mirror of
https://github.com/mattermost/mattermost.git
synced 2026-11-06 06:06:50 -06:00
docs(P13/P14): port remaining content drift into monorepo
Ports outstanding content-only drift identified in docs-experimental phase-P13/P14: V11.9 docs major release content, Azure Blob Storage guide, ID-attribute case-sensitivity notes, ranked attribute types and attribute value masking for ABAC, plugin management guide linkage, and the P14 markdown action buttons reference page with its interactive-messages cross-reference. Excludes all automation/workflow files, which are handled separately. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Eva SarafianouandCursor committed
1 parent
e56cc832af
commit
7e915c99f8
35 files changed
+2524
-498
No files matched your search
@@ -17,6 +17,12 @@ To try it out, you can use this [Matterpoll plugin](https://github.com/matterpol
|
||||
|
||||
|
||||
|
||||
## Markdown action buttons
|
||||
|
||||
In addition to message-attachment buttons and menus, you can embed interactive affordances directly in a post's markdown body using `mmaction://` links backed by a `mm_blocks_actions` post prop. This is useful when a short message reads naturally with an inline "Approve" or "Reject" link and a full message attachment isn't warranted.
|
||||
|
||||
See [markdown action buttons](/developers/integrate/reference/markdown-actions) for the full schema, limits, and end-to-end flow.
|
||||
|
||||
## Message buttons
|
||||
|
||||
Add message buttons as `actions` in your integration [message attachments](https://docs.mattermost.com/developer/message-attachments.html).
|
||||
|
||||
@@ -0,0 +1,227 @@
|
||||
---
|
||||
title: "Markdown action buttons"
|
||||
description: "Markdown action buttons let an integration turn an inline post-markdown link into an action affordance. Clicking the link dispatches a post action to the integration's endpoint instead of navigating away, expanding interactivity beyond message attachments."
|
||||
sidebar_label: "Markdown action buttons"
|
||||
sidebar_position: 45
|
||||
---
|
||||
|
||||
:::note Part of a broader framework
|
||||
Markdown action buttons are one binding surface in a broader Interactive Messages framework under active development. Additional binding surfaces and action types are planned for future iterations.
|
||||
:::
|
||||
|
||||
Use markdown action buttons to add inline, in-text affordances to a post — without using a message attachment. They're useful when:
|
||||
|
||||
- A short message reads naturally with an "Approve" or "Reject" inline link.
|
||||
- An integration wants to mix narrative text and action affordances in the same post body.
|
||||
- The visual weight of a full message attachment isn't warranted.
|
||||
|
||||
For attachment-style buttons and menus, see [interactive messages](/developers/integrate/plugins/interactive-messages).
|
||||
|
||||
## How it works
|
||||
|
||||
A markdown action has two parts:
|
||||
|
||||
1. A markdown link in the post body using the `mmaction://` scheme, where the link host is the action ID:
|
||||
|
||||
```text
|
||||
[Approve](mmaction://approve?ticket=ISS-101)
|
||||
```
|
||||
|
||||
2. A matching entry in the post's `props.mm_blocks_actions` registry that tells the server what to do when the link is clicked:
|
||||
|
||||
```json
|
||||
{
|
||||
"mm_blocks_actions": {
|
||||
"approve": {
|
||||
"type": "external",
|
||||
"url": "https://integration.example.com/hook/approve",
|
||||
"context": {"project": "Demo Project"}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The client renders the link as a button. Clicking it dispatches a request to the Mattermost server, which forwards the call to the integration's `url` along with merged query parameters and any server-side context.
|
||||
|
||||
## Example post payload
|
||||
|
||||
The following payload posts a message with two markdown action buttons. The body markdown references action IDs defined in `mm_blocks_actions`.
|
||||
|
||||
```json
|
||||
{
|
||||
"channel_id": "qmd5oqtwoibz8cuzxzg5ekshgr",
|
||||
"message": "Ticket ISS-101 needs review: [Approve](mmaction://approve?ticket=ISS-101) [Reject](mmaction://reject?ticket=ISS-101)",
|
||||
"props": {
|
||||
"mm_blocks_actions": {
|
||||
"approve": {
|
||||
"type": "external",
|
||||
"url": "https://integration.example.com/hook/approve",
|
||||
"context": {"project": "Demo Project"}
|
||||
},
|
||||
"reject": {
|
||||
"type": "external",
|
||||
"url": "https://integration.example.com/hook/reject",
|
||||
"context": {"project": "Demo Project"}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
You can send this payload using the [create post REST API](https://api.mattermost.com/#operation/CreatePost), an [incoming webhook](/developers/integrate/webhooks/incoming), or from a [plugin](/developers/integrate/plugins/components/server).
|
||||
|
||||
### Submit using the REST API
|
||||
|
||||
```bash
|
||||
curl -X POST $MM_URL/api/v4/posts \
|
||||
-H "Authorization: Bearer $BOT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"channel_id": "'$CHANNEL_ID'",
|
||||
"message": "Ticket ISS-101 needs review: [Approve](mmaction://approve?ticket=ISS-101) [Reject](mmaction://reject?ticket=ISS-101)",
|
||||
"props": {
|
||||
"mm_blocks_actions": {
|
||||
"approve": {
|
||||
"type": "external",
|
||||
"url": "https://integration.example.com/hook/approve",
|
||||
"context": {"project": "Demo Project"}
|
||||
},
|
||||
"reject": {
|
||||
"type": "external",
|
||||
"url": "https://integration.example.com/hook/reject",
|
||||
"context": {"project": "Demo Project"}
|
||||
}
|
||||
}
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Submit from a plugin
|
||||
|
||||
A server-side plugin creates posts with markdown actions through the existing `API.CreatePost` / `API.UpdatePost` interfaces. The action `url` typically points at the plugin's own HTTP handler.
|
||||
|
||||
```go
|
||||
post := &model.Post{
|
||||
ChannelId: channelID,
|
||||
UserId: p.botID,
|
||||
Message: "Ticket ISS-101 needs review: " +
|
||||
"[Approve](mmaction://approve?ticket=ISS-101) " +
|
||||
"[Reject](mmaction://reject?ticket=ISS-101)",
|
||||
Props: model.StringInterface{
|
||||
"mm_blocks_actions": map[string]any{
|
||||
"approve": map[string]any{
|
||||
"type": "external",
|
||||
"url": fmt.Sprintf("/plugins/%s/inline_action/approve", manifest.Id),
|
||||
"context": map[string]any{"project": "Demo Project"},
|
||||
},
|
||||
"reject": map[string]any{
|
||||
"type": "external",
|
||||
"url": fmt.Sprintf("/plugins/%s/inline_action/reject", manifest.Id),
|
||||
"context": map[string]any{"project": "Demo Project"},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
_, err := p.API.CreatePost(post)
|
||||
```
|
||||
|
||||
Plugin updates to `mm_blocks_actions` via `UpdatePost` are accepted only when the updated value passes validation. Removal of the `mm_blocks_actions` prop by non-integration sessions is restricted to prevent dropping or corrupting actions on posts owned by another integration.
|
||||
|
||||
## Link syntax
|
||||
|
||||
```text
|
||||
[<label>](mmaction://<action_id>?<query_string>)
|
||||
```
|
||||
|
||||
**`<label>`**<br/>
|
||||
The link text rendered as the button label.
|
||||
|
||||
**`<action_id>`**<br/>
|
||||
The host portion of the URL. Must match a key in `props.mm_blocks_actions`. Must be alphanumeric (`[A-Za-z0-9]+`), matched case-sensitively.
|
||||
|
||||
**`<query_string>`** (optional)<br/>
|
||||
`key=value` pairs that are forwarded with the dispatched action and merged into the target URL's query string by the server. Link-supplied values override registry-supplied values on key conflict.
|
||||
|
||||
## The `mm_blocks_actions` registry
|
||||
|
||||
The `mm_blocks_actions` post prop is a map keyed by action ID. Each entry describes how the server should handle clicks on that action.
|
||||
|
||||
```json
|
||||
{
|
||||
"mm_blocks_actions": {
|
||||
"<action_id>": {
|
||||
"type": "<action_type>",
|
||||
"url": "...",
|
||||
"context": { ... },
|
||||
"query": { ... }
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
| Field | Required | Description |
|
||||
| --- | --- | --- |
|
||||
| `type` | yes | Action type. See [Action types](#action-types) below. |
|
||||
| `url` | depends on type | Target URL for the integration's callback endpoint. Required for `external`. |
|
||||
| `context` | no | Object of server-side context values forwarded to the integration in the post-action request body. Not visible to the client. |
|
||||
| `query` | no | Static `string -> string` map merged into the target URL's query string by the server. Combined with any query parameters supplied in the `mmaction://` link — link values win on key conflict. |
|
||||
|
||||
### Action types
|
||||
|
||||
| Type | Behaviour |
|
||||
| --- | --- |
|
||||
| `external` | The server sends a POST request to `url` with the dispatched action, including `context`, `query` (after merging), and any link-supplied query parameters. The integration responds with a standard post-action response. |
|
||||
|
||||
Additional action types may be introduced as the broader Interactive Messages framework lands. Entries with an unknown `type` value are rejected at post-create time.
|
||||
|
||||
## Click dispatch flow
|
||||
|
||||
The diagram below describes the lifecycle of a single click on a markdown action button.
|
||||
|
||||
1. **Integration** creates a post with an `mmaction://<id>` link and a matching `mm_blocks_actions[<id>]` entry.
|
||||
2. **Mattermost server** validates the post (`mm_blocks_actions` schema and limits) and stores it.
|
||||
3. **Client** renders the link as a button. Clicking it dispatches `POST /api/v4/posts/{post_id}/actions/{action_id}` with the link's query string in the request body.
|
||||
4. **Mattermost server** looks up `mm_blocks_actions[<id>]`, merges the registry's static `query` with the request body's query (request body wins on conflict), merges the result into the action URL's query string, and POSTs the integration endpoint.
|
||||
5. **Integration** responds with a standard post-action response.
|
||||
|
||||
## Receiving action callbacks
|
||||
|
||||
When a user clicks a markdown action button, the Mattermost server sends an HTTP POST request to the `url` configured in the matching `mm_blocks_actions` entry. The request body follows the same `PostActionIntegrationRequest` shape used by [message attachment](/developers/integrate/reference/message-attachments) buttons — the integration responds with the same post-action response format.
|
||||
|
||||
## Validation limits
|
||||
|
||||
Posts that exceed any of the following limits are rejected at create or update time.
|
||||
|
||||
| Limit | Value |
|
||||
| --- | --- |
|
||||
| Maximum entries in `mm_blocks_actions` | 50 |
|
||||
| Maximum length of an action ID (map key) | 64 characters |
|
||||
| Action ID character set | `[A-Za-z0-9]+` |
|
||||
| Maximum entries in `query` (link or registry) | 50 |
|
||||
| Maximum length of a query key | 128 characters |
|
||||
| Maximum length of a query value | 2048 characters |
|
||||
|
||||
## Error reference
|
||||
|
||||
The following error IDs may be returned by the post-action and post-create APIs when processing markdown action requests.
|
||||
|
||||
| Error ID | Cause |
|
||||
| --- | --- |
|
||||
| `api.post.do_action.query.app_error` | The query parameters supplied with the action click exceeded one of the limits above. |
|
||||
| `api.post.do_action.merge_query.app_error` | The server could not merge the supplied query parameters into the action's target URL — typically because the URL is malformed. |
|
||||
|
||||
## Security considerations
|
||||
|
||||
Markdown action buttons follow the same security model as message attachment actions:
|
||||
|
||||
- The action `url` is invoked server-to-server, never directly from the client.
|
||||
- `context` values are server-only and are not exposed to the rendering client.
|
||||
- Action IDs are validated as alphanumeric strings and matched case-sensitively.
|
||||
- Action entries with malformed or unknown `type` values are rejected at post-create time and never reach the click-dispatch path.
|
||||
|
||||
## See also
|
||||
|
||||
- [Interactive messages](/developers/integrate/plugins/interactive-messages) — message-attachment buttons and menus.
|
||||
- [Message attachments](/developers/integrate/reference/message-attachments) — broader message format reference.
|
||||
- [Incoming webhooks](/developers/integrate/webhooks/incoming) — submitting posts via webhooks.
|
||||
- [REST API: create post](https://api.mattermost.com/#operation/CreatePost)
|
||||
@@ -695,6 +695,11 @@ Map AD/LDAP user attributes to Mattermost user profile fields. Use the **Test At
|
||||
|
||||
If a user's ID Attribute changes, a new Mattermost account is created that is not associated with the previous account. If you need to change this field after users have signed-in, use the [mmctl ldap idmigrate](/administration-guide/manage/mmctl-command-line-tool#mmctl-ldap-idmigrate) command.
|
||||
|
||||
</Note>
|
||||
<Note>
|
||||
|
||||
The ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing is treated as a new user and a separate account is created. Ensure your AD/LDAP server returns this attribute with consistent casing.
|
||||
|
||||
</Note>
|
||||
|
||||
#### Login ID attribute
|
||||
@@ -855,6 +860,11 @@ This attribute is only used when AD/LDAP Group Sync is enabled and it is **requi
|
||||
|
||||
This attribute is only used when AD/LDAP Group Sync is enabled and it is **required**. See the [AD/LDAP Group Sync documentation](/administration-guide/onboard/ad-ldap-groups-synchronization) for more information.
|
||||
|
||||
</Note>
|
||||
<Note>
|
||||
|
||||
The Group ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing means Mattermost no longer recognizes the previously synced group and treats it as a new, unlinked group. Ensure your AD/LDAP server returns this attribute with consistent casing.
|
||||
|
||||
</Note>
|
||||
|
||||
### Synchronization performance
|
||||
@@ -1308,6 +1318,12 @@ For more information, see [AD/LDAP Setup](/administration-guide/onboard/ad-ldap)
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<Note>
|
||||
|
||||
The ID attribute value is matched verbatim - Mattermost applies no case normalization. With PostgreSQL's default case-sensitive collation, a change in casing is treated as a new user and a separate account is created. Ensure your identity provider returns this attribute with consistent casing.
|
||||
|
||||
</Note>
|
||||
|
||||
### Guest attribute
|
||||
|
||||
<table>
|
||||
|
||||
@@ -0,0 +1,200 @@
|
||||
---
|
||||
title: "Configure Azure Blob Storage as the Mattermost file store"
|
||||
---
|
||||
<PlanAvailability slug="all-commercial" />
|
||||
|
||||
Mattermost can store user uploads -- attachments, profile images, plugin assets, emoji, compliance exports -- in an Azure Storage account. This guide walks an administrator through the steps to provision the Azure side and point a Mattermost server at it via the System Console.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- An Azure subscription with a storage account and a container already created.
|
||||
- Either the Azure portal, or the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) (`az`) installed and signed in with `az login`. Both are documented below.
|
||||
- A Mattermost deployment (v11.9 or later) with System Console access for a System Admin account.
|
||||
|
||||
If you plan to migrate existing files from another backend, take a backup of the current storage location (S3 bucket, local disk, etc.) before changing the configuration. Switching the file driver does not migrate existing files automatically.
|
||||
|
||||
## Step 1: Choose an authentication mode
|
||||
|
||||
Mattermost supports two ways for the server to authenticate to Azure. Pick the one that fits how the server runs:
|
||||
|
||||
- **Shared key**: the server signs each request with the [Storage Account access key](/administration-guide/configure/environment-configuration-settings#azure-storage-account-key). Works anywhere Mattermost runs (on-premises, non-Azure cloud, local development) because it does not depend on the host having an Azure identity. The trade-off is that the key is a long-lived secret stored in `config.json`.
|
||||
- **Default credential (Microsoft Entra ID)**: the server obtains a token from Microsoft Entra ID and signs requests with it. No long-lived secret in Mattermost configuration. This is the recommended mode for deployments running on Azure, where the host environment already provides an identity (managed identity on Azure VM / App Service / AKS, workload identity for federated workloads, or a service principal).
|
||||
|
||||
The Azure-side setup differs slightly between the two modes. Follow the subsection that matches your choice; you can switch modes later by changing the [Azure authentication](/administration-guide/configure/environment-configuration-settings#azure-authentication) setting in the System Console.
