chore(deps): Upgrade filtermail to v0.7.8

## 0.7.8 - 2026-11-04

### Features

- Set read/write timeouts to incoming HTTP streams
- Set read/write timeouts for SMTP server streams
- Introduce a timeout for WorkerMessage

### Miscellaneous Tasks

- Add cargo-deny and apply security fixes

### Performance

- Avoid copying armored payload in check_armored_payload()
- Switch to jemalloc
- *(smtp-server)* Pre-allocate data vector to max_size
- *(smtp-server)* Reuse line buffer for reading DATA lines
- *(smtp-server)* Shrink_to_fit() data buffers at the end of DATA command

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>

.github/workflows/ci.yaml

@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
       - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.7/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.8/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
       - name: run chatmaild tests 
         working-directory: chatmaild
         run: pipx run tox

chatmaild/src/chatmaild/defaults/appversions.json

@@ -5,9 +5,9 @@
       "sources": [
         {
           "sourceId": "gplay",
-          "versionInteger": 758,
-          "versionString": "2.62.0",
-          "downloadUrl": "https://github.com/deltachat/deltachat-android/releases/download/v2.62.0/deltachat-gplay-release-2.62.0.apk"
+          "versionInteger": 759,
+          "versionString": "2.64.0",
+          "downloadUrl": "https://github.com/deltachat/deltachat-android/releases/download/v2.64.0/deltachat-gplay-release-2.64.0.apk"
         }
       ]
     }

cmdeploy/src/cmdeploy/deployers.py

@@ -12,6 +12,7 @@ from chatmaild.config import read_config
 from pyinfra import facts, host, logger
 from pyinfra.api import FactBase
 from pyinfra.facts import hardware
+from pyinfra.facts.files import Sha256File
 from pyinfra.facts.systemd import SystemdEnabled
 from pyinfra.operations import apt, files, pip, server, systemd
 
@@ -38,6 +39,8 @@ from .postfix.deployer import PostfixDeployer
 from .selfsigned.deployer import SelfSignedTlsDeployer
 from .www import build_webpages, find_merge_conflict, get_paths
 
+OLD_JOURNALD_SHA256 = "107c678516c972d5293a67386458fd4785d467cfa2f2b7174185e9a74e034be5"
+
 
 class Port(FactBase):
     """
@@ -354,7 +357,15 @@ class IrohDeployer(Deployer):
 
 class JournaldDeployer(Deployer):
     def configure(self):
-        self.put_file("journald.conf", "/etc/systemd/journald.conf")
+        self.put_file("90-volatile-logging.conf", "/etc/systemd/journald.conf.d/90-volatile-logging.conf")
+        if host.get_fact(Sha256File, "/etc/systemd/journald.conf") == OLD_JOURNALD_SHA256:
+            server.shell(
+                name="Restore Debian's journald.conf",
+                commands=[
+                    "rm /etc/systemd/journald.conf",
+                    "DEBIAN_FRONTEND=noninteractive apt-get install -y --reinstall -o Dpkg::Options::=--force-confmiss systemd",
+                ],
+            )
 
     def activate(self):
         self.ensure_service("systemd-journald.service")

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

@@ -68,6 +68,11 @@ http {
   
 		listen 127.0.0.1:8443 ssl default_server;
 
+		# nginx is reached through the stream proxy on port 443,
+		# so redirects it generates itself (e.g. /dir -> /dir/)
+		# must not contain the internal port 8443.
+		absolute_redirect off;
+
 		root {{ www_root }};
 
 		index index.html index.htm;

cmdeploy/src/cmdeploy/pins.py

@@ -1,14 +1,14 @@
 """Versions, hashes, and download URLs for pre-built artifacts fetched during deploy."""
 
-FILTERMAIL_VERSION = "v0.7.7"
+FILTERMAIL_VERSION = "v0.7.8"
 FILTERMAIL_ARTIFACTS = {
     "x86_64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-x86_64",
-        "0691debf501f854f4e6a9dd6516f3a0ef03d95721a9b540309014bfe1a1f52b1",
+        "f470431f98468b9f4d2452470bffc00c0010b3f92655005d59b997f599fd7d4a",
     ),
     "aarch64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-aarch64",
-        "964f85df8b65b812666113f968cbfdd8da88ce16d218284deb359c1e2400d2da",
+        "a15a476ab92072ad22f1bc9d81e5c545bc3d81fc9d446d53f8cc1de810867837",
     ),
     "mtail": (
         f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail",

cmdeploy/src/cmdeploy/postfix/main.cf.j2

@@ -127,6 +127,7 @@ lmtp-filtermail_destination_concurrency_limit=10000
 
 # Do not try to deliver messages for more than 2 days.
 maximal_queue_lifetime = 2d
+bounce_queue_lifetime = 2d
 
 {% if not config.ipv4_relay %}
 # DKIM-sign locally generated mail (bounces, DSNs).