Default Stalwart image: v0.16.22 → v0.16.27, the last 0.16 release and the one ihasmail now tests against (coffey-labs/ihasmail#65).
--local deploy against 0.16.27: set up Stalwart, created a mailbox, signed in to ihasmail 2026.10.27.
Public-mode end-to-end test passed, 20/20 checks (e2e job on a GitHub runner, run by hand on this branch): certificates on 993/465/443 from Pebble, alice signs in through the webmail, autoconfig, the auto-ban hits the scanner and not Caddy, ihasmail exempt.
README: a Support section. 0.16.27 is supported and the default. Other 0.16 releases are untested. 1.0 isn't supported, because its first-run setup changed. Troubleshooting's known limits say the same.
README and CONTRIBUTING said the end-to-end test runs every Monday. Since the move to Gitea it has been a job run by hand on a GitHub runner, so they say that now.
Go 1.26.10 for GO-2026-6809 (crypto/x509). The first CI run on this branch failed govulncheck on 1.26.9. go.mod and the Gitea CI image now match stalwart-migrator's #22. The current release binary is built with 1.26.9, so a release after merging picks up the fix too.
Ran locally: go vet ./..., go test ./..., govulncheck with Go 1.26.10 (no vulnerabilities).
- **Default Stalwart image: v0.16.22 → v0.16.27**, the last 0.16 release and the one ihasmail now tests against (coffey-labs/ihasmail#65).
- `--local` deploy against 0.16.27: set up Stalwart, created a mailbox, signed in to ihasmail 2026.10.27.
- **Public-mode end-to-end test passed, 20/20 checks** (`e2e` job on a GitHub runner, run by hand on this branch): certificates on 993/465/443 from Pebble, alice signs in through the webmail, autoconfig, the auto-ban hits the scanner and not Caddy, ihasmail exempt.
- **README: a Support section.** 0.16.27 is supported and the default. Other 0.16 releases are untested. 1.0 isn't supported, because its first-run setup changed. Troubleshooting's known limits say the same.
- **README and CONTRIBUTING** said the end-to-end test runs every Monday. Since the move to Gitea it has been a job run by hand on a GitHub runner, so they say that now.
- **Go 1.26.10 for GO-2026-6809** (crypto/x509). The first CI run on this branch failed govulncheck on 1.26.9. go.mod and the Gitea CI image now match stalwart-migrator's #22. The current release binary is built with 1.26.9, so a release after merging picks up the fix too.
Ran locally: `go vet ./...`, `go test ./...`, `govulncheck` with Go 1.26.10 (no vulnerabilities).
The default Stalwart image moves from v0.16.22 to v0.16.27, the last 0.16
release and the one ihasmail now tests against. A loopback deploy
(--local) against it set up Stalwart, created a mailbox and signed in to
ihasmail 2026.10.27.
The README gets a Support section: 0.16.27 supported and the default, other
0.16 releases untested, 1.0 not supported because its first-run setup
changed. Troubleshooting's known limits say the same.
The README and CONTRIBUTING said the end-to-end test runs every Monday. It
has been a job run by hand on a GitHub runner since the move to Gitea.
govulncheck on GitHub's runner (GOTOOLCHAIN=local, Go from go.mod) reports
GO-2026-6809 in crypto/x509 on 1.26.9, reachable from main. go.mod moves to
1.26.10 and the Gitea CI image to the 1.26-bookworm digest that ships it, the
same bump stalwart-migrator made in its #22.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
--localdeploy against 0.16.27: set up Stalwart, created a mailbox, signed in to ihasmail 2026.10.27.e2ejob on a GitHub runner, run by hand on this branch): certificates on 993/465/443 from Pebble, alice signs in through the webmail, autoconfig, the auto-ban hits the scanner and not Caddy, ihasmail exempt.Ran locally:
go vet ./...,go test ./...,govulncheckwith Go 1.26.10 (no vulnerabilities).