|
||||
|
||||
### Option A: Shared key
|
||||
|
||||
Retrieve the Storage Account access key.
|
||||
|
||||
**Azure portal**
|
||||
|
||||
1. Open the storage account, then **Security + networking** > **Access keys**.
|
||||
2. Select **Show** next to `key1` (or `key2`) and copy the value.
|
||||
|
||||
**Azure CLI**
|
||||
|
||||
```bash
|
||||
az storage account keys list \
|
||||
--account-name acmemattermost \
|
||||
--resource-group mm-prod-files \
|
||||
--query "[0].value" -o tsv
|
||||
```
|
||||
|
||||
<Note>
|
||||
|
||||
Treat the shared key as a secret -- anyone with it has full access to the storage account (every container and all data it holds). A shared key can't be scoped to a single container, to specific operations, or to a resource group; if you need least-privilege access, use [Option B: Default credential (Microsoft Entra ID)](#option-b-default-credential-microsoft-entra-id) with a container-scoped **Storage Blob Data Contributor** role instead. Azure provides two keys so you can rotate without downtime: update Mattermost to `key2`, regenerate `key1`, then swap on the next rotation cycle. Plan a rotation cadence that matches your organisation's policy.
|
||||
|
||||
</Note>
|
||||
|
||||
### Option B: Default credential (Microsoft Entra ID)
|
||||
|
||||
The server uses `DefaultAzureCredential` from the Azure SDK, which discovers a working identity at runtime in this order. The first source that returns a token is used.
|
||||
|
||||
1. `EnvironmentCredential` -- service-principal environment variables.
|
||||
2. `WorkloadIdentityCredential` -- federated workload identity.
|
||||
3. `ManagedIdentityCredential` -- the platform-provided managed identity.
|
||||
4. `AzureCLICredential` -- the signed-in `az` session, useful for local development.
|
||||
|
||||
Whichever identity the SDK selects, **that** identity needs **Storage Blob Data Contributor** (or a custom role with the equivalent `read/write/list/delete` data-plane actions) on the storage account or container. Without it, `TestConnection` returns `AuthorizationPermissionMismatch`.
|
||||
|
||||
Pick the identity source that matches the host:
|
||||
|
||||
| Host | Identity source |
|
||||
|:---|:---|
|
||||
| Azure VM, App Service, AKS, Container Apps | Assign a **system-assigned** or **user-assigned managed identity** to the compute resource. `DefaultAzureCredential` resolves to `ManagedIdentityCredential` with no extra configuration. For user-assigned identities, set `AZURE_CLIENT_ID` in the server's environment so the SDK picks the right one. |
|
||||
| AKS with workload-identity federation | Annotate the Mattermost `ServiceAccount` with the client ID and configure the OIDC issuer per the [AKS workload identity guide](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview). `DefaultAzureCredential` resolves to `WorkloadIdentityCredential`. |
|
||||
| Non-Azure host or container | Create a service principal and set `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET` (or `AZURE_CLIENT_CERTIFICATE_PATH`) in the server's environment. `DefaultAzureCredential` resolves to `EnvironmentCredential`. |
|
||||
| Local development on an admin's workstation | Sign in with `az login`. `DefaultAzureCredential` resolves to `AzureCLICredential`. |
|
||||
|
||||
To prepare the account you're going to use, you'll need to assign the role from the Azure Portal or using the Azure CLI, as shown below (substitute the principal of the identity Mattermost will authenticate as):
|
||||
|
||||
```bash
|
||||
STORAGE_ACCOUNT_ID=$(az storage account show \
|
||||
--name acmemattermost \
|
||||
--resource-group mm-prod-files \
|
||||
--query id -o tsv)
|
||||
|
||||
# For a managed identity (system-assigned on a VM/App Service/AKS pod):
|
||||
az role assignment create \
|
||||
--assignee-object-id "<principalId-of-the-managed-identity>" \
|
||||
--assignee-principal-type ServicePrincipal \
|
||||
--role "Storage Blob Data Contributor" \
|
||||
--scope "$STORAGE_ACCOUNT_ID"
|
||||
|
||||
# For a service principal:
|
||||
az role assignment create \
|
||||
--assignee "<appId-of-the-service-principal>" \
|
||||
--role "Storage Blob Data Contributor" \
|
||||
--scope "$STORAGE_ACCOUNT_ID"
|
||||
```
|
||||
|
||||
<Note>
|
||||
|
||||
Granting the role requires **User Access Administrator** or **Owner** on the storage account; `Contributor` is not enough. Plan to have an administrator with that role run the `az role assignment create` step. If you scope the role to a single container instead of the whole storage account, replace `--scope "$STORAGE_ACCOUNT_ID"` with `--scope "$STORAGE_ACCOUNT_ID/blobServices/default/containers/<container>"`.
|
||||
|
||||
</Note>
|
||||
|
||||
<Tip>
|
||||
|
||||
Azure RBAC role assignments can take 30-120 seconds to propagate. If the first `TestConnection` returns `AuthorizationPermissionMismatch` immediately after the role assignment, wait a minute and retry before assuming a misconfiguration.
|
||||
|
||||
</Tip>
|
||||
|
||||
<Note>
|
||||
|
||||
Mattermost holds the credential, not the token. Microsoft Entra ID access tokens are short-lived, but the Azure SDK caches each token and refreshes it automatically before it expires, so routine token rotation never interrupts file access while the server is running. Access stops only if the underlying identity or its authorization changes or is removed.
|
||||
|
||||
</Note>
|
||||
|
||||
## Step 2: Configure Mattermost
|
||||
|
||||
Sign in as a System Admin and open **System Console > Environment > File Storage**.
|
||||
|
||||
1. **File storage system**: select **Azure Blob Storage**. The Azure-specific fields appear and the S3/local fields are hidden.
|
||||
2. **Azure cloud**: select the Azure cloud that hosts the storage account:
|
||||
|
||||
- **Azure Commercial** (default): the global Azure cloud (`{account}.blob.core.windows.net`). Only the storage account name is required.
|
||||
- **Azure Government**: the US Government cloud (`{account}.blob.core.usgovcloudapi.net`). Only the storage account name is required.
|
||||
- **Custom Endpoint**: any other Azure cloud (for example, Azure China), an Azurite emulator, or a reverse proxy. Provide the full Blob service URL via **Azure endpoint** below.
|
||||
|
||||
3. **Azure Storage account**: the storage account name (for example, `acmemattermost`).
|
||||
4. **Azure container**: the container name (for example, `mattermost`).
|
||||
5. **Azure path prefix**: optional. Set this if you want Mattermost to write under a sub-path inside the container, for example `prod/`. Leave empty to use the container root.
|
||||
6. **Azure authentication**: select the mode you set up in step 1:
|
||||
|
||||
- **Shared key** (default): Mattermost signs each request with the Storage Account access key. Choose this if you completed [Option A: Shared key](#option-a-shared-key).
|
||||
- **Default credential (Microsoft Entra ID)**: Mattermost authenticates as the identity provided by the host environment. Choose this if you completed [Option B: Default credential (Microsoft Entra ID)](#option-b-default-credential-microsoft-entra-id). The **Azure Storage account key** field below is hidden because the access key is not used in this mode.
|
||||
|
||||
7. **Azure Storage account key** (visible only when **Azure authentication** is **Shared key**): paste the shared key from [Option A: Shared key](#option-a-shared-key).
|
||||
8. **Azure endpoint** (visible only when **Azure cloud** is set to **Custom Endpoint**): the full Blob service URL, including scheme and storage account. Mattermost passes this URL to the Azure SDK unchanged, so the storage account must already be embedded in the hostname (vhost-style, for example `https://acmemattermost.blob.core.chinacloudapi.cn/`) or in the path (path-style, for example `http://localhost:10000/devstoreaccount1/` for Azurite). The chosen authentication mode signs against the host this URL points at, so the host must serve the storage account named above.
|
||||
9. **Enable secure Azure Blob Storage connections** (visible only when **Azure cloud** is **Azure Commercial** or **Azure Government**): keep this enabled (the default). The Custom Endpoint cloud determines the scheme from the **Azure endpoint** URL, so this toggle is hidden for that mode.
|
||||
10. **Azure request timeout (milliseconds)**: default is `30000` (30 seconds). Increase only if your network needs more time for large objects.
|
||||
|
||||
Save the settings and click **Test Connection**. Mattermost issues a no-op write/read/delete against the configured container using the credentials submitted in the form. A green `Connection was successful` message confirms the credentials, container name, and endpoint all work. A red error message includes the underlying reason; common ones are listed in [Troubleshooting](#troubleshooting).
|
||||
|
||||
<Warning>
|
||||
|
||||
**Restart required.** The Mattermost server caches the file storage backend at startup and does not re-create it when the file storage configuration changes. After saving, restart every Mattermost server in the deployment (`systemctl restart mattermost`, recycle the container, or roll the deployment in your cluster) for the new driver to take effect. **Test Connection** works before the restart because it builds a temporary backend from the submitted form values.
|
||||
|
||||
</Warning>
|
||||
|
||||
<Warning>
|
||||
|
||||
Switching the file driver does **not** migrate existing files. If you are moving an existing deployment from Amazon S3, see [Migrate existing files from Amazon S3](#migrate-existing-files-from-amazon-s3) below before changing the driver. For migrations from local disk, copy the directory contents into the Azure container using `azcopy` ([docs](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10)). In either case, files uploaded before the switch are unreachable once the driver changes unless they are present at the same key in the destination.
|
||||
|
||||
</Warning>
|
||||
|
||||
## Step 3: Verify
|
||||
|
||||
1. After the restart, reload the System Console or any channel.
|
||||
2. Upload an attachment in any channel. A small image is a good test, because Mattermost stores three blobs for an image (original, preview, thumbnail), which exercises the upload path more thoroughly than a plain file.
|
||||
3. The post should render the attachment and preview as usual.
|
||||
4. In the Azure portal, open the container and confirm new blobs appeared under the path `<YYYYMMDD>/teams/<team>/channels/<channel>/users/<user>/<file_id>/` (the same layout the local-disk and S3 backends use). For an image you will see `<name>.<ext>`, `<name>_preview.<ext>`, and `<name>_thumb.<ext>`.
|
||||
|
||||
## Migrate existing files from Amazon S3
|
||||
|
||||
If you are switching an existing deployment from S3 to Azure Blob Storage, the file content must be present in the Azure container at the same key Mattermost would have written to. Mattermost itself does not move files between backends, so this is an out-of-band copy that you run once before flipping the driver.
|
||||
|
||||
Mattermost writes blobs at the same relative path on every backend:
|
||||
|
||||
```text
|
||||
{path-prefix}/{YYYYMMDD}/teams/{teamID}/channels/{channelID}/users/{userID}/{fileID}/{filename}
|
||||
```
|
||||
|
||||
This means a straight key-for-key copy from the S3 bucket to the Azure container is sufficient. If you use `AmazonS3PathPrefix` on the S3 side, set `AzurePathPrefix` to the same value on the Azure side (or rewrite the prefix during the copy).
|
||||
|
||||
There are multiple ways to accomplish this. The recommended way is using the [Azure Storage Mover service](https://learn.microsoft.com/en-us/azure/storage-mover/cloud-to-cloud-migration), which provides a cloud-to-cloud migration from Amazon S3 to Azure Blob Storage.
|
||||
|
||||
There are alternative tools that can also help, like [rclone](https://rclone.org/azureblob/) and [AzCopy](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-s3).
|
||||
|
||||
## (Optional) Configure the export backend
|
||||
|
||||
Compliance and data exports can be stored separately from regular file uploads. The **File Storage (Exports)** section directly below **File Storage** in the System Console mirrors the fields above and accepts the same Azure credentials. Customers typically point exports at a different container (or a different account) so the export retention policy can differ from regular uploads. The export target is an independent backend with its own driver and credentials, so it doesn't have to use the same provider as regular uploads; e.g., you can keep uploads on Amazon S3 and send exports to Azure Blob Storage, or the reverse.
|
||||
|
||||
See [Enable dedicated export filestore target](/administration-guide/configure/environment-configuration-settings#enable-dedicated-export-filestore-target) for the full list of `ExportAzure*` keys.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
| Symptom | Likely cause |
|
||||
|:---|:---|
|
||||
| `AuthenticationFailed` on **Test Connection** | When **Azure authentication** is **Shared key**: wrong account name or shared key. Confirm both in the **Access keys** blade of the Azure portal. When **Azure authentication** is **Default credential**: no identity source was available -- the host has no managed identity, the workload-identity federation is not set up, and no `AZURE_TENANT_ID` / `AZURE_CLIENT_ID` / `AZURE_CLIENT_SECRET` environment variables are set. |
|
||||
| `AuthorizationPermissionMismatch` on **Test Connection** | Only applies when **Azure authentication** is **Default credential**. The identity the SDK selected does not hold a data-plane role on the storage account. Grant **Storage Blob Data Contributor** to that identity per [Option B: Default credential (Microsoft Entra ID)](#option-b-default-credential-microsoft-entra-id), then wait 30-120 seconds for the role assignment to propagate. |
|
||||
| `ContainerNotFound` | Container name is wrong or was created under a different storage account. |
|
||||
| `connection refused` or TLS errors | When **Azure cloud** is **Custom Endpoint**, the **Azure endpoint** URL points at a host that isn't reachable or uses the wrong scheme. When **Azure cloud** is **Azure Commercial** or **Azure Government**, **Enable secure Azure Blob Storage connections** is disabled in front of a TLS-only destination. |
|
||||
| **Test Connection** succeeds but uploads in channels fail | Check **System Console > Reporting > Server Logs** for the Azure error returned by the SDK. The most common cause is a forgotten server restart after **Save**. |
|
||||
| Files uploaded before the switch are no longer visible | The existing files are still on the previous backend. For S3 migrations, follow [Migrate existing files from Amazon S3](#migrate-existing-files-from-amazon-s3) to copy the bucket into the Azure container at matching keys. For other backends, copy the contents into the Azure container with `azcopy` (or equivalent) and confirm the destination path matches the layout Mattermost uses. |
|
||||
|
||||
## Reference
|
||||
|
||||
Each Azure setting is documented in detail in [Environment configuration settings](/administration-guide/configure/environment-configuration-settings#file-storage):
|
||||
|
||||
- [File storage system](/administration-guide/configure/environment-configuration-settings#file-storage-system) (`FileSettings.DriverName`)
|
||||
- [Azure Storage account](/administration-guide/configure/environment-configuration-settings#azure-storage-account) (`FileSettings.AzureStorageAccount`)
|
||||
- [Azure container](/administration-guide/configure/environment-configuration-settings#azure-container) (`FileSettings.AzureContainer`)
|
||||
- [Azure path prefix](/administration-guide/configure/environment-configuration-settings#azure-path-prefix) (`FileSettings.AzurePathPrefix`)
|
||||
- [Azure authentication](/administration-guide/configure/environment-configuration-settings#azure-authentication) (`FileSettings.AzureAuthMode`)
|
||||
- [Azure Storage account key](/administration-guide/configure/environment-configuration-settings#azure-storage-account-key) (`FileSettings.AzureAccessKey`)
|
||||
- [Azure cloud](/administration-guide/configure/environment-configuration-settings#azure-cloud) (`FileSettings.AzureCloud`)
|
||||
- [Azure endpoint](/administration-guide/configure/environment-configuration-settings#azure-endpoint) (`FileSettings.AzureEndpoint`)
|
||||
- [Enable secure Azure Blob Storage connections](/administration-guide/configure/environment-configuration-settings#enable-secure-azure-blob-storage-connections) (`FileSettings.AzureSSL`)
|
||||
- [Azure request timeout](/administration-guide/configure/environment-configuration-settings#azure-request-timeout) (`FileSettings.AzureRequestTimeoutMilliseconds`)
|
||||
@@ -696,7 +696,7 @@ Your database admin must configure the functionality according to supported valu
|
||||
|
||||
#### AWS High Availablity RDS cluster deployments
|
||||
|
||||
For an AWS High Availability RDS cluster deployment, point this configuration setting to the write/read endpoint at the **cluster** level to benefit from the AWS failover handling. AWS takes care of promoting different database nodes to be the writer node. Mattermost doesn't need to manage this. See the [high availablility database configuration](/administration-guide/scale/high-availability-cluster-based-deployment#database-configuration) documentation for details.
