stalwart

v0.16.14 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

Published 6d Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

caldav carddav imap jmap mail pop3

+4 more

rust server smtp webdav

Affected surfaces

auth rbac deps breaking_upgrade crypto_tls

Summary

AI summary

Broad release touches https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md, https://datatracker.ietf.org/doc/html/rfc9749, VAPID, and IMAP.

Full changelog

[0.16.14] - 2026-07-20

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Use of Voluntary Application Server Identification (VAPID) in JMAP Web Push (RFC 9749).

Changed

Fixed

IMAP:
- Mailbox object-quota only enforced in JMAP.
- Pipelined STORE and EXPUNGE can execute out of order.
JMAP:
- Read-only sharee cannot set isSubscribed on a shared mailbox.
- Web Push payloads with Content-Encoding: aes128gcm should not be base64-encoded but sent as raw bytes.
- Stale push subscription can block verification of a new one.
- PushSubscription/set rejects the unpadded base64url keys the W3C Push API produces.
- Email/import does not send push notifications for imported messages.
- CalendarEvent/set silently ignores ifInState.
CalDAV: calendar-query REPORT returns empty calendar-data for JMAP-created events.
MTA:
- DMARC is skipped when MAIL FROM SPF is unavailable.
- queue_name variable not available in rate limiter expressions.
Calendar:
- No expanded occurrences are returned for a daily recurrences crossing DST.
- Uppercase MAILTO calendar addresses become invalid SMTP recipients.
- Scheduling invitations on a shared, non-owned calendar fail with MAIL FROM unauthorized.
HTTP: Disable allowedEndpoints expression in recovery mode.
Telemetry: Tasks are serialized to the wrong store when using separate stores for telemetry and data.

Check binary attestation here

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track stalwart

Get notified when new releases ship.

About stalwart

All-in-one Mail & Collaboration server. Secure, scalable and fluent in every protocol (IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV).

All releases →