v0.16.7

EmilTholin/image-trace-loaderv0.16.7May 29, 2026by github-actions[bot]

AI Summary

This release adds HTTP RateLimit header fields and implements spam testing in trusted Sieve scripts. It includes various fixes for the MTA, DNS updater, and HTTP request handling.

Key Highlights

RateLimit header fields for HTTP
Spamtest implementation in trusted Sieve scripts
Log rejected messages to tracing store
DNS updater keeps external TXT records when updating

New Features

RateLimit header fields for HTTP
MTA spamtest implementation
Log rejected messages to tracing store

Full Release Notes

## [0.16.7] - 2026-05-28

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- RateLimit header fields for HTTP ([draft-ietf-httpapi-ratelimit-headers-10](https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-ratelimit-headers-10))
- MTA: Implement `spamtest` in trusted Sieve scripts.

## Changed

## Fixed
- Log rejected messages to tracing store.
- MTA:
  - Always update next DSN notify times.
  - Expand lists and resolve catch-all addresses when building autogenerated messages.
- Sharing: Includes resource that themselves carry a direct ACL grant and are leaves.
- Tasks cannot be deleted in OSS builds.
- Directory: Per-domain external directory resolution fails.
- DNS updater: Keep external `TXT` records when updating RRSet.
- HTTP: Reject requests from blocked IPs when `Keep-Alive` is enabled.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/29125359)