Modoboa Files

What's Changed

• Bump caldav from 3.2.0 to 3.2.1 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4043
• Updates for file frontend/src/locale/en/app.po in ru by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4044
• Updates for file modoboa/locale/en/LC_MESSAGES/django.po in ru by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4045
• Updates for file frontend/src/locale/en/app.po in ru by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4046
• chore: update metadata and contributing file by @kryskool in https://github.com/modoboa/modoboa/pull/4048
• Bump django from 5.2.14 to 5.2.15 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4049
• fix: retrieve version when not installed as package by @kryskool in https://github.com/modoboa/modoboa/pull/4050
• Bump django-reversion from 6.2.0 to 6.3.0 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4052
• chore(deps-dev): bump vite from 8.0.14 to 8.0.16 in /frontend by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4053
• chore(deps): bump form-data from 4.0.5 to 4.0.6 in /frontend by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4054
• Don’t depend on running Redis for caching when executing tests by @ntninja in https://github.com/modoboa/modoboa/pull/4051
• fix(calendar): Fixed 2 IDOR issues in calendar component by @tonioo in https://github.com/modoboa/modoboa/pull/4056
• fix(dmarc): bound decompression of aggregate report archives by @tonioo in https://github.com/modoboa/modoboa/pull/4058
• fix(webmail): Fixed 2 security issues in webmail component: by @tonioo in https://github.com/modoboa/modoboa/pull/4057
• fix(export): Prevent CSV formula injection. by @tonioo in https://github.com/modoboa/modoboa/pull/4061
• fix(amavis): Enforce access control on quarantine write actions by @tonioo in https://github.com/modoboa/modoboa/pull/4062
• fix(imap_migration): Fix cross-tenant disclosure in migration API by @tonioo in https://github.com/modoboa/modoboa/pull/4063
• fix(parameters): prevent secret disclosure via global parameters API by @tonioo in https://github.com/modoboa/modoboa/pull/4064
• fix(admin): enforce access control on account domains field by @tonioo in https://github.com/modoboa/modoboa/pull/4070
• fix(admin): prevent path traversal via domain name in DKIM key genera… by @tonioo in https://github.com/modoboa/modoboa/pull/4071
• fix(calendars): prevent rights file injection via calendar name by @tonioo in https://github.com/modoboa/modoboa/pull/4072
• fix(imap_migration): prevent code injection via folder filter params by @tonioo in https://github.com/modoboa/modoboa/pull/4073
• chore(deps): bump fido2 from 2.2.0 to 2.2.1 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4069
• Better crypto key management by @tonioo in https://github.com/modoboa/modoboa/pull/4080
• fix(core): pin rq<2.10.0 to prevent rqcron scheduler crash by @BrunoNyland in https://github.com/modoboa/modoboa/pull/4076
• fix(autoconfig): parse real Outlook Autodiscover XML request body by @BrunoNyland in https://github.com/modoboa/modoboa/pull/4075
• Fix/i18n core improvements v2 by @BrunoNyland in https://github.com/modoboa/modoboa/pull/4078
• feat(admin): add account bulk delete API endpoint by @tonioo in https://github.com/modoboa/modoboa/pull/4081
• Allow policy daemon to listen on Unix domain socket and systemd socket activation by @ntninja in https://github.com/modoboa/modoboa/pull/3677
• fix(security): hardening core admin by @tonioo in https://github.com/modoboa/modoboa/pull/4079
• feat(core,admin,webmail): add doveadm HTTP API support by @tonioo in https://github.com/modoboa/modoboa/pull/4083
• fix(admin): don't re-validate domain quota when quota is unchanged by @tonioo in https://github.com/modoboa/modoboa/pull/4086
• refactor(admin): use queryset delete in accounts bulk_delete by @tonioo in https://github.com/modoboa/modoboa/pull/4087
• chore(deps): bump django from 5.2.15 to 5.2.16 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4089
• fix(autoconfig): Thunderbird Mobile Autoconfig changes by @pionsys-mhs in https://github.com/modoboa/modoboa/pull/4074
• fix(admin): enable ordering by quota_usage on accounts endpoint by @tonioo in https://github.com/modoboa/modoboa/pull/4093
• security: use defusedxml to protect against XML attacks by @AndrianBalanescu in https://github.com/modoboa/modoboa/pull/4094
• fix(webmail): lazy-load contacts models to allow disabling contacts app by @tonioo in https://github.com/modoboa/modoboa/pull/4096

New Contributors

• @BrunoNyland made their first contribution in https://github.com/modoboa/modoboa/pull/4076
• @AndrianBalanescu made their first contribution in https://github.com/modoboa/modoboa/pull/4094

Full Changelog: https://github.com/modoboa/modoboa/compare/2.9.0...2.9.1