v0.16.11

codex-team/editor.jsv0.16.11Jun 25, 2026by github-actions[bot]

AI Summary

A maintenance release introducing encryption-at-rest support, S3 connectivity options, and Redis Sentinel support, alongside bug fixes for DNSSEC, TLS, JMAP, and Webhooks.

Key Highlights

Support for AES-256-GCM and ChaCha20-Poly1305 encryption-at-rest for S/MIME.
S3 support for `allowInvalidCerts` to connect to endpoints with invalid TLS certificates.
Redis Sentinel integration as an in-memory store and cluster coordinator backend.
Fixes for JMAP query broad results and Webhook event ID collisions.

New Features

Encryption-at-rest: Support for `AES-256-GCM` and `ChaCha20-Poly1305` for S/MIME.
S3: Support for `allowInvalidCerts` option.
Redis Sentinel support as an in-memory store and cluster coordinator backend.

Full Release Notes

## [0.16.11] - 2026-06-25

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- Encryption-at-rest: Support for `AES-256-GCM` and `ChaCha20-Poly1305` for S/MIME (#161).
- S3: Support for `allowInvalidCerts` option to allow connecting to S3 endpoints with invalid TLS certificates.
- Redis Sentinel support as an in-memory store and cluster coordinator backend (#2430).

## Changed

## Fixed
- DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
- TLS: Update search index when file-backed certificates are refreshed.
- JMAP: `Principal/query` returns broad results when a `name` or `email` filter cannot be resolved.
- Webhooks: event IDs collide for same event type emitted in the same second.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/32653276)