|
||||
For an AWS High Availability RDS cluster deployment, point this configuration setting to the write/read endpoint at the **cluster** level to benefit from the AWS failover handling. AWS takes care of promoting different database nodes to be the writer node. Mattermost doesn't need to manage this. See the [high availability database configuration](/administration-guide/scale/high-availability-cluster-based-deployment#database) documentation for details.
|
||||
|
||||
### Maximum open connections
|
||||
|
||||
@@ -892,7 +892,7 @@ Read-only display of the currently active backend used for search. Values can in
|
||||
|
||||
#### AWS High Availability RDS cluster deployments
|
||||
|
||||
For an AWS High Availability RDS cluster deployment, point this configuration setting directly to the underlying read-only node endpoint within the RDS cluster to circumvent the failover/load balancing that AWS/RDS takes care of (except for the write traffic). Mattermost has its own method of balancing the read-only connections and can also balance those queries to the data source/write+read connection should those nodes fail. See the [high availablility database configuration](/administration-guide/scale/high-availability-cluster-based-deployment#database-configuration) documentation for details.
|
||||
For an AWS High Availability RDS cluster deployment, point this configuration setting directly to the underlying read-only node endpoint within the RDS cluster to circumvent the failover/load balancing that AWS/RDS takes care of (except for the write traffic). Mattermost has its own method of balancing the read-only connections and can also balance those queries to the data source/write+read connection should those nodes fail. See the [high availability database configuration](/administration-guide/scale/high-availability-cluster-based-deployment#database) documentation for details.
|
||||
|
||||
### Search replicas
|
||||
|
||||
@@ -917,7 +917,7 @@ Each database connection string in the array must be in the same form used for t
|
||||
|
||||
#### AWS High Availability RDS cluster deployments
|
||||
|
||||
For an AWS High Availability RDS cluster deployment, point this configuration setting directly to the underlying read-only node endpoint within the RDS cluster to circumvent the failover/load balancing that AWS/RDS takes care of (except for the write traffic). Mattermost has its own method of balancing the read-only connections and can also balance those queries to the data source/write+read connection should those nodes fail. See the [high availablility database configuration](/administration-guide/scale/high-availability-cluster-based-deployment#database-configuration) documentation for details.
|
||||
For an AWS High Availability RDS cluster deployment, point this configuration setting directly to the underlying read-only node endpoint within the RDS cluster to circumvent the failover/load balancing that AWS/RDS takes care of (except for the write traffic). Mattermost has its own method of balancing the read-only connections and can also balance those queries to the data source/write+read connection should those nodes fail. See the [high availability database configuration](/administration-guide/scale/high-availability-cluster-based-deployment#database) documentation for details.
|
||||
|
||||
### Replica lag settings
|
||||
|
||||
@@ -1711,9 +1711,14 @@ With self-hosted deployments, you can configure file storage settings by going t
|
||||
|
||||
<Note>
|
||||
|
||||
Mattermost currently supports storing files on the local filesystem and Amazon S3 or S3-compatible containers. We have tested Mattermost with [Digital Ocean Spaces](https://docs.digitalocean.com/products/spaces/), but not all S3-compatible containers on the market. If you are looking to use other S3-compatible containers, we recommend completing your own testing. You can also use local storage or a network drive using NFS.
|
||||
Mattermost supports storing files on the local filesystem, Amazon S3 or S3-compatible containers, and Azure Blob Storage. We have tested Mattermost with [Digital Ocean Spaces](https://docs.digitalocean.com/products/spaces/), but not all S3-compatible containers on the market. If you are looking to use other S3-compatible containers, we recommend completing your own testing. You can also use local storage or a network drive using NFS.
|
||||
|
||||
</Note>
|
||||
<Tip>
|
||||
|
||||
For a step-by-step walk-through covering Azure resource provisioning, System Console configuration, and verification, see [Configure Azure Blob Storage as the Mattermost file store](/administration-guide/configure/azure-blob-storage).
|
||||
|
||||
</Tip>
|
||||
|
||||
### File storage system
|
||||
|
||||
@@ -1724,12 +1729,18 @@ Mattermost currently supports storing files on the local filesystem and Amazon S
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>The type of file storage system used. Can be either Local File System or Amazon S3.</p><ul><li><strong>local</strong>: <strong>(Default)</strong> Files and images are stored in the specified local file directory.</li><li><strong>amazons3</strong>: Files and images are stored on Amazon S3 based on the access key, bucket, and region fields provided. The driver is compatible with other S3-compatible services, such as Digital Ocean Spaces.</li></ul></td>
|
||||
<td><p>The type of file storage system used. Can be Local File System, Amazon S3, or Azure Blob Storage.</p><ul><li><strong>local</strong>: <strong>(Default)</strong> Files and images are stored in the specified local file directory.</li><li><strong>amazons3</strong>: Files and images are stored on Amazon S3 based on the access key, bucket, and region fields provided. The driver is compatible with other S3-compatible services, such as Digital Ocean Spaces.</li><li><strong>azureblob</strong>: Files and images are stored on Azure Blob Storage based on the storage account name, shared key, and container fields provided.</li></ul></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>DriverName</code> > <code>"local"</code></li><li>Environment variable: <code>MM_FILESETTINGS_DRIVERNAME</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<Note>
|
||||
|
||||
After saving a new file storage system, restart every Mattermost server in the deployment for the change to take effect. The file storage backend is initialized at startup and isn't rebuilt automatically when `FileSettings` change at runtime.
|
||||
|
||||
</Note>
|
||||
|
||||
### Local storage directory
|
||||
|
||||
<table>
|
||||
@@ -2119,6 +2130,147 @@ A smaller part size can result in more requests and an increase in latency, whil
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Azure Storage account
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>The name of your Azure Storage account.</p><p>A string with the storage account name as it appears in the Azure portal. Must be 3-24 lowercase letters and numbers.</p></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureStorageAccount</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZURESTORAGEACCOUNT</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Azure container
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>The name of the container in your Azure Storage account where Mattermost stores uploads.</p><p>A string with the container name.</p></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureContainer</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZURECONTAINER</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Azure path prefix
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>An optional path prefix to use for blobs in your Azure container.</p><p>A string containing the path prefix. Leave empty to write at the container root.</p></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzurePathPrefix</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZUREPATHPREFIX</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Azure authentication
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>Selects how Mattermost authenticates to the Azure Storage account.</p><ul><li><code>shared_key</code>: <strong>(Default)</strong> Mattermost signs requests with the Storage Account access key in <code>FileSettings.AzureAccessKey</code>. Works for any deployment (on-premises, non-Azure cloud, local development).</li><li><code>default_credential</code>: Mattermost obtains an Entra ID token via the Azure SDK's <code>DefaultAzureCredential</code> chain (managed identity, workload identity, service-principal environment variables, or <code>az login</code> — in that order) and signs requests with it. <code>FileSettings.AzureAccessKey</code> is ignored. Recommended for deployments on Azure where the host already provides a managed identity.<br/><br/>The identity the SDK selects must hold <strong>Storage Blob Data Contributor</strong> (or equivalent) on the storage account or container.</li></ul></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureAuthMode</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZUREAUTHMODE</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Azure Storage account key
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>The shared key for your Azure Storage account. Used only when <code>FileSettings.AzureAuthMode</code> is <code>shared_key</code>. Find this value in the Azure portal under your storage account's <strong>Security + networking > Access keys</strong> blade.</p></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureAccessKey</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZUREACCESSKEY</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<Note>
|
||||
|
||||
Treat the shared key as a secret. Azure provides two keys to support rotation without downtime: update Mattermost to one key, regenerate the other, then swap on the next rotation cycle.
|
||||
|
||||
</Note>
|
||||
|
||||
### Azure cloud
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>Selects which Azure cloud Mattermost connects to. The choice determines which host the Azure SDK signs requests against.</p><ul><li><code>commercial</code>: <strong>(Default)</strong> Vhost-style against <code>{'{account}'}.blob.core.windows.net</code>. Only the storage account name is required.</li><li><code>government</code>: Vhost-style against <code>{'{account}'}.blob.core.usgovcloudapi.net</code> (Azure Government). Only the storage account name is required.</li><li><code>custom</code>: Mattermost uses the value of <code>FileSettings.AzureEndpoint</code> as the full Blob service URL. Use this for Azurite, reverse proxies, Azure China, or any other Azure cloud that doesn't have a built-in preset.</li></ul></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureCloud</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZURECLOUD</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Azure endpoint
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>Full Blob service URL, including scheme and storage account. Used only when <code>FileSettings.AzureCloud</code> is <code>custom</code>; ignored for the <code>commercial</code> and <code>government</code> clouds (which derive the URL from the storage account name).</p><p>Mattermost passes this URL to the Azure SDK unchanged, so the storage account must already be embedded in the hostname (vhost-style, for example <code>https://acmemattermost.blob.core.chinacloudapi.cn/</code>) or in the path (path-style, for example <code>http://localhost:10000/devstoreaccount1/</code> for Azurite). Shared-key auth signs against the host this URL points at, so make sure it actually serves the storage account configured in <code>FileSettings.AzureStorageAccount</code>.</p></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureEndpoint</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZUREENDPOINT</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Enable secure Azure Blob Storage connections
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>Enable or disable secure connections to Azure Blob Storage.</p><ul><li><strong>true</strong>: <strong>(Default)</strong> Enables only secure Azure Blob Storage connections.</li><li><strong>false</strong>: Allows insecure connections. Only set to <strong>false</strong> when pointing at a local emulator without TLS.</li></ul></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureSSL</code> > <code>true</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZURESSL</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Azure request timeout
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><p>The amount of time, in milliseconds, before requests to Azure Blob Storage time out.</p><p>Default is 30000 (30 seconds). Increase only if your network needs more time for large objects.</p></td>
|
||||
<td><ul><li>System Config path: <strong>Environment > File Storage</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>AzureRequestTimeoutMilliseconds</code> > <code>30000</code></li><li>Environment variable: <code>MM_FILESETTINGS_AZUREREQUESTTIMEOUTMILLISECONDS</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Initial font
|
||||
|
||||
<table>
|
||||
@@ -3857,18 +4009,20 @@ Adding a prefix to all Redis cache keys reduces key collisions, simplifies debug
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '100%'}} />
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>Enables the ability to specify an alternate filestore | - System Config path: <strong>N/A</strong> | target for Mattermost | - <code>config.json</code> setting: <code>FileSettings</code> > <code>DedicatedExportStore</code> | <a href="mm-doc:%2Fadministration-guide%2Fmanage%2Fbulk-export-tool">bulk exports</a> and | - Environment variable: <code>MM_FILESETTINGS_DEDICATEDEXPORTSTORE</code> | <a href="mm-doc:%2Fadministration-guide%2Fcomply%2Fcompliance-export">compliance exports</a>. | | | | - <strong>True</strong>: A new <code>ExportFileBackend()</code> is generated | | under <code>FileSettings</code> using new configuration values | | for the following configuration settings: | | | | - <code>ExportDriverName</code> | | - <code>ExportDirectory</code> | | - <code>ExportAmazonS3AccessKeyId</code> | | - <code>ExportAmazonS3SecretAccessKey</code> | | - <code>ExportAmazonS3Bucket</code> | | - <code>ExportAmazonS3PathPrefix</code> | | - <code>ExportAmazonS3Region</code> | | - <code>ExportAmazonS3Endpoint</code> | | - <code>ExportAmazonS3SSL</code> | | - <code>ExportAmazonS3SignV2</code> | | - <code>ExportAmazonS3SSE</code> | | - <code>ExportAmazonS3Trace</code> | | - <code>ExportAmazonS3RequestTimeoutMilliseconds</code> | | - <code>ExportAmazonS3PresignExpiresSeconds</code> | | | | - <strong>False</strong>: (<strong>Default</strong>) Standard | | <a href="mm-ref:administration-guide%2Fconfigure%2Fenvironment-configuration-settings%3Afile%20storage">file storage | |</a> | is used. Standard file storage will also be used when the configuration setting | | or value is omitted. | |</td>
|
||||
<td><p>Enables the ability to specify an alternate filestore target for Mattermost <a href="mm-doc:%2Fadministration-guide%2Fmanage%2Fbulk-export-tool">bulk exports</a> and <a href="mm-doc:%2Fadministration-guide%2Fcomply%2Fcompliance-export">compliance exports</a>.</p><ul><li><strong>True</strong>: A new <code>ExportFileBackend()</code> is generated under <code>FileSettings</code> using new configuration values for the following configuration settings:<ul><li><code>ExportDriverName</code></li><li><code>ExportDirectory</code></li><li><code>ExportAmazonS3AccessKeyId</code></li><li><code>ExportAmazonS3SecretAccessKey</code></li><li><code>ExportAmazonS3Bucket</code></li><li><code>ExportAmazonS3PathPrefix</code></li><li><code>ExportAmazonS3Region</code></li><li><code>ExportAmazonS3Endpoint</code></li><li><code>ExportAmazonS3SSL</code></li><li><code>ExportAmazonS3SignV2</code></li><li><code>ExportAmazonS3SSE</code></li><li><code>ExportAmazonS3Trace</code></li><li><code>ExportAmazonS3RequestTimeoutMilliseconds</code></li><li><code>ExportAmazonS3PresignExpiresSeconds</code></li><li><code>ExportAzureStorageAccount</code></li><li><code>ExportAzureAuthMode</code></li><li><code>ExportAzureAccessKey</code></li><li><code>ExportAzureContainer</code></li><li><code>ExportAzurePathPrefix</code></li><li><code>ExportAzureCloud</code></li><li><code>ExportAzureEndpoint</code></li><li><code>ExportAzureSSL</code></li><li><code>ExportAzureRequestTimeoutMilliseconds</code></li><li><code>ExportAzurePresignExpiresSeconds</code></li></ul></li><li><strong>False</strong>: (<strong>Default</strong>) Standard <a href="mm-ref:administration-guide%2Fconfigure%2Fenvironment-configuration-settings%3Afile%20storage">file storage</a> is used. Standard file storage will also be used when the configuration setting or value is omitted.</li></ul></td>
|
||||
<td><ul><li>System Config path: <strong>N/A</strong></li><li><code>config.json</code> setting: <code>FileSettings</code> > <code>DedicatedExportStore</code></li><li>Environment variable: <code>MM_FILESETTINGS_DEDICATEDEXPORTSTORE</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<Note>
|
||||
|
||||
- When an alternate filestore target is configured, Mattermost Cloud admins can generate an S3 presigned URL for exports using the `/exportlink [job-id|zip file|latest]` slash command. See the [Mattermost data migration](/administration-guide/manage/cloud-data-export#create-the-export) documentation for details. Alternatively, Cloud and self-hosted admins can use the [mmctl export generate-presigned-url](/administration-guide/manage/mmctl-command-line-tool#mmctl-export-generate-presigned-url) command to generate a presigned URL directly from mmctl.
|
||||
- Generating an S3 presigned URL requires the feature flag `EnableExportDirectDownload` to be set to `true`, the storage must be compatible with generating an S3 link, and this experimental configuration setting must be set to `true`. Presigned URLs for exports aren't supported for systems with shared storage.
|
||||
- When an alternate filestore target is configured, Mattermost Cloud admins can generate a presigned download URL for exports using the `/exportlink [job-id|zip file|latest]` slash command. On Amazon S3 this is an S3 presigned URL; on Azure Blob Storage it's a Shared Access Signature (SAS) URL. The lifetimes of these URLs are controlled, respectively, by `ExportAmazonS3PresignExpiresSeconds` or `ExportAzurePresignExpiresSeconds`. See the [Mattermost data migration](/administration-guide/manage/cloud-data-export#create-the-export) documentation for details. Alternatively, Cloud and self-hosted admins can use the [mmctl export generate-presigned-url](/administration-guide/manage/mmctl-command-line-tool#mmctl-export-generate-presigned-url) command to generate a presigned URL directly from mmctl.
