Update stalwartlabs/stalwart Docker tag to v1.0.1 #72

Merged

mathieu merged 1 commit from renovate/stalwartlabs-stalwart-1.x into main

2026-10-28 23:07:26 +00:00

Renovate_Bot commented

2026-10-28 23:00:33 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
stalwartlabs/stalwart	patch	`v1.0.0` → `v1.0.1`

Release Notes

stalwartlabs/stalwart (stalwartlabs/stalwart)

`v1.0.1`

Compare Source

[1.0.1] - 2026-10-28

Added

Telemetry
- New OpenTelemetry (OTLP over HTTP and gRPC) and Prometheus exporters replace the opentelemetry and prometheus crates, with 4x to 14x faster encoding.
- Metric names follow the OpenTelemetry and Prometheus conventions (stalwart.* in OTLP, stalwart_* with unit and _total suffixes in Prometheus); dashboards and alerts must be updated.
- OpenMetrics output, plus serviceName, serviceNamespace and resourceAttributes settings replacing the OTEL_* environment variables.
- gRPC exporters support TLS options, authentication and custom headers; histogram buckets and counters are fixed (cumulative, inclusive, 64-bit).

Changed

Encryption at rest: JMAP messages stored with the $draft keyword are no longer encrypted on append, so they are submitted as written by the client. The Sent copy of messages submitted over JMAP is stored unencrypted.
OAuth: The consent screen is shown after sign-in and is skipped while the client is listed under the account's connected applications with the requested scopes. prompt=consent always shows it. All cluster nodes must be upgraded before relying on the new sign-in flow.
Registry: Listing connected applications, public keys, masked addresses and archived items returns only the requested account's objects, also for administrators. Administrators reach other accounts through the account id or an explicit accountId filter.

Fixed

ACME: DNS-01 challenges for a subdomain are written to the registrable domain's zone instead of the domain's own zone when no zone origin is configured.
iTIP
- Invitation emails for all-day events show the start as 00:00 with a time zone instead of the date only.
- Attendee replies are rejected when the client drops or changes the organizer's PRIORITY, for example when accepting an invitation from BusyCal.
JMAP
- Mailbox/set returns only the id of created mailboxes instead of also the server-set and defaulted properties (RFC 8620, section 5.3).
- AddressBook/set, ContactCard/set and Identity/set return only the id of created objects, and Calendar/set and CalendarEvent/set omit some defaulted properties (RFC 8620, section 5.3).
Registry
- config.json is created with the process umask (usually 0644), so the data store credentials are readable by other local users.
- Listing archived items with an accountId filter fails with unsupportedFilter for users without the impersonate permission instead of ignoring the filter like the other account-owned objects.
RocksDB:
- Updated to 11.8.1 with the upstream fix for spurious compare-and-swap failures in the write group leader (facebook/rocksdb#15415).
- aarch64 release builds crash with SIGSEGV under concurrent writes (C and C++ dependencies are now compiled with outline atomics).
Spam filter: FORGED_RCVD_TRAIL is added for every Received header whose reverse DNS name ends with a dot, such as those written by Gmail.
WebUI
- Saving objects that use schema defaults fails with "Invalid value for object property", for example when enabling the AI classifier.
- Object pickers on tenant-scoped objects (for example the ACME provider of a tenant domain) list objects from other tenants, and saving one fails with a generic "references another item that does not exist" error instead of saying the object belongs to another tenant.
Multi-tenancy: Tenant administrators given the impersonate permission can reach accounts of other tenants. The permission is now never granted to tenant members and cannot be added to a tenant's permissions.
Installer: The systemd unit written by install.sh uses Type=simple instead of Type=notify.

Check binary attestation here

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [stalwartlabs/stalwart](https://github.com/stalwartlabs/stalwart) | patch | `v1.0.0` → `v1.0.1` | --- ### Release Notes <details> <summary>stalwartlabs/stalwart (stalwartlabs/stalwart)</summary> ### [`v1.0.1`](https://github.com/stalwartlabs/stalwart/releases/tag/v1.0.1) [Compare Source](https://github.com/stalwartlabs/stalwart/compare/v1.0.0...v1.0.1) #### \[1.0.1] - 2026-10-28 #### Added - Telemetry - New OpenTelemetry (OTLP over HTTP and gRPC) and Prometheus exporters replace the `opentelemetry` and `prometheus` crates, with 4x to 14x faster encoding. - Metric names follow the OpenTelemetry and Prometheus conventions (`stalwart.*` in OTLP, `stalwart_*` with unit and `_total` suffixes in Prometheus); dashboards and alerts must be updated. - OpenMetrics output, plus `serviceName`, `serviceNamespace` and `resourceAttributes` settings replacing the `OTEL_*` environment variables. - gRPC exporters support TLS options, authentication and custom headers; histogram buckets and counters are fixed (cumulative, inclusive, 64-bit). #### Changed - Encryption at rest: JMAP messages stored with the `$draft` keyword are no longer encrypted on append, so they are submitted as written by the client. The Sent copy of messages submitted over JMAP is stored unencrypted. - OAuth: The consent screen is shown after sign-in and is skipped while the client is listed under the account's connected applications with the requested scopes. `prompt=consent` always shows it. All cluster nodes must be upgraded before relying on the new sign-in flow. - Registry: Listing connected applications, public keys, masked addresses and archived items returns only the requested account's objects, also for administrators. Administrators reach other accounts through the account id or an explicit `accountId` filter. #### Fixed - ACME: DNS-01 challenges for a subdomain are written to the registrable domain's zone instead of the domain's own zone when no zone origin is configured. - iTIP - Invitation emails for all-day events show the start as `00:00` with a time zone instead of the date only. - Attendee replies are rejected when the client drops or changes the organizer's `PRIORITY`, for example when accepting an invitation from BusyCal. - JMAP - `Mailbox/set` returns only the id of created mailboxes instead of also the server-set and defaulted properties (RFC 8620, section 5.3). - `AddressBook/set`, `ContactCard/set` and `Identity/set` return only the id of created objects, and `Calendar/set` and `CalendarEvent/set` omit some defaulted properties (RFC 8620, section 5.3). - Registry - `config.json` is created with the process umask (usually `0644`), so the data store credentials are readable by other local users. - Listing archived items with an `accountId` filter fails with `unsupportedFilter` for users without the `impersonate` permission instead of ignoring the filter like the other account-owned objects. - RocksDB: - Updated to 11.8.1 with the upstream fix for spurious compare-and-swap failures in the write group leader ([facebook/rocksdb#15415](https://github.com/facebook/rocksdb/pull/15415)). - `aarch64` release builds crash with `SIGSEGV` under concurrent writes (C and C++ dependencies are now compiled with outline atomics). - Spam filter: `FORGED_RCVD_TRAIL` is added for every `Received` header whose reverse DNS name ends with a dot, such as those written by Gmail. - WebUI - Saving objects that use schema defaults fails with "Invalid value for object property", for example when enabling the AI classifier. - Object pickers on tenant-scoped objects (for example the ACME provider of a tenant domain) list objects from other tenants, and saving one fails with a generic "references another item that does not exist" error instead of saying the object belongs to another tenant. - Multi-tenancy: Tenant administrators given the `impersonate` permission can reach accounts of other tenants. The permission is now never granted to tenant members and cannot be added to a tenant's permissions. - Installer: The systemd unit written by `install.sh` uses `Type=simple` instead of `Type=notify`. <hr /> ##### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/60989992) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Renovate_Bot added 1 commit

2026-10-28 23:00:33 +00:00

Update stalwartlabs/stalwart Docker tag to v1.0.1 a232238424