Merge upstream v0.16.27

jcoffey-dev commented

2026-10-18 21:22:31 +00:00

Owner

Brings in upstream v0.16.27 (released 2026-10-18) as a stripped snapshot
(ad1330f, branch import/upstream-v0.16.27; fast-forward upstream to it
after this lands). upstream-watch hadn't opened an issue for it yet. No
release is planned yet.

v0.16.27 is fixes only:

IMAP: APPEND and COPY/MOVE into another account's mailbox no longer
change the JMAP EmailDelivery state; SEARCH RETURN with MIN or MAX
alongside ALL returns only those, and SAVE with them saves only those.
iTIP: merging a received update brings the VTIMEZONE definitions it
uses, so an occurrence moved by an outside organizer no longer points
at a TZID the stored event doesn't define (Apple Calendar showed both
occurrences). itip_merge_changes takes the iTIP message for it.
OAuth: loopback redirect URIs without a path match registered loopback
URIs on any port, and dynamic registration accepts them.
WebDAV: PROPFIND allprop returns DAV:current-user-principal (Windows
Explorer).
The web interface it installs is pinned to webui v1.0.11, and a bundle
with a major version above 1 is refused: webui 2.x is for upstream's
next server line, not 0.16.
A new STALWART_INCLUDE_SECRETS switch (upstream calls it a temporary
migration aid) makes registry reads return secrets instead of ****.
Renamed here to INBUXA_INCLUDE_SECRETS, off unless set.
dns-update 0.5 → 0.6 and other dependency bumps.

Strip: clean; same Enterprise footprint as v0.16.26 (63 files, 118
snippets); no new third-party code; privacy catalog complete. Build
check: the expected rebuilt-feature test errors, plus upstream's own
iTIP test still calling itip_merge_changes with two arguments.

Merge:

crates/main: inbuxa's name and AGPL-only license, 0.16.27.
manager/defaults.rs: still installs no web interface (SPEC §5.3).
Upstream's pin constants come in, so an install upgraded from Stalwart
that still has its web application stays on 1.x bundles.
Cargo.lock: upstream's, re-resolved against inbuxa's manifests.
44bdf33: the iTIP test passes the iTIP message.
7348dc7: INBUXA_INCLUDE_SECRETS (and renames.py renames it on future
imports); the bundle error says the bundle is for a newer server; the
two upstream webui URLs allowlisted, with the reason.

Checked locally: every fork check (name, notice, context, privacy,
expr-schema, tool tests); cargo build -p inbuxa and cargo test --workspace --no-run; common's application tests (incl. upstream's new
bundle-version test); store, WebDAV, IMAP and JMAP suites (RocksDB).
The JMAP suite fails on main too since #201: its first domain check runs
5 minutes after start, inside the suite, and gives the test domain DKIM
keys the cleanup check then finds. Fixed separately in #203; with that
change the JMAP suite passes on this branch.

