v78

update: roundcube to 1.6.20 for recently reported security vulnerabilities

CHANGELOG.md

@@ -1,6 +1,17 @@
 CHANGELOG
 =========
 
+Version 78 (October 22, 2026)
+-----------------------------
+
+This is a security update. Although the main security issue this week
+is in upstream PHP and is fixed simply by `apt-get update && apt-get upgrade`,
+updating to the latest Mail-in-a-Box will do that for you. Roundcube
+separately released security fixes in the updated version in this release.
+
+* zpush updated to version 2.7.7.
+* Roundcube updated to 1.6.20.
+
 Version 77 (September 26, 2026)
 -------------------------------
 

setup/bootstrap.sh

@@ -23,7 +23,7 @@ if [ -z "$TAG" ]; then
 	if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then
 		# This machine is running Ubuntu 22.04, which is supported by
 		# Mail-in-a-Box versions 60 and later.
-		TAG=v77
+		TAG=v78
 	elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then
 		# This machine is running Ubuntu 18.04, which is supported by
 		# Mail-in-a-Box versions 0.40 through 5x.

setup/webmail.sh

@@ -36,8 +36,8 @@ apt_install \
 #   https://github.com/mstilkerich/rcmcarddav/releases
 # The easiest way to get the package hashes is to run this script and get the hash from
 # the error message.
-VERSION=1.6.19
-HASH=d30d11f91857b1962879e06a19ef217dceeb506c
+VERSION=1.6.20
+HASH=15c70410af3071219aae209ba89e2ff1dacb1ab5
 PERSISTENT_LOGIN_VERSION=bde7b6840c7d91de627ea14e81cf4133cbb3c07a # version 5.3
 HTML5_NOTIFIER_VERSION=68d9ca194212e15b3c7225eb6085dbcf02fd13d7 # version 0.6.4+
 CARDDAV_VERSION=4.4.3

setup/zpush.sh

@@ -22,8 +22,8 @@ apt_install \
 phpenmod -v "$PHP_VER" imap
 
 # Copy Z-Push into place.
-VERSION=2.7.6
-TARGETHASH=a0591c8c58b2cdb3ba25cd7a9115a40a3f76a72c
+VERSION=2.7.7
+TARGETHASH=b8ba5fdf5594a642c98f92c30683d19b5c6aae77
 needs_update=0 #NODOC
 if [ ! -f /usr/local/lib/z-push/version ]; then
 	needs_update=1 #NODOC