Update docker.io/stalwartlabs/stalwart Docker tag to v0.16.21

[Baconing]

This PR contains the following updates:

Package	Update	Change
docker.io/stalwartlabs/stalwart	patch	v0.16.20 → v0.16.21

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

stalwartlabs/stalwart (docker.io/stalwartlabs/stalwart)

v0.16.21

Compare Source

[0.16.21] - 2026-09-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

• Sieve: Messages generated by user scripts are DKIM signed through the new SieveUserInterpreter.dkimSignDomain setting, which defaults to the account's own domain.

Fixed

• JMAP:
  • CalendarEvent/set requests that ask for scheduling messages are rejected with a forbidden error when the account cannot send them.
  • Calendar/get and AddressBook/get return every property when the properties argument is omitted or null.
  • EventSource ping events advertise the interval in seconds rather than milliseconds.
  • Calendar synthetic ids returned when expanding recurrences identify an occurrence by its recurrence id.
• IMAP: Every command in a pipelined STATUS or FETCH batch receives its tagged completion, instead of the first failing command dropping the responses for all commands queued behind it.
• WebDAV: Accounts without a storage quota no longer advertise a 4 GiB limit in DAV:quota-available-bytes.
• MTA: Inbound DMARC and TLS aggregate reports that a reporter sends more than once are imported again as a duplicate entry.
• Spam filter: Domain and URL blocklists are queried only for text written as a link.
• iTIP: Detaching an occurrence that the recurrence rule already generates is sent as a METHOD:REQUEST carrying the RECURRENCE-ID instead of a METHOD:ADD.
• Sieve: fileinto :specialuse and specialuse_exists accept special-use attributes in the \Trash form.
• LDAP: Active Directory servers that answer an unauthenticated bind (a non-empty DN with a zero-length password) with success no longer authenticate accounts without a password.
• Network: Listeners bound to the unspecified IPv6 address ([::]) fall back to IPv4 when socket creation fails with EPROTONOSUPPORT.
• OpenTelemetry: log exporter does not include the parent span's attributes.

---

Check binary attestation here

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.