🍀🐮 Moorch 2026 | forced 2FA, DNS-01, SOGo & Rspamd Updates

What's Changed

New Features

• [Web] Add forced 2FA setup and password update enforcement by @FreddleSpl0it in #7077
• Add skip feature to mailcow admin password reset script by @HichemAK in #7078
• feat: Implement passwordless autodiscover endpoint by @DerLinkman in #6976
• acme: add DNS challenges by @cjlapao in #6912 (Documentation)
• [SOGo] Build SOGo from source with security patches by @FreddleSpl0it in #7086
• [SOGo] Update to 5.12.5 by @FreddleSpl0it in #7098
• [Rspamd] Update to 3.14.3-1 by @FreddleSpl0it in #7100

Bug Fixes

• Fix lua script sub-addressing by @DocFraggle in #7037
• Document qitem endpoint in openapi.yaml for editing quarantine mails by @jonprocter in #7047
• check_dns: better time measurement by @maxi322 in #6695
• fix: show stopped and failed containers in dashboard and API by @JeremieCrinon in #7082
• Bump alpine version of netfilter by @jovobe in #7060
• [Web] Add missing EAS and DAV protocol options to mailbox bulk actions by @FreddleSpl0it in #7088
• [Web] switch from GET to POST for datatable requests by @FreddleSpl0it in #7089
• [SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view by @FreddleSpl0it in #7093

Other

• Translations update from Weblate by @milkmaker in #7040
• Translations update from Weblate by @milkmaker in #7055
• Translations update from Weblate by @milkmaker in #7069
• Translations update from Weblate by @milkmaker in #7091
• Translations update from Weblate by @milkmaker in #7095
• [Postfix] update postscreen_access.cidr by @milkmaker in #7042
• [Postfix] update postscreen_access.cidr by @milkmaker in #7084
• Update actions/stale action to v10.2.0 by @renovate[bot] in #7062
• Update docker/build-push-action action to v7 by @renovate[bot] in #7097
• chore(deps): update dependency composer/composer to v2.9.5 by @renovate[bot] in #6457
• chore(deps): update docker/setup-qemu-action action to v4 by @renovate[bot] in #7092
• chore(deps): update docker/login-action action to v4 by @renovate[bot] in #7094
• chore(deps): update docker/setup-buildx-action action to v4 by @renovate[bot] in #7096

Notes

Special thanks to Philipps-Universität Marburg for sponsoring the development of the forced 2FA setup feature in this release and supporting the continued security improvements of mailcow.

New Contributors

• @HichemAK made their first contribution in #7078
• @jonprocter made their first contribution in #7047
• @JeremieCrinon made their first contribution in #7082
• @jovobe made their first contribution in #7060
• @cjlapao made their first contribution in #6912

Full Changelog: 2026-01...2026-03