v0.11.5

[0.11.5] - 2025-02-01

To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

Changed

• Open source third party OIDC support.

Fixed

• Case insensitive flag parsing (#1138).
• BCC not removed from JMAP EmailSubmissions (#618).
• Group pipelined IMAP FETCH and STATUS operations (#1096).

---

Check binary attestation at here

v0.11.4

[0.11.4] - 2025-01-29

To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

• RFC 9208 - IMAP QUOTA Extension (#484).

Changed

• session.throttle.* is now queue.limiter.inbound.*.
• queue.throttle.* is now queue.limiter.outbound.*.
• Changed DNSBL error level to debug (#1107).

Fixed

• Creating a mailbox in a shared folder results in wrong hierarchy (#1128).
• IMAP LIST-STATUS (RFC 5819) returns items in wrong order (#1129).
• Avoid non-RFC SMTP status codes (#1109).
• Do not DNSBL check invalid domains (#1107).
• Sieve message flag parser (#1059).
• Sieve script import case insensitivity (#962).
• mailto: parsing in HTMLs.

v0.11.3

Same as 0.11.2, fixes a build issue with Docker images.

v0.11.2

[0.11.2] - 2025-01-17

To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

• Automatic revoking of access tokens when secrets, permissions, ACLs or group memberships change (#649).
• Increased concurrency for local message delivery (configurable via queue.threads.local).
• Cluster node roles.
• config_get expression function.

Changed

• queue.outbound.concurrency is now queue.threads.remote.
• lookup.default.hostname is now server.hostname.
• lookup.default.domain is now report.domain.

Fixed

• Distributed locking issues in non-Redis stores (#1066).
• S3 incorrect backoff wait time after failures.
• Panic parsing broken HTMLs.
• Update CLI response serializer to v0.11.x (#1082).
• Histogram bucket counts (#1079).
• Do not rate limit trusted IPs (#1078).
• Avoid double encrypting PGP parts encoded as plain text (#1083).
• Return empty SASL challenge rather than "" (#1064).

v0.11.1

[0.11.0] - 2025-01-06

This version includes breaking changes to the configuration file, please read UPGRADING.md for details.
To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

• Spam filter rewritten in Rust for a significant performance improvement.
• Multiple spam filter improvements (#947) such as training spam/ham when moving between inbox and spam folders (#819).
• Improved distributed locking and handling of large distributed SMTP queues.
• ASN and GeoIP lookups.
• Bulk operations REST endpoints (#925).
• Faster S3-FIFO caching.
• Support adding the Delivered-To header (#916).
• Semver compatibility checks when upgrading (#844).
• Sharded In-Memory Store.

Changed

• Removed authentication rate limit (no longer necessary since there is fail2ban).
• Pipes have been deprecated in favor of MTA hooks.

Fixed

• OpenPGP EOF error (#1024).
• Convert emails obtained from external directories to lowercase (#1004).
• LDAP: Support both name and email fields to be mapped to the same attribute.
• Admin role can't be assigned if an acccount with the same name exists.
• Fix macro detection in DNS record generation (#978).
• Use host FQDN in install script (#1003).

v0.11.0

[0.11.0] - 2025-01-06

This version includes breaking changes to the configuration file, please read UPGRADING.md for details.
To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

• Spam filter rewritten in Rust for a significant performance improvement.
• Multiple spam filter improvements (#947) such as training spam/ham when moving between inbox and spam folders (#819).
• Improved distributed locking and handling of large distributed SMTP queues.
• ASN and GeoIP lookups.
• Bulk operations REST endpoints (#925).
• Faster S3-FIFO caching.
• Support adding the Delivered-To header (#916).
• Semver compatibility checks when upgrading (#844).
• Sharded In-Memory Store.

Changed

• Removed authentication rate limit (no longer necessary since there is fail2ban).
• Pipes have been deprecated in favor of MTA hooks.

Fixed

• OpenPGP EOF error (#1024).
• Convert emails obtained from external directories to lowercase (#1004).
• LDAP: Support both name and email fields to be mapped to the same attribute.
• Admin role can't be assigned if an acccount with the same name exists.
• Fix macro detection in DNS record generation (#978).
• Use host FQDN in install script (#1003).

v0.10.7

[0.10.7] - 2024-12-04

To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

• Delivery and DMARC Troubleshooting (#420).
• Support for external email addresses on mailing lists (#152).
• Azure blob storage support.

Changed

Fixed

• Some mails can't be moved out of the junk folder (#670).
• Out of bound index error on Sieve script (#941).
• Missing User-Agent header for ACME (#937).
• UTF8 support in IMAP4rev1 (#948).
• Account alias owner leak on autodiscover.
• Include all events in OTEL traces + Include spanId in webhooks.
• Implement todo!() causing panic on concurrency and rate limits.
• Mark SQL store as active if used as a telemetry store.
• Discard empty form submissions.

v0.10.6

[0.10.6] - 2024-11-07

To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

• Enterprise license automatic renewals before expiration (disabled by default).
• Allow to LDAP search using bind dn instead of auth bind connection when bind auth is enabled (#873)

Changed

Fixed

• Include preferred_username and email in OIDC id_token.
• Verify roles and permissions when creating or modifying accounts (#874)

v0.10.5

[0.10.5] - 2024-10-15

To upgrade replace the stalwart-mail binary.

Added

• Data store CLI.

Changed

Fixed

• Tokenizer performance issue (#863)
• Incorrect AI model endpoint setting.

v0.10.4

[0.10.4] - 2024-10-08

To upgrade replace the stalwart-mail binary and then upgrade to the latest web-admin.

Added

• Detect and ban port scanners as well as other forms of abuse (#820).
• ACME External Account Binding support (#379).

Changed

• The settings server.fail2ban.* have been moved to server.auto-ban.*.
• The event security.brute-force-ban is now security.abuse-ban.

Fixed

• Do not send SPF failures reports to local domains.
• Allow nonce in OAuth code requests.
• Warn when there are errors migrating domains rather than aborting migration.