v0.12.3

stalwartlabs/stalwartv0.12.3May 30, 2025by mdecimus

AI Summary

A security and stability focused release that fixes XML injection vulnerabilities and macro replacement issues in configuration files. It also resolves nested CalDAV/CardDAV property tags.

Key Highlights

Fixed XML `CDATA` injection vulnerability.
Macro references now replaced with content in config files.
Fixed double nested CalDAV and CardDAV property tags.
Fixed WebDAV dead property updates.
Allow empty properties in PROPPATCH requests.

Breaking Changes

Database layout changes requiring migration (from v0.11.x).

Full Release Notes

## [0.12.3] - 2025-05-30

If you are upgrading from v0.11.x, this version includes **breaking changes** to the database layout and requires a migration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.

## Added
- Store vanished IMAP UIDs and WebDAV paths in the changelog.

## Changed

## Fixed
- XML `CDATA` injection (credits to @andreymal for the report).
- Macro references are replaced with their content when writing config file (#1595).
- Double nested CalDAV and CardDAV property tags (#1591).
- Allow empty properties in PROPPATCH requests (#1580).

<hr />

### Check binary attestation at [here](https://github.com/stalwartlabs/stalwart/attestations/7394687)