4.1.5

4.1.5 follows 4.1.4. Its main fixes are security: the shared Redis/Valkey cache is now secured on every server, and the update secures one an earlier install left open; and a mailbox password changed from the panel now really ends that mailbox's other webmail sessions. It also makes wp work on AlmaLinux and RHEL, and moves the TLS root store past RUSTSEC-2026-0381 and RUSTSEC-2026-0382.

Upgrade notes and behaviour changes

The shared Redis/Valkey cache is secured on every server, and the update secures one that was left open. Up to 4.1.4, a fresh install on a server with any user of uid 1000 or more (every Ubuntu cloud image ships ubuntu) counted that user as a hosting account and left the shared cache without a password or per-account logins. On Ubuntu 24.04, Valkey was also given Redis's socket, failed to start, and the panel fell back to the open Redis on 127.0.0.1:6379. Hosting accounts now come from the panel's own account list, each engine gets its own socket, and every update runs hitechcloudcli objectcache secure all --heal in a new cache-secure step. On an open cache it creates the per-account logins, moves the panel's WordPress caches to them, and re-keys the panel and webmail logins in place, so 2083 and webmail sessions survive. A cache that is already secured is left alone. (hitechcloudcli#482)
A mailbox password changed in 2083, 2087, the portal or through mailsync signs that mailbox out of its other webmail sessions. It was meant to do this already, but the webmail never had the endpoint the panel and mailsync called. The 404 was ignored, so a signed-in webmail session kept working after the password changed. Anyone who is signed in to the webmail as such a mailbox has to sign in again after the next password change. (hitechcloudmail#92, hitechcloudadmin#323, HiTechCloud-Panel#1790)
wp-cli has moved to /usr/local/lib/hitechcloud/wp-cli.phar. /usr/local/bin/wp and /usr/local/bin/wp-root are now shell wrappers. Each wrapper runs the phar with a PHP it names: the one the install found, else php on PATH, else the newest /usr/bin/phpX.Y or Remi PHP. Only wp-root adds --allow-root. The update moves a phar it finds at /usr/local/bin/wp (the same file, nothing is downloaded) and removes the old /etc/hitechcloud/tools/wp-cli.phar link. If a file at either path is not ours, the update leaves it alone and warns. A script that passed /usr/local/bin/wp to php as a file must use the phar path, or call wp directly. (hitechcloudcli#474, #475, HiTechCloud-Panel#1789)

Added

Sign out of all webmail sessions. The new button is on the Webmail card of a mailbox's page in 2083, and in the mailbox's row menu on Emails > Accounts in 2087. It ends every webmail session of the mailbox and drops its open IMAP connections. The password does not change. Each use is written to the account's activity, or to the 2087 user actions, and to /var/log/hitechcloud/admin/actions.log. (HiTechCloud-Panel#1790, hitechcloudadmin#323, translations#68)
hitechcloudcli webmail end-sessions --mailbox <address> | --domain <domain> [--json] [--actor <account>] does the same for one mailbox or for every webmail user of a domain. It asks the webmail over the panel's signed loopback call and never touches the cache, so it behaves the same on a secured and an unsecured cache. With --actor, the account must own the mailbox's domain. When the webmail is not installed, is down, or is older than the endpoint, the command exits 1 and ends nothing. (hitechcloudcli#476, #479, hitechcloudmail#92)
2083 Domains > Logs shows the end of a site's error log in the page: the newest line first, at most 500 lines, read from the last 512 KiB of the file. Before, the error log could only be downloaded. (HiTechCloud-Panel#1755)

