# changelog

author: Ralf Ertzinger <ralf@skytale.net> - 0.6.7-19.20061216
changelog:
  - Fix stack trashing due to wrong size calculation, closes bz1042667
  - Fix compiler warnings about narrowing longs into chars


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.10-1
changelog:
  - dovecot updated to 2.2.10
  - quota-status: quota_grace was ignored
  - ldap: Fixed memory leak with auth_bind=yes and without
    auth_bind_userdn.
  - imap: Don't send HIGHESTMODSEQ anymore on SELECT/EXAMINE when
    CONDSTORE/QRESYNC has never before been enabled for the mailbox.
  - imap: Fixes to handling mailboxes without permanent modseqs.
    (When [NOMODSEQ] is returned by SELECT, mainly with in-memory
    indexes.)
  - imap: Various fixes to METADATA support.
  - stats plugin: Processes that only temporarily dropped privileges
    (e.g. indexer-worker) may have been logging errors about not being
    able to open /proc/self/io.


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.11-1
changelog:
  - dovecot updated to 2.2.11
  - imap: SEARCH/SORT PARTIAL reponses may have been too large.
  - doveadm backup: Fixed assert-crash when syncing mailbox deletion.


author: John Morris <john@zultron.com> - 1:2.2.12-2
changelog:
  - el6 build fixes (#1082384):
  - el6 autoconf too old to regen; use packaged files
  - fix compile error when __global_ldflags macro undefined


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.13-1
changelog:
  - dovecot updated to 2.2.13
  - fixes CVE-2014-3430: denial of service through maxxing out SSL connections
  - pop3 server was still crashing in v2.2.12 
  - maildir: Various fixes and improvements to handling compressed mails
  - fts-lucene, fts-solr: Fixed crash on search when the index contained
    duplicate entries.
  - mail_attachment_dir: Attachments with the last base64-encoded line
    longer than the rest wasn't handled correctly.
  - IMAP: SEARCH/SORT PARTIAL was handled completely wrong in v2.2.11+
  - acl: Global ACL file handling was broken when multiple entries
    matched the mailbox name


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.14-1
changelog:
  - dovecot updated to 2.2.14, pigeonhole updated to 0.4.3
  - fixed several race conditions with dovecot.index.cache handling that
    may have caused unnecessary "cache is corrupted" errors.
  - auth: If auth client listed userdb and disconnected before finishing,
    the auth worker process got stuck
  - imap-login, pop3-login: Fixed potential crashes when client
    disconnected unexpectedly.
  - imap proxy: The connection was hanging in some usage patterns.


author: Django <django@mailserver.guru> - 1:2.2.15-1
changelog:
  - Plugins can now print a banner comment in doveconf output
      (typically the plugin version)
    - Replication plugin now triggers low (instead of high) priority for
      mail copying operations.
    - IMAP/POP3/ManageSieve proxy: If destination server can't be
      connected to, retry connecting once per second up to the value of
      proxy_timeout. This allows quick restarts/upgrades on the backend
      server without returning login failures.
    - Internal passdb lookups (e.g. done by lmtp/doveadm proxy) wasn't
      returning failure in some situations where it should have (e.g.
      allow_nets mismatch)
    - LMTP uses mail_log_prefix now for logging mail deliveries instead of
      a hardcoded prefix. The non-delivery log prefix is still hardcoded
      though.

       + passdb allow_nets=local matches lookups that don't contain an IP
         address (internally done by Dovecot services)
       + Various debug logging and error logging improvements
       - Various race condition fixes to LAYOUT=index
        - v2.2.14 virtual plugin crashed in some situations


author: Django <django@mailserver.guru> - 1:2.2.15-1
changelog:
  - Plugins can now print a banner comment in doveconf output
      (typically the plugin version)
    - Replication plugin now triggers low (instead of high) priority for
      mail copying operations.
    - IMAP/POP3/ManageSieve proxy: If destination server can't be
      connected to, retry connecting once per second up to the value of
      proxy_timeout. This allows quick restarts/upgrades on the backend
      server without returning login failures.
    - Internal passdb lookups (e.g. done by lmtp/doveadm proxy) wasn't
      returning failure in some situations where it should have (e.g.
      allow_nets mismatch)
    - LMTP uses mail_log_prefix now for logging mail deliveries instead of
      a hardcoded prefix. The non-delivery log prefix is still hardcoded
      though.

       + passdb allow_nets=local matches lookups that don't contain an IP
         address (internally done by Dovecot services)
       + Various debug logging and error logging improvements
       - Various race condition fixes to LAYOUT=index
       - v2.2.14 virtual plugin crashed in some situations


author: Django <django@mailserver.guru> - 1:2.2.15-2
changelog:
  + Added a Pigeonhole version banner to doveconf output. This way, future
      bug reports will also include Pigeonhole version information.
    - Fixed handling of implicit keep. Last version erroneously reported
      that implicit keep succeeded after an earlier failure, while it in
      fact had failed. Particularly occurred for mailbox quota errors.
    - Fixed segfault occurring on SunOS systems when there is no active
      script.


author: Django <django@mailserver.guru> - 1:2.2.15-3
changelog:
  + lmtp: Added support for STARTTLS command. 
    + lmtp: Added TLS security information to Received: header when 
      STARTTLS was used.


author: Django <django@mailserver.guru> - 1:2.2.16-1
changelog:
  * dbox: Resyncing (e.g. doveadm force-resync) no longer deletes
     dovecot.index.cache file. The cache file was rarely the problem
     so this just caused unnecessary slowness.
   * Mailbox name limits changed during mailbox creation: Each part of
     a hierarchical name (e.g. "x" or "y" in "x/y") can now be up to 255
     chars long (instead of 200). This also reduces the max number of
     hierarchical levels to 16 (instead of 20) to keep the maximum name
     length 4096 (a common PATH_MAX limit). The 255 char limit is
     hopefully large enough for migrations from all existing systems.
     It's also the limit on many filesystems.

   + director: Added director_consistent_hashing setting to enable
     consistent hashing (instead of the mostly-random MD5 hashing).
     This causes fewer user moves between backends when backend counts
     are changed, which may improve performance (mainly due to caching).
   + director: Added support for "tags", which allows one director ring
     to serve multiple backend clusters with different sets of users.
   + LMTP server: Added lmtp_user_concurrency_limit setting to limit how
     many LMTP deliveries can be done concurrently for a single user.
   + LMTP server: Added support for STARTTLS command.
   + If logging data is generated faster than it can be written, log a
     warning about it and show information about it in log process's
     process title in ps output. Also don't allow a single service to
     flood too long at the cost of delaying other services' logging.
   + stats: Added support for getting global statistics.
   + stats: Use the same session IDs as the rest of Dovecot.
   + stats: Plugins can now create their own statistics fields
   + doveadm server: Non-mail related commands can now also be used
     via doveadm server (TCP socket).
   + doveadm proxying: passdb lookup can now override doveadm_port and
     change the username.
   + doveadm: Search query supports now "oldestonly" parameter to stop
     immediately on the first non-match. This can be used to optimize:
     doveadm expunge mailbox Trash savedbefore 30d oldestonly
   + doveadm: Added "save" command to directly save mails to specified
     mailbox (bypassing Sieve).
   + doveadm fetch: Added body.snippet field, which returns the first
     100 chars of a message without whitespace or HTML tags. The result
     is stored into dovecot.index.cache, so it can be fetched efficiently.
   + dsync: Added -t <timestamp> parameter to sync only mails newer than
     the given received-timestamp.
   + dsync: Added -F [-]<flag> parameter to sync only mails with[out] the
     given flag/keyword.
   + dsync: Added -a <mailbox> parameter to specify the virtual mailbox
     containing user's all mails. If this mailbox is already found to
     contain the wanted mail (by its GUID), the message is copied from
     there instead of being re-saved. (This isn't efficient enough yet
     for incremental replication.)
   + dsync: -m parameter can now specify \Special-use names for mailboxes.
   + imapc: Added imapc_features=gmail-migration to help migrations from
     GMail. See http://wiki2.dovecot.org/Migration/Gmail
   + imapc: Added imapc_features=search to support IMAP SEARCH command.
     (Currently requires ESEARCH support from remote server.)
   + expire plugin: Added expire_cache=yes setting to cache most of the
     database lookups in dovecot index files.
   + quota: If overquota-flag in userdb doesn't match the current quota
     usage, execute a configured script.
   + redis dict: Added support for expiring keys (:expire_secs=n) and
     specifying the database number (:db=n)
   - auth: Don't crash if master user login is attempted without
     any configured master=yes passdbs
   - Parsing UTF-8 text for mails could have caused broken results
     sometimes if buffering was split in the middle of a UTF-8 character.
     This affected at least searching messages.
   - String sanitization for some logged output wasn't done properly:
     UTF-8 text could have been truncated wrongly or the truncation may
     not have happened at all.
   - fts-lucene: Lookups from virtual mailbox consisting of over 32
     physical mailboxes could have caused crashes.


author: Django <django@mailserver.guru> - 1:2.2.17-1
changelog:
  * Dovecot no longer checks or warns if a mountpoint is removed. This
     was causing more trouble than it was worth. Make sure that all the
     mountpoints that Dovecot accesses aren't writable by mail processes
     when they're unmounted.
   * dict server wasn't properly escaping/unescaping data. Fixing this
     broke backwards compatibility with data that contains line feeds.
     This hopefully affects only very few installations. If you're using
     dict to save multiline data (Sieve scripts to SQL), you may be
     affected.
   * imap: SPECIAL-USE capability is no longer advertised if there are
     no special_use flags specified for any mailboxes.
   + lmtp: Added lmtp_hdr_delivery_address setting to specify whether
     to include email address in Delivered-To: and Received: headers.
   + Added initial version of full text search library, which includes
     language-specific text normalization and filtering. This is still
     in development, but it's already possible to use for testing with
     fts-lucene and fts-solr.
   + lda, lmtp: deliver_log_format can now include %{delivery_time},
     which expands to how many milliseconds it took to deliver the mail.
     With LMTP %{session_time} also expands to how many milliseconds the
     LMTP session took, not including the delivery time.
   + lmtp proxy: Mail delivery logging includes timing information.
   + imap: Most IMAP commands now include in the tagged reply how many
     milliseconds it took to run the command (not counting the time spent
     on waiting for the IMAP client to read/write data).
   + director: Implemented director_proxy_maybe passdb extra field to
     be able to run director and backend in the same Dovecot instance.
     (LMTP doesn't support mixed proxy/non-proxy destinations currently.)
   + doveadm: Added -F <file> parameter to read a list of users from the
     given file and run the command for all the users. This is similar to
     -A parameter reading the list of users from userdb lookup.
   + Implemented initial Cassandra CQL support as lib-sql backend. It's
     only usable as dict backend currently.
   + Added quota-clone plugin to copy current quota usage to a dict.
   - auth: If auth_master_user_separator was set, auth process could be
     crashed by trying to log in with empty master username.
   - imap-login, pop3-login: Fixed crash on handshake failures with new
     OpenSSL versions (v1.0.2) when SSLv3 was disabled.
   - auth: If one passdb fails allow_nets check, it shouldn't have failed
     all the other passdb checks later on.
   - imap: Server METADATA couldn't be accessed
   - imapc: Fixed \Muted label handling in gmail-migration.
   - imapc: Various bugfixes and improvements.
   - Trash plugin fixes by Alexei Gradinari
   - mbox: Fixed crash/corruption in some situations


author: Django <django@mailserver.guru> - 1:2.2.18-1
changelog:
  - director: Login UNIX sockets were normally detected as doveadm or
     director ring sockets, causing it to break in existing installations.
   - sdbox: When copying a mail in alt storage, place the destination to
     alt storage as well.


