Starstruk Logo MarkStarstruk

v0.16.16

Schniz/fnmv0.16.16Aug 2, 2026by github-actions[bot]

AI Summary

This release introduces JMAP Email Delivery Push Notifications and enhances MTA stability. It also includes changes to Windows IPv6 listener defaults and S3 configuration handling.

Key Highlights

  • Added JMAP Email Delivery Push Notifications support
  • Fixed MTA behavior for BDAT chunks and maxMessageSize configuration
  • Updated Windows IPv6 listener to refuse IPv4 connections by default
  • Enhanced S3 configuration to support environment variables and files for access keys
  • Fixed Meilisearch index verification to prevent timeouts on busy servers

Breaking Changes

  • Windows: Listeners bound to `[::]` now refuse IPv4 connections due to `IPV6_V6ONLY` being enabled by default
  • MTA: `maxMessageSize` set to `0` now rejects messages with an error instead of disabling the limit
  • MTA: Invalid BDAT chunks sent without a valid `MAIL FROM` now return `552` instead of `503`

New Features

  • JMAP Email Delivery Push Notifications
  • System Sieve scripts can access `orcpt` during the DATA stage
  • S3 access key can be read from an environment variable or file
  • Recovery mode: Download WebUI if missing

Full Release Notes

## [0.16.16] - 2026-08-02

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- JMAP Email Delivery Push Notifications ([draft-ietf-jmap-emailpush-03](https://datatracker.ietf.org/doc/draft-ietf-jmap-emailpush/))
- MTA: Allow System Sieve scripts to access `orcpt` during the `DATA` stage.

## Changed
- S3: `accessKey` can now be read from an environment variable or file.

## Fixed
- Meilisearch: Verify index existence using `GET` instead of creating a new task which times out on busy servers.
- Branding: Stalwart logo flashes before the per-tenant logo is loaded on the login page.
- Calendar: iMIP and alarm notification messages embed the default logo using bare `LF` line endings, producing a single 4247 octet line that strict SMTP relays reject with `line too long`.
- DMARC: Failure reports state `Identity-Alignment: none` when a mechanism authenticated successfully but against an identity that is not aligned with the `From` domain.
- Redis: Task and queue locks are never released after a worker dies, because failed lock attempts refresh the lock expiry.
- Recovery mode: Download WebUI if missing.
- Logging: The systemd journal tracer omits the parent span's fields.
- MTA: 
  - `BDAT` chunks sent without a valid `MAIL FROM` are answered with `552 5.3.4 Message too big for system` instead of `503 5.5.1`.
  - A `maxMessageSize` of `0` rejects every message with `552 5.3.4 Message too big for system` instead of disabling the size limit.
- Windows: Listeners bound to the unspecified IPv6 address (`[::]`), including all defaults, refuse IPv4 connections such as `127.0.0.1`, since `IPV6_V6ONLY` is enabled by default on Windows.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/38449267)