Starstruk Logo MarkStarstruk

v0.16.11

pingcap/autoflowv0.16.11Jun 25, 2026by github-actions[bot]

AI Summary

This release introduces security enhancements, backend storage improvements, and critical bug fixes. It adds support for advanced encryption standards, Redis Sentinel, and S3 connectivity options, while resolving issues in DANE validation, JMAP compliance, and webhook event handling.

Key Highlights

  • Added encryption-at-rest support for AES-256-GCM and ChaCha20-Poly1305.
  • Introduced Redis Sentinel support for in-memory storage and coordination.
  • Fixed extensive JMAP conformance issues to pass the official test suite.
  • Added S3 `allowInvalidCerts` option for flexible TLS connections.
  • Resolved webhook event ID collisions.

New Features

  • Encryption-at-rest (AES-256-GCM/ChaCha20-Poly1305) for S/MIME.
  • Redis Sentinel support as an in-memory store and cluster coordinator backend.
  • S3 `allowInvalidCerts` option.
  • IMAP Extension for Object Identifiers.
  • JMAP `Principal/query` improvements and `GETJMAPACCESS` command.

Full Release Notes

## [0.16.11] - 2026-06-25

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- Encryption-at-rest: Support for `AES-256-GCM` and `ChaCha20-Poly1305` for S/MIME (#161).
- S3: Support for `allowInvalidCerts` option to allow connecting to S3 endpoints with invalid TLS certificates.
- Redis Sentinel support as an in-memory store and cluster coordinator backend (#2430).

## Changed

## Fixed
- DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
- TLS: Update search index when file-backed certificates are refreshed.
- JMAP: `Principal/query` returns broad results when a `name` or `email` filter cannot be resolved.
- Webhooks: event IDs collide for same event type emitted in the same second.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/32653276)