.2` → `v2.38.5` | | ghcr.io/mastodon/mastodon | | patch | `v4.7.3` → `v4.7.4` | | [ghcr.io/matrix-org/matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) | | minor | `7.5.0` → `7.6.0` | | [ghcr.io/recyclarr/recyclarr](https://github.com/recyclarr/recyclarr) | | patch | `8.8.0` → `8.8.1` | | hoppscotch/hoppscotch-frontend | | minor | `2026.9.0` → `2026.10.0` | | [plexinc/pms-docker](https://github.com/plexinc/plex-media-server-deploy) ([source](https://github.com/plexinc/pms-docker)) | | patch | `1.43.5.11029-6bf8af3f0` → `1.43.5.11079-b3b13e506` | | [proxmox](https://registry.terraform.io/providers/bpg/proxmox) ([source](https://github.com/bpg/terraform-provider-proxmox)) | required_provider | minor | `~> 0.118` → `~> 0.119` | | [sealed-secrets](https://github.com/bitnami/sealed-secrets) | | minor | `2.20.0` → `2.22.0` | | [searxng/searxng](https://searxng.org) ([source](https://github.com/searxng/searxng)) | | patch | `2026.10.25-54ca1d9cf` → `2026.10.30-ffa88e3ba` | | [twinproduction/gatus](https://github.com/TwiN/gatus) | | minor | `v5.37.0` → `v5.38.0` | | [vectorim/element-web](https://github.com/element-hq/element-web) | | patch | `v1.12.32` → `v1.12.33` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/15) for more information. --- ### Release Notes <details> <summary>binwiederhier/ntfy</summary> ### [`v2.35.0`](https://github.com/binwiederhier/ntfy/releases/tag/v2.35.0) [Compare Source](https://github.com/binwiederhier/ntfy/compare/v2.34.0...v2.35.0) This release keeps what a user already spent when their tier changes, and makes a tier's daily email limit a hard cap. It also fixes intermittent 403s under concurrent requests from the same IP, and the Matrix push gateway storing messages under a protected topic on SQLite. **Security:** - Reject Matrix push gateway requests whose push key does not name a valid topic. Publishing strips NUL bytes and invalid UTF-8 from the topic after authorization, so an anonymous push key like `/sec%00ret` was authorized against an unmatched topic and then stored under the protected topic `secret` (SQLite only; on PostgreSQL the request was denied; thanks to [Efe Çam](https://github.com/the-arma-of-owl) for reporting) **Features:** - A tier change (an upgrade, a downgrade, or a tier edited in place) applies on the user's next request and keeps what was already spent; before, it refilled the request, email and attachment bandwidth limits ([#2104](https://github.com/binwiederhier/ntfy/pull/2104), [#2105](https://github.com/binwiederhier/ntfy/pull/2105)) - A tier's daily email limit is a hard cap; before, the tier's email burst came on top of it, so a user could send more emails a day than the tier allows **Bug fixes + maintenance:** - Fix intermittent 403s and panics in the account handlers under concurrent requests from the same IP: a login or logout could change the user under another request, so a request with valid credentials was treated as anonymous, or the other way around. Every request now gets its own visitor ([#1051](https://github.com/binwiederhier/ntfy/issues/1051), [#2113](https://github.com/binwiederhier/ntfy/issues/2113), [#2118](https://github.com/binwiederhier/ntfy/pull/2118), thanks to [@ivanetinajero](https://github.com/ivanetinajero) for reporting) - A tier with a daily email limit of zero sends no emails; before, it could still send the server's email burst (`visitor-email-limit-burst`) - An attachment upload rejected at a size limit is no longer charged to the attachment bandwidth limit for the part that went over - Rate limits live in one shared limit service, keyed by `ip:<prefix>` or `user:<id>`, instead of in each visitor, which uses less memory per visitor and takes a global lock off the request path - Accept terabyte units (e.g. `1T`) in size settings such as attachment and tier limits, matching how sizes are displayed ([#2078](https://github.com/binwiederhier/ntfy/pull/2078), thanks to [@cangen185-sudo](https://github.com/cangen185-sudo) for the contribution) </details> <details> <summary>pgsty/silo (docker.io/pgsty/silo)</summary> ### [`vRELEASE.2026-10-26T00-00-00Z`](https://github.com/pgsty/silo/blob/HEAD/CHANGELOG.md#RELEASE2026-10-26T00-00-00Z) [Compare Source](https://github.com/pgsty/silo/compare/RELEASE.2026-10-18T00-00-00Z...RELEASE.2026-10-26T00-00-00Z) Package version: `20261026000000.0.0`; published from source `c3ad836aed0d`. Artifacts are listed in the [GitHub release](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-10-26T00-00-00Z). The coordinated [English release notes](https://silo.pgsty.com/blog/release/silo-20261026/) and [Chinese release notes](https://silo.pgsty.com/zh/blog/release/silo-20261026/) cover all components, upgrade guidance, and validation scope. - Fix LDAP login for long normalized DNs without hiding unreadable IAM revocation records. Only length errors for valid keys with an ASCII path component over 255 bytes are treated as absent; long-DN writes still fail. Thanks to [@910patin](https://github.com/910patin) for the original fix and reproduction in [#250](https://github.com/pgsty/silo/pull/250). - Build the server and standalone debugging tools with Go 1.27.3 and refresh Go dependencies, including silo-pkg v3.15.2, mcli [`2026102`](https://github.com/pgsty/silo/commit/20261026) and upstream minio-go `320af050c445` for multipart, read/seek, batch-delete and bucket-replication removal fixes. Retain output-format and NetBSD compatibility selections. - Embed Console v2.5.1 source `fff1618d9abb`, including its GUI update, diagnostic WebSocket closing handshake, complete health-report decoding, group-membership preservation, OIDC group permissions, TLS-proxy session cookies, credential exports and accessibility fixes. - Bundle mcli [`2026102`](https://github.com/pgsty/silo/commit/20261026) in container builds, the verified client installer and Helm client jobs. Include client identity isolation, resync status and rate fixes, and bounded batch-status fallback. Scripts must handle the additive batch `pending` state and nonzero exits for partial resync mutations. - Read current bucket inventory in account-info responses so Console refreshes immediately reflect successful creation and deletion. This management endpoint now performs a live list instead of returning a cached inventory. - Restore the native built-in policy immediately after resetting an override. Peer and etcd notifications reload committed state, so delayed delete events preserve subsequent edits. Keep deletion revisions, policy-in-use checks and custom-policy deletion behavior; storage failures retain the previous policy. - Reload policies without holding the authentication-cache lock, retain IAM write ordering and publish replacements only after a complete successful load. Propagate cancellation through IAM/KMS and SSE-S3 decryption without shortening the caller's policy-query deadline. - Preserve authoritative copies when a multi-pool delete or bulk cleanup fails, choose an available pool for a new delete marker, and keep tier data referenced by surviving copies. This does not introduce strict cross-pool read recovery. - Preserve remote tier data when lifecycle expiry only adds a delete marker, including non-null versions in suspended buckets. Forward `FULL_OBJECT` checksum type for multipart replicas. Thanks to [@botdeniska](https://github.com/botdeniska) for these lifecycle, replication and multi-pool deletion contributions. - Preserve Kafka's default broker protocol 2.1 and terminal-width behavior; fix legacy DARE v1 key unsealing and verify DARE v1/v2 and MinKMS TLS compatibility. - Forward storage RPC delete options, including the previous data directory needed by overwrite rollback. Preserve existing drive/RPC timeouts, request cancellation, object locking, read-quorum and healing behavior. - Update bundled curl to 8.23.0 and require patched static libraries. Apply [Red Hat's compromised-CA mitigation](https://access.redhat.com/security/vulnerabilities/RHSB-2026-012); the root blocklist also rejects legitimate chains under the affected roots. - Ship Windows platform archives as ZIP; Linux and macOS retain tar.gz. Storage timeouts retain their existing meaning: a returned timeout does not prove that the underlying disk operation stopped or that a write did not commit. Late commits or delayed rollback can affect newer writes; stale reads remain possible after partial failures, lease loss or network partitions. This release does not provide distributed fencing or repair previously inconsistent objects. These source changes are not included in the published [`2026101`](https://github.com/pgsty/silo/commit/20261018) artifacts. </details> <details> <summary>bulwarkmail/webmail (ghcr.io/bulwarkmail/webmail)</summary> ### [`v1.19.1`](https://github.com/bulwarkmail/webmail/blob/HEAD/CHANGELOG.md#1191-2026-10-31) [Compare Source](https://github.com/bulwarkmail/webmail/compare/1.19.0...1.19.1) 1.19.1 shows a card above booking, shipping and order mail, with the times, tracking and status that matter, and can put a booking in the calendar and keep it up to date. Mail that passes DMARC shows the sender's BIMI logo as its icon. Archiving, moving and reporting spam from an open message now follow "Return to list", archiving in unread first opens the next unread message, and a shared mailbox sends through its own identity. Plugins can forward a message to an address the user allowed and print a page they made, and new mail plays the Involved sound by default. Thank you for your donations: - *You? [Become a sponsor!](https://github.com/sponsors/bulwarkmail)* **One-time** - [@systemflair](https://github.com/systemflair) - [@bultester](https://github.com/bultester) - Anonymous - Anonymous - Anonymous **Monthly** - [@Focus-On-Agency](https://github.com/Focus-On-Agency) - Anonymous - [@superspacehosting](https://github.com/superspacehosting) - [@naokton](https://github.com/naokton) - [@yerTools](https://github.com/yerTools) - [@jsaathof](https://github.com/jsaathof) - [@berkersal](https://github.com/berkersal) - [@NABarnes](https://github.com/NABarnes) - [@felixzieger](https://github.com/felixzieger) - [@pr0ton11](https://github.com/pr0ton11) - [@fpauser](https://github.com/fpauser) - [@proxforge](https://github.com/proxforge) - [@spss20](https://github.com/spss20) - [@elgringoYan](https://github.com/elgringoYan) - [@pauladams8](https://github.com/pauladams8) - [@djpriest](https://github.com/djpriest) - [@umakers](https://github.com/umakers) - [@zplizzi](https://github.com/zplizzi) - [@jeremiah](https://github.com/jeremiah) - [@Theoretisch1337](https://github.com/Theoretisch1337) - [@svandive](https://github.com/svandive) - [@HiltMundell](https://github.com/HiltMundell) ##### Changes - **Notifications**: New mail plays the Involved sound by default instead of the beep. If you never picked a sound you get Involved too; a sound you chose stays - **Appearance**: List rows are no longer tinted with their first tag's colour by default. If you turned "Tint list rows by tag color" on yourself it stays on ##### Features - **Mail**: Booking, shipping and order mail