v0.16.8

stalwartlabs/stalwartv0.16.8Jun 6, 2026by github-actions[bot]

AI Summary

Security and stability updates including OAuth token rework, MTA fixes for sub-addressing, and Sieve/Cache improvements.

Key Highlights

OAuth token rework to AES-256-GCM-SIV AEAD format
MTA fixes for sub-addressing and disabled aliases
Rate limiter panic fix for periods under 1 second
Sieve keep behavior fix

New Features

OAuth: Rework access tokens to AES-256-GCM-SIV AEAD format
Added more internal TLDs to domain validation

Full Release Notes

## [0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added

## Changed
- OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing.
- Added more internal TLDs to the domain validation.

## Fixed
- MTA: 
  - Sub-addressing with external directories returns `550 Mailbox not found`.
  - Disabled aliases continue receiving messages.
- JMAP for File Storage: `FileNode/get` returns a stale state string.
- Make `SieveSystemInterpreter.defaultReturnPath` and `MtaQueueQuota.match` optional expressions.
- Rate limiter panics when periods under 1 second are used.
- CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
- DNS updater: bump to `dns-update-v0.5.1`.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/30137514)