v0.16.8

OpenMOSS/MOSS-TTS-Nanov0.16.8Jun 6, 2026by github-actions[bot]

AI Summary

This update reworks OAuth security protocols and fixes critical bugs in MTA sub-addressing, JMAP file storage, and the rate limiter.

Key Highlights

Reworked OAuth access tokens to AES-256-GCM-SIV AEAD format
Fixed MTA sub-addressing with external directories
Fixed JMAP File Storage stale state string return
Fixed rate limiter panics with periods under 1 second
Fixed CalDAV/CardDAV tombstone writes via JMAP

New Features

OAuth AEAD security rework
Improved MTA sub-addressing support

Full Release Notes

## [0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added

## Changed
- OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing.
- Added more internal TLDs to the domain validation.

## Fixed
- MTA: 
  - Sub-addressing with external directories returns `550 Mailbox not found`.
  - Disabled aliases continue receiving messages.
- JMAP for File Storage: `FileNode/get` returns a stale state string.
- Make `SieveSystemInterpreter.defaultReturnPath` and `MtaQueueQuota.match` optional expressions.
- Rate limiter panics when periods under 1 second are used.
- CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
- DNS updater: bump to `dns-update-v0.5.1`.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/30137514)