that carries schema.org markup gets a card above the message: route and local times for flights, trains and buses, check-in and check-out for hotels, rental cars, events and restaurants, tracking for parcels and status for orders, with copy buttons and links that show where they lead. Flights, hotels and the other bookings can be added to a calendar you pick; a later mail about the same booking offers to update the event and a cancellation to remove it. Apple Wallet boarding passes and event tickets attached to a mail give the same cards. Cards appear only when the receiving server verified the sender's domain, never for forwarded mail, and everything is read in the browser without contacting airlines or carriers. Admins can turn them off under Policy - **Mail**: Mail that passes DMARC for its From domain shows the sender's BIMI logo as the sender icon, with a check mark beside the name when a Verified Mark or Common Mark Certificate backs it. Bulwark checks the record and the certificate itself, since Stalwart doesn't do BIMI. A contact photo still comes first, and logos follow the sender icons setting and stay off when third-party traffic is turned off. Admins can limit logos to certificate-backed ones with "Require a mark certificate" or `BIMI_REQUIRE_CERTIFICATE` - **Mail**: Expanded message headers in Mountain View have Reply all next to Reply ([#1404](https://github.com/bulwarkmail/webmail/issues/1404), thanks [@pcatapan](https://github.com/pcatapan)) - **Accessibility**: Each preset on the Accessibility page shows a small picture of what it changes - **Admin**: On Stalwart 1.0, Auto-configure OAuth also registers a client for Bulwark Mobile, so the app signs in as a first-party client and gets the account security settings ([#1459](https://github.com/bulwarkmail/webmail/issues/1459), thanks [@Chaoskjell44](https://github.com/Chaoskjell44)) - **Admin**: The marketplace shows the changelog of every version an update brings, not only the newest, and a rollback lists what it undoes - **Plugins**: `api.email.forward` forwards a message with its attachments, from team mailboxes too, under the new `email:forward` permission. The user allows each address once, and can see and remove allowed addresses in Settings > Add-ons. A forward goes through the same checks and undo delay as a normal send - **Plugins**: `api.ui.print` prints a page the plugin made, such as a readable invoice, without scripts or network access. The UI kit has a `Table` for line items and totals, and admin settings of type string can ask for a multi-line box with `multiline: true` ##### Fixes - **Mail**: Archiving, moving or reporting the open message as spam returns to the list when "Return to list after delete, archive, move or mark unread" is on, in Mountain View too ([#1458](https://github.com/bulwarkmail/webmail/issues/1458), thanks [@cmess0822](https://github.com/cmess0822)) - **Mail**: Archiving in unread first opens the next unread message instead of the first read one ([#1453](https://github.com/bulwarkmail/webmail/issues/1453), thanks [@ottsch](https://github.com/ottsch)) - **Mail**: Search results can be moved into the folder that is open ([#1452](https://github.com/bulwarkmail/webmail/issues/1452), thanks [@sandrobraendli](https://github.com/sandrobraendli)) - **Mail**: A message sent from a shared mailbox uses that mailbox's identity for its From address, so the server no longer takes the envelope sender from one of your own identities ([#1450](https://github.com/bulwarkmail/webmail/issues/1450), thanks [@robinbohnen](https://github.com/robinbohnen)) - **Mail**: Mountain View no longer offers Reply on drafts and scheduled messages in a conversation ([#1404](https://github.com/bulwarkmail/webmail/issues/1404)) - **Mail**: Quick reply asks the same questions as the composer before sending: unfilled placeholders, a forgotten attachment and "Confirm before sending" - **Mail**: The delivery report of a bounce or read receipt no longer shows as an attachment chip in the list or goes along when the message is forwarded - **Mail**: The message list no longer jumps back while you scroll, the quick actions on the open message hide once the pointer leaves it, and a one-digit unread count stays next to the folder's total - **Mail**: When two accounts have the same name, the account switcher shows the address as the title - **Themes**: Unread mail stands out in Flat fields with a tint and a bar beside the avatar - **Settings**: The density sample leaves out the preview line while "Show preview text" is off, and the search filter panel's button says Search instead of Done - **Sidebar**: The gear and plus buttons in the header no longer run into the folder row below, and demo mode shows as a plain row instead of a tinted box - **Accessibility**: With reduce motion, menus open in place instead of flashing in the corner first - **Plugins**: Badges show on message rows drawn before the plugin started, and dev plugins whose dependencies only declare `main` or reach for Node built-ins now bundle - **Server**: `npm start` listens on the `HOSTNAME` and `PORT` from `.env.local` ([#1441](https://github.com/bulwarkmail/webmail/issues/1441), thanks [@garceri](https://github.com/garceri)) - **Demo**: Replies sent in demo mode show in the conversation they answer, and the personal demo account has contact photos ### [`v1.19.0`](https://github.com/bulwarkmail/webmail/blob/HEAD/CHANGELOG.md#1190-2026-10-29) [Compare Source](https://github.com/bulwarkmail/webmail/compare/1.18.0...1.19.0) 1.19.0 gives admins an Organisation area: signatures, disclaimers and template libraries per domain or group, external mail warnings, idle and session time limits, settings locked to a value, and one switch that stops all traffic to third-party services. On Stalwart 1.0, group mailboxes share tags and templates, a colleague can be made a delegate in one step, and mail deleted for good can be recovered from Stalwart's archive. A new Accessibility page in Settings has presets, text size and spacing, reading aids for mail and keyboard options, and the app was gone through with screen readers, the keyboard, contrast themes and large text. A usability pass made dialogs, menus, wording and phone layouts work the same way in Mail, Calendar, Contacts and Files, and added Undo for most mail actions, a Files trash and printing. Thai is a new language. Thank you for your donations: - *You? [Become a sponsor!](https://github.com/sponsors/bulwarkmail)* **One-time** - [@systemflair](https://github.com/systemflair) - [@bultester](https://github.com/bultester) - Anonymous - Anonymous - Anonymous **Monthly** - [@Focus-On-Agency](https://github.com/Focus-On-Agency) - Anonymous - [@superspacehosting](https://github.com/superspacehosting) - [@naokton](https://github.com/naokton) - [@yerTools](https://github.com/yerTools) - [@jsaathof](https://github.com/jsaathof) - [@berkersal](https://github.com/berkersal) - [@NABarnes](https://github.com/NABarnes) - [@felixzieger](https://github.com/felixzieger) - [@pr0ton11](https://github.com/pr0ton11) - [@fpauser](https://github.com/fpauser) - [@proxforge](https://github.com/proxforge) - [@spss20](https://github.com/spss20) - [@elgringoYan](https://github.com/elgringoYan) - [@pauladams8](https://github.com/pauladams8) - [@djpriest](https://github.com/djpriest) - [@umakers](https://github.com/umakers) - [@zplizzi](https://github.com/zplizzi) - [@jeremiah](https://github.com/jeremiah) - [@Theoretisch1337](https://github.com/Theoretisch1337) - [@svandive](https://github.com/svandive) - [@HiltMundell](https://github.com/HiltMundell) ##### Changes - **Accessibility**: Text size is now a share of the text size set in the browser, from 87.5% to 200%, instead of a fixed 14, 16 or 18 px, and small text everywhere follows it. The Animations switch is now Reduce motion, which follows the system unless you set it ##### Features - **Organisation**: The admin panel has an Organisation area where the user policy applies to everyone, a domain or a group. Admins can lock any setting to a chosen value or only preset it, accessibility options included, and export and import the whole policy as one file; an import names the locks and defaults it changes. Users see "Set by your organisation" next to a locked setting - **Organisation**: Admins can set an organisation signature with placeholders for each user's name, address, company, job title, department and phone numbers, per domain or group, and lock it so it replaces everyone's own signature. Users fill in their details once under Settings > Account. Lines whose details are empty are left out ([#908](https://github.com/bulwarkmail/webmail/issues/908), thanks [@chutescarabee7](https://github.com/chutescarabee7)) - **Organisation**: Admins can add a legal disclaimer that goes below every message when it is sent, never into drafts, and is shown read-only in the composer - **Organisation**: Admins can give every user a library of templates, per domain or group, that users pick under "Organisation" in the template picker and can copy but not change - **Templates**: On Stalwart 1.0, members of a group mailbox share team templates, and users' own templates are kept in their account so they follow them to every browser. Templates already in a browser move over on the first sign-in. Admins can lock team templates or leave users only the organisation and team templates - **Tags**: On Stalwart 1.0, members of a group mailbox see the same tag names and colors on its mail, in the list, the tag picker, the sidebar and the unified inbox. They edit them under Settings > Folders & tags, where tags already on the group's mail can be given a name. Admins can lock the list per domain or group, for example so only team leads change it ([#470](https://github.com/bulwarkmail/webmail/issues/470), [#1310](https://github.com/bulwarkmail/webmail/issues/1310), thanks [@andrei-miron](https://github.com/andrei-miron) and [@HOLOEYE-JZ](https://github.com/HOLOEYE-JZ)) - **Organisation**: Admins can label mail from outside the organisation with an "External" chip and have users confirm before sending to or inviting external recipients (composer, quick reply and meeting invitations), per domain or group. Partner domains and contacts count as internal. This replaces the External Mail Warning plugin, whose safe domains can be imported. Plugins can read `api.host.features.externalSenderLabel` and `externalRecipientWarning` - **Organisation**: Admins can sign users out after a time without activity or a fixed time after sign-in, per domain or group. A countdown with "Stay signed in" comes first, open and minimised messages and quick replies are saved as drafts, and the login page says why - **Delegates**: Settings > Sharing gives a colleague read, or read and write, access to all mail folders or just the Inbox, calendars and contacts in one step, lists who has access to what, and removes access everywhere at once. Admins can hide it per domain or group and limit every share dialog to read access on Organisation > Sharing - **Recover deleted items**: On Stalwart Enterprise