Dear subscribers
We proudly announce the beta release for the next major version 1.6 of
Roundcube webmail.
With this milestone we cleaned up the code and bring full support for PHP
8.1. The most noteworthy changes are:
- PHP 8.1 support
- Dropped support for PHP < 7.3
- Support responses (snippets) in HTML format
- Option to purge deleted mails older than 30, 60 or 90 days
- Unified and simplified services connection config options
- Removed the Classic and Larry skins from the release packages
- SQLite: Use foreign keys, require SQLite >= 3.6.19
Adding support for PHP 8.1 again required some refactoring of the Roundcube
codebase and removing/replacing now deprecated PHP code. We also used this
cleaning efforts and simplified Roundcube's config options a bit.
*Breaking Changes*
Some config options have either been removed or renamed. Read the details
in the release announcement
<https://roundcube.net/news/2022/03/06/roundcube-1.6-beta-released> on our
website or in the release notes
<https://github.com/roundcube/roundcubemail/releases/tag/1.6-beta>.
If you used the Larry or the Classic skin in your deployment, you need to
install them manually as they are no longer part of the release packages.
They can easily be installed via Composer. See the full changelog in the
release notes on the Github download page
<https://github.com/roundcube/roundcubemail/releases/tag/1.6-beta>.
This is a beta release and we recommend to test it on a separate
environment. Download it from roundcube.net
<https://roundcube.net/download/>. Migrate existing configs with either the
installto.sh or the update.sh scripts. And don't forget to backup your data
before installing it.
Cheers,
Thomas & Alec
Dear subscribers
Due to some technical issues with our mailing lists, it was not possible
for us to announce new releases through this list. Please accept our
apologies for this inconvenience. There were a few releases for Roundcube
Webmail since the last post to this list so please read about them in our
news stream at https://roundcube.net/news/
Kind regards,
Thomas
Dear subscribers
We proudly announce the final release of the next major version 1.5 of
Roundcube webmail. With this milestone we introduce new features and full
PHP 8.0 support. The most noteworthy additions are:
- Dark mode for Elastic skin
- OAuth2/XOauth support (with plugin hooks)
- Collected recipients and trusted senders
- Moving recipients between inputs with drag & drop
- Full unicode support with MySQL database
- Support of IMAP LITERAL- extension RFC 7888
<https://datatracker.ietf.org/doc/html/rfc7888>
- Support of RFC 2231 <https://datatracker.ietf.org/doc/html/rfc2231>
encoded names
- Cache refactoring
See the full changelog in the release notes
<https://github.com/roundcube/roundcubemail/releases/tag/1.5.0> on the
Github download page.
We also disabled the spell checking feature using spell.roundcube.net by
default because some privacy concerns were raised. It now needs to be
enabled explicitly by setting the enable_spellcheck config option to true.
In case you’re running Roundcube directly from source or if you’re not
using the complete package, you need to install 3rd party PHP and
JavaScript modules manually. See this post for more details
<https://roundcube.net/news/2021/10/18/roundcube-1.5.0-released>.
This release is considered stable and we encourage you to update your
productive installations after carefully testing the upgrade scenario.
Download it from roundcube.net <https://roundcube.net/download>.
With the release of Roundcube 1.5.0, the previous stable release branches
1.4.x and 1.3.x will change into LTS low maintenance mode which means they
will only receive important security updates but no longer any regular
improvement updates. The 1.2.x series is no longer supported and maintained.
Kind regards
Alec & Thomas
Dear subscribers
We proudly announce the beta release for the next major version 1.5 of
Roundcube webmail. With this milestone we introduce new features and
long-awaited improvements. The most noteworthy additions are:
- PHP 8.0 support
- OAuth2/XOauth support
- Dark mode for Elastic skin
- Collected recipients and trusted senders
- Moving recipients between inputs with drag & drop
- Full unicode support with MySQL database
- Cache refactoring
Adding support for PHP 8 required some deep refactoring of the Roundcube
codebase which started with early PHP 5 versions. However, this refactoring
also was a bit of a cleaning procedure and resulted in more testable
components.
