v0.16.20

stalwartlabs/stalwartv0.16.20Aug 30, 2026by github-actions[bot]

AI Summary

This release introduces Cross-domain Identity Management (SCIM) v2 support for enterprise users, enhances calendar functionality with conference links and extensive language translations, and resolves several issues related to DANE, S3, and MTA operations.

Key Highlights

Added SCIM v2 support for Cross-domain Identity Management (Enterprise)
Calendar improvements including conference links and 30+ language translations
DANE improvements: better MX lookup, permanent failures, and fallback logic
Redis: TLS connection for Sentinel deployments

New Features

SCIM v2 Core Schema and Protocol support
Calendar conference links in invites and alarms
Calendar translations for Arabic, Portuguese, Chinese, and many others
JMAP CalendarEvent/set support for updating and deleting synthetic ids

Full Release Notes

## [0.16.20] - 2026-08-30

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- System for Cross-domain Identity Management (SCIM) v2 (*Enterprise*):
  - Core Schema ([RFC 7643](https://www.rfc-editor.org/rfc/rfc7643.html))
  - Protocol ([RFC 7644](https://www.rfc-editor.org/rfc/rfc7644.html))
  - Cursor-Based Pagination ([RFC 9865](https://www.rfc-editor.org/rfc/rfc9865.html))
  - Interoperability Profile ([draft-zollner-scim-interop-profile](https://datatracker.ietf.org/doc/draft-zollner-scim-interop-profile/))
  - IPSIE lifecycle profile ([draft-schreiber-scim-ipsie-profile](https://datatracker.ietf.org/doc/draft-schreiber-scim-ipsie-profile/))
- JMAP: `CalendarEvent/set` support for updating and deleting synthetic ids (#2925).
- Calendar: 
  - Conference links in calendar invites and email alarms.
  - Translations for Arabic, Brazilian Portuguese, Bulgarian, Chinese Simplified, Chinese Traditional, Croatian, Czech, Finnish, Hebrew, Hindi, Hungarian, Indonesian, Japanese, Korean, Lithuanian, Norwegian Bokmål, Persian, Romanian, Russian, Slovak, Slovenian, Thai, Turkish, Ukrainian and Vietnamese.

## Changed
- Calendar: Updated HTTP RSVP page.

## Fixed
- DANE:
  - `TLSA` records are looked up whenever the MX RRset is signed, even when the MX host's own zone is not.
  - Mandatory DANE failures are permanent rather than temporary, bouncing messages that should be delayed.
  - Valid but unusable `TLSA` records fall back to the configured TLS strategy, permitting cleartext delivery where TLS is required.
- S3: Fix outdated upstream `af-south-1` region configuration.
- Setup wizard: SQL directories set to use the main data store are now validated against the data store being configured.
- CardDAV: Delete default address book id when deleting the default address book.
- Redis: Sentinel deployments configured with `rediss://` URLs now connect to the master over TLS instead of silently falling back to cleartext.
- Email: Generated `Message-ID` headers use the hostname of the node that built the message instead of the configured server hostname.
- MTA: 
  - Do not send DMARC reports to local domains.
  - Messages addressed to an `inboundReportAddresses` match are only discarded when they actually contain a report (#1088).
- Directory: Impersonation using the recovery admin fails when the impersonated account has not logged in before (LDAP and SQL directories).
- WebUI: Failed logins open the browser's native credential prompt.
- Cluster: Expired node id leases are released periodically rather than only during startup, so entries for removed nodes no longer remain `Stale` or `Inactive` indefinitely.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/43963355)