with archiving turned on, users bring back mail they deleted for good under Settings > Recover deleted items, or from a link in Trash when there is something to recover. Restored mail goes back to the Inbox unread. Admins can limit how many days back it lists or hide it per domain or group ([#1319](https://github.com/bulwarkmail/webmail/issues/1319), thanks [@svandive](https://github.com/svandive)) - **Privacy**: One switch, `NO_THIRD_PARTY_TRAFFIC` or Organisation > Security, stops every connection to services outside your own servers: telemetry, the version check, the built-in push relay, the official extension directory, sender icons, MyMemory translation, map links, OpenPGP key lookups and remote pictures in mail. Plugins that need network access don't run, and the page's CSP allows only the hosts you configured. Push registrations move to your own relay. The admin page lists what stays reachable ([#903](https://github.com/bulwarkmail/webmail/issues/903), thanks [@rickgoud](https://github.com/rickgoud)) - **Team inbox**: The new official Team inbox plugin lets members of a team mailbox assign messages to each other, mark them done, and filter by "Assigned to me" and "Open" - **Plugins**: Plugins can add keyword filters to the message list, shown as chips above it, put icons on row badges, show actions only in team mailboxes or for some keywords, change several keywords in one step, see the user's own account and which mailboxes are team mailboxes, and keep a small shared value in a team mailbox on Stalwart 1.0. Looking people up in the directory needs the new `directory:read` permission. Plugins can no longer set `$draft`, `$junk`, `$notjunk` or `$phishing` - **Plugins**: `api.ui.openPage` moves the tab to one of the plugin's own pages ([#1406](https://github.com/bulwarkmail/webmail/issues/1406), thanks [@HOLOEYE-JZ](https://github.com/HOLOEYE-JZ)). A plugin's search result snippet can mark what matched ([#1418](https://github.com/bulwarkmail/webmail/issues/1418), thanks [@HOLOEYE-JZ](https://github.com/HOLOEYE-JZ)), and the results block holds its place while a plugin is still searching ([#1419](https://github.com/bulwarkmail/webmail/issues/1419), thanks [@HOLOEYE-JZ](https://github.com/HOLOEYE-JZ)) - **Accessibility**: Settings has an Accessibility page. Presets for screen readers, low vision, dyslexia, focus, keyboard and motor, motion and seizure safety, and deaf and hard of hearing users change several options at once and can be undone. Alt+Shift+A opens text size, contrast, motion and the presets from anywhere, and a button in the navigation bar can do the same - **Accessibility**: Text can use Atkinson Hyperlegible Next, Lexend or OpenDyslexic, with more line, letter, word and paragraph spacing. More contrast works on any theme, and transparency can be reduced, links underlined, the focus outline made thicker and the pointer made larger - **Accessibility**: Reading aids for mail: a reader view in the app's font, spacing and colours, read aloud with the browser's voice while highlighting what it reads, a reading mask that dims all but a band of lines, animated images paused behind a play button, HTML mail as plain text by default or per message, lines of about 80 characters, wide mail scaled down to the pane, HTML mail in the app's font and colours, and message bodies at the chosen text size - **Accessibility**: Calendar, tag and folder colours can use a colour-blind-safe palette, and names can show next to colours: a tag's letter in its dot and the calendar's name on events - **Accessibility**: Large targets make buttons, menu items, rows and switches 44 px. Simple mode shows one column and, if wanted, a paged message list. Submenus, previews and the rail peek can open only on click, and tags, filter rules, apps, accounts and Pro tabs can be reordered without dragging - **Accessibility**: Single-key shortcuts can be turned off. Every app has landmarks, a page heading, skip links and F6 to move between panes, and ? opens the keyboard shortcuts of the app you are in - **Accessibility**: Screen readers are told when a folder or search has loaded, how much new mail came, when a draft is saved and when the connection drops, and toasts are read out, errors assertively. Toasts stay while focused, Alt+Shift+N jumps to the newest, and the notification duration also covers undo toasts, errors and reminders. Visual alerts flash the tab title slowly, and plugin notifications stay off the desktop during do not disturb - **Accessibility**: Plain language gives simpler English and German wording for sign-in, errors and Settings. Technical terms in Settings and the admin area get short explanations that work with keyboard, touch and screen readers - **Accessibility**: Optional confirmations before deleting, archiving and sending, a prompt for alt text when an image goes into a message, an accessible example message in the template picker, and a default font and size for new messages - **Admin**: Links to an accessibility statement, a barrier report, help, Easy Read and sign language show on the login page, in the settings sidebar and in the account menu when set with `ACCESSIBILITY_STATEMENT_URL`, `ACCESSIBILITY_FEEDBACK_URL`, `HELP_URL`, `EASY_READ_URL` and `SIGN_LANGUAGE_URL` - **Admin**: `OAUTH_REVOKE_ON_SIGN_OUT=false` keeps the refresh token valid on sign-out, so Stalwart 1.0 keeps Bulwark in the user's connected applications and doesn't ask for consent again ([#1388](https://github.com/bulwarkmail/webmail/issues/1388), thanks [@Beckid](https://github.com/Beckid)) - **Login**: `LOGIN_USERNAME_PLACEHOLDER` sets the placeholder of the login email field ([#1423](https://github.com/bulwarkmail/webmail/issues/1423), thanks [@DerFolder](https://github.com/DerFolder)) - **Login**: The SSO-only login page offers "Remember me", and the box decides for every single sign-on path ([#1437](https://github.com/bulwarkmail/webmail/issues/1437), thanks [@marketstead-dave](https://github.com/marketstead-dave)) - **Setup**: The setup wizard shows in the browser's language, in all 29 languages - **Mail**: Ctrl+Z or z undoes the last mail actions, newest first, marking read or unread, stars and tags included. Delete to Trash, archive, move, spam report and remove from folder offer Undo in their toast, also after a move to another account and in lists that mix accounts - **Mail**: Scheduled messages can be cancelled back into Drafts and rescheduled in the Schedule send dialog. "This morning" and "This afternoon" are offered as schedule times while they are still ahead ([#1390](https://github.com/bulwarkmail/webmail/issues/1390), thanks [@PoltoS](https://github.com/PoltoS)) - **Mail**: Before sending, Bulwark warns about unfilled placeholders such as \[Your name], in every app language, and about unfinished text. The warning can be turned off - **Mail**: Attachments can be saved to Files from the message, from shared and group mailboxes too - **Mail**: The list header has a Sort menu and the folder's actions, and the filter panel is simpler, with on/off toggles, date and size ranges and every field in view - **Mail**: A click anywhere beside a row's avatar or checkbox ticks it ([#1381](https://github.com/bulwarkmail/webmail/issues/1381), thanks [@mmomjian](https://github.com/mmomjian)) - **Mail**: A message whose sender check failed shows a warning shield instead of the sender icon - **Composer**: Quoted reply history collapses behind an ellipsis ([#1405](https://github.com/bulwarkmail/webmail/issues/1405), thanks [@pcatapan](https://github.com/pcatapan)) - **Composer**: A recipient chip's menu moves it between To, Cc and Bcc, and the tag and template pickers can make a new tag or open the template manager - **Command palette**: Mail's commands (reply, archive, delete, move, read state, spam, go to a folder), Calendar's, Contacts' and Files' commands, plugin pages, account switching and "search everything" are in the palette. Apps can add their own commands - **Print**: Print or Ctrl+P prints a clean copy of the page instead of the app shell: the calendar's month, week, day, agenda, tasks and single events, and contact lists, contacts, groups and directory entries - **Calendar**: Events can be searched from the toolbar, with / and from the command palette - **Calendar**: Light event colours show events tinted with a colour bar, as in Outlook - **Calendar**: A cancellation mail offers to remove the cancelled meeting from the calendar ([#1425](https://github.com/bulwarkmail/webmail/issues/1425), thanks [@chutescarabee7](https://github.com/chutescarabee7)) - **Calendar**: Dragging or resizing a repeating event asks which occurrences move, and the move can be undone. A single click on a month day or the all-day row opens the quick editor for an all-day event, and Shift+F10 opens an event's menu - **Contacts**: Address books and contact categories can be deleted in Settings, and contacts move with Move to… - **Files**: Deleted files go to a trash with Restore, Delete permanently and Empty trash. Files and folders move with Move to… and a folder picker, a folder downloads as a zip built in the browser with progress and cancel, and images and other files open in one preview with ←/→ to the next file - **Files**: With a document editor configured, "New file" also creates Word, Excel, PowerPoint, OpenDocument and (where the editor edits PDFs) PDF files and opens them in the editor. It offers the formats the editor can edit; admins can narrow the list with `WOPI_NEW_FILE_FORMATS` and add their own blank templates, or other formats, with `WOPI_TEMPLATE_DIR` ([#1393](https://github.com/bulwarkmail/webmail/issues/1393), thanks [@Monarobase](https://github.com/Monarobase)) - **Files**: The Files settings sync with the other settings, with export, reset and a one-time move from this device - **Phone**: Every app's phone header has notifications, the command palette and the account avatar, and Contacts gets a create button and long-press menus like Mail and Files - **i18n**: Thai ([#1379](https://github.com/bulwarkmail/webmail/issues/1379), thanks [@phumiphat2201](https://github.com/phumiphat2201)) ##### Performance - **Mail**: Shared accounts' folders load in batched, parallel requests instead of one request per account ([#1409](https://github.com/bulwarkmail/webmail/issues/1409), thanks [@truesysadmin](https://github.com/truesysadmin)) - **Tags**: Tag counts come from one Keyword/get on servers that count keywords ([#1399](https://github.com/bulwarkmail/webmail/issues/1399), thanks [@lucamzanon](https://github.com/lucamzanon)), and a hidden tab recounts once it is shown instead of on every push ([#1400](https://github.com/bulwarkmail/webmail/issues/1400), thanks [@lucamzanon](https://github.com/lucamzanon)) - **Push**: The keep-alive echo is skipped while the push stream is live ([#1401](https://github.com/bulwarkmail/webmail/issues/1401), thanks [@lucamzanon](https://github.com/lucamzanon)) ##### Fixes - **Accessibility**: Every form field, icon button and switch has a name screen readers read out, and password managers can fill the sign-in form. Dialogs, file