Stalwart Mail Server 0.16.24 → 1.0.0
4 releases · 0 breaking changes · 1 security fix · 0 advisories fixed
1security0breaking0deprecated36feature31fix
Breaking changes
None in the release notes.
Security changes
- security OAuth: The OAuth Profile for Open Public Clients is now fully enforced. If you use an external OIDC provider, make sure it conforms to the draft; otherwise mail clients such as Apple Mail will stop working with it as they adopt the profile. Ask your provider to add support, or, at your own risk,… in 1.0.0
Every release in between
featureFull-text search:
featureText extraction and indexing of PDF, Microsoft Office (docx, xlsx, pptx), OpenDocument (odt, ods, odp), EPUB and RTF documents found in attachments and files.
featureFull-text search of file storage contents.
featureIndex queue with per-partition status, concurrency control, retries and index rebuilds.
featureMetadata:
featureJMAP Object Metadata (draft-ietf-jmap-metadata-04) for e-mails, mailboxes, Sieve scripts, calendars, events, address books, contacts and files.
featureIMAP METADATA extension (RFC 5464).
featureDKIM2:
featurePost-quantum composite signatures using ML-DSA-44 and Ed25519 with SHA-512.
featureConfigurable Message-Instance hash algorithms (SHA-256 and SHA-512).
featureOAuth and OIDC:
featureOAuth Client ID Metadata Documents (draft-ietf-oauth-client-id-metadata-document-02).
featureOAuth scopes (mail, contacts, calendars and files) per client and grant.
featureConnected applications: users can list and revoke the applications authorized to access their account.
featureFirst-party clients, post-logout redirect URIs and per-client grant types.
featureExternal OIDC directories: audience matching, opaque token validation via UserInfo or token introspection and a policy for unscoped tokens.
featureCaching:
featureRedesigned cache subsystem with a dedicated tier for large accounts.
featureCache snapshots can be swapped to local disk, Redis or the blob store.
featureBuilt-in local in-memory store for single-node deployments.
featureAzure Blob Storage authentication using shared keys, SAS tokens, client secrets, managed identities or workload identities.
featureSecondary LDAP servers for failover.
featureSSRF protection for outbound HTTP requests (webhooks, OIDC discovery, AI and DNS providers).
featureConfigurable client IP source (X-Forwarded-For or Forwarded) and number of trusted proxy hops.
featureMemory budget for buffered data.
featureConfigurable limits for e-mail headers, keywords and mailboxes per message, calendars, address books and spam filter text processing.
featureTLS options for Kafka and NATS cluster coordinators.
featureAutomatic cleanup of per-user data after a share is revoked.
featureAI (Enterprise):
featureAI models from multiple providers: OpenAI-compatible endpoints (OpenAI, Azure, vLLM, llama.cpp), Anthropic, Google Gemini and Ollama, with per-model rate limits, concurrency caps, timeouts and reasoning levels.
featureAI spam classifier with structured verdicts, model tiers with escalation, training from AI verdicts and optional web search.
featureNew database layout: the key layout was redesigned and the database schema version is now tied to the edition (AGPL-only or AGPL/SEL). Data must be migrated from v0.16.x using the migration tool.
otherSettings schema: multiple objects, fields and enumeration values were renamed, restructured (AI models, OIDC directories, Azure Blob Storage, HTTP forwarded headers) or removed, and internal identifiers were renumbered. See SCHEMA_CHANGES.md for the full list.
featureTelemetry: New events and metrics were added and event identifiers were renumbered. See SCHEMA_CHANGES.md.
securityOAuth: The OAuth Profile for Open Public Clients is now fully enforced. If you use an external OIDC provider, make sure it conforms to the draft; otherwise mail clients such as Apple Mail will stop working with it as they adopt the profile. Ask your provider to add support, or, at your own risk,…
otherUpdated IETF drafts:
otherDKIM2 to draft-ietf-dkim-dkim2-spec-07.
otherJMAP for Calendars to draft-ietf-jmap-calendars-33.
featureDevelopment: Test suites (unit, integration, conformance and stress) are now kept in a private repository, and new features are developed privately before release. The source code of every release remains public under the AGPL-3.0. Learn why
fixMultiple bug and security fixes.
