v0.16.7

stalwartlabs/stalwartv0.16.7May 29, 2026by github-actions[bot]

AI Summary

Adds HTTP RateLimit headers and enables spamtest in trusted Sieve scripts, along with fixes for logging rejected messages and MTA DSN updates.

Key Highlights

HTTP RateLimit header fields for API rate limiting
Spamtest implementation in trusted Sieve scripts
Log rejected messages to tracing store
MTA DSN notify time updates

New Features

HTTP RateLimit header fields
Spamtest in trusted Sieve scripts
Enhanced message rejection logging

Full Release Notes

## [0.16.7] - 2026-05-28

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- RateLimit header fields for HTTP ([draft-ietf-httpapi-ratelimit-headers-10](https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-ratelimit-headers-10))
- MTA: Implement `spamtest` in trusted Sieve scripts.

## Changed

## Fixed
- Log rejected messages to tracing store.
- MTA:
  - Always update next DSN notify times.
  - Expand lists and resolve catch-all addresses when building autogenerated messages.
- Sharing: Includes resource that themselves carry a direct ACL grant and are leaves.
- Tasks cannot be deleted in OSS builds.
- Directory: Per-domain external directory resolution fails.
- DNS updater: Keep external `TXT` records when updating RRSet.
- HTTP: Reject requests from blocked IPs when `Keep-Alive` is enabled.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/29125359)