v0.16.8

pingcap/autoflowv0.16.8Jun 6, 2026by github-actions[bot]

AI Summary

This release focuses on security updates for OAuth tokens, domain validation improvements, and various bug fixes for MTA, JMAP, and CalDAV components, along with a dependency bump for the DNS updater.

Key Highlights

OAuth access tokens reworked to `AES-256-GCM-SIV` AEAD format for proxy routing.
Fixed MTA sub-addressing issues with external directories and disabled aliases.
Resolved JMAP for File Storage stale state string issue.
Fixed rate limiter panic when periods under 1 second are used.
DNS updater bumped to `dns-update-v0.5.1`.

Full Release Notes

## [0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added

## Changed
- OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing.
- Added more internal TLDs to the domain validation.

## Fixed
- MTA: 
  - Sub-addressing with external directories returns `550 Mailbox not found`.
  - Disabled aliases continue receiving messages.
- JMAP for File Storage: `FileNode/get` returns a stale state string.
- Make `SieveSystemInterpreter.defaultReturnPath` and `MtaQueueQuota.match` optional expressions.
- Rate limiter panics when periods under 1 second are used.
- CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
- DNS updater: bump to `dns-update-v0.5.1`.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/30137514)