On Fri, Sep 25, 2026 at 01:37:12PM +0200, Guilhem Moulin wrote: > so AFAICT existing installations keep using crc32 hashes and remain > affected by the denial of service issue. X-Debbugs-Cc'ing secteam as > heads up: for the backports to older suites it might make sense to lower > the version threshold. (Given 2.3 series lack the storage version check > logic I will unconditionally trigger the v1 → v2 on-disk upgrade for > Bookworm LTS, but need to wait for subsequent suites to add support for > the v2 format to avoid broken upgrade paths.)
I think we'll want to do the unconditional format upgrade in the trixie security update as well. We don't want to bump supported_versions without actually bumping to a new upstream dovecot release, which is impractical. > Unfortunately dovecot doesn't allow overriding `dovecot_*_version` later > in `/etc/dovecot/conf.d/99-*.conf`. Please consider bumping *both* > `dovecot_config_version` and `dovecot_storage_version` to 2.4.5. > > An argument for bumping the former too is to honor the current > `mail_attachment_detection_options` default value for maildir. With the > current value dovecot adds `$HasAttachment` or `$HasNoAttachment > keywords for maildir too, but doesn't bump the HIGHESTMODSEQ counter > resulting in split-brain issues for QRESYNC-capable synchronization > tools (possibly a dovecot bug, but the stock configuration is not > affected and given `dovecot_storage_version` needs to be bumped anyway > it probably makes sense to upgrade `dovecot_config_version` too). For forky, we should update both settings as requested. noah