In case you’re running Roundcube directly from source or if you’re not
using the complete package, you need to install 3rd party javascript
modules using the bin/install-jsdeps.sh script. With this release the
toolchain required to build a functional package has changed a bit:
- bin/jsshrink.sh: replaced google-closure-compiler with UglifyJS
- bin/cssshrink.sh: replaced yuicompressor with csso
- Elastic theme: require lessc >= 2.5.2 (and add support for v4) with
less-plugin-clean-css
See the full changelog in the release notes
<https://github.com/roundcube/roundcubemail/releases/tag/1.5-beta> on the
Github download page.
This is a beta release and we recommend to test it on a separate
environment. And don’t forget to backup your data before installing it.
Download it from roundcube.net <https://roundcube.net/download>.
If you intend to test new Roundcube with OAuth2, have a look at this wiki
page <https://github.com/roundcube/roundcubemail/wiki/Configuration:-OAuth2>
.
We also have some Docker images
<https://hub.docker.com/r/roundcube/roundcubemail/tags?page=1&name=beta>
available for quick testing and evaluation.
Kind regards,
Alec & Thomas
Dear subscribers
We just published a service and security update to the stable version 1.4
of Roundcube Webmail.
It provides a fix for a recently reported stored XSS vulnerability as well
a some general improvements from our issue tracker.
*Security fix*
Fix cross-site scripting (XSS) via HTML messages with malicious CSS content
Credits go to Mateusz Szymaniec (CERT Polska).
See the full changelog in the release notes on the Github download page:
https://github.com/roundcube/roundcubemail/releases/tag/1.4.11
This release is considered stable and we recommend to update all productive
installations of Roundcube with this version.
Download it from https://roundcube.net/download/
Please do backup your data before updating!
Best,
Alec & Thomas
Dear subscribers
We proudly announce yesterday's release of version 1.4.9. It's a service
update to the stable version 1.4 of Roundcube Webmail.
It contains fixes and general improvements from our issue tracker, mainly
related to email composition and UI oddities in Elastic skin and with the
TinyMCE richtext editor. See the full changelog in the release notes on the
Github download page [1].
This version is considered stable and we recommend updating all productive
installations of Roundcube with it.
Download the latest tarballs from https://roundcube.net/download
Best,
Alec & Thomas
[1] https://github.com/roundcube/roundcubemail/releases/tag/1.4.9
Dear subscribers
We just published security updates to the stable version 1.4 and the LTS
versions 1.3 and 1.2 of Roundcube Webmail.
They all contain two recently reported cross-site scripting (XSS)
vulnerabilities. The 1.4.8 release also contains a number of general
improvements from our issue tracker [1].
Security fixes:
* Fix cross-site scripting (XSS) via HTML messages with malicious svg
content (CVE-2020-16145)
* Fix cross-site scripting (XSS) via HTML messages with malicious math
content
Credits for these two findings go to Łukasz Pilorz from Pentesters [2].
See the full changelogs in the release notes on the Github download pages
for the updated versions.
We strongly recommend updating all productive installations of Roundcube
with these new versions. Download the latest tarballs from
https://roundcube.net/download
Best,
Alec & Thomas
[1] https://github.com/roundcube/roundcubemail/releases/tag/1.4.8
[2] https://www.pentesters.pl/
Dear subscribers
We just published security updates to the stable version 1.4 and the LTS
versions 1.3 and 1.2 of Roundcube Webmail.
They all contain a recently reported cross-site scripting (XSS)
vulnerability via HTML messages with malicious svg/namespace.
Credits for this finding go to SSD Secure Disclosure [1].
The 1.4.7 release also contains a number of general improvements from our
issue tracker.
See the full changelog in the release notes on the Github download page [2].
We strongly recommend to update all productive installations of Roundcube
with these new versions.
Download the latest tarballs from https://roundcube.net/download
Best,
Alec & Thomas
[1] https://ssd-disclosure.com/
[2] https://github.com/roundcube/roundcubemail/releases/tag/1.4.7