stalwartlabs/stalwart v0.16.22

on GitHub

[0.16.22] - 2026-09-13

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

• WebDAV: PROPFIND responses do not declare the namespace of every requested property on the DAV:multistatus element.
• MTA:
  • SMTP session state obtained before STARTTLS is discarded once the TLS handshake completes, as required by RFC 3207.
  • Inbound throttle, outbound throttle and queue quota match expressions evaluate their if/then conditions.
  • DMARC: Messages without an aligned SPF or DKIM pass from a domain that publishes a DMARC policy are reported as fail instead of none in logs.
  • DMARC: A temporary DNS error on an SPF or DKIM check whose identifier aligns with the author domain produces temperror instead of fail.
  • DMARC: A policy record without a p tag is only applied, as p=none, when it contains a rua tag, even if it declares sp or np.
• iMIP: Notification subjects and bodies omit the event start date, time and timezone for recurring events.
• OIDC: Discovery is retried for 30 seconds before the directory is marked as unavailable, so a provider that is still starting up no longer requires a restart.
• WebUI: The cached bundle of an Application is discarded when its resourceUrl changes or the record is deleted, so the next unpack fetches the new resource.
• DNS: Append . to MX record hostnames.
• Recovery mode: Automatic IP banning is disabled during recovery and initial setup.
• FoundationDB: The cached read version is invalidated when a queue refresh or registry change broadcast is received.
• Sieve: Messages filed with fileinto by a user script are treated as ham and are no longer moved to Junk when classified as spam.
• IMAP:
  • SELECT, EXAMINE and STATUS on a shared mailbox require the r (read) right.
  • AUTHENTICATE is refused on clear-text connections unless allowPlainTextAuth is enabled, and the greeting and CAPABILITY response advertise LOGINDISABLED instead of the AUTH= mechanisms in that case.
• IMAP, POP3, ManageSieve: Partial commands received before STARTTLS or STLS are discarded once the TLS handshake completes.
• Network: Inbound TLS handshakes, both implicit and STARTTLS, are aborted after the listener's tlsTimeout, releasing the connection slot.
• OAuth: A random key is used when the OIDC provider's encryptionKey or HMAC signatureKey cannot be read, instead of an empty key.
• LDAP: The {local} and {domain} filter placeholders are escaped.
• JMAP:
  • CalendarEvent/set stores useDefaultAlerts per user, and CalendarEvent/get returns false when it was never set.
  • CalendarEvent/get returns null for baseEventId unless the id is a synthetic recurrence instance.
  • CalendarEvent/get returns null for requested recurrenceRule and recurrenceOverrides properties on synthetic recurrence instances.
  • CalendarEvent/get and ContactCard/get return only id when the properties argument is an empty list, instead of every property.

Check binary attestation here