Starstruk Logo MarkStarstruk

v0.16.15

Schniz/fnmv0.16.15Jul 27, 2026by github-actions[bot]

AI Summary

This release focuses on fixing critical bugs across JMAP, MTA, Auth, and Encryption modules, addressing issues with message copying, calendar event handling, and security validations.

Key Highlights

  • JMAP fixes for email copying and calendar event UID handling
  • Security improvements rejecting public suffix domains and invalid VAPID keys
  • Encryption at rest now applies to appended messages for non-opt-in accounts
  • Fixes for MTA-STS panic and cluster broadcast re-subscription issues

Full Release Notes

## [0.16.15] - 2026-07-26

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added

## Changed

## Fixed
- JMAP:
  - `Email/copy` should return `alreadyExists` when copying a message to a mailbox that already contains it.
  - `Email/copy` with `onSuccessDestroyOriginal` destroys the copy's creation id instead of the source Email id.
  - `CalendarEvent/set` does not generate a `uid` on create when the client omits it.
  - `CalendarEvent/set` does not refresh the `updated` property (iCalendar `DTSTAMP`) on create or update.
  - `EmailSubmission/set` rejects valid recipients whose domain is itself a public suffix (e.g. `gov.in`, `co.uk`).
  - Requests are rejected with `notRequest` when a method name contains a JSON-escaped solidus (e.g. `Core\/echo`).
- MTA: Panic when MTA-STS is disabled and a remote MTA fetched `/.well-known/mta-sts.txt`.
- Auth: Scoped credentials with `SysApiKeyCreate` or `SysApiKeyUpdate` permissions can regain its own account's full rights.
- Web Push: Valid VAPID keys are rejected when PEM-encoded with explicit EC parameters, in SEC1 (`EC PRIVATE KEY`) format, or with a leading byte-order mark.
- Encryption at rest: Appended messages are encrypted for accounts that did not opt in to `encryptOnAppend`.
- Cache: Account caches silently discard entries larger than a single `quick-cache` shard, causing constant database rebuilds.
- Registry: Id references (e.g. `#certificate-...`) fail to resolve on `defaultCertificateId`, `defaultAdminRoleIds`, `listenerIds` and `publicKey`.
- Search: `reindex` drops calendar and contact index tasks for accounts with fewer than a full batch of items.
- Migration: Abort `--import` when the target already contains data in the key range being imported.
- Cluster: Broadcast subscriber re-subscribes after every message, losing bursts of cluster broadcasts during the reconnect window.
- Enterprise: Per-tenant logo is not shown on the OAuth login password and OTP screens, which are served from the server's canonical host rather than the tenant domain.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/37235143)