+5 more items in the release notesfixIMAP:
fixAPPEND and COPY/MOVE into another account's mailbox do not change the JMAP EmailDelivery state.
fixSEARCH RETURN with MIN or MAX alongside ALL returns only the minimum and maximum in ALL, and SAVE combined with MIN or MAX and ALL or COUNT saves only the minimum and maximum instead of every match.
fixiTIP: Merging a received update does not copy the VTIMEZONE definitions it carries, so an occurrence moved by an external organizer can reference a TZID (for example W. Europe Standard Time) the stored event no longer defines, and Apple Calendar shows both the original and the moved occurrence.
fixOAuth: Loopback redirect URIs without a path (for example http://127.0.0.1:45678) are not matched against registered loopback URIs on any port and are rejected by dynamic client registration.
fixWebDAV: PROPFIND allprop returns DAV:current-user-principal, so Windows Explorer shows every file and folder under the account name.
featuresd_notify support.
featureJMAP: Mailbox/set allows moving a mailbox under a parent that already has a child with the same name, and rejects renames that only change the case of a mailbox name with alreadyExists.
fixDNSSEC: Use hickory-resolver patched fork at https://github.com/stalwartlabs/hickory-dns.
fixRocksDB: Blob garbage collection rewrites every stored blob on each compaction of the blobs column family, about once per 128MB of new mail.
fixMilter: End-of-headers is not sent to milters that negotiate SMFIP_NOHDRS without SMFIP_NOEOH, so the transaction stalls until it times out.
fixOIDC: When the access token lacks the claimUsername claim but has an email claim, the account is built from email without consulting the userinfo endpoint.
fixJMAP:
fixonSuccessUpdateEmail and onSuccessDestroyEmail entries in EmailSubmission/set that name an existing submission by id update or destroy the Email with the same id instead of the submission's own Email.
fixA VacationResponse/set that only sets isEnabled on an account without a vacation response activates an empty Sieve script.
fixJMAP: Creating a MaskedEmail with emailDomain fails with forbidden for every domain when the account has addresses on more than one domain.
fixAutodiscover: Requests for a response schema other than Outlook's, such as ActiveSync (mobilesync), are answered with the Outlook settings instead of error 601.
fixIMAP:
fixLOGIN and AUTHENTICATE with a wrong, expired or unknown app password or API key are answered with an untagged NO, so clients keep waiting for the command to complete until the connection times out.
fixThe failed login that exceeds the maximum number of authentication failures is answered with an untagged NO before the connection is closed.
fixDKIM:
fixA rotation moves the active key to retiring even when its successor fails to publish or propagate, so outgoing mail is sent unsigned until a retry publishes the new key. The DNS write failure is also not logged and the task reports success.
fixKeys created while DNS management was manual, or before DKIM was added to the published records, are never rotated after DNS management becomes automatic. Domains already affected start rotating once a DkimManagement task is created for them.
fixAfter switching DNS management from automatic to manual, a due rotation activates a new key that was never published in DNS, so signatures fail verification, and retiring the old key is retried forever.
fixSpam filter:
fixMessages with no text line long enough for a Pyzor digest are checked with the digest of empty input and tagged PYZOR.
fixDNSBL answers with several return codes, such as a Spamhaus ZEN listing in both SBL and PBL, are scored for only the first code returned.
fixDNSBL lookups that return "not listed" are cached for 24 hours regardless of the zone's negative TTL.
fixRemoving a duplicate training sample of a message reclassified on the same day clears the blob link of the sample that is kept.
fixMTA: Queue quotas with an empty match expression are never enforced, including the global queue quota created on first start.
fixRocksDB: The info log (LOG, LOG.old.*) grows without limit because log rotation and retention are left at RocksDB defaults.
fixWebUI: A blob store read error at startup, such as an S3 authentication failure, stops the web interface from being downloaded.