v0.16.17

stalwartlabs/stalwartv0.16.17Aug 10, 2026by github-actions[bot]

AI Summary

Adds several IMAP extensions (UIDBATCHES, UIDONLY, MESSAGELIMIT, SAVELIMIT) and WebDAV header support, while replacing the unmaintained jemallocator with tikv-jemallocator.

Key Highlights

New IMAP extensions: UIDBATCHES, UIDONLY, MESSAGELIMIT, and SAVELIMIT
WebDAV Range and If-Range header support for file downloads
Spam filter url_original expression variable
Memory allocator replaced with tikv-jemallocator

New Features

IMAP UIDBATCHES and UIDONLY extensions
IMAP MESSAGELIMIT and SAVELIMIT extensions
WebDAV Range and If-Range header support
Spam filter url_original expression variable

Full Release Notes

## [0.16.17] - 2026-08-10

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- IMAP:
  - `UIDBATCHES` extension ([RFC 10022](https://www.rfc-editor.org/rfc/rfc10022.html)).
  - `UIDONLY` extension ([RFC 9586](https://www.rfc-editor.org/rfc/rfc9586.html)).
  - `MESSAGELIMIT` and `SAVELIMIT` extensions ([RFC 9738](https://www.rfc-editor.org/rfc/rfc9738.html)).
- WebDAV: `Range` and `If-Range` header support on file downloads ([RFC 7233](https://www.rfc-editor.org/rfc/rfc7233.html)) (#2377).
- Spam filter: `url_original` expression variable for `Url` rules.

## Changed
- Memory allocator: Replaced the unmaintained `jemallocator` crate with `tikv-jemallocator` (contributed by @checkraisefold).
- ACME registry: Use `description` as label property.

## Fixed
- MTA: 
  - Certificates for domains publishing an enforcing MTA-STS policy are always validated, even in the fallback TLS strategy.
  - DSN delivery date uses wrong timestamp.
  - `FUTURERELEASE HOLDUNTIL` uses Unix timestamps instead of RFC 3339 date-times.
- JMAP:
  - `EmailSubmission/query` filtering on `undoStatus` contradicts `EmailSubmission/get`, reporting held `FUTURERELEASE` submissions as `final` instead of `pending`.
  - `EmailSubmission/get` requests without an `ids` argument iterates the wrong index.
- CardDAV: `Accept: text/vcard` version negotiation is ignored whenever another parameter such as `q` or `charset` follows `version=`.
- Calendar: Server-side scheduling messages place the `text/calendar` part outside the `multipart/alternative` and disposed as an attachment.
- Sharing: Accounts holding the `impersonate` permission never have their ACL grants collected, so shared items are never listed in JMAP sessions, CalDAV/CardDAV discovery or IMAP.
- IMAP:
  - `COPY`/`MOVE` into a shared folder fails with `NO [ALREADYEXISTS]` when the destination account already holds the message, leaving the message in the source mailbox and clients in a retry loop.
  - `BODYSTRUCTURE` and `ENVELOPE` return MIME parameters, `Content-Description`, subjects and display names as raw UTF-8 even to sessions that never enabled `UTF8=ACCEPT`.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/39894653)