Question ETA for Roundcube 1.6.20? (20 security fixes)

[Cmdr]

Server operating system version

Ubuntu 24.04.5 LTS

Plesk version and microupdate number

18.0.81 #4

Hello,

Roundcube released a security update on October 19th. Version 1.6.20 and 1.7.5.

Security updates 1.6.20 and 1.7.5 released

Free and open source webmail software for the masses, written in PHP

roundcube.net

With everything going on with PHP and security vulnerabilities right now, I wanted to ask if there’s an ETA for when Plesk will update to this version.

Thanks!

Kind regards

 

[King555]

I'm actually looking forward to the update to 1.7.x much more, so I can finally uninstall PHP 8.3, which I only have because Roundcube depends on it.

 

[Sebahat.hadzhi]

Updating RoundCube to 1.6.20/1.7.5 is already in our team processing queue. The update will likely be introduced either along with Obsidian 18.0.83 or with one of the minor updates of 18.0.82. I cannot confirm when exactly for sure. Once there are more details I will follow up. Thank you for your patience in the meantime.

 

[learning_curve]

@Cmdr / @King555 As per the post by @Sebahat.hadzhi above, Plesk will, after fully testing, provide what you're looking for. That's the best / easiest option.

FWIW We didn't want to wait and because unlike Plesk, who have to ensure legacy support for users before releasing upgrades, new configs etc, we are able to focus purely on our own servers. So since Roundcube 1.7.4, we've run Roundcube on PHP 8.5.* ourselves, outside of Plesk. It's still fully interfaced with Plesk (e.g. all links from within the GUI Plesk Panel operate as though it were a Plesk managed Roundcube package, but it's invisible in the GUI **:8443/admin/pum/list and/or the **:8447/installer/add_components.html list. Opting for self-management means adopting responsibilty for Roundcube upgrades as well as the initial custom install. Upgrades take a bit longer than if it were a Plesk managed upgrade, due to the config required to ensure it always seeemlessly interfaces with Plesk. We're fine with the extra work & responsibility, but others may not be. Example of the Roundcube 1.7.4 > 1.7.5 post upgrade final checks:

:~# echo "===== LIVE VERSION ====="
/opt/plesk/php/8.5/bin/php -r \
'include "/opt/roundcube/current/program/include/iniset.php"; echo RCMAIL_VERSION, PHP_EOL;'

echo
echo "===== LIVE TARGET ====="
readlink -f /opt/roundcube/current

echo
echo "===== LIVE HEALTHCHECK ====="
cd /opt/roundcube/current
/opt/plesk/php/8.5/bin/php bin/healthcheck.sh
printf 'healthcheck exit code: %s\n' "$?"

===== LIVE VERSION =====
1.7.5

===== LIVE TARGET =====
/opt/roundcube/releases/1.7.5

===== LIVE HEALTHCHECK =====
DB: OK
IMAP: OK (ssl://localhost:993)
SMTP: OK (ssl://localhost:465)
Managesieve: OK (tls://localhost:4190)
healthcheck exit code: 0
:/#

 

[Sebahat.hadzhi]

Roundcube was updated to 1.6.20 as of today's release - Plesk Obsidian 18.0.81 Update 5. The update to 1.7.5 is still in progress.