author: Django <django@mailserver.guru> - 1:2.2.17-1
changelog:
  Dovecot no longer checks or warns if a mountpoint is removed. This
     was causing more trouble than it was worth. Make sure that all the
     mountpoints that Dovecot accesses aren't writable by mail processes
     when they're unmounted.
     dict server wasn't properly escaping/unescaping data. Fixing this
     broke backwards compatibility with data that contains line feeds.
     This hopefully affects only very few installations. If you're using
     dict to save multiline data (Sieve scripts to SQL), you may be
     affected.
     imap: SPECIAL-USE capability is no longer advertised if there are
     no special_use flags specified for any mailboxes.
   + lmtp: Added lmtp_hdr_delivery_address setting to specify whether
     to include email address in Delivered-To: and Received: headers.
   + Added initial version of full text search library, which includes
     language-specific text normalization and filtering. This is still
     in development, but it's already possible to use for testing with
     fts-lucene and fts-solr.
   + lda, lmtp: deliver_log_format can now include %{delivery_time},
     which expands to how many milliseconds it took to deliver the mail.
     With LMTP %{session_time} also expands to how many milliseconds the
     LMTP session took, not including the delivery time.
   + lmtp proxy: Mail delivery logging includes timing information.
   + imap: Most IMAP commands now include in the tagged reply how many
     milliseconds it took to run the command (not counting the time spent
     on waiting for the IMAP client to read/write data).
   + director: Implemented director_proxy_maybe passdb extra field to
     be able to run director and backend in the same Dovecot instance.
     (LMTP doesn't support mixed proxy/non-proxy destinations currently.)
   + doveadm: Added -F <file> parameter to read a list of users from the
     given file and run the command for all the users. This is similar to
     -A parameter reading the list of users from userdb lookup.
   + Implemented initial Cassandra CQL support as lib-sql backend. It's
     only usable as dict backend currently.
   + Added quota-clone plugin to copy current quota usage to a dict.
   - auth: If auth_master_user_separator was set, auth process could be
     crashed by trying to log in with empty master username.
   - imap-login, pop3-login: Fixed crash on handshake failures with new
     OpenSSL versions (v1.0.2) when SSLv3 was disabled.
   - auth: If one passdb fails allow_nets check, it shouldn't have failed
     all the other passdb checks later on.
   - imap: Server METADATA couldn't be accessed
   - imapc: Fixed \Muted label handling in gmail-migration.
   - imapc: Various bugfixes and improvements.
   - Trash plugin fixes by Alexei Gradinari
   - mbox: Fixed crash/corruption in some situations


author: Django <django@mailserver.guru> - 1:2.2.19-1
changelog:
  pop3_deleted_flag has been broken since v2.2.10. Using it would
     cause buffer overflows, which could be exploitable. However, this
     bug would have become visible quite soon after users had deleted
     some POP3 mails, because the pop3 processes would have started
     crashing all the time even in normal use.
     "doveadm director flush" command has a changed meaning now:
     It safely moves users to their wanted backends, instead of simply
     forgetting the mapping entirely and leaving the existing connections
     untouched. Use -F parameter to get the original unsafe behavior.
   + Added imap-hibernate processes (see imap_hibernate_timeout setting).
     IDLEing IMAP connections can be hibernated, which saves memory.
   + Optimized tracking mailboxes' vsizes (= sum of all messages' sizes).
     If mailbox_list_index=yes, it's also stored in there. This makes it
     very efficient to look up vsizes for all mailboxes.
   + Added a quota "count" backend, which uses the mailbox vsizes to get
     the current quota usage. It requires using the new quota_vsizes=yes
     setting, which tracks the messages' "virtual sizes" rather than
     "physical sizes". Their distiction is minor and mostly irrelevant
     nowadays (if mail sizes should be counted with LF or CRLF newlines).
   + "doveadm director up/down" commands added. The monitoring script
     should be using these commands instead of changing the vhost count.
     This allows admin to manually disable a server by changing the vhost
     count to 0 without the monitoring script changing it back.
   + Added support for HAProxy protocol: http://wiki2.dovecot.org/HAProxy
   + Added push-notification plugin framework, which can be used to
     easily implement push notifications to various backends. Implemented
     "ox" backend for notifying Open-Xchange via HTTP/json.
   + imap_logout_format supports more variables now, e.g. number of
     deleted messages.
   + pop3: Added pop3_delete_type setting (related to pop3_deleted_flag).
   + plugin { fts_enforced=yes } setting now fails body searches unless
     it can be done via the full text search engine.
   + Added %{passdb:*} and %{userdb:*} variables to various places
   + auth: Added ":protected" suffix for passdb and userdb fields. If
     used, the field doesn't overwrite an existing field.
   + IMAP/POP3 proxy: If a backend server dies, avoid client reconnection
     spikes by slowly disconnecting clients over time. This is enabled by
     setting login_proxy_max_disconnect_delay=secs passdb extra field.
   + imap: Added new read-only METADATA entries: /private/specialuse,
     /shared/comment, /shared/admin
   + imap: If client disconnects in the middle of a command, log how long
     the command had been running.
   - mdbox: Rebuilding could have caused message's reference count to
     overflow the 16bit number in some situations, causing problems when
     trying to expunge the duplicates.
   - Various search fixes (fts, solr, tika, lib-charset, indexer)
   - Various virtual plugin fixes
   - Various fixes and optimizations to dsync, imapc and pop3-migration
   - imap: Various RFC compliancy and crash fixes to NOTIFY
     Properly implemented checking of ABI version for Sieve interpreter plugins,
     much like Dovecot itself does for plugins. This will prevent plugin ABI
     mismatches.
   + Implemented a vnd.dovecot.environment extension. This builds upon the
     standard environment extension and adds a few more environment items, such
     as username and default mailbox. It also creates a variables namespace so
     that environment items can be accessed directly. I am still thinking about
     more environment items that can be added.
   + Sieve extprograms plugin: Made line endings of the input passed to the
     external programs configurable. This can be configured separately for each
     of the three extensions.
   + ManageSieve: Implemented proxy XCLIENT support. This allows the proxy to
     pass client information to the back-end.
   - ManageSieve: Fixed an assert failure occurring when a client disconnects
     during the GETSCRIPT command.
   - doveadm sieve plugin: Fixed incorrect initialization of mail user. This
     caused a few memory leaks.
   - sieve-filter command line tool: Fixed handling of failure-related implicit
     keep when there is an explicit default destination folder. This caused
     message duplication.
   - lib-sieve: Fixed bug in RFC5322 header folding. Words longer than the
     optimal line length caused empty lines in the output, which would break the
     resulting message header. This surfaced in References: headers with very
     long message IDs.


author: Django <django@mailserver.guru> - 1:2.2.19-2
changelog:
  pop3_deleted_flag has been broken since v2.2.10. Using it would
     cause buffer overflows, which could be exploitable. However, this
     bug would have become visible quite soon after users had deleted
     some POP3 mails, because the pop3 processes would have started
     crashing all the time even in normal use.
     "doveadm director flush" command has a changed meaning now:
     It safely moves users to their wanted backends, instead of simply
     forgetting the mapping entirely and leaving the existing connections
     untouched. Use -F parameter to get the original unsafe behavior.
   + Added imap-hibernate processes (see imap_hibernate_timeout setting).
     IDLEing IMAP connections can be hibernated, which saves memory.
   + Optimized tracking mailboxes' vsizes (= sum of all messages' sizes).
     If mailbox_list_index=yes, it's also stored in there. This makes it
     very efficient to look up vsizes for all mailboxes.
   + Added a quota "count" backend, which uses the mailbox vsizes to get
     the current quota usage. It requires using the new quota_vsizes=yes
     setting, which tracks the messages' "virtual sizes" rather than
     "physical sizes". Their distiction is minor and mostly irrelevant
     nowadays (if mail sizes should be counted with LF or CRLF newlines).
   + "doveadm director up/down" commands added. The monitoring script
     should be using these commands instead of changing the vhost count.
     This allows admin to manually disable a server by changing the vhost 
     count to 0 without the monitoring script changing it back.
   + Added support for HAProxy protocol: http://wiki2.dovecot.org/HAProxy
   + Added push-notification plugin framework, which can be used to
     easily implement push notifications to various backends. Implemented
     "ox" backend for notifying Open-Xchange via HTTP/json.
   + imap_logout_format supports more variables now, e.g. number of
     deleted messages.
   + pop3: Added pop3_delete_type setting (related to pop3_deleted_flag).
   + plugin { fts_enforced=yes } setting now fails body searches unless
     it can be done via the full text search engine.
   + Added %{passdb:*} and %{userdb:*} variables to various places
   + auth: Added ":protected" suffix for passdb and userdb fields. If
     used, the field doesn't overwrite an existing field.
   + IMAP/POP3 proxy: If a backend server dies, avoid client reconnection
     spikes by slowly disconnecting clients over time. This is enabled by
     setting login_proxy_max_disconnect_delay=secs passdb extra field.
   + imap: Added new read-only METADATA entries: /private/specialuse,
     /shared/comment, /shared/admin
   + imap: If client disconnects in the middle of a command, log how long
     the command had been running.
   - mdbox: Rebuilding could have caused message's reference count to
     overflow the 16bit number in some situations, causing problems when
     trying to expunge the duplicates.
   - Various search fixes (fts, solr, tika, lib-charset, indexer)
   - Various virtual plugin fixes
   - Various fixes and optimizations to dsync, imapc and pop3-migration
   - imap: Various RFC compliancy and crash fixes to NOTIFY


author: Django <django@mailserver.guru> - 1:2.2.20-1
changelog:
  + Added mailbox { autoexpunge=<time> } setting. See
    http://wiki2.dovecot.org/MailboxSettings for details.
  + ssl_options: Added support for no_ticket
  + imap/pop3/managesieve-login: Added postlogin_socket=path passdb extra
    field. This allows replacing the default service
    imap/pop3/managesieve {} settings for specific users (e.g. running
    their imap process via valgrind or strace).
  + doveadm fetch: Added date.sent/received/saved.unixtime
  + fs-posix: Added mode=auto parameter to set the created files' and
    directories' mode based on the parent dir if it has setgid-bit.
  + director: Support backends having hostnames, which makes it possible
    to verify their SSL certificates.
  - director: Directors' state became desynchronized if doveadm director
    commands were used to modify the same backend in multiple directors
    at the same time with conflicting changes. This fix includes some
    extra checks, which makes sure that if such a conflict still happens
    it's automatically fixed. In some situations such an automatic fix
    may now be unnecessarily triggered and an error logged.
  - director: Backend tags weren't working correctly.
  - ldap: tls_* settings weren't used for ldaps URIs.
  - ldap, mysql: Fixed setting connect timeout.
  - auth: userdb lookups via auth-worker couldn't change username
  - dsync: Fixed handling deleted directories. Make sure we don't go to
    infinite mailbox renaming loop.
  - imap: Fixed crash in NOTIFY when there were watched namespaces that
    didn't support NOTIFY.
  - imap: After SETMETADATA was used, various commands (especially FETCH)
    could have started hanging when their output was large.
  - stats: Idle sessions weren't refreshed often enough, causing stats
    process to forget them and log errors about unknown sessions when
    they were updated later.
  - stats: Fixed "Duplicate session ID" errors when LMTP delivered to
    multiple recipients and fts_autoindex=yes.
  - zlib plugin: Fixed copying causing cache corruption when zlib_save
    wasn't set, but the source message was compressed.
  - fts-solr: Fixed escaping Solr query parameters.
  - lmtp: quota_full_tempfail=yes was ignored with
    lmtp_rcpt_check_quota=yes


author: Django <django@mailserver.guru> - 1:2.2.21-1
changelog:
  - doveadm mailbox list (and some others) were broken in v2.2.20
  - director: Fixed making backend changes when running with only a
    single director server.
  - virtual plugin: Fixed crash when trying to open nonexistent
    autocreated backend mailbox.


author: Django <django@mailserver.guru> - 1:2.2.24-1
changelog:
  doveconf now warns if it sees a global setting being changed when
    the same setting was already set inside some filters. (A common
    mistake has been adding more plugins to a global mail_plugins
    setting after it was already set inside protocol { .. }, which
    caused the global setting to be ignored for that protocol.)
    LMTP proxy: Increased default timeout 30s -> 125s. This makes it
    less likely to reach the timeout and cause duplicate deliveries.
    LMTP and indexer now append ":suffix" to session IDs to make it
    unique for the specific user's delivery. (Fixes duplicate session
    ID warnings in stats process.)
  + Added dict-ldap for performing read-only LDAP dict lookups.
  + lazy-expunge: All mails can be saved to a single specified mailbox.
  + mailbox { autoexpunge } supports now wildcards in mailbox names.
  + doveadm HTTP API: Added support for proxy commands
  + imapc: Reconnect when getting disconnected in non-selected state.
  + imapc: Added imapc_features=modseq to access MODSEQs/HIGHESTMODSEQ.
    This is especially useful for incremental dsync.
  + doveadm auth/user: Auth lookup performs debug logging if
    -o auth_debug=yes is given to doveadm.
  + Added passdb/userdb { auth_verbose=yes|no } setting.
  + Cassandra: Added user, password, num_threads, connect_timeout and
    request_timeout settings.
  + doveadm user -e <value>: Print <value> with %variables expanded.
  - Huge header lines could have caused Dovecot to use too much memory
    (depending on config and used IMAP commands). (Typically this would
    result in only the single user's process dying with out of memory
    due to reaching service { vsz_limit } - not a global DoS).
  - dsync: Detect and handle invalid/stale -s state string better.
  - dsync: Fixed crash caused by specific mailbox renames
  - auth: Auth cache is now disabled passwd-file. It was unnecessary and
    it broke %variables in extra fields.
  - fts-tika: Don't crash if it returns 500 error
  - dict-redis: Fixed timeout handling
  - SEARCH INTHREAD was crashing
  - stats: Only a single fifo_listeners was supported, making it
    impossible to use both auth_stats=yes and mail stats plugin.
  - SSL errors were logged in separate "Stacked error" log lines
    instead of as part of the disconnection reason.
  - MIME body parser didn't handle properly when a child MIME part's
    --boundary had the same prefix as the parent.


