Update stalwartlabs/stalwart Docker tag to v0.16.18 #1016

Merged

renovate merged 1 commit from renovate/stalwartlabs-stalwart-0.16.x into master

2026-08-17 22:30:06 +00:00

renovate commented

2026-08-17 22:20:49 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
stalwartlabs/stalwart	patch	`v0.16.17` → `v0.16.18`

Release Notes

stalwartlabs/stalwart (stalwartlabs/stalwart)

`v0.16.18`

Compare Source

[0.16.18] - 2026-08-17

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Reporting: inboundReportMaxSize setting, which bounds the size of a decompressed inbound DMARC or TLS report (default 25MB).
RocksDB: cacheSize setting, which bounds the total memory shared by the block caches of every column family (default 128MB).

Changed

ASN & GeoIP: Default data source URLs now point at the ip-location-db GitHub releases, as the previously used npm packages are no longer updated. Existing installations keep their configured URLs and should update them following the ASN and GeoIP documentation.
JMAP: Identity/get keeps identities in sync with the account's e-mail addresses.
MTA: Queue scheduler no longer rescans the queue from the earliest pending event and coalesces bursts of delivery completions into a single scan.
RocksDB:
- Column families are tuned for the access pattern of the data they hold.
- Range iteration uses bounded iterators and no longer reads values when only keys were requested.

Fixed

JMAP:
- Setting uploadTtl to 1ms triggers panic.
- CalendarEvent/set does not assign organizerCalendarAddress nor send scheduling messages when an event is created with participants.
- CalendarEvent/get omits isOrigin when it is listed explicitly in properties.
- CalendarEventNotification/changes and FileNode/changes reject with cannotCalculateChanges the state that /get returned for an account with no change history.
- CalendarEvent/set and ContactCard/set do not write a vanished tombstone for the previous CalDAV/CardDAV href when calendarIds or addressBookIds moves an item between collections.
CalDAV: Attendee addresses that percent-encode a display name into the mailto: URI are queued verbatim.
Calendar: Recurring events disappear from CalDAV time-range REPORTs and JMAP CalendarEvent/query results a few years after their first occurrence.
WebDAV:
- When a file node references a parent folder that no longer exists, any request on a file collection panics.
- MOVE on a folder honors a Depth header of 0 or 1 instead of always moving the whole subtree.
MTA:
- DSN bounces are emitted with a malformed Message-ID wrapped in doubled angle brackets.
- Delivery to any MX host whose name is an IDN A-label fails permanently.
- Queue strategy and quota expressions that branch on source never match at enqueue.
- MTA-STS:
  - Policies in testing mode are enforced, turning any TLS error into a permanent failure.
  - mx patterns published as U-labels never authorize the MX host they name.
- DMARC:
  - Alignment compares identifiers in their A-label form.
  - External reporting addresses published as U-labels are rejected as unauthorized.
Spam filter:
- Some rules misfire on internationalized addresses when the envelope and the headers spell the same domain in different label forms.
- Punycode labels that do not re-encode to the label they came from are no longer decoded.
WebPush: Validate push URL and use application/octet-stream as Content-Type for encrypted payloads.
Directory:
- Local group membership is cleared when the external directory is configured with a group claim or attribute that it does not return.
- LDAP: Directories that store aliases as additional values of the primary address attribute provision no aliases.
- Mail addressed to a domain alias is rejected with 550 Relay not allowed, unless the domain's primary name happened to be resolved earlier and is still cached.
RocksDB: bufferSize setting was applied to the unused default column family and had no effect.
Sieve: include statements fail to find system and user global scripts whose name contains uppercase characters.
Task manager: totalDeadline is measured from the time a task was created instead of its first failed attempt.

Check binary attestation here

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [stalwartlabs/stalwart](https://github.com/stalwartlabs/stalwart) | patch | `v0.16.17` → `v0.16.18` | --- ### Release Notes <details> <summary>stalwartlabs/stalwart (stalwartlabs/stalwart)</summary> ### [`v0.16.18`](https://github.com/stalwartlabs/stalwart/releases/tag/v0.16.18) [Compare Source](https://github.com/stalwartlabs/stalwart/compare/v0.16.17...v0.16.18) #### \[0.16.18] - 2026-08-17 If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions. #### Added - Reporting: `inboundReportMaxSize` setting, which bounds the size of a decompressed inbound DMARC or TLS report (default 25MB). - RocksDB: `cacheSize` setting, which bounds the total memory shared by the block caches of every column family (default 128MB). #### Changed - ASN & GeoIP: Default data source URLs now point at the ip-location-db GitHub releases, as the previously used npm packages are no longer updated. Existing installations keep their configured URLs and should update them following the [ASN and GeoIP documentation](https://stalw.art/docs/server/asn). - JMAP: `Identity/get` keeps identities in sync with the account's e-mail addresses. - MTA: Queue scheduler no longer rescans the queue from the earliest pending event and coalesces bursts of delivery completions into a single scan. - RocksDB: - Column families are tuned for the access pattern of the data they hold. - Range iteration uses bounded iterators and no longer reads values when only keys were requested. #### Fixed - JMAP: - Setting `uploadTtl` to 1ms triggers panic. - `CalendarEvent/set` does not assign `organizerCalendarAddress` nor send scheduling messages when an event is created with participants. - `CalendarEvent/get` omits `isOrigin` when it is listed explicitly in `properties`. - `CalendarEventNotification/changes` and `FileNode/changes` reject with `cannotCalculateChanges` the state that `/get` returned for an account with no change history. - `CalendarEvent/set` and `ContactCard/set` do not write a vanished tombstone for the previous CalDAV/CardDAV href when `calendarIds` or `addressBookIds` moves an item between collections. - CalDAV: Attendee addresses that percent-encode a display name into the `mailto:` URI are queued verbatim. - Calendar: Recurring events disappear from CalDAV time-range `REPORT`s and JMAP `CalendarEvent/query` results a few years after their first occurrence. - WebDAV: - When a file node references a parent folder that no longer exists, any request on a file collection panics. - `MOVE` on a folder honors a `Depth` header of `0` or `1` instead of always moving the whole subtree. - MTA: - DSN bounces are emitted with a malformed `Message-ID` wrapped in doubled angle brackets. - Delivery to any MX host whose name is an IDN A-label fails permanently. - Queue strategy and quota expressions that branch on `source` never match at enqueue. - MTA-STS: - Policies in `testing` mode are enforced, turning any TLS error into a permanent failure. - `mx` patterns published as U-labels never authorize the MX host they name. - DMARC: - Alignment compares identifiers in their A-label form. - External reporting addresses published as U-labels are rejected as unauthorized. - Spam filter: - Some rules misfire on internationalized addresses when the envelope and the headers spell the same domain in different label forms. - Punycode labels that do not re-encode to the label they came from are no longer decoded. - WebPush: Validate push URL and use `application/octet-stream` as `Content-Type` for encrypted payloads. - Directory: - Local group membership is cleared when the external directory is configured with a group claim or attribute that it does not return. - LDAP: Directories that store aliases as additional values of the primary address attribute provision no aliases. - Mail addressed to a domain alias is rejected with `550 Relay not allowed`, unless the domain's primary name happened to be resolved earlier and is still cached. - RocksDB: `bufferSize` setting was applied to the unused default column family and had no effect. - Sieve: `include` statements fail to find system and user global scripts whose name contains uppercase characters. - Task manager: `totalDeadline` is measured from the time a task was created instead of its first failed attempt. <hr /> ##### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/41218930) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-08-17 22:20:50 +00:00