Prereq: "3.8.12"
diff -ur --new-file /var/tmp/postfix-3.8.12/src/global/mail_version.h ./src/global/mail_version.h
--- /var/tmp/postfix-3.8.12/src/global/mail_version.h	2025-10-26 18:35:44.000000000 -0400
+++ ./src/global/mail_version.h	2025-11-25 12:32:33.000000000 -0500
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20251026"
-#define MAIL_VERSION_NUMBER	"3.8.12"
+#define MAIL_RELEASE_DATE	"20251125"
+#define MAIL_VERSION_NUMBER	"3.8.13"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff -ur --new-file /var/tmp/postfix-3.8.12/HISTORY ./HISTORY
--- /var/tmp/postfix-3.8.12/HISTORY	2025-10-23 19:58:14.000000000 -0400
+++ ./HISTORY	2025-11-25 12:33:00.000000000 -0500
@@ -27585,3 +27585,15 @@
 	with "database X is older than source file Y". Files:
 	util/dict.c, util/dict_db.c, util/dict_dbm.c, util/dict_lmdb.c,
 	util/dict_sdbm.c.
+
+20251028
+
+	Documentation: removed incorrect text from the parameter
+	description for smtp_cname_overrides_servername. File:
+	proto/postconf.proto.
+
+20251120
+
+	Bugfix (defect introduced: Postfix 2.9, date: 20120307):
+	segfault with duplicate parameter name in "postconf -X" or
+	"postconf -#'. File: postconf/postconf_edit.c.
diff -ur --new-file /var/tmp/postfix-3.8.12/html/postconf.5.html ./html/postconf.5.html
--- /var/tmp/postfix-3.8.12/html/postconf.5.html	2025-02-16 15:03:39.000000000 -0500
+++ ./html/postconf.5.html	2025-11-25 12:38:55.000000000 -0500
@@ -11023,10 +11023,6 @@
 password file lookups more predictable. This is the default setting
 as of Postfix 2.3. </p>
 
-<p> When DNS CNAME records are validated with secure DNS lookups
-(<a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a> = dnssec), they are always allowed to
-override the above servername (Postfix 2.11 and later). </p>
-
 <p> This feature is available in Postfix 2.2.9 and later. </p>
 
 
diff -ur --new-file /var/tmp/postfix-3.8.12/man/man5/postconf.5 ./man/man5/postconf.5
--- /var/tmp/postfix-3.8.12/man/man5/postconf.5	2025-02-16 15:03:39.000000000 -0500
+++ ./man/man5/postconf.5	2025-11-25 12:34:09.000000000 -0500
@@ -7031,10 +7031,6 @@
 password file lookups more predictable. This is the default setting
 as of Postfix 2.3.
 .PP
-When DNS CNAME records are validated with secure DNS lookups
-(smtp_dns_support_level = dnssec), they are always allowed to
-override the above servername (Postfix 2.11 and later).
-.PP
 This feature is available in Postfix 2.2.9 and later.
 .SH smtp_connect_timeout (default: 30s)
 The Postfix SMTP client time limit for completing a TCP connection, or
diff -ur --new-file /var/tmp/postfix-3.8.12/proto/postconf.proto ./proto/postconf.proto
--- /var/tmp/postfix-3.8.12/proto/postconf.proto	2025-02-16 15:03:09.000000000 -0500
+++ ./proto/postconf.proto	2025-11-25 12:33:00.000000000 -0500
@@ -11172,10 +11172,6 @@
 password file lookups more predictable. This is the default setting
 as of Postfix 2.3. </p>
 
-<p> When DNS CNAME records are validated with secure DNS lookups
-(smtp_dns_support_level = dnssec), they are always allowed to
-override the above servername (Postfix 2.11 and later). </p>
-
 <p> This feature is available in Postfix 2.2.9 and later. </p>
 
 %PARAM lmtp_cname_overrides_servername yes
diff -ur --new-file /var/tmp/postfix-3.8.12/src/postconf/postconf_edit.c ./src/postconf/postconf_edit.c
--- /var/tmp/postfix-3.8.12/src/postconf/postconf_edit.c	2025-10-23 19:58:14.000000000 -0400
+++ ./src/postconf/postconf_edit.c	2025-11-25 12:33:00.000000000 -0500
@@ -209,8 +209,10 @@
 	    msg_panic("pcf_edit_main: unknown mode %d", mode);
 	}
 	if ((cvalue = htable_find(table, pattern)) != 0) {
-	    msg_warn("ignoring earlier request: '%s = %s'",
-		     pattern, cvalue->value);
+	    if (edit_value && cvalue->value 
+		&& strcmp(edit_value, cvalue->value) != 0)
+		msg_warn("ignoring earlier request: '%s = %s'",
+			 pattern, cvalue->value);
 	    htable_delete(table, pattern, myfree);
 	}
 	cvalue = (struct cvalue *) mymalloc(sizeof(*cvalue));