On 27/08/25, Stefan G. Weichinger via dovecot (dovecot@dovecot.org) wrote:

Am 26.08.25 um 17:03 schrieb Maciej Milaszewski via dovecot:

...

Hi Debian have something like Preferences in apt and packages will be working fine

thank you. For our setup the config conversion isn't that easy, so the step to dovecot-2.4 has to be prepared and tested ...

So far 2.3 runs fine even with Trixie.

I've often used apt-pinning in this way. (https://douglasrumbaugh.com/post/apt-pinning/)

The issue may be that 2.3.x series may not receive security updates, I guess?

Look here : https://tracker.debian.org/pkg/dovecot

dovecot 2.3 has entered pldstable and old-sec. It will receive security patches as long as oldstable lives 2026-06-10 as of https://www.debian.org/releases/ may be longer depending on LTS team.

-----Original Message----- From: Stefan G. Weichinger via dovecot <dovecot@dovecot.org> Reply-To: Stefan G. Weichinger <lists@xunil.at> To: dovecot <dovecot@dovecot.org> Subject: Re: Debian 13 with Dovecot-2.3 from dovecot repos Date: 28/08/25 08:04:47

Am 27.08.25 um 16:52 schrieb Rory Campbell-Lange:

On 27/08/25, Stefan G. Weichinger via dovecot (dovecot@dovecot.org) wrote: I've often used apt-pinning in this way. (https://douglasrumbaugh.com/post/apt-pinning/)

The issue may be that 2.3.x series may not receive security updates, I guess?

That's why I asked ;-)

here it was mentioned that 2.3 gets security patches:

https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/3P45L7...

I don't know if the 2.3 repositories for Debian will be maintained also, but I assume so.

The upgrade to 2.4 is planned here, but the config changes are quite drastic as far as I see. Until I figured out how to convert all the sieve- and imapsieve-parameters I will stay on 2.3. Yes, I read the docs, sure, but without some kind of secondary test-clone this looks too risky for me right now. I prepare the new config in a test VM and work my way through it until dovecot doesn't complain anymore.

I assume the 2.3 repos will live for a few months from now, I will be ready to upgrade sooner ;-)

dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org

-- kind regards / mit freundlichen Grüßen Moosbauer Josef <josef@moosbauer.net> GPG Fingerprint 6748 9413 0EF1 5B23 D707  DBFA 570B 00E3 4689 8CC9 "Of course I'm crazy, but that doesn't mean I'm wrong.I'm mad but not ill"

On Thu, Aug 28, 2025 at 03:02:45PM +0200, Stefan G. Weichinger via dovecot wrote:

...

Look here : https://tracker.debian.org/pkg/dovecot

dovecot 2.3 has entered pldstable and old-sec. It will receive security patches as long as oldstable lives 2026-06-10 as of https://www.debian.org/releases/ may be longer depending on LTS team.

that relates to the packages in the official debian repos

As mentioned I use the packages from dovecot.org:

https://repo.dovecot.org/ce-2.3-latest/debian/bullseye/

The EOL of these packages might be different, right?

So maybe I would have to switch over and remove the extra repo from my setup.

Yes, these packages are provided by Dovecot and may have a different support lifecycle from those provided by Debian.

In general, I'd expect the packages distributed by Dovecot to work on newer distro releases. The package manager will not remove any dependencies as long as the packages remain installed. The main concern is the case when some package from the new distro version conflicts with an older version (that is, they can't both be present on the system simultaneously). You'd likely have already run into this if you've upgraded to trixie, though. Any updates to the Dovecot packages will still be installed as expected.

I don't have any experience migrating (in either direction) between the Dovecot-provided packages and the Debian-provided packages, so if you do pursue that course, be sure to test thoroughly before going to prod.

noah (Debian Dovecot maintainer)

From https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/3...

Dovecot lifecycle announcement (excerpt) For Dovecot CE 2.3 we will provide critical security bug fixes. If you are using a 2.3.x version packaged from an Operating System Vendor, please open a bug against them for fixing it. We do not provide patches or bug fixes against these OS Vendor specific releases.

No dates mentioned

-----Original Message----- From: Stefan G. Weichinger via dovecot <dovecot@dovecot.org> Reply-To: Stefan G. Weichinger <lists@xunil.at> To: dovecot@dovecot.org Subject: Re: Debian 13 with Dovecot-2.3 from dovecot repos Date: 28/08/25 15:02:45

Am 28.08.25 um 11:02 schrieb Josef Moosbauer via dovecot:

Look here : https://tracker.debian.org/pkg/dovecot

dovecot 2.3 has entered pldstable and old-sec. It will receive security patches as long as oldstable lives 2026-06-10 as of https://www.debian.org/releases/ may be longer depending on LTS team.

that relates to the packages in the official debian repos

As mentioned I use the packages from dovecot.org:

https://repo.dovecot.org/ce-2.3-latest/debian/bullseye/

The EOL of these packages might be different, right?

So maybe I would have to switch over and remove the extra repo from my setup.

dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org

-- kind regards / mit freundlichen Grüßen Moosbauer Josef <josef@moosbauer.net> GPG Fingerprint 6748 9413 0EF1 5B23 D707  DBFA 570B 00E3 4689 8CC9 "Of course I'm crazy, but that doesn't mean I'm wrong.I'm mad but not ill"