fix leaking mailboxes if virtual mailbox can't be opened (#2128857)

fix possible privilege escalation when similar master and non-master passdbs are used (#2106231)

do not disable xz/lzma for now despite being deprecated

dovecot updated to 2.3.16, pigeonhole to 0.5.16
fix CVE-2021-33515 plaintext commands injection (#1980014)

fix CVE-2020-24386 IMAP hibernation function allows mail access (#1913534)

fix CVE-2020-25275 denial of service via mail MIME parsing (#1914019)

change run directory from /var/run to /run (#1805947)

fix mail storage block count parsing (#1894418)
MIME parser crashed when boundaries were wrong (#1888111)

multilib compatibility (#1853137)

fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)
fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)
fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)

fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)
fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines
after-free (#1840357)
fix CVE-2020-10967 dovecot: sending mail with empty quoted localpart

fix default attributes for ghost files

dovecot updated to 2.3.8 with pigeonhole updated to 0.5.8 (#1653117)

fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte

reset errno before iterating through users (#1630410)

fix CVE-2019-3814: improper certificate validation (#1674370)