11 files changed, 93 insertions, 21 deletions
diff --git a/nixpkgs/pkgs/servers/mail/exim/default.nix b/nixpkgs/pkgs/servers/mail/exim/default.nix
index 407a319270f7..dc8d0dd648a1 100644
--- a/nixpkgs/pkgs/servers/mail/exim/default.nix
+++ b/nixpkgs/pkgs/servers/mail/exim/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "exim";
-  version = "4.96";
+  version = "4.96.2";
 
   src = fetchurl {
     url = "https://ftp.exim.org/pub/exim/exim4/${pname}-${version}.tar.xz";
-    hash = "sha256-KZpWknsus0d9qv08W9oCvGflxOWJinrq8nQIdSeM8aM=";
+    hash = "sha256-A44yfo0ek9AFusm7Bv0irsRNUCiTDW2+iBetRLv8HeY=";
   };
 
   enableParallelBuilding = true;
diff --git a/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix b/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
index 334a24b1ed00..ba2a894e12b8 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,6 +1,7 @@
 { lib
 , python3
 , fetchPypi
+, fetchpatch
 }:
 
 with python3.pkgs;
@@ -17,6 +18,10 @@ buildPythonPackage rec {
 
   patches = [
     ./0001-Disable-broken-test_help_output-testcase.patch
+    (fetchpatch {
+      url = "https://gitlab.com/mailman/hyperkitty/-/commit/5bb394662882bfc73c3e877458da44343aa06922.patch";
+      hash = "sha256-9vcY6nu3txDftH6aYpdh9qSrLzZceGjVFxuD1Ux18gw=";
+    })
   ];
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/servers/mail/mailman/package.nix b/nixpkgs/pkgs/servers/mail/mailman/package.nix
index f74e20566f68..42e0f433d88d 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/package.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/package.nix
@@ -2,7 +2,6 @@
 , fetchpatch
 , python3
 , fetchPypi
-, sphinx
 , postfix
 , lynx
 }:
@@ -30,7 +29,6 @@ buildPythonPackage rec {
     flufl_i18n
     flufl_lock
     gunicorn
-    importlib-resources
     lazr_config
     passlib
     requests
@@ -57,6 +55,11 @@ buildPythonPackage rec {
       url = "https://gitlab.com/mailman/mailman/-/commit/9613154f3c04fa2383fbf017031ef263c291418d.patch";
       sha256 = "0vyw87s857vfxbf7kihwb6w094xyxmxbi1bpdqi3ybjamjycp55r";
     })
+    (fetchpatch {
+      url = "https://gitlab.com/mailman/mailman/-/commit/5e4431af6bb7d672a7ed7e3329f8fac7812d47f8.patch";
+      excludes = [ ".gitlab-ci.yml" ];
+      hash = "sha256-y2AE9hU4Z1BpBlJywxMWiuRvltWkk+R9YgMkpemvlIo=";
+    })
     ./log-stderr.patch
   ];
 
@@ -83,6 +86,6 @@ buildPythonPackage rec {
     homepage = "https://www.gnu.org/software/mailman/";
     description = "Free software for managing electronic mail discussion and newsletter lists";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ qyliss ma27 ];
+    maintainers = with lib.maintainers; [ qyliss ];
   };
 }
diff --git a/nixpkgs/pkgs/servers/mail/mailman/python.nix b/nixpkgs/pkgs/servers/mail/mailman/python.nix
index 7c6edbd5e9ea..e4f96db0224d 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/python.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/python.nix
@@ -20,6 +20,14 @@ python3.override {
       */
       django = super.django_3;
 
