v0.16.8

kyegomez/swarmsv0.16.8Jun 6, 2026by github-actions[bot]

AI Summary

This release focuses on security and stability improvements for Stalwart Mail Server, featuring a major rework of OAuth access tokens and fixes for sub-addressing, rate limiting, and JMAP file storage issues.

Key Highlights

OAuth access tokens reworked to AES-256-GCM-SIV AEAD format
Sub-addressing with external directories now returns correct responses
Rate limiter panic fixed for periods under 1 second
JMAP for File Storage stale state string bug resolved
DNS updater updated to version 0.5.1

Breaking Changes

OAuth token format reworked (requires binary replacement for v0.16.x)
Upgrading from v0.16.x requires replacing the binary

Full Release Notes

## [0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added

## Changed
- OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing.
- Added more internal TLDs to the domain validation.

## Fixed
- MTA: 
  - Sub-addressing with external directories returns `550 Mailbox not found`.
  - Disabled aliases continue receiving messages.
- JMAP for File Storage: `FileNode/get` returns a stale state string.
- Make `SieveSystemInterpreter.defaultReturnPath` and `MtaQueueQuota.match` optional expressions.
- Rate limiter panics when periods under 1 second are used.
- CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
- DNS updater: bump to `dns-update-v0.5.1`.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/30137514)