v0.16.1

stalwartlabs/stalwartv0.16.1Apr 25, 2026by github-actions[bot]

AI Summary

Bug fixes for JMAP, IMAP, WebDAV, and ACME, plus new system expression variables.

Key Highlights

Added `system('node_hostname')` and `system('node_role')` expression variables.
Fixed JMAP `receivedAt` headers and sorting order issues.
Fixed IMAP `BINARY` fetch responses.
Fixed ACME to allow requesting apex domain certificates.

New Features

`system('node_hostname')` expression variable
`system('node_role')` expression variable

Full Release Notes

## [0.16.1] - 2026-04-25

This version includes **multiple breaking changes**. If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- OIDC: Extract username from JWT token.
- `system('node_hostname')` and `system('node_role')` expression variables to retrieve the local node hostname and cluster role respectively.

## Changed

## Fixed
- JMAP:
  - Invalid `receivedAt` headers after importing (#2939).
  - Sorting order issues when emails lack `receivedAt` headers.
- IMAP: Fix `BINARY` fetch responses (#2940).
- WebDAV: Fix ACL validation for target folders.
- ACME: Allow requesting apex domain certificates.
- Hostname issues: 
  - Accept RFC 6761 reserved TLDs during bootstrap.
  - Allow hostnames without TLDs in remote server settings.
- Reverse proxy issues.
- OSS builds.
- DNS Updater:
  - RFC2136: TSIG secret not base64 decoded.
  - Google DNS: Chunk TXT records when they exceed 255 characters.
  - Cloudflare: 
    - Fix `CAA` record updates.
    - Check zone subdomains when finding zones



<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/25562510)