+      elasticsearch = super.elasticsearch.overridePythonAttrs ({ pname, ... }: rec {
+        version = "7.17.9";
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-ZsTs4q3+fMEg4rameYof1cd3rs+C7sObuVzvfPx+orM=";
+        };
+      });
+
       # https://gitlab.com/mailman/hyperkitty/-/merge_requests/541
       mistune = super.mistune.overridePythonAttrs (old: rec {
         version = "2.0.5";
@@ -29,6 +37,15 @@ python3.override {
           hash = "sha256-AkYRPLJJLbh1xr5Wl0p8iTMzvybNkokchfYxUc7gnTQ=";
         };
       });
+
+      # django-q tests fail with redis 5.0.0.
+      redis = super.redis.overridePythonAttrs ({ pname, ... }: rec {
+        version = "4.5.4";
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-c+w12k2iZ9aEfkf2hzD91fYuLKaePvWIXGp4qTdMOJM=";
+        };
+      });
     })
 
     overlay;
diff --git a/nixpkgs/pkgs/servers/mail/mailman/web.nix b/nixpkgs/pkgs/servers/mail/mailman/web.nix
index ed5c267ad0c2..21fa64085d57 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/web.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/web.nix
@@ -1,4 +1,4 @@
-{ lib, python3, fetchPypi
+{ lib, python3, fetchPypi, fetchpatch
 , sassc, hyperkitty, postorius
 }:
 
@@ -14,6 +14,13 @@ buildPythonPackage rec {
     sha256 = "sha256-UWdqrcx529r6kwgf0YEHiDrpZlGoUBR6OdYtHMTPMGY=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.com/mailman/mailman-web/-/commit/448bba249d39c09c0cef5e059415cc07a3ce569c.patch";
+      hash = "sha256-rs1vaV4YyLyJ0+EGY70CirvjArpGQr29DOTvgj68wgs=";
+    })
+  ];
+
   postPatch = ''
     # Django is depended on transitively by hyperkitty and postorius,
     # and mailman_web has overly restrictive version bounds on it, so
diff --git a/nixpkgs/pkgs/servers/mail/mox/default.nix b/nixpkgs/pkgs/servers/mail/mox/default.nix
index 897f6ffc7a5b..17d34d368f6d 100644
--- a/nixpkgs/pkgs/servers/mail/mox/default.nix
+++ b/nixpkgs/pkgs/servers/mail/mox/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "mox";
-  version = "0.0.6";
+  version = "0.0.7";
 
   src = fetchFromGitHub {
     owner = "mjl-";
     repo = "mox";
     rev = "v${version}";
-    hash = "sha256-RNzjDAvyz0RfD4GV6hT9RNJOfHSUXCLfwN4+V5acX28=";
+    hash = "sha256-zFPgMVQQUnEKIgt35KxcRUxuBNSmTM8ZfAZvP22iKgg=";
   };
 
   # set the version during buildtime
diff --git a/nixpkgs/pkgs/servers/mail/postfix/default.nix b/nixpkgs/pkgs/servers/mail/postfix/default.nix
index 5955789d566f..e9dea5282aa9 100644
--- a/nixpkgs/pkgs/servers/mail/postfix/default.nix
+++ b/nixpkgs/pkgs/servers/mail/postfix/default.nix
@@ -99,6 +99,11 @@ in stdenv.mkDerivation rec {
       --prefix PATH ":" ${lib.makeBinPath [ coreutils findutils gnugrep ]}
     wrapProgram $out/libexec/postfix/postfix-script \
       --prefix PATH ":" ${lib.makeBinPath [ coreutils findutils gnugrep gawk gnused ]}
+
+    # Avoid dev-only outputs from being retained in final closure.
+    # `makedefs.out` is a documenttation-only file. It should be safe
+    # to store invalid store paths there.
+    sed -e "s|$NIX_STORE/[a-z0-9]\{32\}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" -i $out/etc/postfix/makedefs.out
   '';
 
   passthru = {
diff --git a/nixpkgs/pkgs/servers/mail/rspamd/default.nix b/nixpkgs/pkgs/servers/mail/rspamd/default.nix
index eb96fa9738e3..004490c8687a 100644
--- a/nixpkgs/pkgs/servers/mail/rspamd/default.nix
+++ b/nixpkgs/pkgs/servers/mail/rspamd/default.nix
@@ -28,24 +28,15 @@ assert withHyperscan -> stdenv.isx86_64;
 
 stdenv.mkDerivation rec {
   pname = "rspamd";
-  version = "3.6";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    hash = "sha256-GuWuJK73RE+cS8451m+bcmpZNQEzmZtexm19xgdDQeU=";
+    hash = "sha256-emxvSqtpTcv0LZjzhMncvnApRLXFDeyFVmkoeSVp6f4=";
   };
 