previews, the document editor, the search palette and plugin dialogs keep the focus inside and give it back when they close - **Accessibility**: The message list is one Tab stop that screen readers read row by row. The calendar grid and mini calendar work with arrow keys and read events with their date, the contact and files lists move with the keyboard, and menus, grid cells and other roving-focus controls show the focus outline - **Accessibility**: Text contrast is at least 4.5:1 in every built-in theme, light and dark. Switches, selections and pressed buttons stay visible in Windows contrast themes, small controls have at least a 24 px target, and toasts move away from the focused control - **Accessibility**: With a large browser text size the message list stays visible next to the reader and cut-off labels wrap, Aurora Glass turns solid when transparency is reduced, and animations inside mail stop with reduce motion - **Dialogs**: Dialogs share one shell with the close button at the end, Escape, outside click and a discard prompt for typed changes, and their title stays in view while the content scrolls. The app's own dialogs replace browser prompts and confirm boxes, and leaving an editor or admin page with unsaved changes asks first, also on browser Back - **Wording**: The same action has the same word, icon and place across Mail, Calendar, Contacts, Files and Settings, labels use sentence case, delete prompts say what is lost, and German addresses you formally everywhere - **Mail**: A message has the same actions in its row menu, the reader's ⋮ and the phone panel. The selection bar has Archive, Report spam and a menu with the rest, the phone conversation view has Archive, Delete, Report spam, Mark as unread and Move, and a swipe archives or deletes a conversation row too - **Mail**: Delete follows the Delete action setting, archiving a conversation leaves your sent copy in Sent, Undo after Report spam puts the message back, and View source shows the message's real source - **Mail**: Clearing search filters keeps the open folder ([#1430](https://github.com/bulwarkmail/webmail/issues/1430), thanks [@creyD](https://github.com/creyD)), system folder names are translated in advanced search ([#1429](https://github.com/bulwarkmail/webmail/issues/1429), thanks [@creyD](https://github.com/creyD)), and a rule run on existing messages reads From, To and Cc conditions on Stalwart ([#1424](https://github.com/bulwarkmail/webmail/issues/1424), thanks [@creyD](https://github.com/creyD)) - **Mail**: A dmarc pass no longer comes with a warning about failed checks ([#1403](https://github.com/bulwarkmail/webmail/issues/1403), thanks [@Fneufneu](https://github.com/Fneufneu)), a DKIM pass reported only by `header.i` counts ([#1420](https://github.com/bulwarkmail/webmail/issues/1420), thanks [@DerFolder](https://github.com/DerFolder)), and invitations from users on your own domains aren't flagged as unverified ([#1374](https://github.com/bulwarkmail/webmail/issues/1374), thanks [@chlw](https://github.com/chlw)) - **Mail**: Failed attachment downloads and partial or failed "Download all" say so ([#1426](https://github.com/bulwarkmail/webmail/issues/1426), [#1428](https://github.com/bulwarkmail/webmail/issues/1428), thanks [@VasilisNtovolos](https://github.com/VasilisNtovolos)), permanent bulk deletes that partly failed are reconciled ([#1384](https://github.com/bulwarkmail/webmail/issues/1384), thanks [@VasilisNtovolos](https://github.com/VasilisNtovolos)), and the attachments of a previewed .eml preview too ([#1395](https://github.com/bulwarkmail/webmail/issues/1395), thanks [@lucamzanon](https://github.com/lucamzanon)) - **Mail**: Conversations show the scheduled status ([#1359](https://github.com/bulwarkmail/webmail/issues/1359), thanks [@arnauda-gh](https://github.com/arnauda-gh)), folder counts update as soon as a send removes its draft ([#1412](https://github.com/bulwarkmail/webmail/issues/1412), thanks [@NobinKhan](https://github.com/NobinKhan)), and a mail sent right after a proxy outage goes out from the account's identity ([#1377](https://github.com/bulwarkmail/webmail/issues/1377), thanks [@kisaanu](https://github.com/kisaanu)) - **Mail**: Attachment icons in the reader are coloured by file type like in the list, a mail's own overflow no longer adds a second scrollbar, and pushed notifications stay silent during do not disturb - **Composer**: A send no longer races the autosave ([#1394](https://github.com/bulwarkmail/webmail/issues/1394), thanks [@lucamzanon](https://github.com/lucamzanon)), a draft written in another client keeps its paragraph spacing ([#1416](https://github.com/bulwarkmail/webmail/issues/1416), thanks [@b3rsrk](https://github.com/b3rsrk)), the footer drops its labels when the composer is narrow ([#1375](https://github.com/bulwarkmail/webmail/issues/1375), thanks [@rgaliull](https://github.com/rgaliull)), and the install card stays off the Send button and remembers "Not now" ([#1411](https://github.com/bulwarkmail/webmail/issues/1411), thanks [@NobinKhan](https://github.com/NobinKhan)) - **Sign-in**: The two-factor prompt shows as the next step instead of an error ([#1422](https://github.com/bulwarkmail/webmail/issues/1422), thanks [@DerFolder](https://github.com/DerFolder)), password and two-factor settings show after a password and code sign-in ([#1432](https://github.com/bulwarkmail/webmail/issues/1432), thanks [@JamesJosephFinn](https://github.com/JamesJosephFinn)), Lite on Stalwart no longer opens the browser's login dialog when the access token expired, uploads included ([#1396](https://github.com/bulwarkmail/webmail/issues/1396), thanks [@robinbohnen](https://github.com/robinbohnen)), and the account security docs open on bulwarkmail.org ([#1387](https://github.com/bulwarkmail/webmail/issues/1387), thanks [@DodoLeDev](https://github.com/DodoLeDev)). Every app asks for a fresh two-factor code, not only Mail - **Calendar**: Default alerts get account-wide unique ids ([#1435](https://github.com/bulwarkmail/webmail/issues/1435), thanks [@rich0](https://github.com/rich0)), a shared calendar shows the colour the server gives it ([#1414](https://github.com/bulwarkmail/webmail/issues/1414), thanks [@chodid](https://github.com/chodid)), and one account's tasks stay out of another's task list ([#1380](https://github.com/bulwarkmail/webmail/issues/1380), thanks [@HOLOEYE-JZ](https://github.com/HOLOEYE-JZ)) - **Calendar**: Week and day view fill with the visible hours and mark events that run past them, a saved event comes into view, short events open on click, and events you can't change offer no Edit, Delete, drag or resize - **Contacts**: Exports are valid vCard 4.0 ([#1407](https://github.com/bulwarkmail/webmail/issues/1407), thanks [@motofix](https://github.com/motofix)), escaped colons in imported vCard notes are decoded ([#1438](https://github.com/bulwarkmail/webmail/issues/1438), thanks [@tacky6775](https://github.com/tacky6775)), and a new or duplicated contact shows after saving - **Files**: Files list on Stalwart 1.0 when the account holds more nodes than one request returns ([#1385](https://github.com/bulwarkmail/webmail/issues/1385), thanks [@IchiganCS](https://github.com/IchiganCS)), and Back closes a preview or the document editor instead of leaving Files - **Plugins**: Full-height app pages fill the page ([#1357](https://github.com/bulwarkmail/webmail/issues/1357), thanks [@yontani](https://github.com/yontani)), and search stops waiting for plugin results when it fails - **Right-to-left**: In Arabic, Hebrew and Persian, arrows, panels, drawers and the phone sidebar are mirrored, events sit on the right day, and senders, subjects and event titles keep their own text direction - **Phone**: Tour steps open the screen they point at, toasts sit above the bottom bars and can be swiped away, and calendar, contact and settings rows put their actions behind a ⋮ menu - **Build**: The production build's type check stays within 2 GB of memory ([#1431](https://github.com/bulwarkmail/webmail/issues/1431), thanks [@bagasme](https://github.com/bagasme)) - **Demo**: Switching demo accounts no longer crashes, and forwarding as attachment, export, view source and file previews work in the demo ### [`v1.18.0`](https://github.com/bulwarkmail/webmail/blob/HEAD/CHANGELOG.md#1180-2026-10-26) [Compare Source](https://github.com/bulwarkmail/webmail/compare/1.17.2...1.18.0) 1.18.0 works with Stalwart 1.0, released today, as well as with 0.16. Sign-in, calendars, contacts, files and sending were adapted to what changed in 1.0, and a Stalwart that was moved from 0.16 to 1.0 with Stalwart's migration tool keeps working with the same open tabs. It also fixes the findings of a security review of the whole webmail, more places where an action in a view that mixes accounts could hit another account's message with the same id, and a series of calendar bugs around repeating events. Plugins can show their own search results and a count on their buttons, quick reply can be turned off, and a new device offers to restore your saved account list. Thank you for your donations: - *You? [Become a sponsor!](https://github.com/sponsors/bulwarkmail)* **One-time** - [@bultester](https://github.com/bultester) - Anonymous - Anonymous - Anonymous - Anonymous **Monthly** - Anonymous - [@superspacehosting](https://github.com/superspacehosting) - [@naokton](https://github.com/naokton) - [@yerTools](https://github.com/yerTools) - [@jsaathof](https://github.com/jsaathof) - [@berkersal](https://github.com/berkersal) - [@NABarnes](https://github.com/NABarnes) - [@felixzieger](https://github.com/felixzieger) - [@pr0ton11](https://github.com/pr0ton11) - [@fpauser](https://github.com/fpauser) - [@proxforge](https://github.com/proxforge) - [@spss20](https://github.com/spss20) - [@elgringoYan](https://github.com/elgringoYan) - [@pauladams8](https://github.com/pauladams8) - [@djpriest](https://github.com/djpriest) - [@umakers](https://github.com/umakers) - [@zplizzi](https://github.com/zplizzi) - [@jeremiah](https://github.com/jeremiah) - [@Theoretisch1337](https://github.com/Theoretisch1337) - [@svandive](https://github.com/svandive) - [@HiltMundell](https://github.com/HiltMundell) ##### Upgrading to Stalwart 1.0 - After moving Stalwart to 1.0, run **Auto-configure OAuth** once on the admin **Authentication** page. It registers Bulwark with Stalwart as a first-party client. Without it, mail, contacts, calendars and files work, but the account security settings (password, two-factor, app passwords) are not available, and single sign-on through Stalwart needs the registered client - Stalwart 1.0 can't be installed over 0.16: its migration tool (`stalwart-migrate`) copies the data into a new store. Ids and sync state are kept, so Bulwark carries on without reloading anything, but OAuth tokens are not migrated: everyone who signed in with single sign-on, or with a password and a two-factor code, signs in again. Keep the server's public URL the same - Admin sessions are signed out once by this update, and they now also end when you sign out or change