Update stalwartlabs/stalwart Docker tag to v1.0.3 #82

Merged

mathieu merged 2 commits from renovate/stalwartlabs-stalwart-1.x into main

2026-11-04 23:58:33 +00:00

Renovate_Bot commented

2026-11-04 23:00:40 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
stalwartlabs/stalwart	patch	`v1.0.2` → `v1.0.3`

Release Notes

stalwartlabs/stalwart (stalwartlabs/stalwart)

`v1.0.3`

Compare Source

[1.0.3] - 2026-11-04

Third-party apps (not the WebUI) need the new Stalwart OAuth scopes. Apps signing in through Stalwart or an external OpenID Connect provider could not manage app passwords, API keys or account settings. This access is now granted by the scopes urn:stalwart:oauth:scope:security, urn:stalwart:oauth:scope:settings and urn:stalwart:oauth:scope:full:

Apps registered in Stalwart: add the scopes the app needs to its OAuthClient scopes (only a superuser can allow full), and have the app request them.
Apps signing in through an external OpenID Connect provider: create the scopes in the provider and assign them to the apps that need them.
WebUI: no action needed.

Add the new permissions to the default roles (not a breaking change). This release adds new permissions, and default roles are created only on the first start of a new installation, so on an upgraded server they are missing and the features they control stay unavailable. Restart the server once with the environment variable STALWART_UPDATE_ROLE_PERMISSIONS=true to add them, then remove the variable. See Default roles on upgraded servers for details.

Added

Blob storage:
- Blob encryption at rest. Blobs can be encrypted by the server with symmetric keys (AES-256-GCM or ChaCha20-Poly1305) defined as SymmetricKey objects.
- Zstandard compression for blobs (zstd in compressionAlgorithm).
- BlobRecode task, which rewrites stored blobs with a chosen compression and encryption.
STALWART_UPDATE_ROLE_PERMISSIONS environment variable. When set to true (or 1), startup adds to each default role every permission introduced after v1.0.0 that a new install would give that role and that the role is missing.
OAuth: Stalwart scopes urn:stalwart:oauth:scope:security, urn:stalwart:oauth:scope:settings and urn:stalwart:oauth:scope:full, so clients signing in through Stalwart or an external OpenID Connect provider can manage app passwords, API keys and account settings.

Fixed

JMAP:
- /copy methods called with the same accountId and fromAccountId return a clear error message.
- PushSubscription objects created with an empty types list no longer receive StateChange notifications, and EmailPush notifications are delivered regardless of types.
IMAP SEARCH accepts up to 32 levels of nested filters, so free-text searches from Apple Mail no longer fail with Too many nested filters.
OIDC: Bearer tokens are routed to the OpenID Connect directory whose issuer matches before the domain in their claims is tried, so a claim naming a domain the server does not host no longer sends the token to the default directory.
Security: Editing a default role, or a role nested in one, now invalidates the cached access tokens of accounts and groups that use the default role sets.

Check binary attestation here

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [stalwartlabs/stalwart](https://github.com/stalwartlabs/stalwart) | patch | `v1.0.2` → `v1.0.3` | --- ### Release Notes <details> <summary>stalwartlabs/stalwart (stalwartlabs/stalwart)</summary> ### [`v1.0.3`](https://github.com/stalwartlabs/stalwart/releases/tag/v1.0.3) [Compare Source](https://github.com/stalwartlabs/stalwart/compare/v1.0.2...v1.0.3) #### \[1.0.3] - 2026-11-04 **Third-party apps (not the WebUI) need the new Stalwart OAuth scopes.** Apps signing in through Stalwart or an external OpenID Connect provider could not manage app passwords, API keys or account settings. This access is now granted by the scopes `urn:stalwart:oauth:scope:security`, `urn:stalwart:oauth:scope:settings` and `urn:stalwart:oauth:scope:full`: - Apps registered in Stalwart: add the scopes the app needs to its OAuthClient `scopes` (only a superuser can allow `full`), and have the app request them. - Apps signing in through an external OpenID Connect provider: create the scopes in the provider and assign them to the apps that need them. - WebUI: no action needed. **Add the new permissions to the default roles (not a breaking change).** This release adds new permissions, and default roles are created only on the first start of a new installation, so on an upgraded server they are missing and the features they control stay unavailable. Restart the server once with the environment variable `STALWART_UPDATE_ROLE_PERMISSIONS=true` to add them, then remove the variable. See [Default roles on upgraded servers](https://stalw.art/docs/auth/authorization/permissions#default-roles-on-upgraded-servers) for details. #### Added - Blob storage: - Blob encryption at rest. Blobs can be encrypted by the server with symmetric keys (AES-256-GCM or ChaCha20-Poly1305) defined as `SymmetricKey` objects. - Zstandard compression for blobs (`zstd` in `compressionAlgorithm`). - `BlobRecode` task, which rewrites stored blobs with a chosen compression and encryption. - `STALWART_UPDATE_ROLE_PERMISSIONS` environment variable. When set to `true` (or `1`), startup adds to each default role every permission introduced after v1.0.0 that a new install would give that role and that the role is missing. - OAuth: Stalwart scopes `urn:stalwart:oauth:scope:security`, `urn:stalwart:oauth:scope:settings` and `urn:stalwart:oauth:scope:full`, so clients signing in through Stalwart or an external OpenID Connect provider can manage app passwords, API keys and account settings. #### Fixed - JMAP: - `/copy` methods called with the same `accountId` and `fromAccountId` return a clear error message. - `PushSubscription` objects created with an empty `types` list no longer receive `StateChange` notifications, and `EmailPush` notifications are delivered regardless of `types`. - IMAP `SEARCH` accepts up to 32 levels of nested filters, so free-text searches from Apple Mail no longer fail with `Too many nested filters`. - OIDC: Bearer tokens are routed to the OpenID Connect directory whose issuer matches before the domain in their claims is tried, so a claim naming a domain the server does not host no longer sends the token to the default directory. - Security: Editing a default role, or a role nested in one, now invalidates the cached access tokens of accounts and groups that use the default role sets. <hr /> ##### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/63532224) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Renovate_Bot added 1 commit

2026-11-04 23:00:40 +00:00

Update stalwartlabs/stalwart Docker tag to v1.0.3 493cbef537

mathieu added 1 commit

2026-11-04 23:58:07 +00:00