author: Django <django@mailserver.guru> - 1:2.2.25-1
changelog:
  lmtp: Start tracking lmtp_user_concurrency_limit and reject already
    at RCPT TO stage. This avoids MTA unnecessarily completing DATA only
    to get an error.
    doveadm: Previously only mail settings were read from protocol
    doveadm { .. } section. Now all settings are.
  + quota: Added quota_over_flag_lazy_check setting. It avoids checking
    quota_over_flag always at startup. Instead it's checked only when
    quota is being read for some other purpose.
  + auth: Added a new auth policy service:
    http://wiki2.dovecot.org/Authentication/Policy
  + auth: Added PBKDF2 password scheme
  + auth: Added %{auth_user}, %{auth_username} and %{auth_domain}
  + auth: Added ":remove" suffix to extra field names to remove them.
  + auth: Added "delay_until=<timestamp>[+<max random secs>]" passdb
    extra field. The auth will wait until <timestamp> and optionally some
    randomness and then return success.
  + dict proxy: Added idle_msecs=<n> parameter. Support async operations.
  + Performance improvements for handling large mailboxes.
  + Added lib-dcrypt API for providing cryptographic functions.
  + Added "doveadm mailbox update" command
  + imap commands' output now includes timing spent on the "syncing"
    stage if it's larger than 0.
  + cassandra: Added metrics=<path> to connect setting to output internal
    statistics in JSON format every second to <path>.
  + doveadm mailbox delete: Added -e parameter to delete only empty
    mailboxes. Added --unsafe option to quickly delete a mailbox,
    bypassing lazy_expunge and quota plugins.
  + doveadm user & auth cache flush are now available via doveadm-server.
  + doveadm service stop <services> will stop specified services while
    leaving the rest of Dovecot running.
  + quota optimization: Avoid reading mail sizes for backends which
    don't need them (count, fs, dirsize)
  + Added mailbox { autoexpunge_max_mails=<n> } setting.
  + Added welcome plugin: http://wiki2.dovecot.org/Plugins/Welcome
  + fts: Added fts_autoindex_exclude setting.
  - v2.2.24's MIME parser was assert-crashing on mails having truncated
    MIME headers.
  - auth: With multiple userdbs the final success/failure result wasn't
    always correct. The last userdb's result was always used.
  - doveadm backup was sometimes deleting entire mailboxes unnecessarily.
  - doveadm: Command -parameters weren't being sent to doveadm-server.
  - If dovecot.index read failed e.g. because mmap() reached VSZ limit,
    an empty index could have been opened instead, corrupting the
    mailbox state.
  - imapc: Fixed EXPUNGE handling when imapc_features didn't have modseq.
  - lazy-expunge: Fixed a crash when copying failed. Various other fixes.
  - fts-lucene: Fixed crash on index rescan.
  - auth_stats=yes produced broken output
  - dict-ldap: Various fixes
  - dict-sql: NULL values crashed. Now they're treated as "not found".


author: Django <django@mailserver.guru> - 1:2.2.26-1
changelog:
  - Fixed some compiling issues.
  - auth: Fixed assert-crash when using NTLM or SKEY mechanisms and
    multiple passdbs.
  - auth: Fixed crash when exporting to auth-worker passdb extra fields
    that had empty values.
  - dsync: Fixed assert-crash in dsync_brain_sync_mailbox_deinit


author: Django <django@mailserver.guru> - 1:2.2.27-1
changelog:
  dovecot.list.index.log rotation sizes/times were changed so that
    the .log file stays smaller and .log.2 is deleted sooner.
  + Added mail_crypt plugin that allows encryption of stored emails.
    See http://wiki2.dovecot.org/Plugins/MailCrypt
  + stats: Global stats can be sent to Carbon server by setting
    stats_carbon_server=ip:port
  + imap/pop3 proxy: If passdb returns proxy_not_trusted, don't send
    ID/XCLIENT
  + Added generic hash modifier for %variables:
    %{<hash algorithm>;rounds=<n>,truncate=<bits>,salt=s>:field}
    Hash algorithm is any of the supported ones, e.g. md5, sha1, sha256.
    Also "pkcs5" is supported using SHA256. For example: %{sha256:user}
    or %{md5;truncate=32:user}.
  + Added support for SHA3-256 and SHA3-512 hashes.
  + config: Support DNS wildcards in local_name, e.g.
    local_name *.example.com { .. } matches anything.example.com, but
    not multiple.anything.example.com.
  + config: Support multiple names in local_name, e.g.
    local_name "1.example.com 2.example.com" { .. }
  - Fixed crash in auth process when auth-policy was configured and
    authentication was aborted/failed without a username set.
  - director: If two users had different tags but the same hash,
    the users may have been redirected to the wrong tag's hosts.
  - Index files may have been thought incorrectly lost, causing
    "Missing middle file seq=.." to be logged and index rebuild.
    This happened more easily with IMAP hibernation enabled.
  - Various fixes to restoring state correctly in un-hibernation.
  - dovecot.index files were commonly 4 bytes per email too large. This
    is because 3 bytes per email were being wasted that could have been
    used for IMAP keywords.
  - Various fixes to handle dovecot.list.index corruption better.
  - lib-fts: Fixed assert-crash in address tokenizer with specific input.
  - Fixed assert-crash in HTML to text parsing with specific input
    (e.g. for FTS indexing or snippet generation)
  - doveadm sync -1: Fixed handling mailbox GUID conflicts.
  - sdbox, mdbox: Perform full index rebuild if corruption is detected
    inside lib-index, which runs index fsck.
  - quota: Don't skip quota checks when moving mails between different
    quota roots.
  - search: Multiple sequence sets or UID sets in search parameters
    weren't handled correctly. They were incorrectly merged together.


author: Django <django@mailserver.guru> - 1:2.2.28-1
changelog:
  director: "doveadm director move" to same host now refreshes user's
    timeout. This allows keeping user constantly in the same backend by
    just periodically moving the user there.
    When new mailbox is created, use initially INBOX's
    dovecot.index.cache caching decisions.
    Expunging mails writes GUID to dovecot.index.log now only if the
    GUID is quickly available from index/cache.
    pop3c: Increase timeout for PASS command to 5 minutes.
    Mail access errors are no longer ignored when searching or sorting.
    With IMAP the untagged SEARCH/SORT reply is still sent the same as
    before, but NO reply is returned instead of OK.
  + Make dovecot.list.index's filename configurable. This is needed when
    there are multiple namespaces pointing to the same mail root
    (e.g. lazy_expunge namespace for mdbox).
  + Add size.virtual to dovecot.index when folder vsizes are accessed
    (e.g. quota=count). This is mainly a workaround to avoid slow quota
    recalculation performance when message sizes get lost from
    dovecot.index.cache due to corruption or some other reason.
  + auth: Support OAUTHBEARER and XOAUTH2 mechanisms. Also support them
    in lib-dsasl for client side.
  + auth: Support filtering by SASL mechanism: passdb { mechanisms }
  + Shrink the mail processes' memory usage by not storing settings
    duplicated unnecessarily many times.
  + imap: Add imap_fetch_failure setting to control what happens when
    FETCH fails for some mails (see example-config).
  + imap: Include info about last command in disconnection log line.
  + imap: Created new SEARCH=X-MIMEPART extension. It's currently not
    advertised by default, since it's not fully implemented.
  + fts-solr: Add support for basic authentication.
  + Cassandra: Support automatically retrying failed queries if
    execution_retry_interval and execution_retry_times are set.
  + doveadm: Added "mailbox path" command.
  + mail_log plugin: If plugin { mail_log_cached_only=yes }, log the
    wanted fields only if it doesn't require opening the email.
  + mail_vsize_bg_after_count setting added (see example-config).
  + mail_sort_max_read_count setting added (see example-config).
  + pop3c: Added pop3c_features=no-pipelining setting to prevent using
    PIPELINING extension even though it's advertised.
  - Index files: day_first_uid wasn't updated correctly since v2.2.26.
    This caused dovecot.index.cache to be non-optimal.
  - imap: SEARCH/SORT may have assert-crashed in
    client_check_command_hangs
  - imap: FETCH X-MAILBOX may have assert-crashed in virtual mailboxes.
  - imap: Running time in tagged command reply was often wrongly 0.
  - search: Using NOT n:* or NOT UID n:* wasn't handled correctly
  - director: doveadm director kick was broken
  - director: Fix crash when using director_flush_socket
  - director: Fix some bugs when moving users between backends
  - imapc: Various error handling fixes and improvements
  - master: doveadm process status output had a lot of duplicates.
  - autoexpunge: If mailbox's rename timestamp is newer than mail's
    save-timestamp, use it instead. This is useful when autoexpunging
    e.g. Trash/* and an entire mailbox is deleted by renaming it under
    Trash to prevent it from being autoexpunged too early.
  - autoexpunge: Multiple processes may have been trying to expunge the
    same mails simultaneously. This was problematic especially with
    lazy_expunge plugin.
  - auth: %{passdb:*} was empty in auth-worker processes
  - auth-policy: hashed_password was always sent empty.
  - dict-sql: Merge multiple UPDATEs to a single statement if possible.
  - fts-solr: Escape {} chars when sending queries
  - fts: fts_autoindex_exclude = \Special-use caused crashes
  - doveadm-server: Fix leaks and other problems when process is reused
    for multiple requests (service_count != 1)
  - sdbox: Fix assert-crash on mailbox create race
  - lda/lmtp: deliver_log_format values weren't entirely correct if Sieve
    was used. especially %{storage_id} was broken.
  - lmtp_user_concurrency_limit didn't work if userdb changed username


author: Django <django@mailserver.guru> - 1:2.2.29-1
changelog:
  passdb/userdb dict: Don't double-expand %variables in keys. If dict
    was used as the authentication passdb, using specially crafted
    %variables in the username could be used to cause DoS (CVE-2017-2669)
    When Dovecot encounters an internal error, it logs the real error and
    usually logs another line saying what function failed. Previously the
    second log line's error message was a rather uninformative "Internal
    error occurred. Refer to server log for more information." Now the
    real error message is duplicated in this second log line.
    lmtp: If a delivery has multiple recipients, run autoexpunging only
    for the last recipient. This avoids a problem where a long
    autoexpunge run causes LMTP client to timeout between the DATA
    replies, resulting in duplicate mail deliveries.
    config: Don't stop the process due to idling. Otherwise the
    configuration is reloaded when the process restarts.
    mail_log plugin: Differentiate autoexpunges from regular expunges
    imapc: Use LOGOUT to cleanly disconnect from server.
    lib-http: Internal status codes (>9000) are no longer visible in logs
    director: Log vhost count changes and HOST-UP/DOWN
  + quota: Add plugin { quota_max_mail_size } setting to limit the
    maximum individual mail size that can be saved.
  + imapc: Add imapc_features=delay-login. If set, connecting to the
    remote IMAP server isn't done until it's necessary.
  + imapc: Add imapc_connection_retry_count and
    imapc_connection_retry_interval settings.
  + imap, pop3, indexer-worker: Add (deinit) to process title before
    autoexpunging runs.
  + Added %{encrypt} and %{decrypt} variables
  + imap/pop3 proxy: Log proxy state in errors as human-readable string.
  + imap/pop3-login: All forward_* extra fields returned by passdb are
    sent to the next hop when proxying using ID/XCLIENT commands. On the
    receiving side these fields are imported and sent to auth process
    where they're accessible via %{passdb:forward_*}. This is done only
    if the sending IP address matches login_trusted_networks.
  + imap-login: If imap_id_retain=yes, send the IMAP ID string to
    auth process. %{client_id} expands to it in auth process. The ID
    string is also sent to the next hop when proxying.
  + passdb imap: Use ssl_client_ca_* settings for CA validation.
  - fts-tika: Fixed crash when parsing attachment without
    Content-Disposition header. Broken by 2.2.28.
  - trash plugin was broken in 2.2.28
  - auth: When passdb/userdb lookups were done via auth-workers, too much
    data was added to auth cache. This could have resulted in wrong
    replies when using multiple passdbs/userdbs.
  - auth: passdb { skip & mechanisms } were ignored for the first passdb
  - oauth2: Various fixes, including fixes to crashes
  - dsync: Large Sieve scripts (or other large metadata) weren't always
    synced.
  - Index rebuild (e.g. doveadm force-resync) set all mails as \Recent
  - imap-hibernate: %{userdb:*} wasn't expanded in mail_log_prefix
  - doveadm: Exit codes weren't preserved when proxying commands via
    doveadm-server. Almost all errors used exit code 75 (tempfail).
  - ACLs weren't applied to not-yet-existing autocreated mailboxes.
  - Fixed a potential crash when parsing a broken message header.
  - cassandra: Fallback consistency settings weren't working correctly.
  - doveadm director status <user>: "Initial config" was always empty
  - imapc: Various reconnection fixes.
  - imapc reconnection fix was forgotten from 2.2.29 release, which also
    made "make check" fail in a unit test
  - dict-sql: Merging multiple UPDATEs to a single statement wasn't
    actually working.
  - Fixed building with vpopmail