|
||||
- Generating a presigned URL requires the feature flag `EnableExportDirectDownload` to be set to `true`, the storage must support presigned links (Amazon S3 or Azure Blob Storage), and this experimental configuration setting must be set to `true`. Presigned URLs for exports aren't supported for systems with shared storage.
|
||||
|
||||
</Note>
|
||||
@@ -167,6 +167,15 @@ In the System Console, enter URIs as a comma-separated list. When setting this v
|
||||
|
||||
This setting applies only when [Enable dynamic client registration](/administration-guide/configure/integrations-configuration-settings#enable-dynamic-client-registration) is enabled.
|
||||
|
||||
Redirect URIs are matched per URL component. Patterns support two wildcards:
|
||||
|
||||
- `*` matches any characters except `/` (for example, a single path segment or a hostname label).
|
||||
- `**` matches any characters including `/` (for example, a multi-segment path).
|
||||
|
||||
Wildcards are applied within URL components only: host wildcards match against the host, path wildcards match against the path, and a wildcard in one component can't satisfy another component. For example, `https://*.example.com/**` matches `https://app.example.com/callback` but not `https://attacker.example.net`.
|
||||
|
||||
Query strings are matched only when the pattern explicitly includes one. A pattern without a query string (such as `https://app.example.com/callback` or `https://app.example.com/**`) matches only redirect URIs that have no query string. To allow redirect URIs that carry query parameters, include a query component in the pattern, for example `https://app.example.com/callback?tenant=*`. To allow a callback both with and without a query string, add both patterns.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '100%'}} />
|
||||
|
||||
@@ -942,6 +942,32 @@ Avoid enabling both this experimental configuration setting and the [Enable simu
|
||||
|
||||
</Note>
|
||||
|
||||
### Enable video calls in DMs (Experimental)
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style={{width: '39%'}} />
|
||||
<col style={{width: '60%'}} />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><ul><li><strong>true</strong>: Enables experimental video calls in direct message (DM) channels.</li><li><strong>false</strong>: <strong>(Default)</strong> Video calls are disabled.</li></ul><p>Video is supported in DM calls on the desktop and web apps only. Mobile users can't start video calls; when joining a DM call that includes video, they receive voice and screen sharing only. Call recordings capture voice and screen sharing only — video isn't recorded.</p></td>
|
||||
<td><ul><li>System Config path: <strong>Plugins > Calls</strong></li><li><code>config.json</code> setting: <code>PluginSettings</code> > <code>Plugins</code> > <code>com.mattermost.calls</code> > <code>enablevideo</code></li><li>Environment variable: <code>MM_CALLS_ENABLE_VIDEO</code></li></ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<Note>
|
||||
|
||||
The ability to enable video calls in DMs is currently [Experimental](/administration-guide/manage/feature-labels#experimental).
|
||||
|
||||
</Note>
|
||||
<Note>
|
||||
|
||||
If your deployment offloads calls to the [RTCD service](/administration-guide/configure/calls-rtcd-setup), video in DM calls requires **rtcd v1.2.2 or later**. We recommend running the rtcd version that ships with your Calls plugin release (rtcd v1.2.5 for Calls v1.12.0) and keeping rtcd updated alongside the plugin. Deployments that use the plugin's built-in RTC server (no RTCD) support video without additional configuration.
|
||||
|
||||
</Note>
|
||||
|
||||
### Enable DC signaling (Experimental)
|
||||
|
||||
<table>
|
||||
|
||||
@@ -2158,7 +2158,7 @@ Enabling these features can increase the load on your Mattermost server’s CPU,
|
||||
|
||||
From Mattermost v11.8, system admins can configure classification markings in the System Console by going to **Site Configuration \> Classification Markings**.
|
||||
|
||||
Classification markings define reusable classification levels that can be displayed as global or channel-level banners in the web and desktop apps. Each classification level includes a name, color, and rank order. You can select a preset, such as US DoD, NATO, UK GSCP, Canada, or Australia PSPF, or define custom classification levels.
|
||||
Classification markings define reusable classification levels that can be displayed as global or channel-level banners in the web and desktop apps. Each classification level includes a name, color, and rank order. You can select a preset, such as US DoD, NATO, UK GSCP, Canada, or Australia PSPF, or define custom classification levels. Levels are ordered using the same **Ranked** attribute type available for [user attributes](/administration-guide/manage/admin/user-attributes), so each level sits at a defined position from lowest to highest.
|
||||
|
||||
<Note>
|
||||
|
||||
|
||||
@@ -73,6 +73,11 @@ The **Auto-add members based on access rules** toggle controls automatic members
|
||||
- On **private** channels, users who no longer meet required attribute rules are always removed during synchronization regardless of the auto-sync setting. On **public** channels, no member is ever removed by ABAC.
|
||||
|
||||
</Important>
|
||||
<Note>
|
||||
|
||||
If a policy rule references attribute values from a `shared_only` or `source_only` attribute that you don't personally hold, those values appear as `--------` and the row is read-only. Test and Delete actions are also disabled for those rows. See [Attribute value masking](/administration-guide/manage/admin/abac-system-wide-policies#attribute-value-masking) for details.
|
||||
|
||||
</Note>
|
||||
|
||||
### Validation and safety
|
||||
|
||||
|
||||
@@ -47,6 +47,14 @@ Simple Mode is ideal for simple and straightforward access control scenarios. Ea
|
||||
> - **Starts with**: The attribute value must start with the specified value.
|
||||
> - **Ends with**: The attribute value must end with the specified value.
|
||||
> - **Contains**: The attribute value must exist somewhere with the specified value.
|
||||
>
|
||||
> When the selected attribute is a **Ranked** attribute (an ordered list of values, such as clearance or classification levels), the match options are ordered comparisons instead. These let you match everyone at or above a threshold rather than only an exact value:
|
||||
>
|
||||
> - **Is exactly** / **Is not**: The value must exactly match, or must not match, the specified value.
|
||||
> - **Is at least**: The value must be equal to or higher than the specified value - for example, clearance *is at least* Secret matches Secret and every higher level.
|
||||
> - **Is greater than**: The value must be higher than the specified value.
|
||||
> - **Is at most**: The value must be equal to or lower than the specified value.
|
||||
> - **Is less than**: The value must be lower than the specified value.
|
||||
|
||||
3. Specify the attribute values that users must have to be granted access to the channel.
|
||||
|
||||
@@ -150,3 +158,21 @@ Permission policies can be used to restrict the following actions based on user
|
||||
When a permission policy applies, users who don't match the configured attribute values can't perform the restricted action. Users may see file attachments as unavailable or redacted in messages they would otherwise have access to. See [Restricted file attachments](/end-user-guide/collaborate/share-files-in-messages#restricted-file-attachments) for the end-user-facing behavior.
|
||||
|
||||
Permission policies follow the same unique-name requirement as access policies: each parent permission policy must have a unique name, and Mattermost surfaces a user-friendly error if a duplicate name is entered.
|
||||
|
||||
## Attribute value masking
|
||||
|
||||
From Mattermost v11.8, when a policy references attribute values that the editing admin doesn't personally hold, those values are hidden in the policy editor. This prevents admins from reading or copying sensitive attribute values they're not authorized to see, while still allowing the policy to enforce access control normally.
|
||||
|
||||
Masking only applies to attributes configured with a `shared_only` or `source_only` access mode. Attributes with a `public` access mode are always visible to all admins. See [Attribute access modes](/administration-guide/manage/admin/user-attributes#attribute-access-modes) for details on how each mode controls value visibility.
|
||||
|
||||
**What you'll see:**
|
||||
|
||||
- Masked values appear as `--------` in the rule editor instead of the raw value.
|
||||
- Rows containing masked values are **read-only** and cannot be modified.
|
||||
- **Test rule** and **Delete** actions are disabled for rules that contain masked values.
|
||||
|
||||
**Enforcement is unaffected:** masking applies to the editing UI only. The underlying rules continue to control channel access and permissions as configured.
|
||||
|
||||
**To edit a masked rule**, ask the policy owner or another System Admin who holds the relevant attribute values to make the change.
|
||||
|
||||
This behavior applies to both the table editor and the CEL editor, and also to Team Admin and Channel Admin policy editors in Team Settings and Channel Settings. Requires Enterprise Advanced license and the `AttributeValueMasking` feature flag.
|
||||
@@ -11,6 +11,7 @@ Whether you’re setting up email notifications, optimizing search capabilities,
|
||||
- [Set up Mattermost Agents](/administration-guide/configure/agents-admin-guide) - Learn how to enable AI-powered Agents for your Mattermost instance.
|
||||
- [Set up auto-translation](/administration-guide/manage/admin/autotranslation) - Learn how to enable and configure automatic message translation for your Mattermost instance.
|
||||
- [Install Mattermost Boards](/administration-guide/configure/install-boards) - Learn how to install and configure the Boards plugin for your Mattermost instance.
|
||||
- [Install and manage plugins](/administration-guide/configure/manage-plugins) - Learn how to install, enable, configure, update, and remove plugins for your Mattermost instance.
|
||||
- [Manage custom user attributes](/administration-guide/manage/admin/user-attributes) - Learn how to manage custom user attributes in user profiles in Mattermost.
|
||||
- [Environment variables](/administration-guide/configure/environment-variables) - Learn how to use environment variables for Mattermost configuration.
|
||||
- [Customize the server](/administration-guide/manage/admin/customize-branding) - Learn about customizing branding for Mattermost server.
|
||||
@@ -20,3 +21,4 @@ Whether you’re setting up email notifications, optimizing search capabilities,
|
||||
- [SSL client certificate setup](/administration-guide/onboard/ssl-client-certificate) - Learn how to set up SSL client certificates for Mattermost.
|
||||
- [Connected workspaces](/administration-guide/onboard/connected-workspaces) - Learn how to connect Mattermost workspaces.
|
||||
- [Telemetry](/administration-guide/manage/telemetry) - Learn about Mattermost telemetry and data collection.
|
||||
- [Configure Azure Blob Storage as the Mattermost file store](/administration-guide/configure/azure-blob-storage) - Learn how to configure Azure Blob Storage as the Mattermost file store.
|
||||
@@ -112,6 +112,7 @@ When you disable the **Editable by Users** option for an attribute, only admins
|
||||
> - **URL** for web site address-based profile attributes.
|
||||
> - **Select** for a list of profile attribute values users can choose from. Specify each value followed by pressing **TAB** or **ENTER**. Values can be up to 64 characters long, and users can choose a single value.
|
||||
> - **Multi-select** for a list of profile attribute values users can select from. Specify each value followed by pressing **TAB** or **ENTER**. Values can be up to 64 characters long, and users can choose multiple values.
|
||||
> - **Ranked** for an ordered list of values, where each value ranks higher or lower than the others - for example, clearance or classification levels such as *Public*, *Secret*, and *Top Secret*. Specify each value, then order the values from lowest to highest rank. Users can choose a single value. Because the values are ordered, [access control policies](/administration-guide/manage/admin/abac-system-wide-policies) can compare a ranked attribute against a threshold - for example, clearance *is at least* Secret - rather than only checking for an exact match.
|
||||
|
||||
3. Specify the attribute's visibility as one of the following:
|
||||
|
||||
@@ -158,6 +159,18 @@ When updating user attributes via API or automation, the `attrs` object replaces
|
||||
|
||||
In cases where multiple system admins manage system attributes, refresh your web browser instance to see real-time updates to system attributes made by other admins.
|
||||
|
||||
## Attribute access modes
|
||||
|
||||
Each user attribute has an **access mode** that controls who can see its values when those values appear in access control policies. The access mode is set per attribute and determines whether an admin editing a policy can see the raw attribute values referenced in its rules.
|
||||
|
||||
Access modes are not configurable through the System Console. They can only be set programmatically by a Mattermost plugin using the [Property Fields API](https://api.mattermost.com/#tag/properties). Attributes created by system admins through the System Console always use the `public` access mode. A plugin that needs to restrict attribute visibility must create the field with `protected: true` and set the desired `access_mode` — this is typically done by plugins that sync sensitive attributes from an external identity source and need to control which admins can read those values.
|
||||
|
||||
- **Public** (default): The attribute value is visible to all admins editing policies that reference it. No masking is applied.
|
||||
- **Shared only**: The attribute value is only visible to admins who personally hold that same value. Admins who don't hold the value see it masked (`--------`) in the policy editor.
|
||||
- **Source only**: The attribute value is only visible to the system source that set it (for example, the identity provider). All admins see it masked in the policy editor regardless of their own attribute values.
|
||||
|
||||
Masking in the policy editor only applies to attributes with `shared_only` or `source_only` access mode. See [Attribute value masking](/administration-guide/manage/admin/abac-system-wide-policies#attribute-value-masking) for the editor behavior when masked values are present.
|
||||
|
||||
## Sync attributes with your identity provider
|
||||
|
||||
1. Synchronize a attribute with AD/LDAP or SAML by selecting **More** <img src="/img/ui/dots-horizontal_F01D8.svg" alt="Use the More icon to access additional message options." className="theme-icon" /> and selecting **Link attribute to AD/LDAP** or **Link attribute to SAML**. Mattermost takes you directly to the **AD/LDAP** or **SAML 2.0** configuration settings page in the System Console where you can map the attributes you want to synchronize.
|
||||
|
||||
@@ -72,7 +72,7 @@ Master DB Conns
|
||||
The number of active connections currently on your master database.
|
||||
|
||||
Replica DB Conns
|
||||
The number of active connections currently on one or more of [your read replica databases](/administration-guide/scale/high-availability-cluster-based-deployment#database-configuration).
|
||||
The number of active connections currently on one or more of [your read replica databases](/administration-guide/scale/high-availability-cluster-based-deployment#database).
|
||||
|
||||
Total Playbooks
|
||||
The total number of collaborative playbooks on this server.
|
||||
|
||||
@@ -23,48 +23,106 @@ This page provides guidance on configuring SAML with Microsoft Entra ID for Matt
|
||||
- A Microsoft Entra tenant containing applicable user data.
|
||||
- A verified custom domain for your tenant. See Microsoft's [Add your custom domain name to your tenant](https://learn.microsoft.com/en-us/entra/fundamentals/add-custom-domain) documentation for details.
|
||||
- A Microsoft Entra ID P1 or P2 license.
|
||||
- An account with at least the **Application Administrator** role in your Entra tenant.
|
||||
|
||||
## Set up an enterprise app for Mattermost SSO in Entra ID
|
||||
|
||||
1. Log into the Microsoft Azure portal and select the **Microsoft Entra ID** service.
|
||||
2. In the left menu, select **Manage \> Enterprise applications**.
|
||||
3. Select the **New application** button.
|
||||
4. In the **Search application** field, search for **Microsoft Entra SAML Toolkit** and select **Microsoft Entra SAML Toolkit**.
|
||||
5. In the **Name** field, enter **Mattermost SAML** then select the **Create** button.
|
||||
6. In the **Mattermost SAML** enterprise application settings, select **Manage \> Users and Groups** to assign users and/or groups to the application **or** select **Manage \> Properties** then set **Assignment required?** to **No** then select **Save**.
|
||||
7. In the **Mattermost SAML** enterprise application settings, select **Manage \> Single sign-on** then select **SAML** under **Select a single sign-on method**.
|
||||
8. Select **Edit** in the **Basic SAML Configuration section** then set the below fields then select **Save**:
|
||||
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with an account that has at least the **Application Administrator** role.
|
||||
2. In the left navigation menu, select **Entra ID > Enterprise applications**.
|
||||
3. Select **+ New application**.
|
||||
4. Select **+ Create your own application**.
|
||||
5. In the **What's the name of your app?** field, enter **Mattermost**.
|
||||
6. Under **What are you looking to do with your application?**, select **Integrate any other application you don't find in the gallery (Non-gallery)**.
|
||||
7. Select **Create**. Entra provisions the application; this may take a few seconds.
|
||||
8. In the **Mattermost** enterprise application settings, select **Manage > Users and groups**, then assign the approved users and/or groups that should have access to Mattermost.