the admin password ##### Security - **Plugins**: `/api/plugin-approval-status` refuses plugin packages while user plugins, plugin uploads or their review are turned off. Any signed-in user could fill the admin's review queue and the data directory with packages (GHSA-qc44-275p-gqw9, thanks [@oguzyilmaznet](https://github.com/oguzyilmaznet)) - **Sidebar apps**: With `COOKIE_SECURE=true`, the unprefixed sidebar-app cookie is no longer trusted behind a TLS proxy that sends no `X-Forwarded-Proto`, so a sibling subdomain can't add origins to the page's `frame-src` (GHSA-cjm9-m826-mh78, thanks [@oguzyilmaznet](https://github.com/oguzyilmaznet)) - **Sign-in**: A stored credential that the mail server refused (password changed, app password revoked) is not sent again for an hour, and a global cap stops a loop of them, so a stale session can't get the webmail's address banned by Stalwart for every user. Server-side calls forward the client address (GHSA-g6c7-r7wq-xrm2, thanks [@oguzyilmaznet](https://github.com/oguzyilmaznet)) - **Multi-account**: More actions name both the login and the account. Removing a login whose folder was open, the Scheduled list, contacts in shared address books or another login, plugin moves, single-message archive and delete, the replied/forwarded flags, scheduled badges and Undo for a signed-out login could act on another account's message, contact or submission with the same id (GHSA-8x23-qw3w-mhrx) - **Sign-in**: On a server that reports a bare login name, a token sign-in could claim that name on any domain and reach the synced settings and stored plugin credentials of that address - **Sign-in**: A password and two-factor sign-in to a server you typed went to the default server when custom servers are allowed, and the password sign-in followed a mail server's redirect to another host with the password - **Sign-in**: A password and two-factor sign-in without "Remember me" ends with the browser session instead of staying signed in for 30 days - **Mail**: A link in a printed message can't redirect the webmail tab, links in conversation messages go through the same link check as the reader, a winmail.dat part whose type a browser would drop is downloaded instead of opened, and an unquoted `cid:` image no longer hides the rest of the message - **Mail**: Outlook-style replies (plugin) no longer load the quoted message's remote images - **Calendar**: Only a counter proposal from one of the meeting's participants can be applied to your meeting; anyone who knew its UID could propose a new time or place to all attendees - **Admin**: `config.json`, the admin password hash and the setup token are written readable only by the app's user, a synced settings file can no longer pass as an admin session, and the setup wizard refuses a session secret under 32 characters - **Server**: Request bodies over 10 MB are no longer buffered for every path before routing (only WebDAV uploads, the plugin proxy and office saves take more, and cap it themselves), answers from a mail server you picked are read up to a size limit, and the app files in the Docker image are read-only for the user it runs as - **Dependencies**: undici 7.30.1 (GHSA-xjj6-f33q-929c) ##### Features - **Stalwart 1.0**: Calendars, tasks, contact photos, files, free/busy, sending past Stalwart 1.0's submission limit, phrase search, and its rules for keywords, file names and time zones work on 1.0 as on 0.16. Bulwark Lite installs as a Stalwart 1.0 Application - **Plugins**: Plugins can show their own results in search and open the message a result names ([#1336](https://github.com/bulwarkmail/webmail/issues/1336), [#1338](https://github.com/bulwarkmail/webmail/issues/1338), thanks [@HOLOEYE-JZ](https://github.com/HOLOEYE-JZ)), and show a count on their buttons ([#1345](https://github.com/bulwarkmail/webmail/issues/1345), thanks [@HOLOEYE-JZ](https://github.com/HOLOEYE-JZ)). `email.get`, `email.getRaw` and `email.getAttachment` take an optional account id, and summaries carry it - **Accounts**: A new device offers to restore the saved account list ([#1363](https://github.com/bulwarkmail/webmail/issues/1363), thanks [@lucamzanon](https://github.com/lucamzanon)) - **Mail**: Quick reply below messages can be turned off in Settings ([#1370](https://github.com/bulwarkmail/webmail/issues/1370), thanks [@maxhaomh](https://github.com/maxhaomh)) - **Mountain View**: The inbox splits into Unread and Everything else, and attachment and code chips look like Gmail's - **Server**: iCal subscriptions and other server-side fetches go through the outbound proxy when `NODE_USE_ENV_PROXY=1` is set. Bulwark still checks the address itself and asks the proxy for exactly that address ([#1367](https://github.com/bulwarkmail/webmail/issues/1367), thanks [@Jan0oo](https://github.com/Jan0oo)) ##### Fixes - **Sign-in**: Password and two-factor sign-in, Bulwark Lite and phone pairing work on Stalwart 1.0, single sign-on asks for mail, contacts, calendar and file access there, and a background account signed in with OAuth renews its own token instead of the active account's ([#989](https://github.com/bulwarkmail/webmail/issues/989), thanks [@Almost-Senseless-Coder](https://github.com/Almost-Senseless-Coder)) - **Sign-in**: Signing out of one login switches to the remaining one when it was signed in before the page loaded, instead of signing out of all, and an OAuth account that can't be restored has its refresh token cleared - **Mail**: Bulk archive in the unified inbox creates each account's Archive, and a group account's year and month archive folders are reused - **Mail**: The unified inbox shows new mail of a group or shared account and of another signed-in login without a click ([#1350](https://github.com/bulwarkmail/webmail/issues/1350), thanks [@ClapsAndJiggles](https://github.com/ClapsAndJiggles)), and message links open the message of the account they name ([#1351](https://github.com/bulwarkmail/webmail/issues/1351), thanks [@ClapsAndJiggles](https://github.com/ClapsAndJiggles)) - **Mail**: The list keeps loading older mail when the server sent no total ([#1364](https://github.com/bulwarkmail/webmail/issues/1364), thanks [@inceblog](https://github.com/inceblog)), inline images whose part name is a path show ([#1371](https://github.com/bulwarkmail/webmail/issues/1371), [#1373](https://github.com/bulwarkmail/webmail/issues/1373), thanks [@motofix](https://github.com/motofix)), and Outlook-style HTML quotes without a border are kept ([#1355](https://github.com/bulwarkmail/webmail/issues/1355), thanks [@maxhaomh](https://github.com/maxhaomh)) - **Mail**: Sent paragraphs keep the spacing the composer shows ([#1340](https://github.com/bulwarkmail/webmail/issues/1340), thanks [@arnauda-gh](https://github.com/arnauda-gh)), replies to deeply nested quotes and mails full of blockquotes no longer freeze the page, and attachment names drop direction-override characters everywhere - **Sending**: "Send now" of a group identity's delayed mail no longer drops it back into Drafts, own and group scheduled mail stay apart, a send refused for some recipients says so, and a held reply from a Pro compose tab still marks the original as answered - **Calendar**: The open calendar updates and reminders fire on time when events change elsewhere ([#1349](https://github.com/bulwarkmail/webmail/issues/1349), thanks [@ClapsAndJiggles](https://github.com/ClapsAndJiggles)), events sit and resize at their clock time on DST change days ([#1348](https://github.com/bulwarkmail/webmail/issues/1348), thanks [@ClapsAndJiggles](https://github.com/ClapsAndJiggles)), a calendar added later follows the server's visibility ([#1372](https://github.com/bulwarkmail/webmail/issues/1372), thanks [@somus](https://github.com/somus)), a colour from the system colour dialog is applied ([#1366](https://github.com/bulwarkmail/webmail/issues/1366), thanks [@chodid](https://github.com/chodid)), and hiding every calendar sticks - **Calendar**: Editing, moving, splitting and answering repeating events keeps their changed and cancelled occurrences, organizer and answers, and asks attendees again only when the time changes - **Calendar**: A subscribed feed's changes to events it still carries are applied, meeting replies are checked against the attendee who answers, exported events keep emoji and names with a colon, and the Calendar Agenda shows all-day events on their day west of the server - **Contacts**: Photos, UIDs and group members are kept on Stalwart 1.0, and a closed directory says so instead of reporting a failed refresh - **Files**: Folders and uploads work on Stalwart 1.0, symlinks show as links, shared folders sit under "Shared with me", and files copy between your drive and shared drives - **Push**: Mail in an account shared into another signed-in login gets its notification again, previews work when the webmail reaches Stalwart on an internal address, and two logins with the same account id get a plain notification instead of the wrong preview - **Lite**: A replayed deep link keeps its query parameters ([#1352](https://github.com/bulwarkmail/webmail/issues/1352), thanks [@ClapsAndJiggles](https://github.com/ClapsAndJiggles)) - **Admin**: The allowed frame ancestors saved in the dashboard reach the header, and `setup.sh` asks again for a pasted session secret under 32 characters - **Accessibility**: The rail's Mail entry is named "Mail" for screen readers, not its unread count - **i18n**: Missing Estonian strings and the quick reply setting are translated, and the German account-list restore prompt addresses you formally </details> <details> <summary>calibrain/shelfmark (ghcr.io/calibrain/shelfmark-lite)</summary> ### [`v1.6.0`](https://github.com/calibrain/shelfmark/releases/tag/v1.6.0): : Tightening the Bolts [Compare Source](https://github.com/calibrain/shelfmark/compare/v1.5.1...v1.6.0) This one is mostly about the stuff you only notice when it goes wrong. Downloads that hang around instead of finishing, secrets that end up in a log line, a stuck coordinator that still reports healthy. There is one new feature, Jackett as a release source, and the rest is fixes, cleanup and dependency bumps. #### New - Jackett is now a release source, next to Prowlarr. It searches Jackett's Torznab endpoints (the `all` aggregate, or the indexers you pick) and uses the same torrent client settings you already have. Thanks [@amura11](https://github.com/amura11) ([#1521](https://github.com/calibrain/shelfmark/issues/1521)) #### Downloads that finish when they should - A finished torrent in the wrong directory is handed on instead of waiting out the whole timeout ([#1573](https://github.com/calibrain/shelfmark/issues/1573)) - qBittorrent 5's stopped states and forced metadata downloads are understood now ([#1570](https://github.com/calibrain/shelfmark/issues/1570)), and a torrent is only imported once every listed file is on disk ([#1577](https://github.com/calibrain/shelfmark/issues/1577)) - A change in a torrent's swarm note no longer resets the stall timer ([#1572](https://github.com/calibrain/shelfmark/issues/1572)) - Retrying a download