v0.16.9

EmilTholin/image-trace-loaderv0.16.9Jun 16, 2026by github-actions[bot]

AI Summary

This release focuses on stability and security improvements, including fixes for JMAP object leaks, Sieve validation, and ACME certificate management.

Key Highlights

ACME: Allow specifying a preferred certificate chain.
JMAP: Fixed '*/changes' methods leaking ids of non-shared objects.
Sieve: Do not allow invalid certs in 'http_header' function.
FoundationDB: Fixed read version cache expiration logic.

New Features

ACME preferred certificate chain specification

Full Release Notes

## [0.16.9] - 2026-06-15

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- ACME: Allow specifying a preferred certificate chain.

## Changed

## Fixed
- JMAP: `*/changes` methods leak ids of non-shared objects (reported by @5ud0er).
- Sieve: Do not allow invalid certs in `http_header` function.
- FoundationDB: Fix read version cache expiration logic.
- MTA: Re-scheduling or editing a queued message reports success but persists nothing for recipients in a non-`default` virtual queue.
- CardDAV: Version requests included in `address-data` are ignored.
- ACME: Add freshness check when renewing certificates.
- Autodiscover v2: Read email address from query parameters.
- Sieve: Do not keep copies of redirected messages when `keep` is not specified.
- Registry: Object ids are parsed as numbers.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/31329451)