|
||||
|
||||
> - **Identity (Entity ID)**: `https://<your-mattermost-url>`
|
||||
> - **Reply URL (Assertion Consumer Service URL)**: `https://<your-mattermost-url>/login/sso/saml`
|
||||
> - **Sign on URL**: `https://<your-mattermost-url>/login`
|
||||
<Warning>
|
||||
|
||||
9. Select **Edit** in the **Attributes & Claims** section then set the below attributes:
|
||||
Alternatively, you can select **Manage > Properties**, set **Assignment required?** to **No**, then select **Save**. This grants Mattermost access to **all users in your Entra tenant** — evaluate whether this aligns with your organization's access control requirements before proceeding.
|
||||
|
||||
> 1. Set the the **Unique User Identifier (Name ID)** required claim **Name identifier format** and **Source attribute** values as required for your environment. Setting the **Source attribute** to an immutable value such as `user.objectid` is recommended.
|
||||
> 2. Edit claim names **and namespaces** under **Additional claims** to match SAML attribute settings you wish to set in Mattermost. Configurable settings are Email, Username, Id, Guest, Admin, First Name, Last Name, Nickname, Position, and Preferred Language.
|
||||
</Warning>
|
||||
|
||||
<Important>
|
||||
9. In the **Mattermost** enterprise application settings, select **Manage > Single sign-on**, then select **SAML** under **Select a single sign-on method**.
|
||||
10. Select **Edit** in the **Basic SAML Configuration** section, then set the fields below and select **Save**:
|
||||
|
||||
Mattermost matches each attribute by its **full claim name**, including the namespace, exactly as it appears in the SAML assertion. By default, Entra ID emits its built-in claims under the namespace `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/` — so the claim that appears in the **Claim name** column as `emailaddress` is actually sent in the assertion as `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`.
|
||||
- **Identifier (Entity ID)**: `https://<your-mattermost-url>`
|
||||
- **Reply URL (Assertion Consumer Service URL)**: `https://<your-mattermost-url>/login/sso/saml`
|
||||
- **Sign on URL**: `https://<your-mattermost-url>/login`
|
||||
|
||||
This means the value you enter in each Mattermost attribute field (step 15 of **Configure SAML Sign-On for Mattermost**, below) must be the **fully-qualified** claim name. Entering only the short name (for example, `email` or `name`) will **not** match, and login will fail with an error such as `SAML login was unsuccessful because one of the attributes is incorrect... <attribute> attribute is missing`.
|
||||
11. Select **Edit** in the **Attributes & Claims** section, then configure the required claim and additional claims as described below.
|
||||
|
||||
You have two options:
|
||||
**How Entra claims map to Mattermost**
|
||||
|
||||
- **Clear the namespace** on each claim in Entra ID under **Additional claims** so the claim name becomes the short value (for example, `email`), then enter that same short value in Mattermost; **or**
|
||||
- **Leave the default namespace** in Entra ID and enter the fully-qualified claim name in Mattermost (for example, `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`).
|
||||
The SAML assertion Entra sends to Mattermost contains a set of *claims* — name/value pairs describing the user. Mattermost reads these claims based on the attribute names you configure in **System Console > Authentication > SAML 2.0 > Attributes** (for example, **Email Attribute**, **Username Attribute**, **First Name Attribute**).
|
||||
|
||||
Whichever option you choose, the value in Mattermost must match the assertion **character-for-character**. If a login fails, the safest way to confirm the exact claim names being sent is to capture and decode the SAML response from the browser (for example, with the [SAML-tracer](https://addons.mozilla.org/firefox/addon/saml-tracer/) browser extension) and read the `Name` attribute of each `<Attribute>` element.
|
||||
The **Claim name** you set in Entra must match the value you enter in the corresponding Mattermost attribute field exactly, character for character. The **Value** (also called **Source attribute**) tells Entra which user property to send — for example, `user.mail` sends the user's email address.
|
||||
|
||||
</Important>
|
||||
a. **Required claim — Unique User Identifier (Name ID)**
|
||||
|
||||
10. Select **Edit** in the **SAML Certificates** section. Select **Sign SAML response and assertion** for **Signing Option** and **SHA-256** for **Signing Algorithm** then select **Save**.
|
||||
11. Select the **Certificate (Base64)** Download link in the **SAML Certificates** section. This is the **Identity Provider Public Certificate** to be uploaded to Mattermost.
|
||||
12. In the **Mattermost SAML** enterprise application settings, select **Security \> Token encryption**. Select **Import Certificate** to import the Service Provider certificate. If you used the Bash script referenced in the **Before you begin** section, this is the `mattermost-x509.crt` file. The Import dialog says to upload a certificate with a file extension `.cer`, but `.crt` files are also accepted. Upload the file then select **Add**.
|
||||
13. Select the `...` to the right of the imported certificate details, select **Activate token encryption certificate**, then select **Yes** to activate.
|
||||
14. On the **Home** page for **Microsoft Entra ID**, select the **Overview** link in the left navigation menu and copy the **Tenant ID** value. The **Tenant ID** will be used in Mattermost **SAML 2.0** URL settings.
|
||||
15. In the left navigation menu, select **Manage \> Enterprise applications**. Select the **Mattermost SAML** application then copy the **Application ID**. The **Application ID** will be used in the **Identity Provider Metadata URL** setting in the Mattermost **SAML 2.0** settings.
|
||||
Set the **Name identifier format** and **Source attribute** values as required for your environment. The Name ID is part of the SAML assertion, but Mattermost account binding is controlled by the **Id Attribute (SAML)** setting if you configure it, or by email otherwise. If you want immutable user binding in Mattermost, add a separate `Id` claim under **Additional claims** and set its **Value** (source attribute) to an immutable Entra attribute such as `user.objectid`. `user.userprincipalname` is also a common choice for Name ID when a human-readable identifier is preferred, with the trade-off that renames in Entra can orphan the corresponding Mattermost account if you rely on it for identity matching.
|
||||
|
||||
b. **Additional claims**
|
||||
|
||||
By default, Entra populates this section with four claims using the `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/...` namespace. These work, but we recommend replacing them with short, readable names that match the attribute fields in Mattermost. To edit a claim, select it, update the **Name** field (and clear the **Namespace** field), then save.
|
||||
|
||||
<Important>
|
||||
|
||||
Mattermost matches each attribute by its **full claim name**, including the namespace, exactly as it appears in the SAML assertion. By default, Entra emits its built-in claims under the namespace `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/` — so the claim that appears in the **Claim name** column as `emailaddress` is actually sent in the assertion as `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`.
|
||||
|
||||
Entering only the short name (for example, `email` or `name`) in a Mattermost attribute field will **not** match, and login will fail with an error such as `SAML login was unsuccessful because one of the attributes is incorrect... <attribute> attribute is missing`.
|
||||
|
||||
You have two options:
|
||||
|
||||
- **Clear the namespace** on each claim in Entra ID (the approach shown in the table below) so the claim name becomes the short value (for example, `email`), then enter that same short value in Mattermost; **or**
|
||||
- **Leave the default namespace** in Entra ID and enter the fully-qualified claim name in Mattermost (for example, `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`).
|
||||
|
||||
If a login fails, the safest way to confirm the exact claim names being sent is to capture and decode the SAML response from the browser (for example, with the [SAML-tracer](https://addons.mozilla.org/firefox/addon/saml-tracer/) browser extension) and read the `Name` attribute of each `<Attribute>` element.
|
||||
|
||||
</Important>
|
||||
|
||||
The following claim configuration covers a typical Mattermost setup (using the clear-namespace option):
|
||||
|
||||
| Mattermost attribute field | Entra claim name | Entra source attribute |
|
||||
|:---|:---|:---|
|
||||
| Email Attribute | `email` | `user.mail` |
|
||||
| Username Attribute | `username` | `user.mailnickname` |
|
||||
| First Name Attribute | `firstname` | `user.givenname` |
|
||||
| Last Name Attribute | `lastname` | `user.surname` |
|
||||
| Position Attribute | `position` | `user.jobtitle` |
|
||||
|
||||
<Note>
|
||||
|
||||
Use `user.mailnickname` rather than `user.userprincipalname` as the source for the username claim. The user principal name is typically formatted as an email address (`user@domain.com`), but Mattermost usernames cannot contain the `@` character, so SAML logins using `user.userprincipalname` will fail. The mail nickname is the local part of the email address (the portion before `@`) and maps cleanly to a valid Mattermost username.
|
||||
|
||||
If your organization doesn't populate `mailnickname` consistently, another option is a custom Entra attribute or a transformation that strips the domain from the UPN.
|
||||
|
||||
</Note>
|
||||
|
||||
After editing, your **Attributes & Claims** page should look similar to the screenshot below:
|
||||
|
||||
|
||||
|
||||
The **Guest**, **Admin**, **Nickname**, and **Preferred Language** attributes are also configurable in Mattermost if you want to drive them from Entra. Use the same pattern: pick a short claim name in Entra, set its source attribute, and enter the matching claim name in the corresponding Mattermost attribute field.
|
||||
|
||||
12. Select **Edit** in the **SAML Certificates** section. Select **Sign SAML response and assertion** for **Signing Option** and **SHA-256** for **Signing Algorithm**, then select **Save**.
|
||||
13. Select the **Certificate (Base64)** Download link in the **SAML Certificates** section. This is the **Identity Provider Public Certificate** to be uploaded to Mattermost.
|
||||
14. In the **Mattermost** enterprise application settings, select **Security > Token encryption**. Select **Import Certificate** to import the Service Provider certificate. If you used the Bash script referenced in the **Before you begin** section, this is the `mattermost-x509.crt` file. The Import dialog says to upload a certificate with a file extension `.cer`, but `.crt` files are also accepted. Upload the file then select **Add**.
|
||||
15. Select the `...` to the right of the imported certificate details, select **Activate token encryption certificate**, then select **Yes** to activate.
|
||||
16. Copy the **Tenant ID** for use in the Mattermost **SAML 2.0** URL settings.
|
||||
|
||||
<Note>
|
||||
|
||||
Entra exposes three different GUIDs during this setup, and it's easy to confuse them. The **Tenant ID** identifies your entire Entra directory, while the **Application ID** and **Object ID** (visible on the enterprise application's **Properties** page) identify the Mattermost SAML application within that directory. Mattermost uses the Tenant ID and Application ID; the Object ID is not used.
|
||||
|
||||
</Note>
|
||||
|
||||
To find the Tenant ID, select **Entra ID** from the admin center home, then locate the **Tenant ID** value in the **Basic information** panel on the **Overview** page.
|
||||
|
||||
|
||||
|
||||
17. Copy the **Application ID** for use in the **Identity Provider Metadata URL** setting in the Mattermost **SAML 2.0** settings.
|
||||
|
||||
To find the Application ID, select **Entra ID > Enterprise applications** from the left navigation menu, select the **Mattermost** application, then copy the **Application ID** from the **Properties** page (shown alongside the Object ID, which is not needed).
|
||||
|
||||
## Configure SAML Sign-On for Mattermost
|
||||
|
||||
@@ -74,14 +132,14 @@ Whichever option you choose, the value in Mattermost must match the assertion **
|
||||
4. Select **Get SAML Metadata From IdP** to verify that the SAML metadata can be retrieved successfully.
|
||||
5. Set **SAML SSO URL**: `https://login.microsoftonline.com/<your-tenant-id>/saml2`
|
||||
6. Set **Identity Provider Issuer URL** (trailing slash is required): `https://sts.windows.net/<your-tenant-id>/`
|
||||
7. Choose the **Identity Provider Public Certificate** file from step 11 of **Set up an enterprise app for Mattermost SSO in Entra ID** then upload.
|
||||
7. Choose the **Identity Provider Public Certificate** file from step 13 of **Set up an enterprise app for Mattermost SSO in Entra ID** then upload.
|
||||
8. Set **Verify Signature** to **True**.
|
||||
9. Set **Service Provider Login URL**: `https://<your-mattermost-url>/login/sso/saml`
|
||||
10. Set **Service Provider Identifier**: `https://<your-mattermost-url>`
|
||||
11. Set **Enable Encryption** to **True**
|
||||
11. Set **Enable Encryption** to **True**.
|
||||
12. Choose your **Service Provider Private Key** file then upload. If you used the Bash script referenced in the **Before you begin** section, this is the `mattermost-x509.key` file.
|
||||
13. Choose your **Service Provider Public Certificate** then upload. If you used the Bash script referenced in the **Before you begin** section, this is the `mattermost-x509.crt` file.
|
||||
14. Set **Sign Request** to suit your environment. The **Signature Algorithm** must match the algorithm set in Entra ID (**RSAwithSHA256** is recommended).
|
||||
14. Set **Sign Request** to **True** if you want Mattermost to sign outbound AuthnRequests sent to Entra ID — this is distinct from Entra signing its SAML responses and assertions (configured in step 12 of the Entra setup). If enabled, set **Signature Algorithm** to **RSAwithSHA256** (Entra ID requires RSA-SHA256 for signed requests) and upload Mattermost's public certificate to Entra ID for request verification: in the enterprise application, select **SAML Certificates**, then upload the `mattermost-x509.crt` file under **Verification certificates**.
|
||||
|
||||
<Note>
|
||||
|
||||
@@ -89,11 +147,10 @@ The **Test single sign-on with Mattermost SAML** tool in Microsoft Entra ID does
|
||||
|
||||
</Note>
|
||||
|
||||
15. Set attribute settings to match attributes configured in step 9 of the **Set up an enterprise app for Mattermost SSO in Entra ID** section. Each value must match the **full claim name** sent in the assertion, including the namespace, exactly. See the **important** note under step 9 for details and a common failure mode.
|
||||
15. Set attribute settings to match the attributes configured in step 11 of the **Set up an enterprise app for Mattermost SSO in Entra ID** section. Each value must match the **full claim name** sent in the assertion, including the namespace, exactly. See the **important** note under step 11 for details and a common failure mode.
|
||||
16. Set the **Login Button Text** to suit your environment.
|
||||
17. Select the **Save** button.
|
||||
|
||||
<Inc1_sso_saml_ldapsync />
|
||||
|
||||
<Inc2_sso_saml_faq />
|
||||
:start-after: :nosearch:
|
||||
@@ -139,7 +139,7 @@ This page provides detailed write and read benchmark results for supported stora
|
||||
|
||||
- For S3 tests, [Amazon S3 exported upload part size](/administration-guide/configure/environment-configuration-settings#amazon-s3-upload-part-size) was set to the default value (100MB).
|
||||
- Local EBS storage is the stock gp3 (3000 IOPS) provided by EC2 instances.
|
||||
- Both EBS and EFS solutions tested are considered `local` storage options from the application's perspective, where the [file storage system](/administration-guide/configure/environment-configuration-settings#file-storage-system) is set to `local` in both cases. EFS is essentially AWS's managed NFS, which enables it to serve as a potential alternative to S3 by allowing multiple Mattermost nodes in a high-availability (HA) deployment to share a common file system. In such HA scenarios, the standard local file storage (e.g., an EBS volume attached to a single instance) [is not suitable, as it can't be shared across multiple nodes](/administration-guide/scale/high-availability-cluster-based-deployment#file-storage-configuration). EFS is a good alternative in this case, but EFS is not a block storage solution like EBS.
|
||||
- Both EBS and EFS solutions tested are considered `local` storage options from the application's perspective, where the [file storage system](/administration-guide/configure/environment-configuration-settings#file-storage-system) is set to `local` in both cases. EFS is essentially AWS's managed NFS, which enables it to serve as a potential alternative to S3 by allowing multiple Mattermost nodes in a high-availability (HA) deployment to share a common file system. In such HA scenarios, the standard local file storage (e.g., an EBS volume attached to a single instance) [is not suitable, as it can't be shared across multiple nodes](/administration-guide/scale/high-availability-cluster-based-deployment#file-storage). EFS is a good alternative in this case, but EFS is not a block storage solution like EBS.
|
||||
|
||||
## Supported storage options
|
||||
|
||||
|
||||
+1090
-411
File diff suppressed because it is too large.
