ClamAV engine in image is outdated (1.0.7 vs current 1.0.9)

[Infiniverse]

Hi,

I’m running the mailserver image and noticed that the bundled ClamAV engine appears to be a couple of versions behind.

Environment:

• Image: mailserver2/mailserver

• Deployment: docker-compose

• Host OS: Linux (Debian/Ubuntu)

  commit 276990b (HEAD -> master, tag: v1.1.23, origin/master, origin/HEAD)
  Author: Sara Aimée Smiseth 51710585+SaraSmiseth@users.noreply.github.com
  Date: Fri Aug 29 06:56:40 2025 +0200

freshclam logs report:
2026-01-08T20:31:16.640290+00:00 mail freshclam[112]: Your ClamAV installation is OUTDATED!
2026-01-08T20:31:16.640463+00:00 mail freshclam[112]: Local version: 1.0.7 Recommended version: 1.0.9

I understand that signature updates are separate from the engine version, but newer ClamAV releases include important bugfixes and unpacker support.

Questions:

1. Is the ClamAV engine version intentionally pinned?
2. Are there plans to update the base image to a newer ClamAV (1.x)?
3. Is running an external ClamAV container the recommended approach if a newer engine is required?

Happy to test a newer image or PR if helpful.

Thanks!

[AndrewSav]

I've re-built the docker image from master and pushed it with label 1.1.23.1. I checked that CalmAV reports 1.0.9 now. Please give it a go. I have not updated the latest tag.

Is the ClamAV engine version intentionally pinned?

No

Are there plans to update the base image to a newer ClamAV (1.x)?

I've never heard of concrete plans to do any updates, other then the intention to do that eventually and PR submitted by various people, and I do not see a PR for this open now. There is work being done to upgrade the base image now mailserver2/debian-mail-overlay#31 unfortunately going from bookworm to trixie, dovecot config format changed severely and it might time to untangle it to produce a worker image. Once this is done, it's logical to think that eventually this image will be updated to using the new image, and if the new version of ClamAV came up in the repo feed it will be automatically pulled during the image build (I can see that the latest version in bookworm in 1.0.9 now).

Is running an external ClamAV container the recommended approach if a newer engine is required?

I guess this depends on the needs of particular maintainers. I personally do not use CalmAV as I cannot afford a VPS with enough memory to run it and other software that I need comfortably. @sknight80 and @SaraSmiseth may have different situation and opinions. I would say it's reasonable to expect this to be updated eventually, if it comes from the repo feed, depending on the maintainers availability.