Update docker.io/stalwartlabs/stalwart Docker tag to v0.16.25 #99

2026-10-08T09:35:17+02:00

jlab-renovate-bot commented

2026-10-08 09:35:17 +02:00

This PR contains the following updates:

Package	Type	Update	Change
docker.io/stalwartlabs/stalwart	app-version	patch	`v0.16.24` → `v0.16.25`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

stalwartlabs/stalwart (docker.io/stalwartlabs/stalwart)

`v0.16.25`

Compare Source

[0.16.25] - 2026-10-05

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

JMAP: Creating a MaskedEmail with emailDomain fails with forbidden for every domain when the account has addresses on more than one domain.
Autodiscover: Requests for a response schema other than Outlook's, such as ActiveSync (mobilesync), are answered with the Outlook settings instead of error 601.
IMAP:
- LOGIN and AUTHENTICATE with a wrong, expired or unknown app password or API key are answered with an untagged NO, so clients keep waiting for the command to complete until the connection times out.
- The failed login that exceeds the maximum number of authentication failures is answered with an untagged NO before the connection is closed.
DKIM:
- A rotation moves the active key to retiring even when its successor fails to publish or propagate, so outgoing mail is sent unsigned until a retry publishes the new key. The DNS write failure is also not logged and the task reports success.
- Keys created while DNS management was manual, or before DKIM was added to the published records, are never rotated after DNS management becomes automatic. Domains already affected start rotating once a DkimManagement task is created for them.
- After switching DNS management from automatic to manual, a due rotation activates a new key that was never published in DNS, so signatures fail verification, and retiring the old key is retried forever.
Spam filter:
- Messages with no text line long enough for a Pyzor digest are checked with the digest of empty input and tagged PYZOR.
- DNSBL answers with several return codes, such as a Spamhaus ZEN listing in both SBL and PBL, are scored for only the first code returned.
- DNSBL lookups that return "not listed" are cached for 24 hours regardless of the zone's negative TTL.
- Removing a duplicate training sample of a message reclassified on the same day clears the blob link of the sample that is kept.
MTA: Queue quotas with an empty match expression are never enforced, including the global queue quota created on first start.
RocksDB: The info log (LOG, LOG.old.*) grows without limit because log rotation and retention are left at RocksDB defaults.
WebUI: A blob store read error at startup, such as an S3 authentication failure, stops the web interface from being downloaded.

Check binary attestation here

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/stalwartlabs/stalwart](https://github.com/stalwartlabs/stalwart) | app-version | patch | `v0.16.24` → `v0.16.25` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/4) for more information. --- ### Release Notes <details> <summary>stalwartlabs/stalwart (docker.io/stalwartlabs/stalwart)</summary> ### [`v0.16.25`](https://github.com/stalwartlabs/stalwart/releases/tag/v0.16.25) [Compare Source](https://github.com/stalwartlabs/stalwart/compare/v0.16.24...v0.16.25) #### \[0.16.25] - 2026-10-05 If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions. #### Added #### Changed #### Fixed - JMAP: Creating a `MaskedEmail` with `emailDomain` fails with `forbidden` for every domain when the account has addresses on more than one domain. - Autodiscover: Requests for a response schema other than Outlook's, such as ActiveSync (`mobilesync`), are answered with the Outlook settings instead of error 601. - IMAP: - `LOGIN` and `AUTHENTICATE` with a wrong, expired or unknown app password or API key are answered with an untagged `NO`, so clients keep waiting for the command to complete until the connection times out. - The failed login that exceeds the maximum number of authentication failures is answered with an untagged `NO` before the connection is closed. - DKIM: - A rotation moves the active key to retiring even when its successor fails to publish or propagate, so outgoing mail is sent unsigned until a retry publishes the new key. The DNS write failure is also not logged and the task reports success. - Keys created while DNS management was manual, or before DKIM was added to the published records, are never rotated after DNS management becomes automatic. Domains already affected start rotating once a `DkimManagement` task is created for them. - After switching DNS management from automatic to manual, a due rotation activates a new key that was never published in DNS, so signatures fail verification, and retiring the old key is retried forever. - Spam filter: - Messages with no text line long enough for a Pyzor digest are checked with the digest of empty input and tagged `PYZOR`. - DNSBL answers with several return codes, such as a Spamhaus ZEN listing in both SBL and PBL, are scored for only the first code returned. - DNSBL lookups that return "not listed" are cached for 24 hours regardless of the zone's negative TTL. - Removing a duplicate training sample of a message reclassified on the same day clears the blob link of the sample that is kept. - MTA: Queue quotas with an empty `match` expression are never enforced, including the global queue quota created on first start. - RocksDB: The info log (`LOG`, `LOG.old.*`) grows without limit because log rotation and retention are left at RocksDB defaults. - WebUI: A blob store read error at startup, such as an S3 authentication failure, stops the web interface from being downloaded. <hr /> ##### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/52732142) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

jlab-renovate-bot added the renovate label 2026-10-08 09:35:17 +02:00

jlab-renovate-bot added 1 commit 2026-10-08 09:35:17 +02:00

Update docker.io/stalwartlabs/stalwart Docker tag to v0.16.25

renovate/stability-days Updates have met minimum release age requirement

Details

Validate Helm Charts / Detect changed charts (pull_request) Successful in 3s

Details

Validate Helm Charts / Resource quantities (pull_request) Successful in 12s

Details

Validate Helm Charts / Selector match (pull_request) Successful in 9s

Details

Validate Helm Charts / Build stalwart (pull_request) Successful in 5s