v0.13.4

stalwartlabs/stalwartv0.13.4Sep 30, 2025by mdecimus

AI Summary

Security patch addressing unbounded memory allocation in the IMAP parser.

Key Highlights

Fixed unbounded memory allocation in IMAP request parser (CVE-2025-61600).
Fixed JMAP references when there are no results.
Fixed JMAP quota enforcement on `Blob/copy`.
Fixed iTIP date properties in REPLY.

Full Release Notes

## [0.13.4] - 2025-09-30

If you are upgrading from v0.11.x or v0.12.x, this version includes **breaking changes** to the message queue and MTA configuration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.

## Added

## Changed
- JMAP: Protocol layer rewrite for zero-copy deserialization and architectural improvements.

## Fixed
- IMAP: Unbounded memory allocation in request parser ([CVE-2025-61600 ](https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-8jqj-qj5p-v5rr)).
- IMAP: Wrong permission checked for GETACL.
- JMAP: References to previous method fail when there are no results (#1507).
- JMAP: Enforce quota checks on `Blob/copy`.
- JMAP: `Mailbox/get` fails without `accountId` argument (#1936).
- JMAP: Do not return `invalidProperties` when email update doesn't contain changes (#1139)
- iTIP: Include date properties in `REPLY` (#2102).
- OIDC: Do not set `username` field if it is the same as the `email` field.
- Telemetry: Fix `calculateMetrics` housekeeper task (#2155).
- Directory: Always use `rsplit` to extract the domain part from email addresses.

<hr />

### Check binary attestation at [here](https://github.com/stalwartlabs/stalwart/attestations/11312721)