Load diff
@@ -31,6 +31,7 @@ The above metrics can be used to calculate ETag and memory cache hit rates over
|
||||
- `mattermost_cluster_cluster_health_score`: A score that gives an idea of how well it is meeting the soft-real time requirements of the gossip protocol.
|
||||
- `mattermost_cluster_cluster_requests_total`: The total number of inter-node requests.
|
||||
- `mattermost_cluster_cluster_event_type_totals`: The total number of cluster requests sent for any type.
|
||||
- `mattermost_cluster_reliable_fallback_tcp`: The total length in bytes of the `SendBestEffort` calls (UDP) that had to fallback to `SendReliable` (TCP) because of the message length. This is a histogram with 8 buckets, from 32KiB to 4MiB. Ideally, the count of this metric should be always 0, but plugins may be misusing the websocket API and attempting to send large messages via UDP; in that case, plugins should be fixed to set [ReliableClusterSend](https://github.com/mattermost/mattermost/blob/4fe11a7d5d14616f3c31363762617ddfd99895df/server/public/model/websocket_message.go#L155-L157) to true.
|
||||
|
||||
### Database metrics
|
||||
|
||||
|
||||
@@ -142,7 +142,7 @@ Much of the preparation work is focused on ensuring the environment is deployed
|
||||
> > - Add SSL Cert
|
||||
> >
|
||||
> > > - Resource: [https://docs.mattermost.com/administration-guide/onboard/ssl-client-certificate.html](https://docs.mattermost.com/administration-guide/onboard/ssl-client-certificate.html)
|
||||
> > > - Resource: [https://docs.mattermost.com/administration-guide/scale/high-availability-cluster-based-deployment.html#proxy-server-configuration](https://docs.mattermost.com/administration-guide/scale/high-availability-cluster-based-deployment.html#proxy-server-configuration)
|
||||
> > > - Resource: [https://docs.mattermost.com/administration-guide/scale/high-availability-cluster-based-deployment.html#proxy-server](https://docs.mattermost.com/administration-guide/scale/high-availability-cluster-based-deployment.html#proxy-server)
|
||||
> >
|
||||
> > - (Optional) Set up certificate-based authentication (CBA) for user or device-based authentication with a digital certificate
|
||||
> >
|
||||
|
||||
@@ -21,6 +21,297 @@ We recommend reviewing the [additional upgrade notes](#additional-upgrade-notes)
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td rowspan="13">v11.9</td>
|
||||
<td><p>Mattermost v11.9 changes how redirect URI allowlist patterns are matched for OAuth Dynamic Client Registration (DCR). Patterns are now evaluated per URL component (scheme, host, path, and query) rather than as a whole-string glob. As a result, a pattern such as <code>https://\*.example.com/\*\*</code> no longer matches redirect URIs that include a query string (for example, <code>https://app.example.com/callback?tenant=foo</code>); redirect URIs without a query string continue to match as expected.</p><p>Admins using DCR with redirect URIs that include query strings must update their allowlist. To allow redirect URIs both with and without a query string, add two separate entries:</p><ul><li><code>https://\*.example.com/\*\*</code> — matches redirect URIs with no query string.</li><li><code>https://\*.example.com/\*\*?\*\*</code> — matches redirect URIs with any query string.</li></ul><p>A pattern that includes a query component (such as <code>?\*\*</code>) only matches URIs that also carry a query string; it will not match URIs without one. Both entries are required to cover both cases.</p></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Mattermost 11.9.0 introduces a schema change in the form of a new column added to the <code>incomingwebhooks</code> table. The <code>incomingwebhooks</code> table receives an <code>AccessExclusiveLock</code> when adding the column; however, because PostgreSQL 11+ treats <code>ADD COLUMN</code> with a non-volatile constant default as a metadata-only operation, the lock is held for only microseconds and is not proportional to row count. All concurrent reads and writes are blocked only for the instant the catalog entry is updated, then immediately released — impact to concurrent operations is negligible. Zero downtime is possible when upgrading to this release. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- up
|
||||
ALTER TABLE incomingwebhooks ADD COLUMN IF NOT EXISTS lastused bigint NOT NULL DEFAULT 0;
|
||||
-- down
|
||||
ALTER TABLE incomingwebhooks DROP COLUMN IF EXISTS lastused;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>This migration adds a new <code>voipdeviceid</code> column (<code>VARCHAR(512) NOT NULL DEFAULT ''</code>) to the <code>sessions</code> table to support associating VoIP device identifiers with user sessions. The column is defined with an empty-string default, ensuring existing rows and any rows written by older server versions automatically satisfy the <code>NOT NULL</code> constraint without requiring a data backfill. On PostgreSQL 11 and later, adding a column with a constant default is a metadata-only operation — no table rewrite occurs — so the <code>ACCESS EXCLUSIVE</code> lock on <code>sessions</code> is held for only a brief period (typically milliseconds). Administrators on large deployments should be aware that <code>sessions</code> is one of the most frequently accessed tables, and any long-running transactions already holding locks on it could cause a transient increase in lock-wait times during the migration. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- up
|
||||
ALTER TABLE sessions ADD COLUMN IF NOT EXISTS voipdeviceid VARCHAR(512) NOT NULL DEFAULT '';
|
||||
-- down
|
||||
ALTER TABLE sessions DROP COLUMN IF EXISTS voipdeviceid;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>This migration adds a composite index, <code>idx_access_control_policies_type_id</code>, on the <code>AccessControlPolicies</code> table covering the <code>Type</code> and <code>Id</code> columns. The index is intended to improve query performance when filtering or looking up access control policies by type and identifier. The index is built using <code>CREATE INDEX CONCURRENTLY</code>, meaning it is constructed in the background without blocking reads or writes on the <code>AccessControlPolicies</code> table. No columns, constraints, or existing indexes are modified or removed by this change. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- Up migration (PostgreSQL)
|
||||
CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_access_control_policies_type_id ON AccessControlPolicies(Type, Id);</code></pre><pre><code>-- Down migration (PostgreSQL)
|
||||
DROP INDEX CONCURRENTLY IF EXISTS idx_access_control_policies_type_id;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>This migration removes orphaned rows from the <code>threadmemberships</code> table — specifically, rows where the associated user is no longer a member of the channel that the thread belongs to. The cleanup is performed via a filtered <code>DELETE</code> using a three-way join across <code>threadmemberships</code>, <code>threads</code>, and <code>channelmembers</code>. No schema objects (tables, columns, or indexes) are added or removed; only data rows are affected. Note for large instances: this migration issues a single unbatched delete that scans the entirety of <code>threadmemberships</code> with a join against <code>threads</code> and <code>channelmembers</code>. On databases with tens of millions of rows or significant historical channel-membership churn, this query may run for an extended period, block autovacuum on <code>threadmemberships</code>, increase WAL pressure, and contribute to replication lag. Administrators of large deployments should test execution time on a representative dataset before upgrading and consider scheduling the upgrade during a low-traffic window. The down migration contains no rollback SQL because the deleted rows cannot be recovered; this migration is irreversible. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- Drop ThreadMembership rows whose user is no longer a member of the thread's channel.
|
||||
DELETE FROM threadmemberships WHERE (postid, userid) IN (
|
||||
SELECT
|
||||
threadmemberships.postid,
|
||||
threadmemberships.userid
|
||||
FROM
|
||||
threadmemberships
|
||||
JOIN threads ON threads.postid = threadmemberships.postid
|
||||
LEFT JOIN channelmembers ON channelmembers.userid = threadmemberships.userid
|
||||
AND threads.channelid = channelmembers.channelid
|
||||
WHERE
|
||||
channelmembers.channelid IS NULL
|
||||
);</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Migration 000199 extends the <code>property_field_type</code> enum in PostgreSQL by adding the new value <code>'rank'</code> to support rank-type property fields. The change is made via <code>ALTER TYPE property_field_type ADD VALUE IF NOT EXISTS 'rank'</code>, which is a catalog-only operation that touches only the <code>pg_enum</code> system catalog and acquires no locks on user tables such as <code>PropertyFields</code> or <code>PropertyValues</code>. Existing rows and application code are entirely unaffected by the addition. The rollback (down) migration is intentionally destructive: any <code>PropertyFields</code> rows carrying <code>Type = 'rank'</code> are coerced to <code>'select'</code>, the enum is rebuilt without the <code>'rank'</code> value, and the <code>AttributeView</code> materialized view is dropped and recreated — all of which require an <code>AccessExclusiveLock</code> on <code>PropertyFields</code> and should only be executed during a maintenance window. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- Postgres cannot remove a value from an existing enum in place, so rebuild
|
||||
-- the type without 'rank'. Any rows still holding 'rank' (e.g. fields created
|
||||
-- via the property API after this migration ran) are coerced to 'select'
|
||||
-- first so the recreated enum can accept them; 'select' has the same storage
|
||||
-- shape (single option ID).
|
||||
--
|
||||
-- The AttributeView materialized view reads PropertyFields.Type, so Postgres
|
||||
-- refuses to rebuild the enum on that column while the view exists. Drop the
|
||||
-- view before the ALTER and recreate it afterwards.
|
||||
UPDATE PropertyFields SET Type = 'select' WHERE Type = 'rank';
|
||||
DROP MATERIALIZED VIEW IF EXISTS AttributeView;
|
||||
ALTER TYPE property_field_type RENAME TO property_field_type_old;
|
||||
CREATE TYPE property_field_type AS ENUM (
|
||||
'text',
|
||||
'select',
|
||||
'multiselect',
|
||||
'date',
|
||||
'user',
|
||||
'multiuser'
|
||||
);
|
||||
ALTER TABLE PropertyFields
|
||||
ALTER COLUMN Type TYPE property_field_type USING Type::text::property_field_type;
|
||||
DROP TYPE property_field_type_old;
|
||||
-- Recreate the no-rank AttributeView (matches 000177 / 000198 down).
|
||||
CREATE MATERIALIZED VIEW IF NOT EXISTS AttributeView AS
|
||||
SELECT
|
||||
pv.GroupID,
|
||||
pv.TargetID,
|
||||
pv.TargetType,
|
||||
jsonb_object_agg(
|
||||
pf.Name,
|
||||
CASE
|
||||
WHEN pf.Type = 'select' THEN (
|
||||
SELECT to_jsonb(options.name)
|
||||
FROM jsonb_to_recordset(pf.Attrs->'options') AS options(id text, name text)
|
||||
WHERE options.id = pv.Value #>> '{}'
|
||||
LIMIT 1
|
||||
)
|
||||
WHEN pf.Type = 'multiselect' AND jsonb_typeof(pv.Value) = 'array' THEN (
|
||||
SELECT jsonb_agg(option_names.name)
|
||||
FROM jsonb_array_elements_text(pv.Value) AS option_id
|
||||
JOIN jsonb_to_recordset(pf.Attrs->'options') AS option_names(id text, name text)
|
||||
ON option_id = option_names.id
|
||||
)
|
||||
ELSE pv.Value
|
||||
END
|
||||
) AS Attributes
|
||||
FROM PropertyValues pv
|
||||
LEFT JOIN PropertyFields pf ON pf.ID = pv.FieldID
|
||||
WHERE (pv.DeleteAt = 0 OR pv.DeleteAt IS NULL)
|
||||
AND (pf.DeleteAt = 0 OR pf.DeleteAt IS NULL)
|
||||
AND pf.ObjectType = 'user'
|
||||
GROUP BY pv.GroupID, pv.TargetID, pv.TargetType;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Migration 000195 updates up to three rows in the <code>PropertyFields</code> table that belong to the <code>access_control</code> property group, converting their <code>Type</code> value from <code>'select'</code> to <code>'rank'</code> and backfilling a <code>rank</code> integer key into each element of the <code>options</code> array stored in the <code>Attrs</code> JSONB column. The affected fields are <code>classification</code> (<code>ObjectType = 'template'</code>), <code>system_classification</code> (<code>ObjectType = 'system'</code>), and <code>channel_classification</code> (<code>ObjectType = 'channel'</code>), which are part of the classification-markings feature gated behind a feature flag. No schema structure changes (DDL) are made — only targeted DML <code>UPDATE</code> statements are executed, touching at most three rows regardless of server size. Both statements run within a single transaction, so no intermediate state is ever visible to other sessions. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- up migration
|
||||
-- Convert the classification-markings property fields from 'select' to 'rank'.
|
||||
-- Each (Name, ObjectType) pair is matched explicitly so unrelated fields that
|
||||
-- happen to share a name cannot be touched. At most three rows are updated.
|
||||
UPDATE PropertyFields
|
||||
SET Type = 'rank'
|
||||
WHERE Type = 'select'
|
||||
AND GroupID = (SELECT ID FROM PropertyGroups WHERE Name = 'access_control')
|
||||
AND (
|
||||
(Name = 'classification' AND ObjectType = 'template')
|
||||
OR (Name = 'system_classification' AND ObjectType = 'system')
|
||||
OR (Name = 'channel_classification' AND ObjectType = 'channel')
|
||||
);
|
||||
-- Backfill a rank onto every option.
|
||||
UPDATE PropertyFields pf
|
||||
SET Attrs = jsonb_set(
|
||||
pf.Attrs,
|
||||
'{options}',
|
||||
(
|
||||
SELECT jsonb_agg(elem.opt || jsonb_build_object('rank', elem.ord) ORDER BY elem.ord)
|
||||
FROM jsonb_array_elements(pf.Attrs->'options') WITH ORDINALITY AS elem(opt, ord)
|
||||
)
|
||||
)
|
||||
WHERE pf.Type = 'rank'
|
||||
AND pf.GroupID = (SELECT ID FROM PropertyGroups WHERE Name = 'access_control')
|
||||
AND (
|
||||
(pf.Name = 'classification' AND pf.ObjectType = 'template')
|
||||
OR (pf.Name = 'system_classification' AND pf.ObjectType = 'system')
|
||||
OR (pf.Name = 'channel_classification' AND pf.ObjectType = 'channel')
|
||||
)
|
||||
AND jsonb_typeof(pf.Attrs->'options') = 'array'
|
||||
AND jsonb_array_length(pf.Attrs->'options') > 0;</code></pre><pre><code>-- down migration
|
||||
UPDATE PropertyFields pf
|
||||
SET Attrs = jsonb_set(
|
||||
pf.Attrs,
|
||||
'{options}',
|
||||
(
|
||||
SELECT jsonb_agg(elem.opt - 'rank' ORDER BY elem.ord)
|
||||
FROM jsonb_array_elements(pf.Attrs->'options') WITH ORDINALITY AS elem(opt, ord)
|
||||
)
|
||||
)
|
||||
WHERE pf.Type = 'rank'
|
||||
AND pf.GroupID = (SELECT ID FROM PropertyGroups WHERE Name = 'access_control')
|
||||
AND (
|
||||
(pf.Name = 'classification' AND pf.ObjectType = 'template')
|
||||
OR (pf.Name = 'system_classification' AND pf.ObjectType = 'system')
|
||||
OR (pf.Name = 'channel_classification' AND pf.ObjectType = 'channel')
|
||||
)
|
||||
AND jsonb_typeof(pf.Attrs->'options') = 'array'
|
||||
AND jsonb_array_length(pf.Attrs->'options') > 0;
|
||||
UPDATE PropertyFields
|
||||
SET Type = 'select'
|
||||
WHERE Type = 'rank'
|
||||
AND GroupID = (SELECT ID FROM PropertyGroups WHERE Name = 'access_control')
|
||||
AND (
|
||||
(Name = 'classification' AND ObjectType = 'template')
|
||||
OR (Name = 'system_classification' AND ObjectType = 'system')
|
||||
OR (Name = 'channel_classification' AND ObjectType = 'channel')
|
||||
);</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Migration 000196 updates data within the <code>PropertyFields</code> table as part of the Access Control / Properties framework. Specifically, it renames two classification field entries inside the <code>access_control</code> <code>PropertyGroups</code> group: the <code>system_classification</code> entry (<code>ObjectType = 'system'</code>) and the <code>channel_classification</code> entry (<code>ObjectType = 'channel'</code>) are both renamed to the canonical value <code>classification</code>. The rows remain distinct because the unique index on <code>PropertyFields</code> incorporates <code>ObjectType</code>, preventing collisions. This change affects at most two rows and completes near-instantly with no measurable performance impact. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- Up migration
|
||||
-- Rename the system- and channel-scoped classification linked fields so all
|
||||
-- three classification fields share the canonical Name 'classification'. They
|
||||
-- remain distinct rows because the typed unique index keys on ObjectType as
|
||||
-- well, so template/system/channel rows do not collide.