Fixed

Turning a site's Redis object cache off in 2083 signed every 2083 user out on a server whose cache was not secured. Redis Object Cache 3's wp redis disable and its deactivation hook both send FLUSHDB, which also emptied every other site's cache and the webmail's keys. The panel now removes its own drop-in and the WP_REDIS_* settings and deactivates the plugin without letting it reach the cache. (HiTechCloud-Panel#1793)
Purge on a site's Redis object cache in 2083 cleared nothing. It ran wp redis flush, which Redis Object Cache 3 does not have. With the panel's drop-in it now runs hitechcloudcli objectcache wordpress-flush, which clears only that site's keys by its own prefix and never sends FLUSHDB. (hitechcloudcli#481, HiTechCloud-Panel#1793)
wp exited 127 on AlmaLinux and RHEL, for root and for every account. These systems have no php on PATH, and /usr/local/bin/wp was the phar itself, which starts with #!/usr/bin/env php. It now runs on every supported system (see Upgrade notes). The panel and the CLI run the phar directly. They never pass a file that is not a PHP program to PHP, because PHP would just print a shell script and exit 0. (hitechcloudcli#474, #475, HiTechCloud-Panel#1789)
2083 showed stale aliases and quotas when they were changed outside 2083. An alias added or removed with email-setup alias, in 2087 or through the API did not appear until the customer next changed an alias in 2083. A quota set from the CLI kept its old size for up to an hour. Both lists now follow the mail server's own files (postfix-virtual.cf, dovecot-quotas.cf). (HiTechCloud-Panel#1788)
A failed webmail session end after a password change was dropped without a trace in 2083 and logged without a warning tag in mailsync. It is now a WARNING line in the log, in 2083, mailsync and 2087. (HiTechCloud-Panel#1790, hitechcloudadmin#323)
The 2083 error log download no longer resolves an invalid domain name to a relative .error.log in the engine's working directory. It answers 400 instead. (HiTechCloud-Panel#1755)
The release workflow retries npm and pnpm installs after a transient network error. A reset connection to the registry had ended a release after every binary was built. (HiTechCloud-Panel#1787)
Webmail: the backend moves to otplib 13 and archiver 8, so no deprecated package and no old glob remain in its dependencies. Two-step verification keeps otplib 12's parameters, and every authenticator app already enrolled keeps working. (hitechcloudmail#93)

Security

The shared cache was left open on most fresh installs (see Upgrade notes). Any hosting account could read and write the panel's session keys, and so sign in to 2083 as another account, as well as every other account's cache and the webmail's keys. (hitechcloudcli#482)
A password change did not end the mailbox's other webmail sessions when it was made from 2083, 2087, the portal or mailsync. The webmail reaches the mailbox as its master user, so nothing checked the new password against a session that was already signed in. Password changes made inside the webmail were not affected. See Upgrade notes. (hitechcloudmail#92, hitechcloudadmin#323, HiTechCloud-Panel#1790)
TLS roots: RUSTSEC-2026-0381 and RUSTSEC-2026-0382 (distrusted emSign intermediates). webpki-roots is now 1.0.10 and rustls-webpki 0.103.16 in the CLI, 2087, sentinel and the panel engine and meet. The CLI depends on webpki-roots 1 directly, and sentinel's uptime probe moves to ureq 3. The advisory scan has a new floor check over every lockfile it audits, which fails on any webpki-roots or rustls-webpki below the fixed versions. Only RUSTSEC-2026-0381 is ignored, and only for webpki-roots 0.26.11, the wrapper ureq 2 still pulls into the CLI, which re-exports 1.0.10. (hitechcloudcli#477, #478, hitechcloudadmin#324, sentinel#8, #9, HiTechCloud-Panel#1791)
2087: the sidebar search, the activity log on a user's page, the certificate details and the live CPU, memory, disk and network widgets now render server values as text, not markup. (hitechcloudadmin#325)
The 2083 error log view opens the log with O_NOFOLLOW, so it never follows a symlink or blocks on a FIFO. It escapes every line, so a logged <script> shows as text. (HiTechCloud-Panel#1755)
The webmail's cache login now reaches Webmail:* only. The key families it used before 4.1.4 are removed, and webmail update re-applies the rule. (hitechcloudcli#480)