takes the URL from the release cache only ([#1597](https://github.com/calibrain/shelfmark/issues/1597)), and a provider named alongside a source gets the record policy applied ([#1598](https://github.com/calibrain/shelfmark/issues/1598)) - slskd gets one more try when it answers a batch enqueue with a 500 ([#1590](https://github.com/calibrain/shelfmark/issues/1590)) - Webshare clears the "Resolving" status once the download starts. Thanks [@misko903](https://github.com/misko903) ([#1575](https://github.com/calibrain/shelfmark/issues/1575)) - The seed settings only show for qBittorrent, the one client they apply to ([#1574](https://github.com/calibrain/shelfmark/issues/1574)) #### Louder when something breaks, quieter about what it knows - `/api/health` now reports a stopped download coordinator and returns 503, so the container shows unhealthy instead of everything sitting at "Queued" forever ([#1568](https://github.com/calibrain/shelfmark/issues/1568)) - Credentials, tokens and links are kept out of logs, status messages and error responses, with one shared module doing the masking ([#1571](https://github.com/calibrain/shelfmark/issues/1571), [#1578](https://github.com/calibrain/shelfmark/issues/1578), [#1593](https://github.com/calibrain/shelfmark/issues/1593), [#1562](https://github.com/calibrain/shelfmark/issues/1562)) - The OIDC login shows the issuer guidance when the provider's claims are rejected ([#1603](https://github.com/calibrain/shelfmark/issues/1603)) #### Smaller fixes - A library match works on the full title when the search title is only the series ([#1587](https://github.com/calibrain/shelfmark/issues/1587)) - Notification routes explain what applies on a user's own page ([#1588](https://github.com/calibrain/shelfmark/issues/1588)), and the table row keys are simpler. Thanks [@joshft91](https://github.com/joshft91) ([#1583](https://github.com/calibrain/shelfmark/issues/1583)) - A book requested from a Hardcover search card keeps its series, so the `{Series}` folder and custom script payload are no longer empty. Thanks [@joeRob2468](https://github.com/joeRob2468) for tracing it ([#1589](https://github.com/calibrain/shelfmark/issues/1589)) - The Hardcover scheduler survives an unreadable interval and shares one history connection per sync ([#1569](https://github.com/calibrain/shelfmark/issues/1569)) #### The image - Chromium is now 156.0.8078.73 ([#1601](https://github.com/calibrain/shelfmark/issues/1601), [#1614](https://github.com/calibrain/shelfmark/issues/1614)) - The unused selenium-manager binaries are no longer shipped ([#1615](https://github.com/calibrain/shelfmark/issues/1615)) - Python 3.14.9 and a round of Python, npm and GitHub Actions dependency bumps #### Under the hood and docs - The stats, onboarding and settings routes moved out of `main.py` into their own modules, with no change in behaviour ([#1563](https://github.com/calibrain/shelfmark/issues/1563), [#1594](https://github.com/calibrain/shelfmark/issues/1594), [#1595](https://github.com/calibrain/shelfmark/issues/1595)) - The supported formats list has one lookup instead of several copies ([#1576](https://github.com/calibrain/shelfmark/issues/1576)) - The docs were checked against the code and brought up to date: the readme feature lists, the environment variable reference, and the plugin guides ([#1564](https://github.com/calibrain/shelfmark/issues/1564), [#1565](https://github.com/calibrain/shelfmark/issues/1565), [#1566](https://github.com/calibrain/shelfmark/issues/1566), [#1567](https://github.com/calibrain/shelfmark/issues/1567)) **Full Changelog**: <https://github.com/calibrain/shelfmark/compare/v1.5.1...v1.6.0> </details> <details> <summary>coder/coder (ghcr.io/coder/coder)</summary> ### [`v2.38.5`](https://github.com/coder/coder/releases/tag/v2.38.5) [Compare Source](https://github.com/coder/coder/compare/v2.38.4...v2.38.5) #### Changelog > \[!NOTE] > This is a mainline Coder release. We advise enterprise customers without a staging environment to install our [latest stable release](https://github.com/coder/coder/releases/latest) while we refine this version. Learn more about our [Release Schedule](https://coder.com/docs/install/releases). ##### Bug fixes - Confine read_skill_file reads to the skill directory ([#31462](https://github.com/coder/coder/issues/31462), [`cc97c21`](https://github.com/coder/coder/commit/cc97c21cf7)) - Database: Lock the workspaces row when claiming a prebuild ([#31518](https://github.com/coder/coder/issues/31518), [`97b58bc`](https://github.com/coder/coder/commit/97b58bceae)) ([@dylanhuff-at-coder](https://github.com/dylanhuff-at-coder)) Compare: [`v2.38.4...v2.38.5`](https://github.com/coder/coder/compare/v2.38.4...v2.38.5) #### Container image - `docker pull ghcr.io/coder/coder:v2.38.5` #### Install/upgrade Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below. ### [`v2.38.4`](https://github.com/coder/coder/releases/tag/v2.38.4) [Compare Source](https://github.com/coder/coder/compare/v2.38.3...v2.38.4) #### Changelog > \[!NOTE] > This is a mainline Coder release. We advise enterprise customers without a staging environment to install our [latest stable release](https://github.com/coder/coder/releases/latest) while we refine this version. Learn more about our [Release Schedule](https://coder.com/docs/install/releases). ##### Bug fixes - fix(scripts/release): promote stable on immutable releases ([#30745](https://github.com/coder/coder/issues/30745), [`5f7f094`](https://github.com/coder/coder/commit/5f7f0941f9)) - Documentation: Refresh release calendar and install versions for the 2026-10-19 patches (release/2.38) ([#31035](https://github.com/coder/coder/issues/31035), [`63d102d`](https://github.com/coder/coder/commit/63d102d0b9)) - Server: Bound push response body read and add client timeout ([#31129](https://github.com/coder/coder/issues/31129), [`a7bd712`](https://github.com/coder/coder/commit/a7bd712dfb)) - fix(scripts/releaser): use the v-prefixed image tag in release notes ([#31032](https://github.com/coder/coder/issues/31032), [`9654866`](https://github.com/coder/coder/commit/9654866a92)) - Keep new API keys within the caller's scopes and allow list ([#30256](https://github.com/coder/coder/issues/30256), [`3ee54b4`](https://github.com/coder/coder/commit/3ee54b4e7a)) - Allow fixing stale parameters when the active version is required ([#30660](https://github.com/coder/coder/issues/30660), [`5ed6bd7`](https://github.com/coder/coder/commit/5ed6bd7981)) - Bump coder/tailscale to bound DERP dup client sendHistory ([#31248](https://github.com/coder/coder/issues/31248), [`1df049b`](https://github.com/coder/coder/commit/1df049b7ed)) ([@dylanhuff-at-coder](https://github.com/dylanhuff-at-coder)) - Require SSH permission to fetch external agent credentials ([#31388](https://github.com/coder/coder/issues/31388), [`d16b1ca`](https://github.com/coder/coder/commit/d16b1cabb6)) ([@dylanhuff-at-coder](https://github.com/dylanhuff-at-coder)) Compare: [`v2.38.3...v2.38.4`](https://github.com/coder/coder/compare/v2.38.3...v2.38.4) #### Container image - `docker pull ghcr.io/coder/coder:v2.38.4` #### Install/upgrade Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below. ### [`v2.38.3`](https://github.com/coder/coder/releases/tag/v2.38.3) [Compare Source](https://github.com/coder/coder/compare/v2.38.2...v2.38.3) #### Changelog > \[!NOTE] > This is a mainline Coder release. We advise enterprise customers without a staging environment to install our [latest stable release](https://github.com/coder/coder/releases/latest) while we refine this version. Learn more about our [Release Schedule](https://coder.com/docs/install/releases). ##### Bug fixes - Bump Go to 1.26.10 and terraform to 1.16.7 (backport 2.38) ([#31302](https://github.com/coder/coder/issues/31302), [`5bb296e`](https://github.com/coder/coder/commit/5bb296e4d5)) ##### Tests - Server: Renew the expired TLS test certificate ([#30922](https://github.com/coder/coder/issues/30922), [`fd5da16`](https://github.com/coder/coder/commit/fd5da16600)) ##### Chores - Bump github.com/andybalholm/brotli to v1.2.7 ([#31231](https://github.com/coder/coder/issues/31231), [`8c9d948`](https://github.com/coder/coder/commit/8c9d948a0c)) ([@Shelnutt2](https://github.com/Shelnutt2)) Compare: [`v2.38.2...v2.38.3`](https://github.com/coder/coder/compare/v2.38.2...v2.38.3) #### Container image - `docker pull ghcr.io/coder/coder:2.38.3` #### Install/upgrade Refer to our docs to [install](https://coder.com/docs/install) or [upgrade](https://coder.com/docs/install/upgrade) Coder, or use a release asset below. </details> <details> <summary>matrix-org/matrix-hookshot (ghcr.io/matrix-org/matrix-hookshot)</summary> ### [`v7.6.0`](https://github.com/matrix-org/matrix-hookshot/blob/HEAD/CHANGELOG.md#760-2026-10-26) [Compare Source](https://github.com/matrix-org/matrix-hookshot/compare/7.5.0...7.6.0) #### Features - Serve the compiled OpenProject element-web module in docker under `/modules/v1/static/openproject.js`. ([#1399](https://github.com/matrix-org/matrix-hookshot/issues/1399)) #### Bugfixes - Fix integrations tests failing to due an improper test setup. ([#1404](https://github.com/matrix-org/matrix-hookshot/issues/1404)) #### Internal Changes - Update matrix-bot-sdk / matrix-appservice-bridge to latest versions. ([#1370](https://github.com/matrix-org/matrix-hookshot/issues/1370)) - Support Node 26, and drop support for Node 22. ([#1370](https://github.com/matrix-org/matrix-hookshot/issues/1370)) - Refactor the OpenProject element-web plugin module to use the MVVM pattern. ([#1402](https://github.com/matrix-org/matrix-hookshot/issues/1402)) - Refactor the OpenProject element-web plugin module to use CSS instead of the styled components package. ([#1405](https://github.com/matrix-org/matrix-hookshot/issues/1405)) - Update rustls-webpki and webpki-root-certs to stop trusting compromised eMudhra intermediate certificates (RUSTSEC-2026-0382, RUSTSEC-2026-0383). ([#1441](https://github.com/matrix-org/matrix-hookshot/issues/1441)) - Update the base Node.js images to address the following high/medium/low CVE's `CVE-2026-105482`, `CVE-2026-105483`, `CVE-2026-106069`, `CVE-2026-111497`, `CVE-2026-105481`, `CVE-2026-106072`, `CVE-2026-106074`, `CVE-2026-106070`, `CVE-2026-106071` and `CVE-2026-106073`. </details> <details> <summary>recyclarr/recyclarr (ghcr.io/recyclarr/recyclarr)</summary> ### [`v8.8.1`](https://github.com/recyclarr/recyclarr/blob/HEAD/CHANGELOG.md#881---2026-10-28) [Compare Source](https://github.com/recyclarr/recyclarr/compare/v8.8.0...v8.8.1) ##### Fixed - Sync: Every Radarr sync failed when Radarr 7 uses OIDC login. Sync also no longer fails when Sonarr or Radarr reports a setting value that Recyclarr does not know yet - Sync: When Sonarr or Radarr sends a reply Recyclarr cannot read, the error now says what failed instead of showing only `HTTP 200` - Sync: On Sonarr v5, the progress table kept showing a spinner for quality sizes after sync finished, and failed syncs could be reported as successful in notifications </details> <details> <summary>bpg/terraform-provider-proxmox (proxmox)</summary> ### [`v0.119.