Authentication error after update

Meta

I just updated my mailcow-dockerized setup and now keep getting authentication errors when using a mailclient. Sogo just works fine.
In the logs of dovecot I get these errors:

01.10.2025, 21:17:03	err	auth-worker: Error: /etc/dovecot/auth/passwd-verify.lua:32: in function 'auth_password_verify'
01.10.2025, 21:17:03	err	auth-worker: Error: [C]: in function 'cjson.decode'
01.10.2025, 21:17:03	err	auth-worker: Error: stack traceback:
01.10.2025, 21:17:03	err	auth-worker(410): Error: conn unix:auth-worker (pid=130,uid=401): auth-worker<56>: lua(my@mailaddress,xx.xx.xx.xx,<6qc4th1Ajeo+W6z3>): passdb-lua: lua_pcall(auth_password_verify, 2, 2) failed: /etc/dovecot/auth/passwd-verify.lua:32: Expected value but found invalid token at character 1

From the error I assume that the function tries to decode something as json that is not json but rather html where the “invalid token at character 1” would be the opening of an html tag (<)
The nginx container logs this line when I try to authenticate:
nginx-mailcow-1 | 172.22.1.250 - - [01/Oct/2025:21:17:59 +0200] "POST / HTTP/1.1" 200 227 "-" "LuaSocket 3.0.0"
which looks just fine.
Any ideas on that? Is that a bug?

edit: I updated mailcow to 2025-09b

DocFraggle

Maybe you have a special character in your password that’s breaking the login process? Did you try changing you password?

Meta

Yes, tried changing the password multiple times. Didn’t help. Also all other accounts can not authenticate from mailclients.

DocFraggle

Which version did you update from?

Meta

I’m trying to find out. Is there a place, like a log, where I can find it?
From the update_diffs folder I can see that I last updated at 2025-08-05. So it should be version 2025-07 I think

This is strange:
the content of the lua script does not match the one in the GitHub repository
mailcow/mailcow-dockerizedblob/master/data/conf/dovecot/auth/passwd-verify.lua
But it was last changed 7 month ago

Meta

Got it working again.
Somehow some files from the repository got updated but others didn’t.
data/conf/dovecot/auth/mailcowauth.php was updated
data/conf/dovecot/auth/passwd-verify.lua was not
data/web/inc/functions.inc.php was also not updated, missing a function mailcowauth.php tried to use, generating an html error that the passwd-verify.lua misinterpreted as json ..
I had to reset all files with git reset --hard origin/master (loosing the commits documenting the updates).

DocFraggle

Meta Did you manually edit these files 7 months ago? That’s the only reason why Git wouldn’t update a file (“modified locally”) afaik

Meta

No, I didn’t modify the files. git status did not show any modified files. The “was last changed 7 month ago” was referring to changes in the Github repository. I looked up the contents of the passwd-verify.lua file and compared it with the Github version. The last time changes to this file were commited was 7 month ago. Still the content of my file and the Github version didn’t match. This got me thinking that my file must be even older and didn’t got updated multiple times now.