Update ghcr.io/stalwartlabs/stalwart Docker tag to v0.16.11

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/stalwartlabs/stalwart	patch	v0.16.8-alpine → v0.16.11-alpine

---

Release Notes

stalwartlabs/stalwart (ghcr.io/stalwartlabs/stalwart)

v0.16.11

Compare Source

[0.16.11] - 2026-06-25

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Encryption-at-rest: Support for AES-256-GCM and ChaCha20-Poly1305 for S/MIME (#​161).
• S3: Support for allowInvalidCerts option to allow connecting to S3 endpoints with invalid TLS certificates.
• Redis Sentinel support as an in-memory store and cluster coordinator backend (#​2430).

Changed

Fixed

• DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
• TLS: Update search index when file-backed certificates are refreshed.
• JMAP: Principal/query returns broad results when a name or email filter cannot be resolved.
• Webhooks: event IDs collide for same event type emitted in the same second.

---

Check binary attestation here

v0.16.10

Compare Source

[0.16.10] - 2026-06-21

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• International Domain Names (IDN) support (#​207).
• OAuth:
  • OAuth Profile for Open Public Clients (draft-ietf-mailmaint-oauth-public)
  • Client secret verification for confidential clients.
• HTTP: Add redirectRoot option to Http object to allow redirecting requests to the root path to a different path (e.g. /account).
• ACME: reuseKey option to allow reusing private keys in renewals.
• IMAP:
  • IMAP Extension for Object Identifiers (draft-ietf-mailmaint-imap-objectid-bis)
  • GETJMAPACCESS command to discover the JMAP session resource URL (#​2736).

Changed

Fixed

• JMAP conformance (pass the jmap-test-suite tests):
  • Methods are only available if their capability is in using.
  • Reject requests that do not specify application/json in the Content-Type header.
  • Require accountId argument on requests.
  • Return unparsable ids in notFound / notUpdated / notDestroyed / notCopied instead of dropping them.
  • Default calendars and address books are not subscribed by default.
  • */set: Unchanged immutable id property is rejected on update.
  • */query and */queryChanges: nullrejected asnotRequest`.
  • Email/query:
    • Improper anchor handling.
    • Total miscount when collapseThreads is enabled.
    • Wrong sort order on hasKeyword, allInThreadHaveKeyword, and someInThreadHaveKeyword conditions.
    • Non-standard header values are not searchable.
  • Email/copy: Take the source message id from the value's id property.
  • Email/set: Bump reference-resolution max_depth from 1 to 2.
  • Email/import: Reject blobs that do not contain valid messages.
  • EmailSubmission/set: return sendAt and undoStatus in the created response.
  • Mailbox/set: Return alreadyExists instead of invalidProperties when creating a mailbox with an existing name.
  • SearchSnippet/get: incorrect response structure.
  • Thread/changes: emit a container delete when a thread becomes empty.
  • VacationResponse/set: incorrect singleton handling.
• IMAP: Discard oversized non-synchronizing literals (#​2768).
• DANE: Improper TLSA record validation (#​2328 - credits to @​vdukhovni).
• OIDC: Add default domain name to groups that are not email addresses.
• RocksDB: Enable blob garbage collection to reclaim disk space from deleted blobs.
• Sieve: include statements ignore capitalisation of sub-script names (#​1643)
• Cache: Invalidate negative email caches when an account is created.
• Troubleshoot tool: Use the configured source IP address when connecting to remote servers (#​2867).

---

Check binary attestation here

v0.16.9

Compare Source

[0.16.9] - 2026-06-15

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• ACME: Allow specifying a preferred certificate chain.

Changed

Fixed

• JMAP: */changes methods leak ids of non-shared objects (reported by @​5ud0er).
• Sieve: Do not allow invalid certs in http_header function.
• FoundationDB: Fix read version cache expiration logic.
• MTA: Re-scheduling or editing a queued message reports success but persists nothing for recipients in a non-default virtual queue.
• CardDAV: Version requests included in address-data are ignored.
• ACME: Add freshness check when renewing certificates.
• Autodiscover v2: Read email address from query parameters.
• Sieve: Do not keep copies of redirected messages when keep is not specified.
• Registry: Object ids are parsed as numbers.

---

Check binary attestation here

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.