Starstruk Logo MarkStarstruk

v0.16.10

pingcap/autoflowv0.16.10Jun 21, 2026by github-actions[bot]

AI Summary

This update prioritizes protocol compliance and user experience improvements, specifically targeting JMAP standards and OAuth authentication. It adds support for international domains and improves IMAP functionality while significantly refining the JMAP implementation to pass strict compliance tests.

Key Highlights

  • Added support for International Domain Names (IDN) and public OAuth clients.
  • Fixed extensive JMAP conformance issues to pass the jmap-test-suite.
  • Enabled RocksDB blob garbage collection to reclaim disk space.
  • Added IMAP Object Identifier extension and `GETJMAPACCESS` command.
  • Improved Sieve script case-insensitivity for `include` statements.

New Features

  • International Domain Names (IDN) support.
  • OAuth Profile for Open Public Clients.
  • HTTP `redirectRoot` option.
  • ACME `reuseKey` option.
  • IMAP Object Identifier extension.
  • JMAP `GETJMAPACCESS` command.

Full Release Notes

## [0.16.10] - 2026-06-21

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- International Domain Names (IDN) support (#207).
- OAuth:
  - OAuth Profile for Open Public Clients ([draft-ietf-mailmaint-oauth-public](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-oauth-public/))
  - Client secret verification for confidential clients.
- HTTP: Add `redirectRoot` option to `Http` object to allow redirecting requests to the root path to a different path (e.g. `/account`).
- ACME: `reuseKey` option to allow reusing private keys in renewals.
- IMAP: 
  - IMAP Extension for Object Identifiers ([draft-ietf-mailmaint-imap-objectid-bis](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-imap-objectid-bis/))
  - `GETJMAPACCESS` command to discover the JMAP session resource URL (#2736).

## Changed

## Fixed
- JMAP conformance (pass the [jmap-test-suite](https://github.com/jmapio/jmap-test-suite) tests):
  - Methods are only available if their capability is in `using`.
  - Reject requests that do not specify `application/json` in the `Content-Type` header.
  - Require `accountId` argument on requests.
  - Return unparsable ids in `notFound` / `notUpdated` / `notDestroyed` / `notCopied` instead of dropping them.
  - Default calendars and address books are not subscribed by default.
  - `*/set`: Unchanged immutable `id` property is rejected on update.
  - `*/query` and `*/queryChanges`: null` rejected as `notRequest`.
  - `Email/query`:
    * Improper `anchor` handling.
    * Total miscount when `collapseThreads` is enabled.
    * Wrong sort order on `hasKeyword`, `allInThreadHaveKeyword`, and `someInThreadHaveKeyword` conditions.
    * Non-standard header values are not searchable.
  - `Email/copy`: Take the source message id from the value's `id` property.
  - `Email/set`: Bump reference-resolution max_depth from 1 to 2.
  - `Email/import`: Reject blobs that do not contain valid messages.
  - `EmailSubmission/set`: return `sendAt` and `undoStatus` in the created response.
  - `Mailbox/set`: Return `alreadyExists` instead of `invalidProperties` when creating a mailbox with an existing name.
  - `SearchSnippet/get`: incorrect response structure.
  - `Thread/changes`: emit a container delete when a thread becomes empty.
  - `VacationResponse/set`: incorrect singleton handling.
- IMAP: Discard oversized non-synchronizing literals (#2768).
- DANE: Improper `TLSA` record validation (#2328 - credits to @vdukhovni).
- OIDC: Add default domain name to groups that are not email addresses.
- RocksDB: Enable blob garbage collection to reclaim disk space from deleted blobs.
- Sieve: `include` statements ignore capitalisation of sub-script names (#1643)
- Cache: Invalidate negative email caches when an account is created.
- Troubleshoot tool: Use the configured source IP address when connecting to remote servers (#2867).


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/32044689)