Was the pre-installed version of Roundcube downgraded on purpose?

[Ron_E_James_D.O]

I have a test Virtualmin install with Roundcube and that is a few months old and I managed to break something. To test whether it was me or whether I’m wrongly remembering that it worked before I just installed a fresh test Virtualmin.

The version of both is 7.30.8 and neither wants updates.

Under the original’s Manage Web Apps the Roundcube versions are 1.5.11(LTS) and 1.6.11. Under the one I just installed the versions are 1.5.9(LTS) and 1.6.9.

I don’t think I ever updated the Roundcube on the original server (I don’t know how off hand).

Why would that be older on the new install?

Also a different recent post points to 1.6.11 as the only safe version.

https://forum.virtualmin.com/t/roundcube-before-1-5-10-and-1-6-x-before-1-6-11-allows-remote-code-execution/133621

and I see this:

Thanks.

SYSTEM INFORMATION
OS type and version	Ubuntu 24.04.2
Virtualmin version	7.30.8

[ID10T]

@Ron_E_James_D.O

To test whether it was me or whether I’m wrongly remembering that it worked before I just installed a fresh test Virtualmin.

I wonder if it needs to run a cron to update?

[Ron_E_James_D.O]

I must have run this at some point (and in a coincidence you did too?)… or at least I can correct it here:

(Once I “Save” 1.6.11 becomes available.) It’s not really weird that I don’t remember running any such thing, but I don’t.

Running:

sudo run-parts /etc/cron.daily

(hourly, weekly, monthly, yearly) had no such effect.

[ID10T]

I have a friend that never moved to my server, at least not fully. I have Wordpress just for him, but the site is dead. I regularly get notifications that an update is available, so SOMETHING is updating automatically.