Commit Graph
1699 Commits
Author SHA1 Message Date
Maurus Decimus c5541d6b32 Fix Calendar: iMIP and alarm notification messages embed the default logo using bare LF line endings, producing a single 4247 octet line that strict SMTP relays reject with line too long 2026-08-02 12:33:35 +02:00
Maurus Decimus cf050ae5b0 S3: accessKey can now be read from an environment variable or file 2026-08-02 12:11:56 +02:00
Maurus Decimus efee3ec15b MTA: Allow System Sieve scripts to access orcpt during the DATA stage 2026-08-02 11:44:11 +02:00
Maurus Decimus 97d176300c Fix Brading: Stalwart logo flashes before the per-tenant logo is loaded on the login page 2026-07-31 17:59:27 +02:00
Maurus Decimus c86bb66044 Fix Meilisearch: Verify index existence using GET instead of creating a new task which times out on busy servers 2026-07-31 10:04:43 +02:00
Maurus Decimus 45323d2a16 Merge branch 'main' of github.com:stalwartlabs/stalwart 2026-07-29 18:41:43 +02:00
Maurus Decimus 092c3217e4 JMAP Email Delivery Push Notifications 2026-07-29 18:41:21 +02:00
dependabot[bot] 13903877eb Bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#3231)
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 16:38:03 +02:00
dependabot[bot] c101ab523b Bump actions/cache from 5.0.5 to 6.1.0 (#3232)
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v5.0.5...v6.1.0)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 16:37:55 +02:00
dependabot[bot] cf47b29351 Bump reproducible-containers/buildkit-cache-dance from 3.3.2 to 3.4.0 (#3233)
Bumps [reproducible-containers/buildkit-cache-dance](https://github.com/reproducible-containers/buildkit-cache-dance) from 3.3.2 to 3.4.0.
- [Release notes](https://github.com/reproducible-containers/buildkit-cache-dance/releases)
- [Commits](https://github.com/reproducible-containers/buildkit-cache-dance/compare/v3.3.2...v3.4.0)

---
updated-dependencies:
- dependency-name: reproducible-containers/buildkit-cache-dance
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 16:37:45 +02:00
dependabot[bot] bb7dd12263 Bump mozilla-actions/sccache-action from 0.0.9 to 0.0.10 (#3234)
Bumps [mozilla-actions/sccache-action](https://github.com/mozilla-actions/sccache-action) from 0.0.9 to 0.0.10.
- [Release notes](https://github.com/mozilla-actions/sccache-action/releases)
- [Commits](https://github.com/mozilla-actions/sccache-action/compare/v0.0.9...v0.0.10)

---
updated-dependencies:
- dependency-name: mozilla-actions/sccache-action
  dependency-version: 0.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 16:37:36 +02:00
dependabot[bot] c3b61d9829 Bump actions/upload-artifact from 6.0.0 to 7.0.1 (#3235)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7.0.1)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 16:37:26 +02:00
Maurus Decimus 9395211203 Fix FreeBDS CI v0.16.15 2026-07-27 06:47:41 +02:00
Maurus Decimus c61a6a7955 v0.16.15 2026-07-26 18:59:40 +02:00
Maurus Decimus 94cc6b0ad0 Fix Enterprise: Per-tenant logo is not shown on the OAuth login password and OTP screens, which are served from the servers canonical host rather than the tenant domain 2026-07-26 17:17:17 +02:00
Maurus Decimus c8f46f3276 Fix Migration: Abort --import when the target already contains data in the key range being imported 2026-07-26 16:56:21 +02:00
Maurus Decimus 731f8db6b7 Fix Cluster: Broadcast subscriber re-subscribes after every message, losing bursts of cluster broadcasts during the reconnect window 2026-07-26 16:48:33 +02:00
Maurus Decimus 896fc975fe Fix JMAP: Requests are rejected with notRequest when a method name contains a JSON-escaped solidus (e.g. Core\/echo) 2026-07-26 16:31:56 +02:00
Maurus Decimus 052a120463 Fix Search: reindex drops calendar and contact index tasks for accounts with fewer than a full batch of items 2026-07-26 16:29:05 +02:00
Maurus Decimus f3446dd7b4 Fix JMAP: Email/copy with onSuccessDestroyOriginal destroys the copys creation id instead of the source Email id 2026-07-26 16:26:43 +02:00
Maurus Decimus 2114e45eb4 Fix JMAP: CalendarEvent/set does not refresh the updated property (iCalendar DTSTAMP) on create or update 2026-07-26 16:22:51 +02:00
Maurus Decimus ce944c435c Fix Registry: Id references (e.g. #certificate-...) fail to resolve on defaultCertificateId, defaultAdminRoleIds, listenerIds and publicKey 2026-07-26 16:19:34 +02:00
Maurus Decimus 462390be89 Fix MTA: Panic when MTA-STS is disabled and a remote MTA fetched /.well-known/mta-sts.txt 2026-07-26 16:14:31 +02:00
Maurus Decimus 14feec6950 Fix Web Push: Valid VAPID keys are rejected when PEM-encoded with explicit EC parameters, in SEC1 (EC PRIVATE KEY) format, or with a leading byte-order mark 2026-07-26 12:39:48 +02:00
Maurus Decimus 1dad75393e Fix JMAP EmailSubmission/set rejects valid recipients whose domain is itself a public suffix (e.g. gov.in, co.uk) 2026-07-26 12:18:03 +02:00
Maurus Decimus 57b913d54e Fix Cache: Account caches silently discard entries larger than a single quick-cache shard, causing constant database rebuilds 2026-07-26 12:09:27 +02:00
Maurus Decimus ed54b37242 Fix Encryption at rest: Appended messages are encrypted for accounts that did not opt in to encryptOnAppend 2026-07-26 12:01:00 +02:00
Maurus Decimus 5205717d72 Fix JMAP CalendarEvent/set does not generate a uid on create when the client omits it 2026-07-26 11:35:48 +02:00
Maurus Decimus 4951d215fc Fix JMAP Email/copy should return alreadyExists when copying a message to a mailbox that already contains it 2026-07-26 11:30:20 +02:00
Robin Venables fed50e684c feat: Start 'stalwart' at boot time, not user login on macOS (#2704) 2026-07-24 10:17:44 +02:00
Maurus Decimus aa9f47cdb6 Fix Auth: Scoped credentials with SysApiKeyCreate or SysApiKeyUpdate permissions can regain its own accounts full rights 2026-07-23 15:49:30 +02:00
dependabot[bot] c10a170c7b Bump reproducible-containers/buildkit-cache-dance from 3.3.0 to 3.3.2 (#2878)
Bumps [reproducible-containers/buildkit-cache-dance](https://github.com/reproducible-containers/buildkit-cache-dance) from 3.3.0 to 3.3.2.
- [Release notes](https://github.com/reproducible-containers/buildkit-cache-dance/releases)
- [Commits](https://github.com/reproducible-containers/buildkit-cache-dance/compare/v3.3.0...v3.3.2)

