stalwartlabs/stalwart v0.16.19

on GitHub

[0.16.19] - 2026-08-24

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• WebUI: oauthClientId setting in Application, which allows the WebUI to use a different OAuth client than the default.
• Sieve: env.spam.score and env.spam.is_spam variables, which expose the spam filter result to system scripts running at the DATA stage.
• CalDAV: vCardVersion setting in AddressBook, which allows the default vCard version to be specified when the client does not request a specific version.

Changed

• MySQL & MariaDB: Key columns are now VARBINARY(255) with a full-length primary key instead of TINYBLOB. Note: Existing deployments should run, once per table, for each of the tables a, d, e, f, g, h, j, k, l, m, n, o, p, q, r, s, t, u, w, x and y the command ALTER TABLE a MODIFY k VARBINARY(255) NOT NULL;.

Fixed

• ACME:
  • Order and authorization failures are never logged, so an order rejected by the CA.
  • An order rejected by the CA marks the renewal task as permanently failed.
• CalDAV:
  • Attendee addresses whose mailto: URI percent-encodes a full name-addr are silently dropped from the scheduling snapshot.
  • Attendees whose calendar user address cannot be parsed should be flagged with SCHEDULE-STATUS=3.7.
  • The RSVP link in an iMIP invitation stamps PARTSTAT on the organizer's copy of the event only, leaving a local attendee's own copy at NEEDS-ACTION and sending the organizer no reply.
  • MKCALENDAR, MKCOL and PROPPATCH store the display name, description, time zone and the other per-user properties under the authenticated account rather than the account that owns the collection.
• Directory:
  • An empty column, attribute or claim returned by an external directory is synchronized as an empty string rather than a missing value.
  • /api/discover splits the account name on @ without accounting for the % master user separator or the recovery administrator.
• FoundationDB: Older chunked entries are not deleted.
• IMAP: SETACL and DELETEACL fail to resolve an identifier spelled with uppercase characters.
• iMIP: Invitations, replies and cancellations reference a TZID parameter with no matching VTIMEZONE component whenever the event was stored without one.
• JMAP:
  • AddressBook/get: A new account's default address book is never recorded.
  • Email/get and Email/parse with fetchAllBodyValues return body values only for the parts listed in textBody or htmlBody, omitting every other text/* part in bodyStructure.
  • Email/set writes display names as an RFC 2047 encoded-word wrapped in a quoted-string, which RFC 2047 forbids.
  • Mailbox/set, AddressBook/set and Calendar/set store isSubscribed and the other per-user properties under the authenticated account rather than the account named in the request.
  • Principal/query returns no results when the name or email filter is spelled with uppercase characters.
  • FileNode/set: File nodes created over JMAP are returned with a <D:href> holding the raw name over WebDAV.
• Meilisearch:
  • Queries return at most 1000 results, as the maxTotalHits pagination setting is left at the Meilisearch default.
  • Searches combining several terms return documents that match only some of them.
  • A task confirmation timeout is reported as a success when failOnTimeout is disabled.
• Import: --import always aborts with the target database already containing data in the key range being imported.
• MTA:
  • A domain catchAllAddress pointing to a mailing list or a sub-addressed mailbox is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
  • is_local_address() and is_local_domain() expression functions do not match an address or domain spelled with uppercase characters.
  • Relay routes are rejected with host resolves loopback address, which prevents relaying through a local proxy or tunnel.
• MySQL, MariaDB & PostgreSQL: Range scans, range deletions and store purges run as a single unbounded statement, so on servers that enforce a statement timeout they abort on large accounts and tasks such as account deletion can never complete.
• Network: local_port and local_ip report the address Stalwart is bound to rather than the address the client connected to when the connection arrives through a trusted proxy.
• Task manager:
  • totalDeadline is not enforced on tasks that fail with a specific retry time.
  • Indexing tasks are dropped after maxAttempts failures, so a search store that is unavailable or overloaded leaves messages permanently missing from the index.
  • Indexing tasks are dropped when the document metadata read returns no data, which can happen on SQL read replicas that have not yet caught up with the primary.
  • The DNS management task republishes the DKIM records of retired keys that the DKIM rotation task had already removed from the zone.
• Sieve: spamtest returns only 1 or 10 (and spamtest :percent only 0 or 100), so scripts cannot act on intermediate spam scores.
• Spam filter: MIME_BAD is tagged whenever the declared Content-Type of an attachment is not byte identical to the type detected from its magic bytes.

Check binary attestation here