Brings in upstream v0.16.27 (released 2026-10-18) as a stripped snapshot (ad1330f, branch import/upstream-v0.16.27; fast-forward `upstream` to it after this lands). upstream-watch hadn't opened an issue for it yet. No release is planned yet. v0.16.27 is fixes only: - IMAP: APPEND and COPY/MOVE into another account's mailbox no longer change the JMAP EmailDelivery state; SEARCH RETURN with MIN or MAX alongside ALL returns only those, and SAVE with them saves only those. - iTIP: merging a received update brings the VTIMEZONE definitions it uses, so an occurrence moved by an outside organizer no longer points at a TZID the stored event doesn't define (Apple Calendar showed both occurrences). `itip_merge_changes` takes the iTIP message for it. - OAuth: loopback redirect URIs without a path match registered loopback URIs on any port, and dynamic registration accepts them. - WebDAV: PROPFIND allprop returns DAV:current-user-principal (Windows Explorer). - The web interface it installs is pinned to webui v1.0.11, and a bundle with a major version above 1 is refused: webui 2.x is for upstream's next server line, not 0.16. - A new `STALWART_INCLUDE_SECRETS` switch (upstream calls it a temporary migration aid) makes registry reads return secrets instead of `****`. Renamed here to `INBUXA_INCLUDE_SECRETS`, off unless set. - dns-update 0.5 → 0.6 and other dependency bumps. Strip: clean; same Enterprise footprint as v0.16.26 (63 files, 118 snippets); no new third-party code; privacy catalog complete. Build check: the expected rebuilt-feature test errors, plus upstream's own iTIP test still calling `itip_merge_changes` with two arguments. Merge: - crates/main: inbuxa's name and AGPL-only license, 0.16.27. - manager/defaults.rs: still installs no web interface (SPEC §5.3). Upstream's pin constants come in, so an install upgraded from Stalwart that still has its web application stays on 1.x bundles. - Cargo.lock: upstream's, re-resolved against inbuxa's manifests. - 44bdf33: the iTIP test passes the iTIP message. - 7348dc7: INBUXA_INCLUDE_SECRETS (and renames.py renames it on future imports); the bundle error says the bundle is for a newer server; the two upstream webui URLs allowlisted, with the reason. Checked locally: every fork check (name, notice, context, privacy, expr-schema, tool tests); `cargo build -p inbuxa` and `cargo test --workspace --no-run`; common's application tests (incl. upstream's new bundle-version test); store, WebDAV, IMAP and JMAP suites (RocksDB). The JMAP suite fails on main too since #201: its first domain check runs 5 minutes after start, inside the suite, and gives the test domain DKIM keys the cleanup check then finds. Fixed separately in #203; with that change the JMAP suite passes on this branch.

jcoffey-dev added 4 commits 2026-10-18 21:22:31 +00:00

Import upstream v0.16.27, stripped ad1330fa66

Upstream commit: aa47d8ef7bfba7200d3293198ac2592747b20e73
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 118 in 50 files
Dangling module declarations removed: 5
Edits turning enterprise off: 25
Third-party code: 14 files, 0 not in THIRD-PARTY.md
Renamed identifiers: 67 in 19 files
Verification: clean

The same Enterprise footprint as v0.16.26. The build check reports the
expected errors in the rebuilt-feature tests and one more:
tests/src/webdav/cal_itip.rs still calls itip_merge_changes with two
arguments after upstream gave it a third (the iTIP message), fixed in
the merge into main. Fixes IMAP APPEND and COPY/MOVE into another
account's mailbox changing EmailDelivery state, SEARCH RETURN MIN/MAX
alongside ALL and SAVE, iTIP updates leaving events pointing at time
zones they no longer define, OAuth loopback redirect URIs without a
path, and WebDAV allprop leaving out current-user-principal.

Merge upstream v0.16.27 0511ea0b05

Pass the iTIP message to itip_merge_changes in the iTIP test 44bdf33bc4

Upstream v0.16.27 gave itip_merge_changes the received iTIP message as a
second argument, so a merged update can bring the VTIMEZONE definitions
it uses, but left the iTIP test calling it with two.

Keep the upstream name out of v0.16.27's new strings

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 17m6s

Details

7348dc7efb

INCLUDE_SECRETS reads INBUXA_INCLUDE_SECRETS, like every other setting,
and renames.py renames it on future imports. The web interface bundle
error says the bundle is for a newer server. Upstream's pinned and
latest web interface URLs are allowlisted: they only serve an install
upgraded from Stalwart that still has its web application.

jcoffey-dev merged commit 3bdb04894b into main

2026-10-18 21:39:46 +00:00

jcoffey-dev deleted branch merge/upstream-v0.16.27

2026-10-18 21:39:46 +00:00

jcoffey-dev referenced this pull request

2026-10-18 22:10:57 +00:00

Drop the Object import test builds warned about #207

Merge upstream v0.16.27 #204