Four scheduled jobs weren't running — and the update checker that should have told you was broken too.
Hermes SEG v260731 is out. Please apply it when you can, even if your system looks fine. The problems it fixes are silent, and nothing in your console reported them.
What wasn't running
- ClamAV third-party malware signature refresh. Supplementary virus signatures stopped updating.
- DMARC aggregate reports. Not generated, not sent.
- Mail queue health alerts. A growing queue raised no alarm.
- Authelia log rotation. Logs grew unbounded.
Your mail was still being filtered. Spam scanning, virus scanning against ClamAV's own official signature feed, encryption, and delivery all worked normally throughout. It is the supplementary third-party feeds that went stale.
Why you haven't heard from us
The same fault disabled the update checker itself. It failed silently every night and never recorded a result, so your console showed UPDATE CHECK PENDING indefinitely and no notification emails were ever sent. If v260628, v260630, v260722 and v260723 passed you by, that is why — and it is why this is arriving as an email rather than a prompt in your console.
Your version number may be wrong
Systems installed fresh, rather than upgraded into, reported the installer's baseline version instead of their own — a v260723 install displayed v260612. The software was correct; only the number was wrong. This update corrects it.
What to do
On your Hermes SEG host:
cd /path/to/hermes-seg sudo ./scripts/system_update_docker.sh
Confirm the prompt. One run catches you up through every release you missed — there is no need to apply them in order or run it repeatedly. Mail flow is not interrupted, and there is no manual database step.
Confirming it worked
sudo ./scripts/hermes_smoke_test.sh
Look for config.ini matches ofelia_jobs (10 job(s) scheduled) and no failures. In the console, Build should match the release you are on, and Hermes Update should no longer read PENDING.
Read the full write-up | Release notes on GitHub
One honest note: this went unnoticed for four releases because our own development server is updated differently from a customer install, so it never reproduced the fault — and our automated health check counted scheduled jobs in the database rather than checking what the scheduler had actually loaded. Both are fixed. The health check now fails loudly if the two ever disagree again, so this class of problem cannot recur silently.
Thanks for running Hermes,
The Hermes SEG team
