GeoIP npm package is deprecated and unmaintained

Issues
1

Issue Description

The GeoIP package (ip address → location lookup) used by Stalwart is deprecated.

Look at logs

@ip-location-db/geolite2-geo-whois-asn-country

https://www.npmjs.com/package/@ip-location-db/geolite2-geo-whois-asn-country

Expected Behavior

Current GeoIP data

Actual Behavior

Outdated GeoIP data

Reproduction Steps

Start Stalwart

Relevant Log Output

2026-08-12T17:59:33Z INFO Downloading external resource (resource.download-external) details = “Downloaded ASN/Geo data”, url = “https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv4.csv”, elapsed = 391ms
2026-08-12T17:59:34Z INFO Downloading external resource (resource.download-external) details = “Downloaded ASN/Geo data”, url = “https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv6.csv”, elapsed = 189ms
2026-08-12T17:59:34Z INFO Downloading external resource (resource.download-external) details = “Downloaded ASN/Geo data”, url = “https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv4.csv”, elapsed = 236ms
2026-08-12T17:59:34Z INFO Downloading external resource (resource.download-external) details = “Downloaded ASN/Geo data”, url = “https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv6.csv”, elapsed = 212ms

Stalwart Version

v0.16.x

Installation Method

Docker

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

The GeoIP/ASN data source is a configurable setting, not hardcoded, so you can point Stalwart at a different @ip-location-db package (or any other CSV source) yourself. In the WebUI, go to Settings › Network › ASN & GeoIP, select the Resource variant, and update geoUrls to a maintained dataset (for example switch to dbip-country or another actively updated table from ip-location-db, or host your own CSV).

Example configuration:

{
  "@type": "Resource",
  "expires": 86400000,
  "timeout": 300000,
  "maxSize": 104857600,
  "asnUrls": {
    "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv4.csv": true,
    "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv6.csv": true
  },
  "geoUrls": {
    "https://cdn.jsdelivr.net/npm/@ip-location-db/dbip-country/dbip-country-ipv4.csv": true,
    "https://cdn.jsdelivr.net/npm/@ip-location-db/dbip-country/dbip-country-ipv6.csv": true
  },
  "httpAuth": {"@type": "Unauthenticated"}
}

The default shipped URLs currently reference @ip-location-db/geolite2-geo-whois-asn-country, which matches what you’re seeing in the logs. That default is a maintainer decision about which upstream dataset ships out of the box; a human can weigh in on whether the default should change, but in the meantime you’re not stuck with it since the field is fully user-editable.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Yes, the package is deprecated and has to be replaced. @helpbot, please find a drop-in alternative that is maintained and open-source.

4

Fixed in v0.16.18 (yet to be released).

5