---
updated-dependencies:
- dependency-name: reproducible-containers/buildkit-cache-dance
  dependency-version: 3.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 14:49:02 +02:00
dependabot[bot] 72cccc951f Bump actions/download-artifact from 7 to 8 (#2876)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 14:48:31 +02:00
dependabot[bot] 65e26d4580 Bump actions/attest-build-provenance from 3 to 4 (#2875)
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 3 to 4.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 14:48:23 +02:00
Maurus Decimus 425d034ae7 Use of Voluntary Application Server Identification (VAPID) in JMAP Web Push v0.16.14 2026-07-20 13:55:00 +02:00
Maurus Decimus 2553d8ee4c Fix Telemetry: Tasks are serialized to the wrong store when using separate stores for telemetry and data 2026-07-20 11:35:46 +02:00
Maurus Decimus 3cc348726b Fix MTA: queue_name variable not available in rate limiter expressions 2026-07-19 23:09:31 +02:00
Maurus Decimus 2d08933fbc Fix Calendar: No expanded occurrences are returned for a daily recurrences crossing DST 2026-07-19 22:59:03 +02:00
Maurus Decimus 152db36247 Fix HTTP: Disable allowedEndpoints expression in recovery mode 2026-07-19 22:09:17 +02:00
Maurus Decimus acd45e1f9e Fix JMAP: Stale push subscription can block verification of a new one 2026-07-19 21:50:37 +02:00
Maurus Decimus c105cff8fb Fix CalDAV: calendar-query REPORT returns empty calendar-data for JMAP-created events 2026-07-19 21:27:01 +02:00
Maurus Decimus 2bce0d22fd Fix JMAP: PushSubscription/set rejects the unpadded base64url keys the W3C Push API produces 2026-07-19 21:00:45 +02:00
Maurus Decimus 2c04d4473c Fix IMAP: Pipelined STORE and EXPUNGE can execute out of order 2026-07-19 16:02:20 +02:00
Maurus Decimus f967132971 Fix MTA: DMARC is skipped when MAIL FROM SPF is unavailable 2026-07-19 15:44:06 +02:00
Maurus Decimus 3de53f9c31 Fix JMAP: CalendarEvent/set silently ignores ifInState 2026-07-19 15:29:55 +02:00
Maurus Decimus 2d4d3a55be Fix JMAP: Email/import does not send push notifications for imported messages 2026-07-19 15:22:54 +02:00
Maurus Decimus eacec4c45d Fix JMAP: Web Push payloads with Content-Encoding: aes128gcm should not be base64-encoded but sent as raw bytes 2026-07-19 15:17:40 +02:00
Maurus Decimus 6076659e4d Fix Calendar: Scheduling invitations on a shared, non-owned calendar fail with MAIL FROM unauthorized 2026-07-19 12:19:50 +02:00
Maurus Decimus 18dbbda298 Fix Calendar: Uppercase MAILTO calendar addresses become invalid SMTP recipients 2026-07-19 10:29:07 +02:00
Maurus Decimus bd44943661 Fix JMAP: Read-only sharee cannot set isSubscribed on a shared mailbox 2026-07-19 07:54:33 +02:00