diff --git a/postfix/HISTORY b/postfix/HISTORY
index 9af1d27f4..e6db218a9 100644
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -25571,3 +25571,44 @@ Apologies for any names omitted.
 
 	Typo (introduced: Postfix 3.4): silent_discard should be
 	silent-discard. File: proto/BDAT_README.html.
+
+20210615
+
+	Bugfix (introduced: Postfix 3.4): the texthash: map
+	implementation did not support "postmap -F" behavior.
+	Reported by Christopher Gurnee, who also found the missing
+	code in the postmap source. File: util/dict_thash.c.
+
+20210623
+
+	Bugfix (introduced: Postfix 3.6) false "Result too large"
+	(ERANGE) fatal errors in the compatibility_level parser,
+	because an strtol() call had no 'errno = 0' statement before
+	the call. Also fixed two older latent bugs of the same kind.
+	Problem reported by David Bohman. Files: global/compat_level.c,
+	postscreen/postscreen_tests.c, util/mac_expand.c.
+
+20210705
+
+	Bugfix (introduced: Postfix 3.3): "null pointer read" error
+	in the cleanup daemon when "header_from_format = standard"
+	(the default as of Postfix 3.3) and email was submitted
+	with /usr/sbin/sendmail without From: header, and an all-space
+	full name was specified in 1) the password file, 2) with
+	"sendmail -F", or 3) with the NAME environment variable.
+	Found by Renaud Metrich. File: cleanup/cleanup_message.c.
+
+20210708
+
+	Bugfix (introduced: 1999): the Postfix SMTP server was
+	sending all session transcripts to the error_notice_recipient,
+	instead of sending transcripts of bounced mail to the
+	bounce_notice_recipient. File: smtpd/smtpd_chat.c.
+
+20210713
+
+	Bugfix (introduced: Postfix 2.4): false "too many reverse
+	jump" warnings in the showq daemon. The loop detection code
+	was comparing memory addresses instead of queue file names.
+	It now properly compares strings. Reported by Mehmet Avcioglu.
+	File: global/record.c.
diff --git a/postfix/src/cleanup/cleanup_message.c b/postfix/src/cleanup/cleanup_message.c
index 391c7119f..902642f19 100644
--- a/postfix/src/cleanup/cleanup_message.c
+++ b/postfix/src/cleanup/cleanup_message.c
@@ -776,9 +776,12 @@ static void cleanup_header_done_callback(void *context)
 		} else {
 		    token = tok822_alloc(TOK822_QSTRING, state->fullname);
 		}
-		tok822_externalize(state->temp2, token, TOK822_STR_NONE);
-		tok822_free(token);
-		vstring_sprintf_append(state->temp2, " <%s>",
+		if (token) {
+		    tok822_externalize(state->temp2, token, TOK822_STR_NONE);
+		    tok822_free(token);
+		    vstring_strcat(state->temp2, " ");
+		}
+		vstring_sprintf_append(state->temp2, "<%s>",
 				       vstring_str(state->temp1));
 		break;
 
diff --git a/postfix/src/global/compat_level.c b/postfix/src/global/compat_level.c
index 1fb3a6851..41da9f2af 100644
--- a/postfix/src/global/compat_level.c
+++ b/postfix/src/global/compat_level.c
@@ -157,6 +157,7 @@ long    compat_level_from_string(const char *str,
     char   *remainder;
 
     start = str;
+    errno = 0;
     major = strtol(start, &remainder, 10);
     if (start < remainder && (*remainder == 0 || *remainder == '.')
 	&& errno != ERANGE && GOOD_MAJOR(major)) {
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 85e836abc..4304de047 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20210613"
-#define MAIL_VERSION_NUMBER	"3.6.1"
+#define MAIL_RELEASE_DATE	"20210724"
+#define MAIL_VERSION_NUMBER	"3.6.2"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff --git a/postfix/src/global/record.c b/postfix/src/global/record.c
index 5a3516368..80cb1ac3b 100644
--- a/postfix/src/global/record.c
+++ b/postfix/src/global/record.c
@@ -323,7 +323,7 @@ int     rec_get_raw(VSTREAM *stream, VSTRING *buf, ssize_t maxsize, int flags)
 int     rec_goto(VSTREAM *stream, const char *buf)
 {
     off_t   offset;
-    static const char *saved_path;
+    static char *saved_path;
     static off_t saved_offset;
     static int reverse_count;
 
@@ -338,8 +338,10 @@ int     rec_goto(VSTREAM *stream, const char *buf)
      */
 #define REVERSE_JUMP_LIMIT	10000
 
