v0.16.8

EmilTholin/image-trace-loaderv0.16.8Jun 6, 2026by github-actions[bot]

AI Summary

This release focuses on security improvements for OAuth access tokens using AES-256-GCM-SIV and fixes several MTA and File Storage issues.

Key Highlights

OAuth access tokens reworked to AES-256-GCM-SIV AEAD format for proxy routing
Fixed MTA issues including sub-addressing with external directories and disabled aliases
Fixed JMAP File Storage stale state string bug
Fixed rate limiter panic when periods under 1 second are used

Full Release Notes

## [0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added

## Changed
- OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing.
- Added more internal TLDs to the domain validation.

## Fixed
- MTA: 
  - Sub-addressing with external directories returns `550 Mailbox not found`.
  - Disabled aliases continue receiving messages.
- JMAP for File Storage: `FileNode/get` returns a stale state string.
- Make `SieveSystemInterpreter.defaultReturnPath` and `MtaQueueQuota.match` optional expressions.
- Rate limiter panics when periods under 1 second are used.
- CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
- DNS updater: bump to `dns-update-v0.5.1`.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/30137514)