Stalwart Mail Server 1.0.2 → 1.0.3
1 release · 0 breaking changes · 0 security fixes · 0 advisories fixed
0security0breaking0deprecated7feature6fix
Breaking changes
None in the release notes.
Security changes
None in the release notes.
Every release in between
featureApps registered in Stalwart: add the scopes the app needs to its OAuthClient scopes (only a superuser can allow full), and have the app request them.
otherApps signing in through an external OpenID Connect provider: create the scopes in the provider and assign them to the apps that need them.
otherWebUI: no action needed.
featureBlob storage:
featureBlob encryption at rest. Blobs can be encrypted by the server with symmetric keys (AES-256-GCM or ChaCha20-Poly1305) defined as SymmetricKey objects.
featureZstandard compression for blobs (zstd in compressionAlgorithm).
featureBlobRecode task, which rewrites stored blobs with a chosen compression and encryption.
featureSTALWART_UPDATE_ROLE_PERMISSIONS environment variable. When set to true (or 1), startup adds to each default role every permission introduced after v1.0.0 that a new install would give that role and that the role is missing.
featureOAuth: Stalwart scopes urn:stalwart:oauth:scope:security, urn:stalwart:oauth:scope:settings and urn:stalwart:oauth:scope:full, so clients signing in through Stalwart or an external OpenID Connect provider can manage app passwords, API keys and account settings.
fixJMAP:
fix/copy methods called with the same accountId and fromAccountId return a clear error message.
fixPushSubscription objects created with an empty types list no longer receive StateChange notifications, and EmailPush notifications are delivered regardless of types.
fixIMAP SEARCH accepts up to 32 levels of nested filters, so free-text searches from Apple Mail no longer fail with Too many nested filters.
fixOIDC: Bearer tokens are routed to the OpenID Connect directory whose issuer matches before the domain in their claims is tried, so a claim naming a domain the server does not host no longer sends the token to the default directory.
fixSecurity: Editing a default role, or a role nested in one, now invalidates the cached access tokens of accounts and groups that use the default role sets.