author: Django <django@mailserver.guru> - 1:2.2.30-1
changelog:
  auth: Use timing safe comparisons for everything related to
    passwords. It's unlikely that these could have been used for
    practical attacks, especially because Dovecot delays and flushes all
    failed authentications in 2 second intervals. Also it could have
    worked only when passwords were stored in plaintext in the passdb.
    master process sends SIGQUIT to all running children at shutdown,
    which instructs them to close all the socket listeners immediately.
    This way restarting Dovecot should no longer fail due to some
    processes keeping the listeners open for a long time.
  + auth: Add passdb { mechanisms=none } to match separate passdb lookup
  + auth: Add passdb { username_filter } to use passdb only if user
    matches the filter. See https://wiki2.dovecot.org/PasswordDatabase
  + dsync: Add dsync_commit_msgs_interval setting. It attempts to commit
    the transaction after saving this many new messages. Because of the
    way dsync works, it may not always be possible if mails are copied
    or UIDs need to change.
  + imapc: Support imapc_features=search without ESEARCH extension.
  + imapc: Add imapc_features=fetch-bodystructure to pass through remote
    server's FETCH BODY and BODYSTRUCTURE.
  + imapc: Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on the
    remote server.
  + passdb imap: Add allow_invalid_cert and ssl_ca_file parameters.
  + If dovecot.index.cache corruption is detected, reset only the one
    corrupted mail instead of the whole file.
  + doveadm mailbox status: Add "firstsaved" field.
  + director_flush_socket: Add old host's up/down and vhost count as parameters
  - More fixes to automatically fix corruption in dovecot.list.index
  - dsync-server: Fix support for dsync_features=empty-header-workaround
  - imapc: Various bugfixes, including infinite loops on some errors
  - IMAP NOTIFY wasn't working for non-INBOX if IMAP client hadn't
    enabled modseq tracking via CONDSTORE/QRESYNC.
  - fts-lucene: Fix it to work again with mbox format
  - Some internal error messages may have contained garbage in v2.2.29
  - mail-crypt: Re-encrypt when copying/moving mails and per-mailbox keys
    are used. Otherwise the copied mails can't be opened.
  - vpopmail: Fix compiling
  - quota_warning scripts weren't working in v2.2.30
  - vpopmail still wasn't compiling
  - auth: Multiple failed authentications within short time caused
    crashes
  - push-notification: OX driver crashed at deinit


author: Django <django@mailserver.guru> - 1:2.2.31-1
changelog:
  LMTP: Removed "(Dovecot)" from added Received headers. Some
    installations want to hide it, and there's not really any good reason
    for anyone to have it.
  + Add ssl_alt_cert and ssl_alt_key settings to add support for
    having both RSA and ECDSA certificates.
  + dsync/imapc, pop3-migration plugin: Strip trailing whitespace from
    headers when matching mails. This helps with migrations from Zimbra.
  + acl: Add acl_globals_only setting to disable looking up
    per-mailbox dovecot-acl files.
  + Parse invalid message addresses better. This mainly affects the
    generated IMAP ENVELOPE replies.
  - v2.2.30 wasn't fixing corrupted dovecot.index.cache files properly.
    It could have deleted wrong mail's cache or assert-crashed.
  - v2.2.30 mail-crypt-acl plugin was assert-crashing
  - v2.2.30 welcome plugin wasn't working
  - Various fixes to handling mailbox listing. Especially related to
    handling nonexistent autocreated/autosubscribed mailboxes and ACLs.
  - Global ACL file was parsed as if it was local ACL file. This caused
    some of the ACL rule interactions to not work exactly as intended.
  - auth: forward_* fields didn't work properly: Only the first forward
    field was working, and only if the first passdb lookup succeeded.
  - Using mail_sort_max_read_count sometimes caused "Broken sort-*
    indexes, resetting" errors.
  - Using mail_sort_max_read_count may have caused very high CPU usage.
  - Message address parsing could have crashed on invalid input.
  - imapc_features=fetch-headers wasn't always working correctly and
    caused the full header to be fetched.
  - imapc: Various bugfixes related to connection failure handling.
  - quota=imapc sent unnecessary FETCH RFC822.SIZE to server when
    expunging mails.
  - quota=count: quota_warning = -storage=.. was never executed
  - quota=count: Add support for "ns" parameter
  - dsync: Fix incremental syncing for mails that don't have Date or
    Message-ID headers.
  - imap: Fix hang when client sends pipelined SEARCH +
    EXPUNGE/CLOSE/LOGOUT.
  - oauth2: Token validation didn't accept empty server responses.
  - imap: NOTIFY command has been almost completely broken since the
    beginning. I guess nobody has been trying to use it.


author: Django <django@mailserver.guru> - 1:2.2.32-1
changelog:
  imapc: Info-level line is logged every time when successfully
    connected to the remote server. This includes local/remote IP/port,
    which can be useful for matching against external logs.
    config: Log a warning if plugin { key=no } is used explicitly.
    v2.3 will support "no" properly in plugin settings, but for now
    any value at all for a boolean plugin setting is treated as "yes",
    even if it's written as explicit "no". This change will now warn
    that it most likely won't work as intended.
  + Various optimizations to avoid accessing files/directories when it's
    not necessary. Especially avoid accessing mail root directories when
    INDEX directories point to a different filesystem.
  + mail_location can now include ITERINDEX parameter. This tells Dovecot
    to perform mailbox listing from the INDEX path instead of from the
    mail root path. It's mainly useful when the INDEX storage is on a
    faster storage.
  + mail_location can now include VOLATILEDIR=<path> parameter. This
    is used for creating lock files and in future potentially other
    files that don't need to exist permanently. The path could point to
    tmpfs for example. This is especially useful to avoid creating lock
    files to NFS or other remote filesystems. For example:
    mail_location=sdbox:~/sdbox:VOLATILEDIR=/tmp/volatile/%2.256Nu/%u
  + mail_location's LISTINDEX=<path> can now contain a full path.
    This allows storing mailbox list index to a different storage
    than the rest of the indexes, for example to tmpfs.
  + mail_location can now include NO-NOSELECT parameter. This
    automatically deletes any \NoSelect mailboxes that have no children.
    These mailboxes are sometimes confusing to users.
  + mail_location can now include BROKENCHAR=<char> parameter. This can
    be useful with imapc to access mailbox names that aren't valid mUTF-7
    charset from remote servers.
  + If mailbox_list_index_very_dirty_syncs=yes, the list index is no
    longer refreshed against filesystem when listing mailboxes. This
    allows the mailbox listing to be done entirely by only reading the
    mailbox list index.
  + Added mailbox_list_index_include_inbox setting to control whether
    INBOX's STATUS information should be cached in the mailbox list
    index. The default is "no", but it may be useful to change it to
    "yes", especially if LISTINDEX points to tmpfs.
  + userdb can return chdir=<path>, which override mail_home for the
    chdir location. This can be useful to avoid accessing home directory
    on login.
  + userdb can return postlogin=<socket> to specify per-user imap/pop3
    postlogin socket path.
  + cassandra: Add support for result paging by adding page_size=<n>
    parameter to the connect setting.
  + dsync/imapc, pop3-migration plugin: Strip also trailing tabs from
    headers when matching mails. This helps with migrations from Zimbra.
  + imap_logout_format supports now %{appended} and %{autoexpunged}
  + virtual plugin: Optimize IDLE to use mailbox list index for finding
    out when something has changed.
  + Added apparmor plugin. See https://wiki2.dovecot.org/Plugins/Apparmor
  - virtual plugin: A lot of fixes. In many cases it was also working
    very inefficiently or even incorrectly.
  - imap: NOTIFY parameter parsing was incorrectly "fixed" in v2.2.31.
    It was actually (mostly) working in previous versions, but broken
    in v2.2.31.
  - Modseq tracking didn't always work correctly. This could have caused
    imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to
    not work perfectly.
  - mdbox: "Inconsistency in map index" wasn't fixed automatically
  - dict-ldap: %variable values used in the LDAP filter weren't escaped.
  - quota=count: quota_warning = -storage=.. was never executed (try #2).
    v2.2.31 fixed it for -messages, but not for -storage.
  - imapc: >= 32 kB mail bodies were supposed to be cached for subsequent
    FETCHes, but weren't.
  - quota-status service didn't support recipient_delimiter
  - acl: Don't access dovecot-acl-list files with acl_globals_only=yes
  - mail_location: If INDEX dir is set, mailbox deletion deletes its
    childrens' indexes. For example if "box" is deleted, "box/child"
    index directory was deleted as well (but mails were preserved).
  - director: v2.2.31 caused rapid reconnection loops to directors
    that were down.


author: Django <django@mailserver.guru> - 1:2.2.33-1
changelog:
  doveadm director commands wait for the changes to be visible in the
    whole ring before they return. This is especially useful in testing.
    Environments listed in import_environment setting are now set or
    preserved when executing standalone commands (e.g. doveadm)
  + doveadm proxy: Support proxying logs. Previously the logs were
    visible only in the backend's logs.
  + Added %{if}, see https://wiki2.dovecot.org/Variables#Conditionals
  + Added a new notify_status plugin, which can be used to update dict
    with current status of a mailbox when it changes. See
    https://wiki2.dovecot.org/Plugins/NotifyStatus
  + Mailbox list index can be disabled for a namespace by appending
    ":LISTINDEX=" to location setting.
  + dsync/imapc: Added dsync_hashed_headers setting to specify which
    headers are used to match emails.
  + pop3-migration: Add pop3_migration_ignore_extra_uidls=yes to ignore
    mails that are visible in POP3 but not IMAP. This could happen if
    new mails were delivered during the migration run.
  + pop3-migration: Further improvements to help with Zimbra
  + pop3-migration: Cache POP3 UIDLs in imapc's dovecot.index.cache
    if indexes are enabled. These are used to optimize incremental syncs.
  + cassandra, dict-sql: Use prepared statements if protocol version>3.
  + auth: Added %{ldap_dn} variable for passdb/userdb ldap
  - acl: The "create" (k) permission in global acl-file was sometimes
    ignored, allowing users to create mailboxes when they shouldn't have.
  - sdbox: Mails were always opened when expunging, unless
    mail_attachment_fs was explicitly set to empty.
  - lmtp/doveadm proxy: hostip passdb field was ignored, which caused
    unnecessary DNS lookups if host field wasn't an IP
  - lmtp proxy: Fix crash when receiving unexpected reply in RCPT TO
  - quota_clone: Update also when quota is unlimited (broken in v2.2.31)
  - mbox, zlib: Fix assert-crash when accessing compressed mbox
  - doveadm director kick -f parameter didn't work
  - doveadm director flush <host> resulted flushing all hosts, if <host>
    wasn't an IP address.
  - director: Various fixes to handling backend/director changes at
    abnormal times, especially while ring was unsynced. These could have
    resulted in crashes, non-optimal behavior or ignoring some of the
    changes.
  - director: Use less CPU in imap-login processes when moving/kicking
    many users.
  - lmtp: Session IDs were duplicated/confusing with multiple RCPT TOs
    when lmtp_rcpt_check_quota=yes
  - doveadm sync -1 fails when local mailboxes exist that do not exist
    remotely. This commonly happened when lazy_expunge mailbox was
    autocreated when incremental sync expunged mails.
  - pop3: rawlog_dir setting didn't work


author: Django <django@mailserver.guru> - 1:2.2.36-1
changelog:
  * login-proxy: If ssl_require_crl=no, allow revoked certificates.
     Also don't do CRL checks for incoming client certificates.
   * stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening
     /proc/self/io. This may still cause security problems if the process
     is ptrace()d at the same time. Instead, open it while still running
     as root.
   + doveadm: Added mailbox cache decision&remove commands. See
     doveadm-mailbox(1) man page for details.
   + doveadm: Added rebuild attachments command for rebuilding
     $HasAttachment or $HasNoAttachment flags for matching mails. See
     doveadm-rebuild(1) man page for details.
   + cassandra: Use fallback_consistency on more types of errors
   - cassandra: Fix consistency=quorum to work
   - dsync: Lock file generation failed if home directory didn't exist
   - In some configs if namespace root directory didn't yet exist, Dovecot
     failed to create mailboxes.lock when trying to create mailboxes
   - Snippet generation for HTML mails didn't ignore &entities inside
     blockquotes, producing strange looking snippets.
   - imapc: Fix assert-crash if getting disconnected and after
     reconnection all mails in the selected mailbox are gone.
   - pop3c: Handle unexpected server disconnections without assert-crash
   - fts: Fixes to indexing mails via virtual mailboxes.
   - fts: If mails contained NUL characters, the text around it wasn't
     indexed.
   - Obsolete dovecot.index.cache offsets were sometimes used. Trying to
     fetch a field that was just added to cache file may not have always
     found it.
   - dict-sql: Fix crash when reading NULL value from database
   - charset_alias: compile fails with Solaris Studio, reported by
     John Woods.
   - Fix local name handling in v2.2.34 SNI code, bug found by cPanel.
   - imapc: Don't try to add mails to index if they already exist there.
   - imapc: If email is modified in istream_opened hook, mail size isn't
     updated.
   - lib-dcrypt: When reading encrypted data, more data would not be
     read if buffer was not consumed causing panic or hang.
   - notify: When notify plugin is used and transaction commit fails in
     dsync, crash occurs.
   - sdbox: When delivering to a mailbox that is over quota, temp files
     are not cleaned up when saving or copying fails.
   * CVE-2017-15130: TLS SNI config lookups may lead to excessive
     memory usage, causing imap-login/pop3-login VSZ limit to be reached
     and the process restarted. This happens only if Dovecot config has
     local_name { } or local { } configuration blocks and attacker uses
     randomly generated SNI servernames.
   * CVE-2017-14461: Parsing invalid email addresses may cause a crash or
     leak memory contents to attacker. For example, these memory contents
     might contain parts of an email from another user if the same imap
     process is reused for multiple users. First discovered by Aleksandar
     Nikolic of Cisco Talos. Independently also discovered by "flxflndy"
     via HackerOne.
   * CVE-2017-15132: Aborted SASL authentication leaks memory in login
     process.
   * Linux: Core dumping is no longer enabled by default via
     PR_SET_DUMPABLE, because this may allow attackers to bypass
     chroot/group restrictions. Found by cPanel Security Team. Nowadays
     core dumps can be safely enabled by using "sysctl -w
     fs.suid_dumpable=2". If the old behaviour is wanted, it can still be
     enabled by setting:
     import_environment=$import_environment PR_SET_DUMPABLE=1
   * doveconf output now includes the hostname.
   + mail_attachment_detection_options setting controls when
     $HasAttachment and $HasNoAttachment keywords are set for mails.
   + imap: Support fetching body snippets using FETCH (SNIPPET) or
     (SNIPPET (LAZY=FUZZY))
   + fs-compress: Automatically detect whether input is compressed or not.
     Prefix the compression algorithm with "maybe-" to enable the
     detection, for example: "compress:maybe-gz:6:..."
   + Added settings to change dovecot.index* files' optimization behavior.
     See https://wiki2.dovecot.org/IndexFiles#Settings
   + Auth cache can now utilize auth workers to do password hash
     verification by setting auth_cache_verify_password_with_worker=yes.
   + Added charset_alias plugin. See
     https://wiki2.dovecot.org/Plugins/CharsetAlias
   + imap_logout_format and pop3_logout_format settings now support all of
     the generic variables (e.g. %{rip}, %{session}, etc.)
   + Added auth_policy_check_before_auth, auth_policy_check_after_auth
     and auth_policy_report_after_auth settings.
   - v2.2.33: doveadm-server: Various fixes related to log handling.
   - v2.2.33: doveadm failed when trying to access UNIX socket that didn't
     require authentication.
   - v2.2.33: doveadm log reopen stopped working
   - v2.2.30+: IMAP stopped advertising SPECIAL-USE capability
   - v2.2.30+: IMAP stopped sending untagged OK/NO storage notifications
   - replication: dsync sends unnecessary replication notification for
     changes it does internally. NOTE: Folder creates, renames, deletes
     and subscribes still trigger unnecessary replication notifications,
     but these should be rather rare.
   - mail_always/never_cache_fields setting changes weren't applied for
     existing dovecot.index.cache files.
   - Fix compiling and other problems with OpenSSL v1.1
   - auth policy: With master user logins, lookup using login username.
   - FTS reindexed all mails unnecessarily after loss of
     dovecot.index.cache file
   - mdbox rebuild repeatedly fails with "missing map extension"
   - SSL connections may have been hanging with imapc or doveadm client.
   - cassandra: Using protocol v3 (Cassandra v2.1) caused memory leaks and
     also timestamps weren't set to queries.
   - fs-crypt silently ignored public/private keys specified in
     configuration (mail_crypt_global_public/private_key) and just
     emitted plaintext output.
   - lock_method=dotlock caused crashes
   - imapc: Reconnection may cause crashes and other errors


