chore(release): v0.2.17 #26

Merged

jlxq0 merged 1 commit from release/v0.2.17 into main

2026-08-29 12:15:45 +00:00

jlxq0 commented

2026-08-29 12:14:05 +00:00

Owner

Version bump so #25 can be tagged. It is the blocker on the acceptance chain.

What v0.2.17 carries

#25: a Stalwart app password authenticates over HTTP Basic, opt-in behind JMAP_MCP_ALLOW_STALWART_APP_PASSWORD and off by default. Bearer stays Logto-JWT-only.
AGENTS.md entries from 2026-08-27/28: Stalwart answers a request with no Authorization header with 200; an image can reach the registry without CI; what the audit log cannot answer.

No behaviour change for the deployed configuration until the flag is set, which is a platform change and Clark's queue.

Gates

Five on the pinned 1.93.0: fmt, clippy --all-targets --all-features -D warnings, test (177), audit, deny.

clippy is clean on 1.93.0 and red on 1.98.0 with unused_async_trait_impl, on this branch and on main alike. CI runs 1.93.0 (ci.yml:35), so that lint gates nothing here, and adding #[allow(clippy::unused_async_trait_impl)] would make the pinned build fail with error: unknown lint under -D unknown-lints. Measured; nothing added.

What this does not do

It does not close #24. owned_addresses still appends a global Arc<Vec<String>> to every authenticated caller, so julian@lindner.earth remains a sendable From for anyone who authenticates. That is the next PR and it has to land before any send tool is granted again.

Version bump so `#25` can be tagged. It is the blocker on the acceptance chain. ## What v0.2.17 carries - **#25**: a Stalwart app password authenticates over HTTP Basic, opt-in behind `JMAP_MCP_ALLOW_STALWART_APP_PASSWORD` and **off by default**. `Bearer` stays Logto-JWT-only. - `AGENTS.md` entries from 2026-08-27/28: Stalwart answers a request with no `Authorization` header with **200**; an image can reach the registry without CI; what the audit log cannot answer. **No behaviour change for the deployed configuration until the flag is set**, which is a `platform` change and Clark's queue. ## Gates Five on the pinned **1.93.0**: `fmt`, `clippy --all-targets --all-features -D warnings`, `test` (177), `audit`, `deny`. `clippy` is clean on 1.93.0 and red on 1.98.0 with `unused_async_trait_impl`, on this branch and on `main` alike. CI runs 1.93.0 (`ci.yml:35`), so that lint gates nothing here, and adding `#[allow(clippy::unused_async_trait_impl)]` would make the pinned build fail with `error: unknown lint` under `-D unknown-lints`. Measured; nothing added. ## What this does not do It does not close `#24`. `owned_addresses` still appends a global `Arc<Vec<String>>` to every authenticated caller, so `julian@lindner.earth` remains a sendable `From` for anyone who authenticates. That is the next PR and it has to land before any send tool is granted again.

jlxq0 added 1 commit

2026-08-29 12:14:05 +00:00

chore(release): v0.2.17

CI / tag-ancestry (pull_request) Successful in 3s

Details

CI / cargo (pull_request) Successful in 57s

Details

CI / docker (pull_request) Successful in 1m14s

Details

762650a28e

Carries #25: a Stalwart app password authenticates over HTTP Basic, opt-in
behind JMAP_MCP_ALLOW_STALWART_APP_PASSWORD and off by default. Bearer stays
Logto-JWT-only, so a garbage bearer takes the path it took before.

Also the AGENTS.md entries from 2026-08-27/28: Stalwart answers a request with
no Authorization header with 200, an image can reach the registry without CI,
and what the audit log cannot answer.

No behaviour change for the deployed configuration until the flag is set.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

jlxq0 merged commit 8dcff72e68 into main

2026-08-29 12:15:45 +00:00

jlxq0 deleted branch release/v0.2.17

2026-08-29 12:15:46 +00:00

jlxq0 referenced this pull request from a commit

2026-08-29 12:15:47 +00:00

Merge pull request 'chore(release): v0.2.17' (#26) from release/v0.2.17 into main