YariloMail 2.4.3: a nologin fix, the JMAP write path and safer backend rollouts ​

17 October 2026

YariloMail 2.4.3 is a patch release of the 2.4 stable line. Upgrade promptly if you disable accounts with a passdb nologin field: before 2.4.3 such an account still logged in.

Security ​

  • A passdb nologin sent as key=value was ignored, so a disabled account logged in over IMAP, POP3, Submission and JMAP Basic. Fixed.

New ​

  • JMAP write path: Email/set, Email/import, blob upload and Mailbox/set, with FTS, quota and conversations kept in step.
  • JMAP Bearer goes through the auth service with the same OAuth2 settings, penalties and policy as the other protocols.
  • OAuth2: the password grant, local keys, forced introspection, a per-entry CA and a limit on JWKS refreshes for unknown key ids.
  • SQL queries take %s, %r and %l, so one account can be refused one protocol and keep the others.

Fixed ​

  • Backend rollout and failover: a removed backend's users move to a live backend on their next login, a session token survives a backend that died before its greeting, and a stopping backend refuses new sessions.
  • mdbox: converted stores with a rotated map log are read in full, and map locking and rebuild are fixed.
  • IMAP, POP3, JMAP, FTS and auth: a set of protocol fixes; the release notes list them.

Before you upgrade ​

  • Submission now names itself submission to the auth service, not smtp. A SQL rule on %s meant for it must test submission. During the rollout from 2.4.2, Submission logins fail wherever an old and a new component meet, for the length of the backend rollout (minutes); IMAP, POP3, ManageSieve and JMAP are not affected.
  • fts-flatcurve is a reserved folder name on mdbox and sdbox.
  • Pull the new image onto the backend nodes before helm upgrade, and keep room for one more backend pod.

Read the release notes before you run helm upgrade.

Get it ​