author: Django <django@mailserver.guru> - 1:2.2.36-4
changelog:
  * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
     when scanning data in quoted strings, leading to out of bounds heap
     memory writes. Found by Nick Roessler and Rafi Rubin.
   * CVE-2019-7524: Missing input buffer size validation leads into
     arbitrary buffer overflow when reading fts or pop3 uidl header
     from Dovecot index. Exploiting this requires direct write access to
     the index files.


author: Django <django@mailserver.guru> 3.4.0-1
changelog:
  - stable release candidate version 3.4.0
  - weightedphrasemode now optional - defaults to 1
  - allowemptyhostcert option added (optional)
  - createlistcachefiles now defaults to off


author: Django <django@mailserver.guru> 3.4.0-3
changelog:
  - This release fixes a number of issues with v3.4.0 
    and has updated documentation.
  - This release is now regarded as stable


author: Django <django@mailserver.guru> 3.4.0-1
changelog:
  - Security Fix: AV and empty access_denied_domain value break scan silently
  - Fix bug #72 (wrong config file)
  - Add new option: "xforwardedforfilterip" 
  - Fix weighted phrases bug #15 
  - New alivewithproxy option (if proxytimeout is expired, E2 is stopped)
  - Add brazilian translation 
  - Code cleaning
  - Add Czech translation
  - New ssllegacylogic option (SSL lists greysslsitelist and bannedsslsitelist in separate files) default off
  - Add SEARCHWORDS as default  
  - Add SSL_EXTRA_LIST as default  
  - Add LOCAL_LIST as default new option enablelocallists = on/off 
  - Add TOTAL_BLOCK_LIST as default
  - Fix e2 now can start with --enable-sslmitm=yes without ca certificat


author: Django <django@mailserver.guru> 3.4.0-5
changelog:
  - Fix bug #76 sslaccessdeniedaddress and reporting level < 3 
  - Remove old & unused values 
  - Remove max_upload option from e2guardian.conf


author: Django <django@mailserver.guru> 4.1.3-0
changelog:
  - Fix segfault with SSLMITM
  - Fix many bugs with BYPASS
  - Fix bug #277 add option "disablecontentscanerror" 
  - Fix bug #276 give better informations about header size filtering


author: Django <django@mailserver.guru> 4.1.4.0
changelog:
  - Fix bug #288 307 Answer is not CRLF just LF
  - Fix bug #302 Client address is missing with squid format logs
  - Fix random crashes with: Header without size
  - Fix bug #300 restrict log permissions with system


author: Django <django@mailserver.guru> 5.3.1-1
changelog:
  - Fix bug with Firefox and SSL denied web sites (connection still opened, massive performance issue)
  - Update ICAP client (tested with drweb AV)
  - Add stealth mode (reporting without block) to StoryBoard mode
  - Add new secure bypass mode (experimental)
  - Better handling for non-tls and non-sni calls on transparent https
  - Fix bug #490 modified URL not shown in log 
  - Fix bug #489 - exception file ext/mime type not working correctly 
  - Fix bug #486 - bypass cookie not being set in proxy mode


author: jango <django@mailserver.guru> 5.3.2-1
changelog:
  - SSLMITM source code clean-up - no logic or call changes
  - Fix bug #514 - useragentin
  - Fix ICAP error (with SSL denied) introduced in 5.3.1


author: Django <django@mailserver.guru> 5.3.2-1
changelog:
  - SSLMITM source code clean-up - no logic or call changes
  - Fix bug #514 - useragentin
  - Fix ICAP error (with SSL denied) introduced in 5.3.1-1


author: Django <django@mailserver.guru> 5.3.3-1
changelog:
  - IE10/11 on Win7 reports 408/9 error on some sites #538
  - Fix segfault when corrupt SNI presented
  - Fix bug #532 - reverse IP lookup give random chars in log and segfaults
  - Update comments in list files - as per issue #530
  - Add support for reading openssl config files - new optional 
    e2guardian.conf params useopensslconf and opensslconffile
  - Fix bug #527 - memory leaking when complied with openssl v1.1
  - Loop detect code added - enhancement #523 - 
    Note that to activate loop detect 'checkip' lines need to be added to 
    e2guardian.conf, one for each ip the e2guardian system is listening on, 
    including loopback and any VIP used.
  - Fix #512
  - Fix segfault bug #509


author: Kay Sievers <kay@redhat.com> - 3.2-11
changelog:
  - fix yum installroot ending up with directories in /var
    instead of the expected symlinks to /run
  - do not handle /var/lock/subsys, it is always on tmpfs
  - create all symlinked directories and their targets
    in pretrans to make sure other packages install into
    the right place, even if filesystem.rpm is not the
    first package installed in the transaction


author: Till Maas <opensource@till.name> - 5.1.0.3599-1
changelog:
  - Update to new release
  - Adjust Provides/Obsoletes/Requires: libfwbuilder does not exist anymore
  - Remove unused patch


author: Django <django@mailserver.guru> - 2.30-1
changelog:
  - New Features:
      When opening a database via an URL fails, the error message 
      dialog now has a button 'Specify different server credentials'
      (on Windows Vista and higher).
      Added support for opening entry URLs with Microsoft Edge via 
      the context menu -> 'URL(s)' -> 'Open with Edge'.
      Added URL override suggestion for Microsoft Edge in the URL 
      override suggestions drop-down list in the entry dialog.
      Added optional built-in global URL overrides for opening 
      HTTP/HTTPS URLs with Microsoft Edge.
      When clicking on a group link in the entry view, KeePass now 
      ensures that the group is visible in the group tree.
      The main window is now moved onto the primary screen when it 
      is restored outside all screens.
      KDBX loader: added support for non-empty protected binary 
      value reference elements.
      Plugins: added two auto-type sequence query events.
      Added workaround for Mono drawing bug when scrolling a rich 
      text box.
      When running under Mono, some automatic locking options are 
      now disabled (because Mono doesn't implement the required 
      events).
      The installer now prevents running the installer while it 
      is already running.
      KPScript: added '-GroupPath:' parameter (for specifying the 
      full path of a group).
      KPScript: the 'MoveEntry' command now also supports the 
      '-GroupName:' parameter (as alternative to '-GroupPath:').
      KPScript: added support for specifying the path of an XSL 
      stylesheet file using the command line parameter '-XslFile:'.
      KPScript: the 'ListGroups' command now also outputs the 
      parent group UUID for each group.
      KPScript: the parameters for specifying new field data 
      (for the 'AddEntry' and the 'EditEntry' command) now support 
      escape sequences (e.g. '\n' is replaced by a new-line 
      character).
  - Improvements / Changes:
      The 'Synchronize' file dialog now shows only KDBX files by 
      default.
      In the 'Attachments (Count)' column, only non-zero counts 
      are shown now.
      Improved MRU item refreshes.
      The entry string dialog now supports changing the case of 
      a string name.
      The entry string dialog now does not allow adding a string 
      whose name differs from another existing string name in 
      this entry only by case.
      The entry view in the main window is now updated 
      immediately after pressing Ctrl+H or Ctrl+J.
      The KDB import module now tries to round any invalid 
      date/time to the nearest valid date/time.
      XML serializers are now loaded/created at KeePass startup 
      in order to avoid a problem when shutting down Windows 
      and KeePass.XmlSerializers.dll not being present.
      Changed tab bar behavior in the options dialog to avoid a 
      tab content cropping issue caused by plugins.
      Improved workaround for Mono splitter bug.
      Upgraded installer.
      Various performance improvements.
      Various code optimizations.
      Minor other improvements.


author: Django <django@nausch.org> 1.2.1.Beta1
changelog:
  - Fix bug #72: Don't crash when From fields are absent.
      Patch from Andreas Schulze.
    Provide better logging when pclose() for a forensic report returns
      non-zero. Problem noted by Michael Nausch.
    REPORTS: Fix bug #70: Fix date range generation in reports.
      Patch from Karol Augustin.
    LIBOPENDMARC: Fix bug #71: Fix "rua" extraction from DMARC records
      Problem noted by Karol Augustin.


author: Django <django@nausch.org> 1.3.0.Beta0
changelog:
  - New beta release
    Logic fixes around ignoring irrelevant Authentication-Results fields.  Reported
      by Todd Lyons.
  - New settings SPFIgnoreResults and SPFSelfValidate allow optional evaluation
      of SPF results when those data were not made available by upstream filters.
  - Fix some crash bugs related to authserv-id specification and checking.  Reported
      by Andreas Schulze


author: Django <django@mailserver.guru> 1.3.1.Beta0
changelog:
  Fix bug #97: Add ability to change envelope sender, client IP
            address, client hostname, and HELO value used in test
            mode, via environment variables.  This can be turned
            into something more formal in a later release.  Suggested
            by Andreas Schulze.
    Fix bug #103: Fix IgnoreAuthenticatedClients by requesting the
            right macro value from the MTA.
    Fix bug #113: Remove "TemporaryDirectory" (unused).  Patch from
            Andreas Schulze.
    LIBOPENDMARC: Fix bug #104: Include <sys/param.h> and <resolv.h>
            in <opendmarc/dmarc.h> so that MAXPATHLEN and MAXNS get
            defined consistently.  Reported by Frank J. Lhota.
    LIBOPENDMARC: Fix bug #105: Get the h_errno definition from
            <netdb.h> rather than declaring it.  Problem noted
            by Frank J. Lhota.
    LIBOPENDMARC: Fix bug #106: Clean up issues with the types passed
            to opendmarc_policy_library_dns_hook().  Noted by
            Frank J. Lhota.
    DOCS: Fix bug #99: Update list of constraints on
            opendmarc_policy_fetch_alignment().  Reported by
            Frank J. Lhota.
    REPORTS: Fix bug #108: Handle malformed mailto URIs in DMARC
            records (e.g., just "mailto:").  Reported by Andreas Schulze.
    REPORTS: Fix bug #110: Support SQL backend selection in
            opendmarc-expire.  Reported by Mark Reidenbach.


author: Django <django@mailserver.guru> - 1.15-1
changelog:
  - Build as mailgraph-ng a fork of David Schweikert's popular mailgraph
    Special thanks goes to:
     ° David Schweikert for Mailgraph
     ° Ralf Hildebrandt for Queuegraph
     ° Markus Neubauer for Greygraph
     ° Sebastian van de Meer for his both Mailgraph-patches


author: Django <django@mailserver.guru> - 3:2.1.26-1
changelog:
  Security

      - An XSS vulnerability in the user options CGI could allow a crafted URL
        to execute arbitrary javascript in a user's browser.  A related issue
        could expose information on a user's options page without requiring
        login.  These are fixed.  Thanks to Calum Hutton for the report.
        CVE-2018-5950  (LP: #1747209)

    New Features

      - Thanks to David Sieb.rger who adapted an existing patch by Andrea
        Veri to use Google reCAPTCHA v2 there is now the ability to add
        reCAPTCHA to the listinfo subscribe form.  There are two new mm_cfg.py
        settings for RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY, the values
        for which you obtain for your domain(s) from Google at
        <https://www.google.com/recaptcha/admin>.

