Starstruk Logo MarkStarstruk

v0.13.3

stalwartlabs/stalwartv0.13.3Sep 9, 2025by mdecimus

AI Summary

This release focuses on bug fixes for iTIP, HTTP, IMAP, and CalDAV protocols, introduces CLI health checks, and updates WebDAV discovery. It includes breaking changes for users upgrading from v0.11.x or v0.12.x regarding message queue and MTA configuration.

Key Highlights

  • Added CLI health checks for monitoring system status.
  • Fixed iTIP handling for REPLY messages and MS Exchange compatibility.
  • Resolved CalDAV recurrence expansion vulnerability (CVE-2025-59045).
  • Improved IMAP ACL responses and UTF8 support.
  • Fixed HTTP scanner fail2ban checks for proxy clients.

Breaking Changes

  • Message queue and MTA configuration changes for v0.11.x/v0.12.x upgrades.

New Features

  • CLI Health checks
  • WebDAV Assisted discovery v2

Full Release Notes

## [0.13.3] - 2025-09-10

If you are upgrading from v0.11.x or v0.12.x, this version includes **breaking changes** to the message queue and MTA configuration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.

## Added
- CLI: Health checks (contributed by @Codekloeppler)

## Changed
- WebDAV: Assisted discovery v2

## Fixed
- iTIP: Do not send a REPLY when deleting an event that was not accepted.
- iTIP: Include event details in REPLY messages (#2102).
- iTIP: Add organizer to iMIP replies if missing to deal with MS Exchange 2010 bug.
- OIDC: Do not overwrite locally defined aliases (#2065).
- HTTP: Scan ban should only be triggered by HTTP parse errors.
- HTTP: Skip scanner fail2ban checks when the proxy client IP can't be parsed (#2121).
- JMAP: Do not allow roles to be removed from system mailboxes (#1977).
- JMAP WS: Fix panic when using invalid server url.
- SMTP: Do no send `EHLO` twice when `STARTTLS` is unavailable (#2050).
- IMAP: Allow `ENABLE UTF8` in IMAPrev1.
- IMAP: Include `administer` permission in ACL responses.
- IMAP: Add owner rights to ACL get responses.
- IMAP: Do not auto-train Bayes when moving messages from Junk to Trash.
- IMAP/ManageSieve: Increase maximum quoted argument size (#2039).
- CalDAV: Limit recurrence expansions in calendar reports ([CVE-2025-59045](https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-xv4r-q6gr-6pfg)).
- WebDAV: Do not fix percent encoding on WebDAV FS (#2036).

<hr />

### Check binary attestation at [here](https://github.com/stalwartlabs/stalwart/attestations/10528818)