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01190-2026-10-29) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.118.1...v0.119.0) ##### ⚠ BREAKING CHANGES - **vm:** reject file ids and disk serials that proxmox can't parse ([#3234](https://github.com/bpg/terraform-provider-proxmox/issues/3234)) - **ceph:** fix pool import by moving storages to proxmox_storage_rbd ([#3204](https://github.com/bpg/terraform-provider-proxmox/issues/3204)) ##### Bug Fixes - **backup:** read exclude-path returned as a json array ([#3225](https://github.com/bpg/terraform-provider-proxmox/issues/3225)) ([aff2785](https://github.com/bpg/terraform-provider-proxmox/commit/aff2785a11a7d29d46880c133b56fa3b1dfe381c)) - **ceph:** fix pool import by moving storages to proxmox_storage_rbd ([#3204](https://github.com/bpg/terraform-provider-proxmox/issues/3204)) ([41be0a0](https://github.com/bpg/terraform-provider-proxmox/commit/41be0a06a4bc443eb4093b785d28af3895ca83db)) - **core:** keep the exit status in ssh command errors ([#3231](https://github.com/bpg/terraform-provider-proxmox/issues/3231)) ([900a296](https://github.com/bpg/terraform-provider-proxmox/commit/900a296545e320a0b6cd881830e1b8b454193cc3)) - **file:** set file mode and check upload size with sudo ssh users ([#3228](https://github.com/bpg/terraform-provider-proxmox/issues/3228)) ([cc3039f](https://github.com/bpg/terraform-provider-proxmox/commit/cc3039f55dbc5791c89de5ae4a8d0dde57f032a9)) - **file:** skip the URL metadata query when `file_name` is set ([#3227](https://github.com/bpg/terraform-provider-proxmox/issues/3227)) ([0bccbd1](https://github.com/bpg/terraform-provider-proxmox/commit/0bccbd1ebf1ff6d72ba716e02262e7fb6ebf5330)) - **vm:** reject file ids and disk serials that proxmox can't parse ([#3234](https://github.com/bpg/terraform-provider-proxmox/issues/3234)) ([429e833](https://github.com/bpg/terraform-provider-proxmox/commit/429e8331e98b521d695ab7449af38774f461939f)) ##### Miscellaneous - **deps:** update image golang ([`9048d5e`](https://github.com/bpg/terraform-provider-proxmox/commit/9048d5e) → [`2920bb1`](https://github.com/bpg/terraform-provider-proxmox/commit/2920bb1)) ([#3232](https://github.com/bpg/terraform-provider-proxmox/issues/3232)) ([93430ca](https://github.com/bpg/terraform-provider-proxmox/commit/93430ca08146ad41de9cb806f28bfce5c183fff8)) - **deps:** update module golang.org/x/net (v0.61.0 → v0.62.0) ([#3233](https://github.com/bpg/terraform-provider-proxmox/issues/3233)) ([0303c23](https://github.com/bpg/terraform-provider-proxmox/commit/0303c230a03d0e43fa6c0dfc951d7803c992f663)) </details> <details> <summary>TwiN/gatus (twinproduction/gatus)</summary> ### [`v5.38.0`](https://github.com/TwiN/gatus/releases/tag/v5.38.0) [Compare Source](https://github.com/TwiN/gatus/compare/v5.37.0...v5.38.0) #### What's Changed - feat(alerting): add Resend alerting provider by [@geffersonFerraz](https://github.com/geffersonFerraz) in [#1830](https://github.com/TwiN/gatus/pull/1830) - fix(maintenance): validate maintenance windows for external, DNS and SSH endpoints by [@anandghegde](https://github.com/anandghegde) in [#1804](https://github.com/TwiN/gatus/pull/1804) - fix(alerting): Redact telegram token from errors on send failure by [@hippi345](https://github.com/hippi345) in [#1843](https://github.com/TwiN/gatus/pull/1843) - fix(websocket): apply the client timeout to reads and writes by [@somaz94](https://github.com/somaz94) in [#1845](https://github.com/TwiN/gatus/pull/1845) - fix(ssh): support keyboard-interactive authentication for endpoints and tunnels by [@peckto](https://github.com/peckto) in [#1863](https://github.com/TwiN/gatus/pull/1863) - fix(security): add comprehensive logging and diagnostics for OIDC ([#1802](https://github.com/TwiN/gatus/issues/1802)) by [@tech00exploere](https://github.com/tech00exploere) in [#1862](https://github.com/TwiN/gatus/pull/1862) - fix(jsonpath): support object keys containing dots via quoted accessors by [@leotemtem](https://github.com/leotemtem) in [#1864](https://github.com/TwiN/gatus/pull/1864) - fix: Honor minimum-reminder-interval for external endpoints by [@yzxcj797](https://github.com/yzxcj797) in [#1773](https://github.com/TwiN/gatus/pull/1773) - chore(alerting): restyle matrix alerts with errors, safe links and escaping by [@mazzz1y](https://github.com/mazzz1y) in [#1875](https://github.com/TwiN/gatus/pull/1875) #### New Contributors - [@anandghegde](https://github.com/anandghegde) made their first contribution in [#1804](https://github.com/TwiN/gatus/pull/1804) - [@yzxcj797](https://github.com/yzxcj797) made their first contribution in [#1773](https://github.com/TwiN/gatus/pull/1773) - [@hippi345](https://github.com/hippi345) made their first contribution in [#1843](https://github.com/TwiN/gatus/pull/1843) - [@geffersonFerraz](https://github.com/geffersonFerraz) made their first contribution in [#1830](https://github.com/TwiN/gatus/pull/1830) - [@somaz94](https://github.com/somaz94) made their first contribution in [#1845](https://github.com/TwiN/gatus/pull/1845) - [@peckto](https://github.com/peckto) made their first contribution in [#1863](https://github.com/TwiN/gatus/pull/1863) - [@tech00exploere](https://github.com/tech00exploere) made their first contribution in [#1862](https://github.com/TwiN/gatus/pull/1862) - [@leotemtem](https://github.com/leotemtem) made their first contribution in [#1864](https://github.com/TwiN/gatus/pull/1864) - [@mazzz1y](https://github.com/mazzz1y) made their first contribution in [#1875](https://github.com/TwiN/gatus/pull/1875) **Full Changelog**: <https://github.com/TwiN/gatus/compare/v5.37.0...v5.38.0> </details> <details> <summary>element-hq/element-web (vectorim/element-web)</summary> ### [`v1.12.33`](https://github.com/element-hq/element-web/releases/tag/v1.12.33) [Compare Source](https://github.com/element-hq/element-web/compare/v1.12.32...v1.12.33) #### ✨ Features - Copy changes for "set up recovery" ([#35437](https://github.com/element-hq/element-web/pull/35437)). Contributed by [@richvdh](https://github.com/richvdh). - Fix calls respawning from error screen on room switch. ([#35470](https://github.com/element-hq/element-web/pull/35470)). Contributed by [@toger5](https://github.com/toger5). - Split `ChangeRecoveryKeyBody` out of `ChangeRecoveryKey` ([#35403](https://github.com/element-hq/element-web/pull/35403)). Contributed by [@kaylendog](https://github.com/kaylendog). - Use a dialog to prompt the user about their recovery key when logging out ([#35398](https://github.com/element-hq/element-web/pull/35398)). Contributed by [@kaylendog](https://github.com/kaylendog). - Remove introductory screen from "create recovery key" flow ([#35451](https://github.com/element-hq/element-web/pull/35451)). Contributed by [@richvdh](https://github.com/richvdh). - Don't allow to skip device verification by default ([#35364](https://github.com/element-hq/element-web/pull/35364)). Contributed by [@mxandreas](https://github.com/mxandreas). - Remodel "Can't confirm" dialog to match designs ([#35375](https://github.com/element-hq/element-web/pull/35375)). Contributed by [@andybalaam](https://github.com/andybalaam). - Drop support for migrating libolm sessions ([#35138](https://github.com/element-hq/element-web/pull/35138)). Contributed by [@Half-Shot](https://github.com/Half-Shot). - Update `Pill` and `PillInput` design ([#35370](https://github.com/element-hq/element-web/pull/35370)). Contributed by [@florianduros](https://github.com/florianduros). - Offer 'Sign out' on the identity reset page if there is no other option ([#35307](https://github.com/element-hq/element-web/pull/35307)). Contributed by [@andybalaam](https://github.com/andybalaam). - Put user status below the avatar ([#35328](https://github.com/element-hq/element-web/pull/35328)). Contributed by [@dbkr](https://github.com/dbkr). #### 🐛 Bug Fixes - Update Electron to pick up patches ([#35573](https://github.com/element-hq/element-web/pull/35573)). Contributed by [@t3chguy](https://github.com/t3chguy). - Expand the device wildcard when a widget sends an encrypted to-device message ([#35183](https://github.com/element-hq/element-web/pull/35183)). Contributed by [@ara4n](https://github.com/ara4n). - Keep opening voice-only calls in PiP when the lobby is skipped ([#35495](https://github.com/element-hq/element-web/pull/35495)). Contributed by [@Johennes](https://github.com/Johennes). - Fix /spoiler command not converting markdown to HTML ([#35103](https://github.com/element-hq/element-web/pull/35103)). Contributed by [@jasonjose007](https://github.com/jasonjose007). - Open a call that is already in progress maximised, even for voice ([#35443](https://github.com/element-hq/element-web/pull/35443)). Contributed by [@ara4n](https://github.com/ara4n). - Fix guest login in oidc flow ([#35432](https://github.com/element-hq/element-web/pull/35432)). Contributed by [@florianduros](https://github.com/florianduros). - Avoid unhandled promise rejection from CallStore.onReady() ([#34861](https://github.com/element-hq/element-web/pull/34861)). Contributed by [@hughns](https://github.com/hughns). - Add border around user profile avatar ([#35460](https://github.com/element-hq/element-web/pull/35460)). Contributed by [@dbkr](https://github.com/dbkr). - Fix PiP drag bar when displaying over widgets ([#35395](https://github.com/element-hq/element-web/pull/35395)). Contributed by [@mgcm](https://github.com/mgcm). - Feed thread replies to widgets ([#35444](https://github.com/element-hq/element-web/pull/35444)). Contributed by [@ara4n](https://github.com/ara4n). - Ensure 'Can't confirm?' is primary only if no other options are available ([#35406](https://github.com/element-hq/element-web/pull/35406)). Contributed by [@andybalaam](https://github.com/andybalaam). - Fix restricted guest module showing excluded UI elements ([#35412](https://github.com/element-hq/element-web/pull/35412)). Contributed by [@florianduros](https://github.com/florianduros). - Update compound-web to 10.3.1 ([#35390](https://github.com/element-hq/element-web/pull/35390)). Contributed by [@dbkr](https://github.com/dbkr). - Run DeviceListener rechecks one at a time ([#35053](https://github.com/element-hq/element-web/pull/35053)). Contributed by [@langleyd](https://github.com/langleyd). - Keep the new timeline at the bottom when its viewport changes height ([#35374](https://github.com/element-hq/element-web/pull/35374)). Contributed by [@langleyd](https://github.com/langleyd). - Stop writing removed legacy mention rules from the Labs notification settings ([#35035](https://github.com/element-hq/element-web/pull/35035)). Contributed by [@barodeur](https://github.com/barodeur). - Ellipsise long names in widget picture-in-picture view ([#35329](https://github.com/element-hq/element-web/pull/35329)). Contributed by [@robintown](https://github.com/robintown). </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - "after 10pm every weekday,every weekend,before 7am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-10-26 12:04:28 +00:00