      - Thanks to Lindsay Haisley, there is a new bin/mailman-config command
        to display various information about this Mailman version and how it
        was configured.

    i18n

      - The Japanese message catalog has been updated for added strings by
        Yasuhito FUTATSUKI.

      - The German translation of a couple of templates has been updated by
        Thomas Hochstein.

      - The Japanese translation of Defaults.py.in has been updated by
        Yasuhito FUTATSUKI.

    Bug fixes and other patches

      - Fixed an i18n bug in the reCAPTCHA feature.  (LP: #1746189)

      - Added a few more environment variables to the list of those passed
        to CGIs to support an nginx/uwsgi configuration.  (LP #1744739)

      - Mailman 2.1.22 introduced a Python 2.7 dependency that could affect
        bin/arch processing a message without a valid Date: header.  The
        dependency has been removed.  (LP: #1740543)

      - Messages held for header_filter_rules now show the matched regexp in
        the hold reason.  (LP: #1737371)

      - When updating the group and mode of a .db file with Mailman's Postfix
        integration, a missing file is ignored.  (LP: #1734162)

      - The DELIVERY_RETRY_WAIT setting is now effective.  (LP: #1729472)


author: Django <django@mailserver.guru> - 0.6-1
changelog:
  - Generating DH Params instead of using static ones.
   - Now considering ServerAlias Directives.
   - Major Legacy Code Cleanup.
   - html and pdf and manual documentation generated from markdown sources
   - support monkeysphere validation agent (MSVA) client-certificate verification
   - wider test suite
   - GnuTLSExportCertificates off by default


author: Django <django@mailserver.guru> - 0.7-1
changelog:
  - Security fix for TLS client authentication (CVE-2015-2091)
  - Bug fixes that enable support for reverse proxy operation
  - Various test suite improvements. Tests are configured through autoconf,
    so the test suite now works for builds without Monkeysphere support.
  - Add support for TLS connections to back end servers when operating as a
    reverse proxy (X.509 authentication only at the moment).
  - PKCS #11 support for server keys and certificates
  - Use strict compiler arguments by default (-Wall -Werror -Wextra)
  - Allow limiting the size of certificates exported as SSL_SERVER_CERT
    and SSL_CLIENT_CERT through the GnuTLSExportCertificates directive


author: Django <django@mailserver.guru> - 0.7.1-1
changelog:
  - Improved handling of PKCS #11 modules: mod_gnutls now loads either
    modules specified using GnuTLSP11Module, or the system defaults, but
    not both. Thanks to Nikos Mavrogiannopoulos for the report and
    initial patch!
  - Initialize variables to safe defaults during client certificate
    verification. Certain error code paths did not set them, but they
    should never be hit due to config validation. This adds another line
    of defense.
  - Enable C99 support via autoconf
  - Test suite improvements. Most importantly, automake now handles
    environment setup without any external make calls. Rules to build
    the certificates are included from the old test makefile. Note that
    the dependency on GNU make is not new (the test makefile always used
    GNU make syntax), it just wasn't listed explicitly


author: Django <django@mailserver.guru> - 0.7.2-1
changelog:
  Bugfix: Non-blocking reads in the input filter could lead to a busy
    wait in the gnutls_io_input_read function, causing high load on
    Keep-Alive connections waiting for data, until either more data
    could be received or the connection was closed. The fix is to pass
    EAGAIN/EINTR results up to the input filter so they can be handled
    properly.
  - Close TLS session if the input filter receives EOF (mostly relevant
    for proper termination of proxy connections).
  - Remove dependency on APR Memcache, which is replaced by the newer
    version included in the APR Utility Library (libaprutil).
  - Remove dependency on bc. It was used for floating point arithmetic
    in the test suite, the calculations have been changed to use
    integers and pure bash code.


author: Django <django@mailserver.guru> 4.1.0-1
changelog:
  ENHANCEMENTS                                             
   - Promoted JSON CGIs to released status (Eric Stanley)  
   - New graphical CGI displays: statusmap, trends, histogram (Eric Stanley)
   - Make sticky status for acks and comments configurable enhancement #20 (Trevor McDonald / Scott Wilkerson)
   - Add host_down_disable_service_checks directive to nagios.cfg #44 (Trevor McDonald / Scott Wilkerson)     
   - httpd.conf doesn't support Apache versions > 2.3 (DanielB / John Frickson)                               

  FIXES
   - Fix for not all service dependencies created (John Frickson)
   - Fix SIGSEGV with empty custom variable (orbis / John Frickson)
   -  Fix contact macros in environment variables (dvoryanchikov)  
   - Fixed host's current attempt goes to 1 after going to hard state (John Frickson)
   - Fixed two bugs/problems: Replace use of %zd in base/utils.c & incorrect va_start() in cgi/jsonutils.c (Peter Eriksson)
   - Fixed: Let remove_specialized actually remove all workers (Phil Mayers)
   - Fixed log file spam caused when using perfdata command directives in nagios.cfg (shashikanthbussa)
   - Fixed off-by-one error in bounds check leads to segfault (Phil Mayers)
   - Added links for legacy graphical displays (Eric Stanley)
   - Update embedded URL's to https versions of Nagios websites (scottwilkerson)
   - Fixed doxygen comments to work with latest doxygen 1.8.9.1 #30 (Trevor McDonald)
   - Fixed makefile target "html" to PHONY to fix GitHub issue #28 (Trevor McDonald)
   - Fixed typo as per GitHub issue #27 (Trevor McDonald)
   - Fixed jsonquery.php 404 not found error, and disabled Send Query button until form populates #43 (Scott Wilkerson)
   - Fixed linking in Tactical Overview for several of the Host entries in Featured section #48 (Scott Wilkerson)
   - Fixed passing limit and sort options to pagination and sort links #42 (Scott Wilkerson)
   - Added form field for icon URL and clean-up when it changes in CGI Status Map. (Eric Stanley)
   - Added options to cgi.cfg to uncheck sticky and send when acknowledging a problem (Trevor McDonald)
   - Low impact changes to automate the generation of RPMs from nagios.spec file. (T.J. Yang)
   - Update index.php (Trevor McDonald)
   - Fixed escaping of corewindow parameter to account for possible XSS injection (Scott Wilkerson)
   - Typo correction (T.J. Yang)
   - Make getCoreStatus respect cgi_base_url (Moritz Schlarb)
   - Adjusted map layout to work within frames (Eric Stanley)
   - Fixed map displays are now the full size of browser window (Eric Stanley)
   - Fixed labels and icons on circular markup no longer scale on zoom (Eric Stanley)
   - Got all maps except circular markup working with icons (Eric Stanley)
   - Fixes to make legacy CGIs work again. (Eric Stanley)
   - Fixes to make all/html target tolerant of being run multiple times (Eric Stanley)
   - For user-supplied maps, converted node group to have transform (Eric Stanley)
   - Fixed issue transitioning from circular markup map to other maps (Eric Stanley)
   - Fix displayForm to trigger on the buttom press (Scott Wilkerson)
   - Fix fo getBBox crash on Firefox (Eric Stanley)
   - Fixed map now resets zoom when form apply()'d (Eric Stanley)
   - Fixed so close box on dialogs actually closes dialog (Eric Stanley)
   - Corrected directive in trends display (Eric Stanley)
   - Fixed minor issue with link in trends linkes (Eric Stanley)
   - Fixed issue with map displaying on Firefox (Eric Stanley)
   - Added exclusions for ctags generation (Eric Stanley)
   - Update map-popup.html (Scott Wilkerson)
   - Initial commit of new graphical CGIs (Eric Stanley)
   - Fixed Github bug #18 - archivejson.cgi returns wrong host for state change query (Eric Stanley)
   - Status JSON: Added next_check to service details (Eric Stanley)
   - Fixed escaping of keys for scalar values in JSON CGIs (Eric Stanley)
   - build: Include <sys/loadavg.h> if it exists. (Eric J. Mislivec)
   - lib-tests: test-io{cache|broker} need -lsocket to link. (Eric J. Mislivec)
   - lib-tests: test-runcmd assumes GNU echo. (Eric J. Mislivec)
   - lib-tests: Signal handlers don't return int on most platforms, and using a cast was the wrong way to resolve this. (Eric J. Mislivec)
   - Fix some type/format mismatch warnings for pid_t. (Eric J. Mislivec)
   - Fix build on Solaris. (Eric J. Mislivec)
   - runcmd: Fix build when we don't HAVE_SETENV. (Eric J. Mislivec)
   - Fixed checkresult output processing (Eric Mislivec)
   - Corrected escaping of long output macros (Eric Mislivec)
   - Fixed null pointer dereferences in archive JSON (Eric Stanley)
   - Fixed memory overwrite issue in JSON string escaping (Eric Stanley)
   - JSON CGI: Now escaping object and array keys (Eric Stanley)

  KNOWN ISSUES
   - New map does not account for multiple parents, leaving "legacy" map as an option in the menu


author: Django <django@mailserver.guru> 4.1.1-1
changelog:
  FIXES                                                    
   - CGI Could not read object configuration data (broken by error in 4.1.0)
   -  exclude (!) not working (broken by mis-applied fix for 4.1.0)


author: Django <django@mailserver.guru> - 1.9.7-1
changelog:
  -          build with nginx-auth-ldap from Valery Komarov
  - Feature: the "nohostname" parameter of logging to syslog.
  - Feature: the "proxy_cache_convert_head" directive.
  - Feature: the $realip_remote_addr variable in the
             ngx_http_realip_module.
  - Bugfix : the "expires" directive might not work when using variables.
  - Bugfix : a segmentation fault might occur in a worker process when
  -          using HTTP/2; the bug had appeared in 1.9.6.
  - Bugfix : if nginx was built with the ngx_http_v2_module it was
             possible to use the HTTP/2 protocol even if the "http2" 
             parameter of the "listen" directive was not specified.
  - Bugfix : in the ngx_http_v2_module.
  - Bugfix : a segmentation fault might occur in a worker process when
             using HTTP/2. (Thanks to Piotr Sikora and Denis Andzakovic.)
  - Bugfix : the $server_protocol variable was empty when using HTTP/2.
  - Bugfix : backend SSL connections in the stream module might be timed
              out unexpectedly.
  - Bugfix : a segmentation fault might occur in a worker process if
             different ssl_session_cache settings were used in different 
             virtual servers.
  - Bugfix : nginx/Windows could not be built with MinGW gcc; the bug had
             appeared in 1.9.4. (Thanks to Kouhei Sutou.)
  - Bugfix : time was not updated when the timer_resolution directive was
             used on Windows.
  -          Miscellaneous minor fixes and improvements.
             (Thanks to Markus Linnala, Kurtis Nusbaum and Piotr Sikora.)


author: Remi Collet <rcollet@redhat.com> - 5.5.16-19
changelog:
  - fix memory leak introduce in patch for CVE-2014-1943
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.0-2
changelog:
  - Fixed systemd error message regarding chroot-update, patch provided
    by John Heidemann <johnh@isi.edu>
    Resolves: rhbz#917463


author: Django <django@nausch.org> - 2:2.11.3-1
changelog:
  - Fix for configurations that prepend message headers with Postfix 
    access maps, policy servers or Milter applications. Postfix now 
    hides its own Received: header from Milters and exposes prepended 
    headers to Milters, regardless of the mechanism used to prepend 
    a header. This fix reverts a partial solution that was released 
    on October 13, 2014, and replaces it with a complete solution.


author: Django <django@nausch.org> - 2:2.11.4-1
changelog:
  - Cleanup: missing " in \%s\" in postconf(1) fatal error
    messages. Iain Hibbert. File: postconf/postconf_master.c.
  - Safety: stop aliasing loops that exponentially increase the
    address length with each iteration. Back-ported from Postfix
    3.0. File: cleanup/cleanup_map1n.c.
  - Robustness: don't segfault due to excessive recursion after
    a faulty configuration runs into the virtual_alias_recursion_limit.
    File: global/tok822_tree.c.
  - Bugfix (introduced: Postfix 2.11): core dump when
    smtp_policy_maps specifies an invalid TLS level. Viktor
    Dukhovni. File: smtp/smtp_tls_policy.c.


author: Django <django@nausch.org> - 2:2.11.5-1
changelog:
  - Portability: FreeBSD10 support. Files: makedefs, util/sys_defs.h.
    Incompatibility: specifying "make makefiles" with "CC=command"
    will no longer override the default WARN setting.
  - Bitrot: prepare for future changes in OpenSSL API. Viktor
    Dukhovni. File: tls_dane.c.
  - Bugfix (introduced: Postfix 2.6): sender_dependent_relayhost_maps
    ignored the relayhost setting in the case of a DUNNO lookup
    result.  It would use the recipient domain instead.  Viktor
    Dukhovni. Wietse took the pieces of code that enforce the
    precedence of a sender-dependent relayhost, the global
    relayhost, and the recipient domain, and put that code
    together in once place so that it is easier to maintain.
    File: trivial-rewrite/resolve.c.