|
||||
UPDATE PropertyFields
|
||||
SET Name = 'classification'
|
||||
WHERE GroupID = (SELECT ID FROM PropertyGroups WHERE Name = 'access_control')
|
||||
AND (
|
||||
(Name = 'system_classification' AND ObjectType = 'system')
|
||||
OR (Name = 'channel_classification' AND ObjectType = 'channel')
|
||||
);
|
||||
-- Down migration
|
||||
-- Restore the previous names so the rows can be matched by 000195's down
|
||||
-- migration. Identified by ObjectType since all three classification rows
|
||||
-- share the same Name='classification' at this point.
|
||||
UPDATE PropertyFields
|
||||
SET Name = 'system_classification'
|
||||
WHERE GroupID = (SELECT ID FROM PropertyGroups WHERE Name = 'access_control')
|
||||
AND Name = 'classification'
|
||||
AND ObjectType = 'system';
|
||||
UPDATE PropertyFields
|
||||
SET Name = 'channel_classification'
|
||||
WHERE GroupID = (SELECT ID FROM PropertyGroups WHERE Name = 'access_control')
|
||||
AND Name = 'classification'
|
||||
AND ObjectType = 'channel';</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Migration 000178 extends the <code>AttributeView</code> materialized view — part of the ABAC/property system — to add support for <code>rank</code>-typed property fields. Previously, <code>rank</code>-typed values were stored as raw values in the view; they are now materialized as <code>{'{'}"name": <option-name>, "rank": <option-rank>{'}'}</code> JSON objects, enabling ABAC policies to compare rank values without embedding rank integers directly in policy expressions. The migration drops and recreates <code>AttributeView</code> in a single transaction, performing a full scan of <code>PropertyValues</code> and <code>PropertyFields</code> at migration time. Because these tables are gated behind a feature flag and expected to be empty or near-empty at the time of this migration, the performance impact is negligible for most deployments. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- Extend the AttributeView matview to materialize rank-typed property values
|
||||
-- as {"{"}"name": <option-name>, "rank": <option-rank>{"}"} so ABAC policies can
|
||||
-- compare ranks without storing rank integers in policy expressions.
|
||||
DROP MATERIALIZED VIEW IF EXISTS AttributeView;
|
||||
CREATE MATERIALIZED VIEW IF NOT EXISTS AttributeView AS
|
||||
SELECT
|
||||
pv.GroupID,
|
||||
pv.TargetID,
|
||||
pv.TargetType,
|
||||
jsonb_object_agg(
|
||||
pf.Name,
|
||||
CASE
|
||||
WHEN pf.Type = 'select' THEN (
|
||||
SELECT to_jsonb(options.name)
|
||||
FROM jsonb_to_recordset(pf.Attrs->'options') AS options(id text, name text)
|
||||
WHERE options.id = pv.Value #>> '{}'
|
||||
LIMIT 1
|
||||
)
|
||||
WHEN pf.Type = 'multiselect' AND jsonb_typeof(pv.Value) = 'array' THEN (
|
||||
SELECT jsonb_agg(option_names.name)
|
||||
FROM jsonb_array_elements_text(pv.Value) AS option_id
|
||||
JOIN jsonb_to_recordset(pf.Attrs->'options') AS option_names(id text, name text)
|
||||
ON option_id = option_names.id
|
||||
)
|
||||
WHEN pf.Type = 'rank' THEN (
|
||||
SELECT jsonb_build_object(
|
||||
'name', options.name,
|
||||
'rank', options.rank
|
||||
)
|
||||
FROM jsonb_to_recordset(pf.Attrs->'options')
|
||||
AS options(id text, name text, rank int)
|
||||
WHERE options.id = pv.Value #>> '{}'
|
||||
LIMIT 1
|
||||
)
|
||||
ELSE pv.Value
|
||||
END
|
||||
) AS Attributes
|
||||
FROM PropertyValues pv
|
||||
LEFT JOIN PropertyFields pf ON pf.ID = pv.FieldID
|
||||
WHERE (pv.DeleteAt = 0 OR pv.DeleteAt IS NULL)
|
||||
AND (pf.DeleteAt = 0 OR pf.DeleteAt IS NULL)
|
||||
AND pf.ObjectType = 'user'
|
||||
GROUP BY pv.GroupID, pv.TargetID, pv.TargetType;</code></pre><pre><code>-- Restore the 000177 matview definition (no rank branch).
|
||||
DROP MATERIALIZED VIEW IF EXISTS AttributeView;
|
||||
CREATE MATERIALIZED VIEW IF NOT EXISTS AttributeView AS
|
||||
SELECT
|
||||
pv.GroupID,
|
||||
pv.TargetID,
|
||||
pv.TargetType,
|
||||
jsonb_object_agg(
|
||||
pf.Name,
|
||||
CASE
|
||||
WHEN pf.Type = 'select' THEN (
|
||||
SELECT to_jsonb(options.name)
|
||||
FROM jsonb_to_recordset(pf.Attrs->'options') AS options(id text, name text)
|
||||
WHERE options.id = pv.Value #>> '{}'
|
||||
LIMIT 1
|
||||
)
|
||||
WHEN pf.Type = 'multiselect' AND jsonb_typeof(pv.Value) = 'array' THEN (
|
||||
SELECT jsonb_agg(option_names.name)
|
||||
FROM jsonb_array_elements_text(pv.Value) AS option_id
|
||||
JOIN jsonb_to_recordset(pf.Attrs->'options') AS option_names(id text, name text)
|
||||
ON option_id = option_names.id
|
||||
)
|
||||
ELSE pv.Value
|
||||
END
|
||||
) AS Attributes
|
||||
FROM PropertyValues pv
|
||||
LEFT JOIN PropertyFields pf ON pf.ID = pv.FieldID
|
||||
WHERE (pv.DeleteAt = 0 OR pv.DeleteAt IS NULL)
|
||||
AND (pf.DeleteAt = 0 OR pf.DeleteAt IS NULL)
|
||||
AND pf.ObjectType = 'user'
|
||||
GROUP BY pv.GroupID, pv.TargetID, pv.TargetType;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Added an <code>expiresat</code> column and partial index to <code>useraccesstokens</code> to support PAT expiry enforcement. Large-dataset testing was not required for this migration as <code>useraccesstokens</code> is not a large table. <code>useraccesstokens</code> receives a brief ACCESS EXCLUSIVE lock when adding the column (Migration 000187, metadata-only, no table rewrite on PostgreSQL 11+), and a SHARE UPDATE EXCLUSIVE lock during the index build via CREATE INDEX CONCURRENTLY (Migration 000188), which never blocks concurrent reads or writes. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- Migration 000187 (transactional):
|
||||
ALTER TABLE useraccesstokens ADD COLUMN IF NOT EXISTS expiresat bigint NOT NULL DEFAULT 0;
|
||||
-- Migration 000188 (run via morph as nontransactional):
|
||||
CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_useraccesstokens_expiresat
|
||||
ON useraccesstokens (expiresat)
|
||||
WHERE expiresat > 0;
|
||||
-- Down migrations:
|
||||
DROP INDEX CONCURRENTLY IF EXISTS idx_useraccesstokens_expiresat;
|
||||
ALTER TABLE useraccesstokens DROP COLUMN IF EXISTS expiresat;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Added support for <code>board</code> as a new channel bookmark type by introducing a <code>targetid</code> column and a corresponding index on the <code>channelbookmarks</code> table. The only table touched is <code>channelbookmarks</code>. The nullable column add is metadata-only with a negligible exclusive lock duration. The index build uses <code>CONCURRENTLY</code> and runs online without blocking DML. Existing <code>link</code> and <code>file</code> bookmark rows and queries are unaffected, and the new <code>targetid</code> column is nullable with no default, which is inert to old code. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- 000190_channel_bookmarks_board_target_id.up.sql
|
||||
ALTER TYPE channel_bookmark_type ADD VALUE IF NOT EXISTS 'board';
|
||||
ALTER TABLE channelbookmarks ADD COLUMN IF NOT EXISTS targetid varchar(26) DEFAULT NULL;
|
||||
-- 000191_channel_bookmarks_target_id_index.up.sql
|
||||
-- morph:nontransactional
|
||||
CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_channelbookmarks_type_targetid ON channelbookmarks (type, targetid) WHERE targetid IS NOT NULL;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Added a <code>SchemaVersion</code> column (<code>integer DEFAULT 1 NOT NULL</code>) to the <code>PropertyGroups</code> table. Large-dataset testing was not performed for this migration. The only table touched is <code>PropertyGroups</code>, which is a small registry table holding one row per registered property group. <code>PropertyGroups</code> receives a brief access exclusive lock when adding the column, held only momentarily for a metadata-only catalog update with no table rewrite. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>ALTER TABLE PropertyGroups ADD COLUMN IF NOT EXISTS SchemaVersion integer DEFAULT 1 NOT NULL;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><p>Two new database migrations introduce the <code>ChannelGuards</code> table, which enables plugins to register exclusive ownership of channels. Migration <code>000185</code> creates the <code>ChannelGuards</code> table with three columns — <code>ChannelId</code>, <code>PluginId</code>, and <code>CreatedAt</code> — and a composite primary key on (<code>ChannelId, PluginId</code>) to enforce uniqueness per plugin per channel. Migration <code>000186</code> adds the secondary index <code>idx_channel_guards_plugin_id</code> on the <code>PluginId</code> column to support efficient plugin-scoped queries against the table. Both migrations are safe to run online with no locking impact on existing production tables. The migrations are fully backwards-compatible and no database downtime is expected for this upgrade. The SQL queries included are:</p><pre><code>-- 000185_create_channel_guards.up.sql
|
||||
CREATE TABLE IF NOT EXISTS ChannelGuards (
|
||||
ChannelId varchar(26) NOT NULL,
|
||||
PluginId varchar(190) NOT NULL,
|
||||
CreatedAt bigint NOT NULL,
|
||||
PRIMARY KEY (ChannelId, PluginId)
|
||||
);</code></pre><pre><code>-- 000185_create_channel_guards.down.sql
|
||||
DROP TABLE IF EXISTS ChannelGuards;</code></pre><pre><code>-- 000186_create_channel_guards_plugin_id_index.up.sql
|
||||
-- morph:nontransactional
|
||||
CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_channel_guards_plugin_id ON ChannelGuards(PluginId);</code></pre><pre><code>-- 000186_create_channel_guards_plugin_id_index.down.sql
|
||||
-- morph:nontransactional
|
||||
DROP INDEX CONCURRENTLY IF EXISTS idx_channel_guards_plugin_id;</code></pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="8">v11.8</td>
|
||||
<td>The Custom Profile Attributes property group is renamed from <code>custom_profile_attributes</code> to <code>access_control</code>, and CPA fields and values are migrated from the legacy property model to the v2 model. The functionality of the CPA feature is unchanged. Plugin developers that use CPA will need to register against the new group name.</td>
|
||||
</tr>
|
||||
|
||||
@@ -36,6 +36,7 @@ The following open source components are used to provide the full benefits of Ma
|
||||
|
||||
## Mobile
|
||||
|
||||
- Mattermost Mobile v2.42.0 - [View Open Source Components](https://github.com/mattermost/mattermost-mobile/blob/release-2.42/NOTICE.txt).
|
||||
- Mattermost Mobile v2.41.0 - [View Open Source Components](https://github.com/mattermost/mattermost-mobile/blob/release-2.41/NOTICE.txt).
|
||||
- Mattermost Mobile v2.40.0 - [View Open Source Components](https://github.com/mattermost/mattermost-mobile/blob/release-2.40/NOTICE.txt).
|
||||
- Mattermost Mobile v2.39.0 - [View Open Source Components](https://github.com/mattermost/mattermost-mobile/blob/release-2.39/NOTICE.txt).
|
||||
@@ -137,6 +138,7 @@ The following open source components are used to provide the full benefits of Ma
|
||||
|
||||
## Server
|
||||
|
||||
- Mattermost Enterprise Edition v11.9.0 - [View Open Source Components](https://github.com/mattermost/mattermost-server/blob/release-11.9/NOTICE.txt).
|
||||
- Mattermost Enterprise Edition v11.8.0 - [View Open Source Components](https://github.com/mattermost/mattermost-server/blob/release-11.8/NOTICE.txt).
|
||||
- Mattermost Enterprise Edition v11.7.0 - [View Open Source Components](https://github.com/mattermost/mattermost-server/blob/release-11.7/NOTICE.txt).
|
||||
- Mattermost Enterprise Edition v11.6.0 - [View Open Source Components](https://github.com/mattermost/mattermost-server/blob/release-11.6/NOTICE.txt).
|
||||
|
||||
@@ -37,14 +37,14 @@ SSH onto the target host and download the release. Replace `amd64` with `arm64`
|
||||
<TabItem value="latest" label="Latest release" default>
|
||||
|
||||
```sh
|
||||
wget https://releases.mattermost.com/11.8.3/mattermost-11.8.3-linux-amd64.tar.gz
|
||||
wget https://releases.mattermost.com/11.9.0/mattermost-11.9.0-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="esr" label="Current ESR">
|
||||
|
||||
```sh
|
||||
wget https://releases.mattermost.com/11.7.6/mattermost-11.7.6-linux-amd64.tar.gz
|
||||
wget https://releases.mattermost.com/11.7.7/mattermost-11.7.7-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
|
||||
@@ -48,14 +48,14 @@ SSH onto the target host and download the release. Replace `amd64` with `arm64`
|
||||
<TabItem value="latest" label="Latest release" default>
|
||||
|
||||
```sh
|
||||
wget https://releases.mattermost.com/11.8.3/mattermost-11.8.3-linux-amd64.tar.gz
|
||||
wget https://releases.mattermost.com/11.9.0/mattermost-11.9.0-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="esr" label="Current ESR">
|
||||
|
||||
```sh
|
||||
wget https://releases.mattermost.com/11.7.6/mattermost-11.7.6-linux-amd64.tar.gz
|
||||
wget https://releases.mattermost.com/11.7.7/mattermost-11.7.7-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
</TabItem>
|
||||
|
||||
@@ -252,7 +252,11 @@ Yes! From Mattermost v8.0 and Calls v0.17.0, desktop app and web users can go to
|
||||
|
||||
### Is video supported?
|
||||
|
||||
The integration currently supports only voice calling and screen sharing. We're considering video support in the future.
|
||||
From Mattermost Calls plugin v1.12.0, experimental video support is available in direct message (DM) calls on the desktop and web apps. It's disabled by default; a system admin can enable it using the [Enable video calls in DMs (Experimental)](/administration-guide/configure/plugins-configuration-settings#enable-video-calls-in-dms-experimental) plugin setting in the System Console. The following limitations apply:
|
||||
|
||||
- Video is available in DM calls only. All other calls continue to support voice calling and screen sharing only.
|
||||
- Video isn't available on the mobile app. Mobile users can't start a video call, and when they join a DM call that includes video, it behaves like an audio call — they hear voice and see shared screens, but don't see video.
|
||||
- Call recordings don't capture video. Recordings include voice and screen sharing only.
|
||||
|
||||
### Can I password-protect a call?
|
||||
|
||||
|
||||
@@ -9,6 +9,8 @@ Mattermost's pre-built plugins make it simple for teams to extend Mattermost wit
|
||||
|
||||
Learn more about what popular [pre-built integrations are available and how to install them](/integrations-guide/popular-integrations).
|
||||
|
||||
As a system admin, see the [install and manage plugins](/administration-guide/configure/manage-plugins) documentation for step-by-step instructions on installing, enabling, configuring, updating, and removing plugins.
|
||||
|
||||
<Tip>
|
||||
|
||||
The [Mattermost Marketplace](https://mattermost.com/marketplace/) offers an expanded selection of community supported integrations.
