Big features

• App base image moved to Ubuntu 26.04. All the App Store packages have been rebuilt to use the new image.
• PostgreSQL 18, MongoDB 8.3, Dovecot 2.4.
• Setup uses Let's Encrypt IP certificates. No more self-signed warning screen!
  • 
• SQLite backups use VACUUM INTO instead of SQL text dumps, so restores keep PRAGMA/header bits.

Other notable changes

• Email notification when the mail status check fails
• Invite and password reset links expire after 24 hours
• Security: API tokens and login tokens are stored hashed
• Users are edited on their own page (was a dialog)
• LDAP users and groups get a badge
• OIDC Token exchange so first-party apps can talk to mail and each other without passing the user's token around. Head's up: unfortunately, this has uncovered a security issue as reported by @marcusquinn . This will be fixed soon with the 10.2 release.
• HSTS and related headers on error pages
• Redis backup and restore with the non-persistent flag
• Mail no longer keeps the previous hostname in SPF after a rename
• Fix crash when stopping an integrity check.
• Node.js updated to 24.22.1 (to fix eMudhra CA compromise)