-  patches = [
-    # Fix leak in `gzip` function
-    # https://github.com/rspamd/rspamd/issues/4564
-    (fetchpatch2 {
-      url = "https://github.com/rspamd/rspamd/commit/ffbab4fbf218514845b8e5209aec044621b1f460.patch";
-      hash = "sha256-ltkC/mZcYmGoSFILaTTRB/UWSn36flEbuJP4Buys05Y=";
-    })
-  ];
-
   hardeningEnable = [ "pie" ];
 
   nativeBuildInputs = [ cmake pkg-config perl ];
diff --git a/nixpkgs/pkgs/servers/mail/smtprelay/default.nix b/nixpkgs/pkgs/servers/mail/smtprelay/default.nix
new file mode 100644
index 000000000000..8142dc76b98b
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/smtprelay/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "smtprelay";
+  version = "1.10.0";
+
+  src = fetchFromGitHub {
+    owner = "decke";
+    repo = "smtprelay";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-zZ3rgbo8nvrpFMtUmhyXnTgoVd0FIh1kWzuM2hCh5gY=";
+  };
+
+  vendorHash = "sha256-assGzM8/APNVVm2vZapPK6sh3tWNTnw6PSFwvEqNDPk=";
+
+  subPackages = [
+    "."
+  ];
+
+  CGO_ENABLED = 0;
+
+  # We do not supply the build time as the build wouldn't be reproducible otherwise.
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.appVersion=v${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/decke/smtprelay";
+    description = "Simple Golang SMTP relay/proxy server";
+    changelog = "https://github.com/decke/smtprelay/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ juliusrickert ];
+  };
+}
diff --git a/nixpkgs/pkgs/servers/mail/spamassassin/default.nix b/nixpkgs/pkgs/servers/mail/spamassassin/default.nix
index 8e9aee8ad986..8b6623200eba 100644
--- a/nixpkgs/pkgs/servers/mail/spamassassin/default.nix
+++ b/nixpkgs/pkgs/servers/mail/spamassassin/default.nix
@@ -52,6 +52,9 @@ perlPackages.buildPerlPackage rec {
     export HOME=$NIX_BUILD_TOP/home
     mkdir -p $HOME
     mkdir t/log  # pre-create to avoid race conditions
+
+    # https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8068
+    checkFlagsArray+=(TEST_FILES='$(shell find t -name *.t -not -name spamd_ssl_accept_fail.t)')
   '';
 
   postInstall = ''
diff --git a/nixpkgs/pkgs/servers/mail/spf-engine/default.nix b/nixpkgs/pkgs/servers/mail/spf-engine/default.nix
index c90522edf041..326d42d5d78c 100644
--- a/nixpkgs/pkgs/servers/mail/spf-engine/default.nix
+++ b/nixpkgs/pkgs/servers/mail/spf-engine/default.nix
@@ -1,15 +1,17 @@
-{ lib, buildPythonApplication, fetchurl, pyspf, dnspython, authres, pymilter }:
+{ lib, buildPythonApplication, fetchurl, flit-core, pyspf, dnspython, authres, pymilter }:
 
 buildPythonApplication rec {
   pname = "spf-engine";
   version = "3.0.4";
-  format = "flit";
+  format = "pyproject";
 
   src = fetchurl {
     url = "https://launchpad.net/${pname}/${lib.versions.majorMinor version}/${version}/+download/${pname}-${version}.tar.gz";
     sha256 = "sha256-Gcw7enNIb/TrZEYa0Z04ezHUmfMmc1J+aEH6FlXbhTo=";
   };
 
+  nativeBuildInputs = [ flit-core ];
+
   propagatedBuildInputs = [ pyspf dnspython authres pymilter ];
 
   pythonImportsCheck = [