-    if (saved_path != VSTREAM_PATH(stream)) {
-	saved_path = VSTREAM_PATH(stream);
+    if (saved_path == 0 || strcmp(saved_path, VSTREAM_PATH(stream)) != 0) {
+	if (saved_path)
+	    myfree(saved_path);
+	saved_path = mystrdup(VSTREAM_PATH(stream));
 	reverse_count = 0;
 	saved_offset = 0;
     }
diff --git a/postfix/src/postscreen/postscreen_tests.c b/postfix/src/postscreen/postscreen_tests.c
index 02dadcac1..0130474c4 100644
--- a/postfix/src/postscreen/postscreen_tests.c
+++ b/postfix/src/postscreen/postscreen_tests.c
@@ -175,6 +175,7 @@ void    psc_parse_tests(PSC_STATE *state,
      * at the time that the cache entry was written.
      */
     for (sp = time_stamps; sp < time_stamps + PSC_TINDX_COUNT; sp++) {
+	errno = 0;
 	*sp = strtoul(start, &cp, 10);
 	if (*start == 0 || (*cp != '\0' && *cp != ';') || errno == ERANGE)
 	    *sp = PSC_TIME_STAMP_DISABLED;
diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c
index 067b9b2d2..fc47e012f 100644
--- a/postfix/src/smtpd/smtpd.c
+++ b/postfix/src/smtpd/smtpd.c
@@ -1301,6 +1301,7 @@ int     var_reject_code;
 int     var_defer_code;
 int     var_smtpd_err_sleep;
 int     var_non_fqdn_code;
+char   *var_bounce_rcpt;
 char   *var_error_rcpt;
 int     var_smtpd_delay_reject;
 char   *var_rest_classes;
@@ -6431,6 +6432,7 @@ int     main(int argc, char **argv)
 	VAR_EOD_CHECKS, DEF_EOD_CHECKS, &var_eod_checks, 0, 0,
 	VAR_MAPS_RBL_DOMAINS, DEF_MAPS_RBL_DOMAINS, &var_maps_rbl_domains, 0, 0,
 	VAR_RBL_REPLY_MAPS, DEF_RBL_REPLY_MAPS, &var_rbl_reply_maps, 0, 0,
+	VAR_BOUNCE_RCPT, DEF_ERROR_RCPT, &var_bounce_rcpt, 1, 0,
 	VAR_ERROR_RCPT, DEF_ERROR_RCPT, &var_error_rcpt, 1, 0,
 	VAR_REST_CLASSES, DEF_REST_CLASSES, &var_rest_classes, 0, 0,
 	VAR_CANONICAL_MAPS, DEF_CANONICAL_MAPS, &var_canonical_maps, 0, 0,
diff --git a/postfix/src/smtpd/smtpd_chat.c b/postfix/src/smtpd/smtpd_chat.c
index 63795b861..c172ab3d1 100644
--- a/postfix/src/smtpd/smtpd_chat.c
+++ b/postfix/src/smtpd/smtpd_chat.c
@@ -316,7 +316,8 @@ void    smtpd_chat_notify(SMTPD_STATE *state)
 #define INDENT	4
 
     notice = post_mail_fopen_nowait(mail_addr_double_bounce(),
-				    var_error_rcpt,
+				    (state->error_mask & MAIL_ERROR_BOUNCE) ?
+				    var_bounce_rcpt : var_error_rcpt,
 				    MAIL_SRC_MASK_NOTIFY, NULL_TRACE_FLAGS,
 				    SMTPUTF8_FLAG_NONE, NO_QUEUE_ID);
     if (notice == 0) {
diff --git a/postfix/src/util/dict_thash.c b/postfix/src/util/dict_thash.c
index a121ead35..5012fb9e2 100644
--- a/postfix/src/util/dict_thash.c
+++ b/postfix/src/util/dict_thash.c
@@ -46,6 +46,7 @@
 /* Utility library. */
 
 #include <msg.h>
+#include <mymalloc.h>
 #include <iostuff.h>
 #include <vstring.h>
 #include <stringops.h>
@@ -179,6 +180,24 @@ DICT   *dict_thash_open(const char *path, int open_flags, int dict_flags)
 		msg_warn("%s, line %d: record is in \"key: value\" format;"
 			 " is this an alias file?", path, lineno);
 
+	    /*
+	     * Optionally treat the value as a filename, and replace the value
+	     * with the BASE64-encoded content of the named file.
+	     */
+	    if (dict_flags & DICT_FLAG_SRC_RHS_IS_FILE) {
+		VSTRING *base64_buf;
+		char   *err;
+
+		if ((base64_buf = dict_file_to_b64(dict, value)) == 0) {
+		    err = dict_file_get_error(dict);
+		    msg_warn("%s, line %d: %s: skipping this entry",
+			     VSTREAM_PATH(fp), lineno, err);
+		    myfree(err);
+		    continue;
+		}
+		value = vstring_str(base64_buf);
+	    }
+
 	    /*
 	     * Store the value under the key. Handle duplicates
 	     * appropriately. XXX Move this into dict_ht, but 1) that map
diff --git a/postfix/src/util/mac_expand.c b/postfix/src/util/mac_expand.c
index 03dc2d8da..cd461c683 100644
--- a/postfix/src/util/mac_expand.c
+++ b/postfix/src/util/mac_expand.c
@@ -274,6 +274,7 @@ static long atol_or_die(const char *strval)
     long    result;
     char   *remainder;
 
+    errno = 0;
     result = strtol(strval, &remainder, 10);
     if (*strval == 0 /* can't happen */ || *remainder != 0 || errno == ERANGE)
 	msg_fatal("mac_exp_eval: bad conversion: %s", strval);