v0.16.8

anomalyco/opentuiv0.16.8Jun 6, 2026by github-actions[bot]

AI Summary

Focuses on security improvements (OAuth), domain validation, and fixes for MTA, JMAP, and CalDAV services.

Key Highlights

Reworked OAuth access tokens to AES-256-GCM-SIV AEAD format.
Added more internal TLDs to domain validation.
Fixed MTA sub-addressing and disabled aliases issues.
Fixed JMAP File Storage stale state string.
Fixed rate limiter panics.

New Features

OAuth token rework to AEAD
Domain validation TLDs
MTA fixes
JMAP fixes
Rate limiter fix

Full Release Notes

## [0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added

## Changed
- OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing.
- Added more internal TLDs to the domain validation.

## Fixed
- MTA: 
  - Sub-addressing with external directories returns `550 Mailbox not found`.
  - Disabled aliases continue receiving messages.
- JMAP for File Storage: `FileNode/get` returns a stale state string.
- Make `SieveSystemInterpreter.defaultReturnPath` and `MtaQueueQuota.match` optional expressions.
- Rate limiter panics when periods under 1 second are used.
- CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
- DNS updater: bump to `dns-update-v0.5.1`.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/30137514)