author: Django <django@nausch.org> - 2:2.11.6-1
changelog:
  - Support for Linux 4.*, and some simplification for future
    makedefs files. Files: makedefs, util/sys_defs.h.
  - Security: opportunistic TLS by default uses "medium" or
    stronger ciphers instead of "export" or stronger. See the
    RELEASE_NOTES file for how to get the old settings back.
    Files: global/mail_params.h, proto/TLS_README.html,
    proto/postconf.proto, and files derived from those.
  - Security: Postfix TLS support by default no longer uses
    SSLv2 or SSLv3.  See the RELEASE_NOTES file for how to get
    the old settings back. Files: global/mail_params.h,
    proto/postconf.proto, and files derived from those.


author: Django <django@nausch.org> - 2:2.11.7-1
changelog:
  - Workaround: disable DNSSEC support for AIX 7x and earlier.
    The AIX 6/7 resolver(5) API defines RES_USE_DNSSEC without
    defining the "ad" bit.  Viktor Dukhovni.  Files: makedefs,
    proto/INSTALL.html, dns/dns.h.
  - Bugfix (introduced: 20120531-617): the Postfix SMTP server
    used a larger-than-1 VSTREAM buffer to read the HAProxy
    connection hand-off information. This broke TLS wrappermode,
    as the TLS helo packet would end up in the plaintext VSTREAM
    buffer. Reported by Lukas Erlacher.  File: smtpd/smtpd_haproxy.c.
  - Bugfix (introduced: 20090216-24): incorrect postmulti error
    message. Reported by Patrik Koetter. Fix by Viktor Dukhovni.
    File: postmulti/postmulti.c.
  - Workaround: don't create a new instance when the template
    main.cf and master.cf files are missing, as happens on
    Debian-like systems. Viktor Dukhovni. File: conf/postmulti-script.
  - Bugfix (introduced: 19970309, fixed 20150421 in development
    release): reset errno before calling readdir(), in order
    to distinguish between an end-of-directory and an error
    condition. File: scandir.c.
  - Bugfix (introduced: 20040124): Milter client panic while
    adding a header, because the PREPEND action used the same
    output function for header_checks and body_checks.  Viktor
    Dukhovni and Wietse. File: cleanup/cleanup_message.c.
  - Bugfix (introduced: 20031128): xtext_unquote() did not
    propagate error reports from xtext_unquote_append(), causing
    the decoder to return partial ouput, instead of rejecting
    malformed input. Fix by Krzysztof Wojta.  File: globa


author: Django <django@nausch.org> - 2:2.11.8-1
changelog:
  - Bugfix (introduced: Postfix 2.6): the Milter SMFIR_CHGFROM
    (replace sender) request lost the sender_bcc_maps address.
    Fixed by moving some record keeping to the sender output
    function.  Files: cleanup/cleanup_envelope.c,
    cleanup/cleanup_addr.c, cleanup/cleanup_milter.c,
    cleanup/cleanup.h, regression tests.
  - Bugfix (introduced: Postfix 2.6): the "bad filetype"
    header_checks pattern falsely rejected Content-Mumble headers
    with ``name="example"; x-apple-part-url="example.com"''.
    Fixed by respecting the ";" separator between content
    attribute values.  Reported by Cedric Knight.  File:
    proto/header_checks.
  - Portability: OpenBSD 6.0. Files: makedefs, util/sys_defs.h.


author: Django <django@nausch.org> - 2:2.11.9-1
changelog:
  - Bugfix (introduced: Postfix 1.1): the postsuper command did
    not count a successful rename operation after error recovery.
    Problem reported by Markus Schönhaber. File: postsuper/postsuper.c.
  - Bugfix (introduced: Postfix 2.1.0): the Postfix SMTP daemon
    did not query sender_canonical_maps when rejecting unknown
    senders with "smtpd_reject_unlisted_recipient = yes" or
    with reject_unlisted_sender.  Stephen R. van den Berg (Mr.
    procmail).  Files: smtpd/smtpd.c, smtpd/smtpd_check.c.
  - Bugfix (introduced: 20090614): with concurrent connections
    from the same client IP address, and after-220 tests enabled,
    postscreen could overwrite the cached "all tests completed"
    result of one connection that completed the after-220 tests,
    with the "some tests not completed" result of a concurrent
    connection where the client hung up later, without completing
    the after-220 tests.


author: Django <django@nausch.org> - 2:2.11.10-1
changelog:
  - Security: Berkeley DB 2 and later try to read settings from
    a file DB_CONFIG in the current directory.  This undocumented
    feature may introduce undisclosed vulnerabilities resulting
    in privilege escalation with Postfix set-gid programs
    (postdrop, postqueue) before they chdir to the Postfix queue
    directory, and with the postmap and postalias commands
    epending on whether the user's current directory is writable
    by other users. This fix does not change Postfix behavior
    for Berkeley DB < 3, but reduces file create performance
    for Berkeley DB 3 .. 4.6.  File: util/dict_db.c.


author:
  Django <django@nausch.org> - 2:2.11.1111111111111111111111x (introduced: Postfix 1.1): the virtual(8) delivery

changelog:
  agent discarded the error result from vstream_fseek().
    File: virtual/mailbox.c.
  - Bugfix (introduced: 20090614): with concurrent connections
    from the same client IP address, and after-220 tests enabled,
    postscreen could overwrite the cached "all tests completed"
    result of one connection that completed the after-220 tests,
    with the "some tests not completed" result of a concurrent
    connection where the client hung up later, without completing
    the after-220 tests.
  - Bugfix (introduced: Postfix 1.1): the postsuper command did
    not count a successful rename operation after error recovery.
    Problem reported by Markus SchÃ¶nhaber. File: postsuper/postsuper.c.
  - Bugfix (introduced: Postfix 2.1.0): the Postfix SMTP daemon
    did not query sender_canonical_maps when rejecting unknown
    senders with "smtpd_reject_unlisted_recipient = yes" or
    with reject_unlisted_sender.  Stephen R. van den Berg (Mr.
    procmail).  Files: smtpd/smtpd.c, smtpd/smtpd_check.c.
  - Security: Berkeley DB 2 and later try to read settings from
    a file DB_CONFIG in the current directory.  This undocumented
    feature may introduce undisclosed vulnerabilities resulting
    in privilege escalation with Postfix set-gid programs
    (postdrop, postqueue) before they chdir to the Postfix queue
    directory, and with the postmap and postalias commands
    depending on whether the user's current directory is writable
    by other users. This fix does not change Postfix behavior
    for Berkeley DB < 3, but reduces file create performance
    for Berkeley DB 3 .. 4.6.  File: util/dict_db.c.
  - Bugfix (introduced: Postfix 2.1): don't log warnings 
    that some restriction returns OK, when the access map
    DISCARD feature is in effect. File: smtpd/smtpd_check.c.
  - Bugfix (introduced: 20170611): the DB_CONFIG bugfix broke
    Berkeley DB configurations with a relative pathname.  File:
    util/dict_db.c.
  - Documentation patches by Sven Neuhaus. Files:
    proto/FORWARD_SECRECY_README.html, proto/SMTPD_ACCESS_README.html.
  - Cleanup: missing mailbox seek-to-end error check in the
    local(8) delivery agent. File: local/mailbox.c.
  - Cleanup: incorrect mailbox seek-to-end error message in the
    virtual(8) delivery agent. File: virtual/mailbox.c.


author: Django <django@nausch.org> - 2:2.11.3-1
changelog:
  - Fix for configurations that prepend message headers with Postfix access maps, policy servers or Milter applications. Postfix now hides its own Received: header from Milters and exposes prepended headers to Milters, regardless of the mechanism used to prepend a header. This fix reverts a partial solution that was released on October 13, 2014, and replaces it with a complete solution.


author: Django <django@mailserver.guru> 2.0.4-1
changelog:
  initial release for CentOS 7, build with patches from Andreas Schulze:
       ° fixwarnings.patch
       ° ar-header.patch
       ° no_daemon.patch
       ° logging.patch
       ° insert_header.patch
       ° ipv6.patch
    Thanx to Andreas!


author: Django <django@mailserver.guru> - 4.0.2-1
changelog:
  - Changes to squid-4.0.2:
    Regression Bug 4351: compile errors when authentication modules disabled
    Regression fix: HTTP/1.1 Transfer-Encoding:chunked parsing
    Bug 4359: assertion failure 'Comm::IsConnOpen(conn)' within ConnStateData::requestTimeout
    Bug 4356: segmentation fault using proxy_auth ACL
    Bug 4352: compile errors in OS X 10.11
    Bug 4021: ext_user_regex does exact match
    Bug 3574: avoid crashes, prohibit reconfiguration during shutdown
    Support re-assigning delay pools based on HTTP reply details


author: Django <django@mailserver.guru> - 4.0.3-1
changelog:
  - Changes to squid-4.0.3i:
    Bug 4372: missing template files
    Bug 4371: compile errors: no such file or directory: DiskIO/*/*DiskIOModule.o
    Bug 4368: A simpler and more robust HTTP request line parser
    Fix compile erorr on clang undefined reference to '__atomic_load_8'
    ext_kerberos_ldap_group_acl: Add missing workarounds for Heimdal Kerberos
    ext_ldap_group_acl: Allow unlimited LDAP search filter
    ext_unix_group_acl: Support -r parameter to strip @REALM from usernames
    ... and much code cleanup and polishing


author: Django <django@mailserver.guru> - 4.0.4-1
changelog:
  - Changes to squid-4.0.4:
    Regression Bug 4393: compile fails on OS X
    Bug 4392: assertion CbcPointer.h:159: 'c' via tunnelServerClosed or tunnelClientClosed
    Support use of Kerberos credentials cache instead of keytab
    Support logging of TLS Cryptography Parameters
    Support substring matching in Note ACL
    ... and some code cleanup and polishing


author: Django <django@mailserver.guru> - 4.0.5-1
changelog:
  - Changes to squid-4.0.5:
    Regression Bug 4429: http(s)_port options= error message missing characters
    Regression Bug 4410: 4.0.4 compile error in basic_ncsa_auth
    Regression Bug 4403: helper compile errors after 4.0.4 rev.14454
    Regression Bug 4401: compile error on Solaris
    Regression Fix: TLS/SSL flags parsing
    Regression Fix: cert validadator always disabled in 4.x
    Regression Fix: Name-only note ACL stopped matching after 4.0.4 rev.14465 (note -m)
    Regression Fix: external_acl problems after 4.0.1 rev.14351
    Bug 4409 (partial): compile error when two Heimdal libraries are installed
    Bug 4005: Dynamic certificate cache exceeds dynamic_cert_mem_cache_size
    SMP: Fix cleanup of a shared memory segment in an unusual configuration
    SSL-Bump: Fix step3 splicing.
    Add connections_encrypted ACL
    Make %<a and %<p details available to [eCAP] RESPMOD services
    Rename cert_valid.pl to security_fake_certverify
    Rename ssl_crtd helper to security_file_certgen
    ... and a lot of code SourceLayout project cleaning
    ... and some documentation updates


author: Django <django@mailserver.guru> - 4.0.6-1
changelog:
  - Changes to squid-4.0.6:
    Regression Bug 4436: Fix DEFAULT_SSL_CRTD
    Fix "dial: Ssl::PeerConnector::sslCrtvdHandleReply threw exception: callback != NULL"
    ... and some documentation updates


author: Django <django@mailserver.guru> - 4.0.7-1
changelog:
  - Changes to squid-4.0.7:
    Regression Fix: external_acl parameters separated by %20 instead of space
    Bug 4432: assertion failed: store.cc:1919: "isEmpty()"
    Bug 4111: leave_suid() does not properly handle error codes returned by setuid
    Fix propagation of response status line parsing error details
    Fix memory leak when the cache of sslcrtvalidator_program is disabled via ttl=0
    ... and some code SourceLayout project cleaning


author: Django <django@mailserver.guru> - 4.0.8-1
changelog:
  - Changes to squid-4.0.8:
    Bug 4459: FHS compliance: move netdb.state and ssl_db to /var/cache/squid
    Bug 4458: Behaviour change with external ACL arguments
    Bug 4450: wait() related cleanup
    Bug 4438: SIGSEGV in memFreeString() destructing SBuf globals on shutdown/restart
    Bug 4312: Support disabling collapsed forwarding SMP cooperation
    Bug 3826: SMP compatibility with systemd and --foreground option
    Bug 1979: Add ACL-driven server_pconn_for_nonretriable squid.conf directive
    Bug 7 (partial): Update cached entries on 304 responses
    Add reply_header_add directive
    HTTP/1.1: Do not prohibit updating Last-Modified on 304 responses
    Fix memory leaks of lastAclData and AccessLogentry::url
    Fix clang -Winconsistent-missing-override warning
    Tests: update test suite for GnuTLS
    ... and some documentation updates
    ... and some code cleanup and polishing


author: Django <django@mailserver.guru> - 4.0.9-1
changelog:
  - Changes to squid-4.0.9:
    Bug 4405: assertion failed: comm.cc:554: "Comm::IsConnOpen(conn)"
    Add a new error page token for unquoted external ACL messages.
    Stop parsing response prefix after discovering an "HTTP/0.9" response.
    ... and some documentation updates
    ... and some code polishing


author: Django <django@mailserver.guru> - 4.0.10-1
changelog:
  - Changes to squid-4.0.10:
    Accumulate fewer unknown-size responses to avoid overwhelming disks.
    Fix shared memory corruption when storing multi-slot (>32KB) shm misses.
    ... and some documentation and code cleanup


author: Django <django@mailserver.guru> - 4.0.11-1
changelog:
  - Changes to squid-4.0.11:
    Bug 4517: error: comparison between signed and unsigned integer
    Bug 4492: chunked parser needs to accept BWS after chunk size
    HTTP/1.1: allow chunking the last HTTP response on a connection
    HTTP/1.1: unfold mime header blocks
    TLS: fast SNI peek
    TLS: check for SSL_CIPHER_get_id() support required in adjustSSL()
    TLS: never enable OPENSSL_HELLO_OVERWRITE_HACK automatically
    squidclient: improve shell-escape support in -H option
    Do not allow low-level debugging to hide important/critical messages
    Replace new/delete operators using modern C++ rules
    Remove ie_refresh configuration option
    Deprecating SMB LanMan helpers
    Mark refresh-waiting transactions with REFRESH
    ... and some code cleanup and polishing


author: Django <django@mailserver.guru> - 6.3-1
changelog:
  This release adds a new report to show statistics about Denied URLs. It also
  allow to add a SquidGuard log to the list of log files and to report blocked
  URLs into the Denied reports. It ialso adds a pie chart on SquidGuard ACLs use.