chore(deps): update all non-major updates

Validate / Kubernetes manifests (pull_request) Successful in 46s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m15s

Details

Validate / Ansible lint (pull_request) Successful in 2m38s

Details

1e37c5f458

renovate-bot force-pushed renovate/all-non-major-updates from 1e37c5f458

Validate / Kubernetes manifests (pull_request) Successful in 46s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m15s

Details

Validate / Ansible lint (pull_request) Successful in 2m38s

Details

to 57450497ba

Validate / Kubernetes manifests (pull_request) Successful in 1m7s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m7s

Details

Validate / Ansible lint (pull_request) Successful in 2m26s

Details

2026-10-26 18:04:13 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 57450497ba

Validate / Kubernetes manifests (pull_request) Successful in 1m7s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m7s

Details

Validate / Ansible lint (pull_request) Successful in 2m26s

Details

to 9f4f8cec5e

Validate / Kubernetes manifests (pull_request) Successful in 42s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m15s

Details

Validate / Ansible lint (pull_request) Successful in 2m38s

Details

2026-10-27 00:04:11 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 9f4f8cec5e

Validate / Kubernetes manifests (pull_request) Successful in 42s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m15s

Details

Validate / Ansible lint (pull_request) Successful in 2m38s

Details

to 60a1e592e1

Validate / Terraform format + validate (pull_request) Successful in 1m53s

Details

Validate / Kubernetes manifests (pull_request) Successful in 2m26s

Details

Validate / Ansible lint (pull_request) Successful in 4m10s

Details

2026-10-27 06:05:27 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 60a1e592e1

Validate / Terraform format + validate (pull_request) Successful in 1m53s

Details

Validate / Kubernetes manifests (pull_request) Successful in 2m26s

Details

Validate / Ansible lint (pull_request) Successful in 4m10s

Details

to 58c45b0b40

Validate / Terraform format + validate (pull_request) Successful in 1m5s

Details

Validate / Kubernetes manifests (pull_request) Successful in 1m8s

Details

Validate / Ansible lint (pull_request) Successful in 2m20s

Details

2026-10-27 12:04:14 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 58c45b0b40

Validate / Terraform format + validate (pull_request) Successful in 1m5s

Details

Validate / Kubernetes manifests (pull_request) Successful in 1m8s

Details

Validate / Ansible lint (pull_request) Successful in 2m20s

Details

to f3c395ad0f

Validate / Kubernetes manifests (pull_request) Successful in 42s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m9s

Details

Validate / Ansible lint (pull_request) Successful in 2m28s

Details

2026-10-27 18:04:16 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from f3c395ad0f

Validate / Kubernetes manifests (pull_request) Successful in 42s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m9s

Details

Validate / Ansible lint (pull_request) Successful in 2m28s

Details

to e0b07ae985

Validate / Kubernetes manifests (pull_request) Successful in 1m17s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m20s

Details

Validate / Ansible lint (pull_request) Successful in 2m35s

Details

2026-10-28 06:04:16 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from e0b07ae985

Validate / Kubernetes manifests (pull_request) Successful in 1m17s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m20s

Details

Validate / Ansible lint (pull_request) Successful in 2m35s

Details

to bece3112dd

Validate / Kubernetes manifests (pull_request) Successful in 41s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m7s

Details

Validate / Ansible lint (pull_request) Successful in 2m36s

Details

2026-10-28 12:04:06 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from bece3112dd

Validate / Kubernetes manifests (pull_request) Successful in 41s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m7s

Details

Validate / Ansible lint (pull_request) Successful in 2m36s

Details

to 421cf49c92

Validate / Kubernetes manifests (pull_request) Successful in 55s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m0s

Details

Validate / Ansible lint (pull_request) Successful in 2m25s

Details

2026-10-28 18:04:10 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 421cf49c92

Validate / Kubernetes manifests (pull_request) Successful in 55s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m0s

Details

Validate / Ansible lint (pull_request) Successful in 2m25s

Details

to 16e0b764ed

Validate / Kubernetes manifests (pull_request) Successful in 1m5s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m6s

Details

Validate / Ansible lint (pull_request) Successful in 2m26s

Details

2026-10-29 00:05:07 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 16e0b764ed

Validate / Kubernetes manifests (pull_request) Successful in 1m5s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m6s

Details

Validate / Ansible lint (pull_request) Successful in 2m26s

Details

to 3c76ba233a

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 41s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m24s

Details

Terraform / plan (pull_request) Failing after 1m27s

Details

Validate / Ansible lint (pull_request) Successful in 2m44s

Details

2026-10-29 06:02:51 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 3c76ba233a

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 41s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m24s

Details

Terraform / plan (pull_request) Failing after 1m27s

Details

Validate / Ansible lint (pull_request) Successful in 2m44s

Details

to bad57058fd

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 48s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m20s

Details

Terraform / plan (pull_request) Failing after 1m21s

Details

Validate / Ansible lint (pull_request) Successful in 2m41s

Details

2026-10-29 12:03:15 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from bad57058fd

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 48s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m20s

Details

Terraform / plan (pull_request) Failing after 1m21s

Details

Validate / Ansible lint (pull_request) Successful in 2m41s

Details

to cfda854f88

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 41s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m19s

Details

Terraform / plan (pull_request) Failing after 1m21s

Details

Validate / Ansible lint (pull_request) Successful in 2m42s

Details

2026-10-29 18:03:35 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from cfda854f88

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 41s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m19s

Details

Terraform / plan (pull_request) Failing after 1m21s

Details

Validate / Ansible lint (pull_request) Successful in 2m42s

Details

to b13a62ed8b

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 40s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m12s

Details

Terraform / plan (pull_request) Failing after 1m19s

Details

Validate / Ansible lint (pull_request) Successful in 2m54s

Details

2026-10-30 00:04:28 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from b13a62ed8b

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 40s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m12s

Details

Terraform / plan (pull_request) Failing after 1m19s

Details

Validate / Ansible lint (pull_request) Successful in 2m54s

Details

to 2e1f988206

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 57s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m1s

Details

Terraform / plan (pull_request) Failing after 1m26s

Details

Validate / Ansible lint (pull_request) Successful in 3m14s

Details

2026-10-30 12:02:47 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 2e1f988206

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 57s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m1s

Details

Terraform / plan (pull_request) Failing after 1m26s

Details

Validate / Ansible lint (pull_request) Successful in 3m14s

Details

to 0fdc996496

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 48s

Details

Terraform / plan (pull_request) Failing after 1m23s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m23s

Details

Validate / Ansible lint (pull_request) Successful in 2m41s

Details

2026-10-30 18:02:54 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 0fdc996496

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 48s

Details

Terraform / plan (pull_request) Failing after 1m23s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m23s

Details

Validate / Ansible lint (pull_request) Successful in 2m41s

Details

to 53d745eaaf

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 45s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m19s

Details

Terraform / plan (pull_request) Failing after 1m20s

Details

Validate / Ansible lint (pull_request) Successful in 2m39s

Details

2026-10-31 00:03:34 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 53d745eaaf

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 45s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m19s

Details

Terraform / plan (pull_request) Failing after 1m20s

Details

Validate / Ansible lint (pull_request) Successful in 2m39s

Details

to 4b39779925

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 44s

Details

Terraform / plan (pull_request) Failing after 1m25s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m24s

Details

Validate / Ansible lint (pull_request) Successful in 2m42s

Details

2026-10-31 06:03:51 +00:00

Compare

renovate-bot force-pushed renovate/all-non-major-updates from 4b39779925

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 44s

Details

Terraform / plan (pull_request) Failing after 1m25s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m24s

Details

Validate / Ansible lint (pull_request) Successful in 2m42s

Details

to 96e4d66521

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 55s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m12s

Details

Terraform / plan (pull_request) Failing after 1m21s

Details

Validate / Ansible lint (pull_request) Successful in 2m36s

Details

2026-10-31 12:02:57 +00:00

Compare

Terraform / apply (pull_request) Has been skipped

Details

Validate / Kubernetes manifests (pull_request) Successful in 55s

Details

Validate / Terraform format + validate (pull_request) Successful in 1m12s

Details

Terraform / plan (pull_request) Failing after 1m21s

Details

Validate / Ansible lint (pull_request) Successful in 2m36s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/all-non-major-updates:renovate/all-non-major-updates

git switch renovate/all-non-major-updates

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/all-non-major-updates

git switch renovate/all-non-major-updates

git rebase main

git switch main

git merge --ff-only renovate/all-non-major-updates

git switch renovate/all-non-major-updates

git rebase main

git switch main

git merge --no-ff renovate/all-non-major-updates

git switch main

git merge --squash renovate/all-non-major-updates

git switch main

git merge --ff-only renovate/all-non-major-updates

git switch main

git merge renovate/all-non-major-updates

git push origin main

Rows
Columns

chore(deps): update all non-major updates #127

Release Notes

Changes

Features

Fixes

Changes

Features

Performance

Fixes

Upgrading to Stalwart 1.0

Security

Features

Fixes

v1.6.0: : Tightening the Bolts

New

Downloads that finish when they should

Louder when something breaks, quieter about what it knows

Smaller fixes

The image

Under the hood and docs

Changelog

Bug fixes

Container image

Install/upgrade

Changelog

Bug fixes

Container image

Install/upgrade

Changelog

Bug fixes

Tests

Chores

Container image

Install/upgrade

Features

Bugfixes

Internal Changes

Fixed

⚠ BREAKING CHANGES

Bug Fixes

Miscellaneous

What's Changed

New Contributors

✨ Features

🐛 Bug Fixes

Configuration

Checkout

Merge

`v1.6.0`: : Tightening the Bolts