YariloMail 2.4.2: sdbox fix and a Go security update ​

11 October 2026

YariloMail 2.4.2 is a patch release of the 2.4 stable line. Upgrade promptly if you run sdbox: 2.4.1 deletes sdbox messages older than a day on the first open of each folder.

Security ​

The release is built with Go 1.26.9 and golang.org/x/net v0.60.0, which fix GO-2026-6617, an HTTP/2 HPACK encoder race.

Fixed ​

  • sdbox: the temporary-file sweep removes only .temp.* files, not delivered messages.
  • maildir: UID list locking and reconcile fixes; renamed messages are kept and a UID is never reused.
  • All formats: the APPEND date reaches storage and survives a rebuild.
  • Director: a domain move no longer panics or splits a domain across backends.

Added ​

  • An operator domain move: yarctl director domains move and the matching director API call.
  • The OAuth2 client secret and policy API secrets can come from environment variables, filled from a Kubernetes Secret by the chart.

Before you upgrade ​

2.4.2 is stricter about configuration. An explicit 0 now turns a setting off or is refused at startup, a negative value is refused, and the chart fails the render on a key it does not read instead of dropping it. A static userdb now answers only users a passdb knows. Read the release notes before you run helm upgrade.

Get it ​