  There's also four new configuration directives:

    - UserReport to be able to remove any user related reports but statistics
      about URL and domains will remain.
    - ExcludedCodes to be able to exclude some log entries following the TCP
      code returned.
    - UrlHitsOnly to be able to enable the generation of additional HTML tables
      with top Url per byte and per duration in Top Urls and Domains report.
    - MaxFormatError to not exit immediatly when a bad format error is encountered. 
      SquidAnalyzer will wait MaxFormatError before exiting.

  Note that this last directive is disable by default, so if you still want the
  three tables in the reports, you must set UrlHitsOnly to 1.

  A Catalan translation file has been added to the lang directory.

  It also included several bug fixes since last release.

    - Skip immediately lines that squid is not able to tag: TAG_NONE. Thanks to
      David Touzeau for the report.
    - Fix display order when OrderUrl was set in Top Url and Top Domain views.
      Thanks to Wesley Bresson for the report.
    - Convert fr_FR.txt translation file from ISO_8859-1 to UTF8 and change
      charset value. Thanks to zezinho42 for the report.
    - Change order in de_DE.txt of WeekDay to So Mo Di Mi Do Fr Sa, the week
      days in translation file must start with Sunday unlike in calendar.
    - Fix case sensitivity in command line options. Thanks to Pavel Podkorytov
      for the report.
    - Add SquidGuard.current state file to be able to do incremental parsing of
      both squid and squidguard log files without issues.
    - Try to fix bad characters in mime_type field and add MaxFormatError to not
      exit immediatly when a bad format error is encountered. SquidAnalyzer will
      wait MaxFormatError before exiting.
    - Add information about how to parse SquidGuard log together with Squid Cache
      access log file.
    - Add pie chart on SquidGuard ACLs use.
    - Remove redundant regular expressions.
    - Try to fix case when method or code in log file are corrupted with non
      printable characters, should never appears but some injection have been
      reported.
    - Add support for SquidGuard log parsing to report denied ACLs. Thanks to
      Pavel Podkorytov for the feature request.
    - Fix detection of new log file from history when log file was in common
      http format.
    - Fix possible POSIX::strftime error with debug mode activated.
    - Add / at end of WebUrl when it is set but does not terminate with a slash.
    - Remove extra slash in week link, update russian translation file and fix
      some missprint. Thanks to badfiles for the patches.
    - Add Catalan translation file. Thanks to atorrillasmat for the file.
    - misprints, there are two of them. badfiles
    - Add TCP_REDIRECT to be counted as a DENIED tag from log file for users of
      squidGuard/ufdbGuard-style URL rewriters. Thanks to slashdoom for the patch.
    - Force SquidAnalyzer to use locale C internally.
    - Exclusion/Inclusion check when reading data files are limited to rebuild
      otherwise there is too much performance lost.
    - Applied exclusion/inclusion on cumulative reports even if rebuild is not
      used.
    - Fix some issue with rebuild and exclusion.
    - Show more information when a log is skipped because his size is detected
      as lower than expected.
    - Print SquidAnalyzer version when debug mode is used.
    - Add TCP_TUNNEL used by Squid 3.5 for streaming to cache miss statistics.
      Thanks to MangOuste for the report.
    - Apply exclusion/inclusion definitions on old data when rebuild is used.
      Thanks to niccarp for the feature request.
    - Fix unwanted message when QuietMode is enabled.
    - Fix typo that was crashing squid-analyzer. Thanks to Juan Jose Pablos for
      the report.
    - Fix output of benckmark info when debug is not enabled. Thanks to Juan Jose
      Pablos for the report.
    - Fix issue when rebuilding previous data without denied url stat. Thanks to
      Stepan Andreev for the report.
    - Add top denied label to translation file.
    - Add UrlHitsOnly configuration directive to be able to disable the generation
      of tables ordered per byte and duration in Top Urls and Domains report.
      Thanks to Cesar Vazquez for the feature request.
    - Add top denied url statistics. Thanks to tierpod for the featur request.
    - Replace call to localtime() to CORE::localtime() to avoid Time::localtime
      override default behaviour. Thanks to oldnrustyreaper for the report.


author: Django <django@mailserver.guru> - 6.4-1
changelog:
  Add -t | --timezone and TimeZone directive to change the timezone. When set,
  SquidAnalyzer will read time from log file as UTC time and will add the
  hours specified in the timezone option. This is useful if the log file is
  not parsed on a computer with the same timezone than the squid server.

  It also included several bug fixes since last release.

    - Fix graphic overlaps that with one of the graphics. Thanks to Daniel Bareiro
      for the report.
    - Add throughput calculation (ratio between bytes and duration) to all reports.
    - Fix missing largest URL in networks detailed report. Thanks to Juan Martin
      for the report.
    - Fix use of network-aliases together with a network include entry that make
      networks disappears from the report. Thanks to Juan Martin for the report.
    - Add -t | --timezone and TimeZone directive to change the timezone. When set,
      SquidAnalyzer will read time from log file as UTC time and will add the
      hours specified in the timezone option. Thanks to Anderson - BR Suporte for
      the feature request.
    - Add support to ufdbGuard log file. squidGuard and ufdbGuard files can be
      given together with squid log file as a list into LogFile configuration
      file or as arguments of command line. Thanks to Martin Hoffmann for the
      feature request.
    - Fix some division by zero. Thanks to cueda for the report.
    - Fix some potential illegal division by zero.
    - Fix negative duration with http like log file when duration is not set (-).
      Thanks to cedua for the report.
    - Add new throughput (Bytes/sec) column in all reports and a throughput graph.
      Thanks to Mike Lerley for the feature request.
    - Allow parsing of xz compressed files. Thanks to Markus Maikis for the patch.
    - Fix bug with include/exclude networks or clients preventing users reports to
      be built. Thanks to Juan Martin for the report.
    - Fix SquidAnalyzer fails to update statistics after cleanup of access.log.
      Thanks to mkhallaf for the report.
    - Limit parsing of ufdbGuard logs to BLOCK line.
    - Replace SquidGuard label by Blocklist as we use more blocklist tools.
    - Update Italian translation file. Thanks to Stefano Cailotto for the update.


author: Django <django@mailserver.guru> - 6.5.1
changelog:
  This is a mantenance release to fix an overlaping bug on bytes charts with 
  last versions of browsers like firefox, iceweasel and chrome. 
    - Fix height of bytes graphs that was overlaping on third graph. 
      Thanks to Daniel Bareiro for the report. 
    - Update russian translation. Thanks to Yuri Voinov for the patch. 
    - Update copyright year.


author: Django <django@mailserver.guru> - 6.6.1
changelog:
  Add TopStorage configuration directive to limit the storage of url to
  a certain quantity in data file and sorted by OrderUrl. On huge access
  log it will improve a lot the performances but you will have less
  precision in the top url. Default to 0, all url will be stored.
  Add a cache to network and user aliases for speed improvement. Thanks to
  Louis-Berthier Soulliere for the report.
   - Add TimeStart and TimeStop configuration directives to allow to
     specify a start and stop time. Log line out of this time range
     will not be parsed. The format of the value is HH:MM. These
     directives can be overridden with the -s | --start and -S | --stop
     command line options. Thanks to Louis-Berthier Soulliere for the
     feature request.
   - Add UpdateAlias configuration directive to apply immediately the changes
     made in aliases files to avoid duplicates. You still have to use
     --rebuild to recreate previous reports with new aliases. Enabling
     this will imply a lost of performances with huge log files.
   - Add UseUrlPort configuration directive to be able to include port number
     into Url statistics. Default is to remove the port information from the
     Url. Thanks to Tobias Wigand for the feature request.
   - Add report of top denied url on user statistic page. Thanks to delumerlino
     and Pavel Podkorytov for the feature request.
   - Add last visited timestamp on urls reports and show last ten visit on user
     url report. The last visit are counted after 5 minutes in hour view, after
     30 minutes in day views and per day in month view. Thanks to Ringa Mari
     Sundberg for the feature request.
   - Add support to ipv6 address dns resolving, you need perl > 5.014. Thanks
     to Brian J. Murrell for the report.
  Full list of other bug fixes:
   - Change user top url title from "Top n/N Url" into "Top n/N sites". Thanks
     to Daniel Bareiro for the report.
   - Update documentation to clarify the use of space character in aliases
     files. Thanks to Darren Spruell for the report.
   - Fix explanation of UserAlias file format about ip address vs DNS name.
     Thanks to Darren Spruell for the report.
   - Fix missing report of TCP_DENIED_REPLY messages. Thanks to Jeff Gebhardt
     for the report.
   - Add license file about resources file and a script to retrieve original
     javascript libraries.
   - Fix html report building that was limited to the last day.
   - Fix missing network alias replacement.
   - Update year in copyrights.
   - Disabled bandwidth cost report by default.
   - Fix removing of obsolete year directory.
   - Fix obsolete statistics no longer being deleted. Thanks to andreybrasil
     for the report.
   - Allow parsing of access.log generated through syslog. Thanks to Celine
     Labrude for the report.
   - Add Url_Hit label in translation files.
   - Fix remaining _SPC_ in username. Thanks to roshanroche for the report.
   - Fix remaining SA_CALENDAR_SA in html output. Thanks to roshanroche for
     the report.
   - Add more fix to denied stat datafile corruption. Thanks to PiK2K for the
     report.
   - Fix denied stat datafile corruption. Thanks to PiK2K for the report.
   - Use CORE::localtime to format denied first and last hit.
   - Fix potential unparsed log case when log file are set in configuration
     file and not on command line.
   - Change the in-line popup (on top domain and top URL) to show hits on hits
     tables, bytes on the bytes tables and duration on the duration tables,
     instead of count. Thanks to Wesley Bresson for the feature request.
   - Only apply OrderUrl to user url list, other reports in Top domain and Top
     Url are now always ordered following the first column, which is the sorted
     column of the report (hits, bytes and duration).
   - Fix missing limit total number of URLs shown for a user to TopNumber.
     Thanks to Graham Wing for the report.
   - Update statistic on users with DENIED code to have the full list of
     user/ip even if they never hit an url.
   - Change Perl install directory from vendor to site to avoid well know issue
     on BSD. Thanks to dspruell for the report.
   - Add initial Debian package build files
   - Update squidanalyzer.css changed the width of the single menu tabs,
     because in German language, it looks better at the tab "TOP DENIED" is in
     German language "TOP VERBOTEN" and will be displayed better, no wordwrap
     anymore, will be done with this change. Thanks to Klaus Tachtler for the
     patch.
   - Fix Throughput label for unit/s that was not dynamically changed during
     value formating and always labelled as B/s. Thanks to aabaker for the
     report.
   - Fix typo in graph titles. Thanks to aabaker for the patch.
   - Update missing fields to German language file. Thanks to Klaus Tachtler
     for the patch.
   - Fix top url report that was not cumulate statistics anymore. Thanks to
     Wesley Bresson for the report.
   - Fix typo about Network exclusion. Thanks to Mathieu Parent for the patch.
   - Manpages fixes. Thanks to Mathieu Parent for the patch.
   - Use FHS for manpages path. Thanks to Mathieu Parent for the patch.
   - Update russian language file. Thanks to Yuri Voinov for the patch.
   - Fix typo in mime type redefinition.
   - Mark mime-types with invalid characters as "invalid/type". Thanks to
     gitdevmod for the report.
   - Add missing throughput translation entries in lang files. Thanks to Yuri
     Voinov for the report.
   - Fix major issue in squidguard and ubfguard history file managment. Thanks
     to Guttilla Elmi for the report and the help.
   - Fix path to xzcat program durinf install. Thanks to Johan Glenac for
     the report.
   - Fix auto detection of SquidGuard log file when there is no denied entry
     in the first lines.
   - Fix typo in debug messages
   - Add warning when DNSLookupTimeout is reach. Thanks to gitdevmod for the
     report.