|
||||
|
||||
@@ -23,7 +23,7 @@ Mattermost releases a new desktop app version every 4 months, in February, May,
|
||||
|
||||
| **Release** | **Support** | **Compatible with** |
|
||||
|:---|:---|:---|
|
||||
| v6.2 [Download](https://github.com/mattermost/desktop/releases/tag/v6.2.2) \| [Changelog](./desktop-app-changelog#release-v6-2) \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.2.2/sbom-desktop-v6.2.2.json) | Released: 2026-05-15<br/>Support Ends: 2027-05-15 [EXTENDED](./release-policy#release-types) | [v11.8](./mattermost-v11-changelog#release-v11-8-feature-release), [v11.7](./mattermost-v11-changelog#release-v11-7-extended-support-release), [v11.6](./mattermost-v11-changelog#release-v11-6-feature-release), [v11.5](./mattermost-v11-changelog#release-v11-5-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
| v6.2 [Download](https://github.com/mattermost/desktop/releases/tag/v6.2.2) \| [Changelog](./desktop-app-changelog#release-v6-2) \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.2.2/sbom-desktop-v6.2.2.json) | Released: 2026-05-15<br/>Support Ends: 2027-05-15 [EXTENDED](./release-policy#release-types) | [v11.9](./mattermost-v11-changelog#release-v11-9-feature-release), [v11.8](./mattermost-v11-changelog#release-v11-8-feature-release), [v11.7](./mattermost-v11-changelog#release-v11-7-extended-support-release), [v11.6](./mattermost-v11-changelog#release-v11-6-feature-release), [v11.5](./mattermost-v11-changelog#release-v11-5-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
| v6.1 [Download](https://github.com/mattermost/desktop/releases/tag/v6.1.2) \| [Changelog](./desktop-app-changelog#release-v6-1) \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.1.2/sbom-desktop-v6.1.2.json) | Released: 2026-03-02<br/>Support Ends: 2026-05-15 | [v11.6](./mattermost-v11-changelog#release-v11-6-feature-release), [v11.5](./mattermost-v11-changelog#release-v11-5-feature-release), [v11.4](./mattermost-v11-changelog#release-v11-4-feature-release), [v11.3](./mattermost-v11-changelog#release-v11-3-feature-release), [v11.2](./mattermost-v11-changelog#release-v11-2-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
| v6.0 [Download](https://github.com/mattermost/desktop/releases/tag/v6.0.4) \| [Changelog](./desktop-app-changelog#release-v6-0) \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v6.0.4/sbom-desktop-v6.0.4.json) | Released: 2025-11-14<br/>Support Ends: 2026-03-15 | [v11.4](./mattermost-v11-changelog#release-v11-4-feature-release), [v11.3](./mattermost-v11-changelog#release-v11-3-feature-release), [v11.2](./mattermost-v11-changelog#release-v11-2-feature-release), [v11.1](./mattermost-v11-changelog#release-v11-1-feature-release), [v11.0](./mattermost-v11-changelog#release-v11-0-major-release), [v10.12](./mattermost-v10-changelog#release-v10-12-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
| v5.13 [Download](https://github.com/mattermost/desktop/releases/tag/v5.13.7) \| [Changelog](./desktop-app-changelog#release-v5-13) \| [SBOM download](https://github.com/mattermost/desktop/releases/download/v5.13.7/sbom-desktop-v5.13.7.json) | Released: 2025-08-15<br/>Support Ends: 2026-08-15 [EXTENDED](./release-policy#release-types) | [v11.0](./mattermost-v11-changelog#release-v11-0-major-release), [v10.12](./mattermost-v10-changelog#release-v10-12-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release), [v10.10](./mattermost-v10-changelog#release-v10-10-feature-release), [v10.9](./mattermost-v10-changelog#release-v10-9-feature-release), [v10.5](./mattermost-v10-changelog#release-v10-5-extended-support-release) |
|
||||
|
||||
@@ -24,6 +24,7 @@ We strongly recommend using the latest mobile app release available that contain
|
||||
|
||||
| **Release** | **Support** | **Compatible with** |
|
||||
|:---|:---|:---|
|
||||
| v2.42 [FEATURE](./mobile-app-changelog#release-v2-42-2) \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.42.2) \| [Changelog](./mobile-app-changelog#release-v2-42-2) \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.42.2/sbom-mattermost-mobile-v2.42.2.json) | Released: 2026-07-16<br/>Support Ends: 2026-08-15 | [v11.9](./mattermost-v11-changelog#release-v11-9-feature-release), [v11.8](./mattermost-v11-changelog#release-v11-8-feature-release), [v11.7](./mattermost-v11-changelog#release-v11-7-extended-support-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
| v2.41 [FEATURE](./mobile-app-changelog#release-v2-41-3) \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.41.3) \| [Changelog](./mobile-app-changelog#release-v2-41-3) \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.41.3/sbom-mattermost-mobile-v2.41.3.json) | Released: 2026-06-16<br/>Support Ends: 2026-07-15 | [v11.8](./mattermost-v11-changelog#release-v11-8-feature-release), [v11.7](./mattermost-v11-changelog#release-v11-7-extended-support-release), [v11.6](./mattermost-v11-changelog#release-v11-6-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
| v2.40 [FEATURE](./mobile-app-changelog#release-v2-40-0) \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.40.0) \| [Changelog](./mobile-app-changelog#release-v2-40-0) \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.40.0/sbom-mattermost-mobile-v2.40.0.json) | Released: 2026-05-15<br/>Support Ends: 2026-06-15 | [v11.7](./mattermost-v11-changelog#release-v11-7-extended-support-release), [v11.6](./mattermost-v11-changelog#release-v11-6-feature-release), [v11.5](./mattermost-v11-changelog#release-v11-5-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
| v2.39 [FEATURE](./mobile-app-changelog#release-v2-39-0) \| [Download](https://github.com/mattermost/mattermost-mobile/releases/tag/v2.39.0) \| [Changelog](./mobile-app-changelog#release-v2-39-0) \| [SBOM download](https://github.com/mattermost/mattermost-mobile/releases/download/v2.39.0/sbom-mattermost-mobile-v2.39.0.json) | Released: 2026-04-16<br/>Support Ends: 2026-05-15 | [v11.6](./mattermost-v11-changelog#release-v11-6-feature-release), [v11.5](./mattermost-v11-changelog#release-v11-5-feature-release), [v11.4](./mattermost-v11-changelog#release-v11-4-feature-release), [v10.11](./mattermost-v10-changelog#release-v10-11-extended-support-release) |
|
||||
@@ -78,4 +79,3 @@ Note that the below versions have not yet been tested. The information below is
|
||||
| v2.45 | Releasing: 2026-10-16<br/>Support Ends: 2026-11-15 | v11.12, v11.11, v11.10, v11.7 |
|
||||
| v2.44 | Releasing: 2026-09-16<br/>Support Ends: 2026-10-15 | v11.11, v11.10, v11.9, v11.7 |
|
||||
| v2.43 | Releasing: 2026-08-16<br/>Support Ends: 2026-09-15 | v11.10, v11.9, v11.8, v11.7, v10.11 |
|
||||
| v2.42 | Releasing: 2026-07-16<br/>Support Ends: 2026-08-15 | v11.9, v11.8, v11.7, v10.11 |
|
||||
@@ -17,8 +17,9 @@ Mattermost releases a new server version on the 16th of each month in [binary fo
|
||||
|
||||
| **Release** | **Released on** | **Support ends** |
|
||||
|:---|:---|:---|
|
||||
| v11.8 [Download](https://releases.mattermost.com/11.8.3/mattermost-11.8.3-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-8-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.8.3/sbom-mattermost-v11.8.3.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.8.3/sbom-enterprise-v11.8.3.json">Enterprise</a></li></ul></details> | 2026-06-16 | 2026-09-15 |
|
||||
| v11.7 [Download](https://releases.mattermost.com/11.7.6/mattermost-11.7.6-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-7-extended-support-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.7.6/sbom-mattermost-v11.7.6.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.7.6/sbom-enterprise-v11.7.6.json">Enterprise</a></li></ul></details> | 2026-05-15 | 2027-05-15 [EXTENDED](./release-policy#release-types) |
|
||||
| v11.9 [Download](https://releases.mattermost.com/11.9.0/mattermost-11.9.0-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-9-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.9.0/sbom-mattermost-v11.9.0.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.9.0/sbom-enterprise-v11.9.0.json">Enterprise</a></li></ul></details> | 2026-07-16 | 2026-10-15 |
|
||||
| v11.8 [Download](https://releases.mattermost.com/11.8.4/mattermost-11.8.4-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-8-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.8.4/sbom-mattermost-v11.8.4.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.8.4/sbom-enterprise-v11.8.4.json">Enterprise</a></li></ul></details> | 2026-06-16 | 2026-09-15 |
|
||||
| v11.7 [Download](https://releases.mattermost.com/11.7.7/mattermost-11.7.7-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-7-extended-support-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.7.7/sbom-mattermost-v11.7.7.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.7.7/sbom-enterprise-v11.7.7.json">Enterprise</a></li></ul></details> | 2026-05-15 | 2027-05-15 [EXTENDED](./release-policy#release-types) |
|
||||
| v11.6 [Download](https://releases.mattermost.com/11.6.6/mattermost-11.6.6-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-6-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.6.6/sbom-mattermost-v11.6.6.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.6.6/sbom-enterprise-v11.6.6.json">Enterprise</a></li></ul></details> | 2026-04-16 | 2026-07-15 |
|
||||
| v11.5 [Download](https://releases.mattermost.com/11.5.7/mattermost-11.5.7-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-5-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.5.7/sbom-mattermost-v11.5.7.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.5.7/sbom-enterprise-v11.5.7.json">Enterprise</a></li></ul></details> | 2026-03-16 | 2026-06-15 |
|
||||
| v11.4 [Download](https://releases.mattermost.com/11.4.5/mattermost-11.4.5-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-4-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.4.5/sbom-mattermost-v11.4.5.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.4.5/sbom-enterprise-v11.4.5.json">Enterprise</a></li></ul></details> | 2026-02-16 | 2026-05-15 |
|
||||
@@ -27,7 +28,7 @@ Mattermost releases a new server version on the 16th of each month in [binary fo
|
||||
| v11.1 [Download](https://releases.mattermost.com/11.1.3/mattermost-11.1.3-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-1-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.1.3/sbom-mattermost-v11.1.3.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.1.3/sbom-enterprise-v11.1.3.json">Enterprise</a></li></ul></details> | 2025-11-14 | 2026-02-15 |
|
||||
| v11.0 [Download](https://releases.mattermost.com/11.0.7/mattermost-11.0.7-linux-amd64.tar.gz) \| [Changelog](./mattermost-v11-changelog#release-v11-0-major-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v11.0.7/sbom-mattermost-v11.0.7.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/11.0.7/sbom-enterprise-v11.0.7.json">Enterprise</a></li></ul></details> | 2025-10-16 | 2026-01-15 |
|
||||
| v10.12 [Download](https://releases.mattermost.com/10.12.4/mattermost-10.12.4-linux-amd64.tar.gz) \| [Changelog](./mattermost-v10-changelog#release-v10-12-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v10.12.4/sbom-mattermost-v10.12.4.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/10.12.4/sbom-enterprise-v10.12.4.json">Enterprise</a></li></ul></details> | 2025-09-16 | 2025-12-15 |
|
||||
| v10.11 [Download](https://releases.mattermost.com/10.11.21/mattermost-10.11.21-linux-amd64.tar.gz) \| [Changelog](./mattermost-v10-changelog#release-v10-11-extended-support-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v10.11.21/sbom-mattermost-v10.11.21.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/10.11.21/sbom-enterprise-v10.11.21.json">Enterprise</a></li></ul></details> | 2025-08-15 | 2026-08-15 [EXTENDED](./release-policy#release-types) |
|
||||
| v10.11 [Download](https://releases.mattermost.com/10.11.22/mattermost-10.11.22-linux-amd64.tar.gz) \| [Changelog](./mattermost-v10-changelog#release-v10-11-extended-support-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v10.11.22/sbom-mattermost-v10.11.22.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/10.11.22/sbom-enterprise-v10.11.22.json">Enterprise</a></li></ul></details> | 2025-08-15 | 2026-08-15 [EXTENDED](./release-policy#release-types) |
|
||||
| v10.10 [Download](https://releases.mattermost.com/10.10.3/mattermost-10.10.3-linux-amd64.tar.gz) \| [Changelog](./mattermost-v10-changelog#release-v10-10-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v10.10.3/sbom-mattermost-v10.10.3.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/10.10.3/sbom-enterprise-v10.10.3.json">Enterprise</a></li></ul></details> | 2025-07-16 | 2025-10-15 |
|
||||
| v10.9 [Download](https://releases.mattermost.com/10.9.5/mattermost-10.9.5-linux-amd64.tar.gz) \| [Changelog](./mattermost-v10-changelog#release-v10-9-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v10.9.5/sbom-mattermost-v10.9.5.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/10.9.5/sbom-enterprise-v10.9.5.json">Enterprise</a></li></ul></details> | 2025-06-16 | 2025-09-15 |
|
||||
| v10.8 [Download](https://releases.mattermost.com/10.8.4/mattermost-10.8.4-linux-amd64.tar.gz) \| [Changelog](./mattermost-v10-changelog#release-v10-8-feature-release) \| <details class="mm-sbom"><summary>SBOM</summary><ul><li><a href="https://github.com/mattermost/mattermost/releases/download/v10.8.4/sbom-mattermost-v10.8.4.json">Team Edition</a></li><li><a href="https://releases.mattermost.com/10.8.4/sbom-enterprise-v10.8.4.json">Enterprise</a></li></ul></details> | 2025-05-16 | 2025-08-15 |
|
||||
|
||||
@@ -92,6 +92,14 @@ If you upgrade from a release earlier than v10.10, please read the other [Import
|
||||
|
||||
</Important>
|
||||
|
||||
- **10.11.22, released 2026-07-17**
|
||||
- Mattermost v10.11.22 contains low to high severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/).
|
||||
- Pre-packaged Playbooks plugin version [v2.4.7](https://github.com/mattermost/mattermost-plugin-playbooks/releases/tag/v2.4.7).
|
||||
- Pre-packaged Jira plugin version [v4.7.1](https://github.com/mattermost/mattermost-plugin-jira/releases/tag/v4.7.1).
|
||||
- Pre-packaged Boards plugin version [v9.2.6](https://github.com/mattermost/mattermost-plugin-boards/releases/tag/v9.2.6).
|
||||
- Tightened validation when updating channel member roles via the API.
|
||||
- Tightened authorization on the OAuth deauthorization and personal access token management endpoints.
|
||||
- Mattermost v10.11.22 contains no database or functional changes.
|
||||
- **10.11.21, released 2026-06-26**
|
||||
- Mattermost v10.11.21 contains low to medium severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/).
|
||||
- Pre-packaged GitLab plugin version [v1.12.3](https://github.com/mattermost/mattermost-plugin-gitlab/releases/tag/v1.12.3).
|
||||
|
||||
@@ -14,8 +14,179 @@ Platform and OS scope reflects reported and tested environments and may not repr
|
||||
|
||||
</Note>
|
||||
|
||||
## Release v11.9 - [Feature Release](https://docs.mattermost.com/product-overview/release-policy.html#release-types) \{#release-v11-9-feature-release}
|
||||
|
||||
**Release day: 2026-07-16**
|
||||
|
||||
<Important>
|
||||
|
||||
**Breaking Changes**
|
||||
- Mattermost v11.9 changes how redirect URI allowlist patterns are matched for OAuth Dynamic Client Registration (DCR). Patterns are now evaluated per URL component (scheme, host, path, and query) rather than as a whole-string glob. See the [Important Upgrade Notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html) for more details.
|
||||
|
||||
</Important>
|
||||
|
||||
### Upgrade Impact
|
||||
|
||||
#### Database Schema Changes
|
||||
- The following schema changes are included in the v11.9 release. No database downtime is expected for this upgrade. See the [Important Upgrade Notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html) for more details.
|
||||
- Added the ``voipdeviceid`` column to the ``sessions`` table to support VoIP device tracking; metadata-only DDL on PostgreSQL 11+, minimal performance impact expected.
|
||||
- Added composite index ``idx_access_control_policies_type_id`` on ``AccessControlPolicies(Type, Id)`` to improve policy lookup performance with no downtime or blocking impact.
|
||||
- Removed orphaned ``threadmemberships`` rows where the user is no longer a channel member; irreversible data-only migration that may run slowly on large instances.
|
||||
- Added a ``lastused`` column to ``incomingwebhooks`` with a negligible-duration catalog-only lock and no downtime required.
|
||||
- Added ``'rank'`` to the ``property_field_type`` enum via a catalog-only ``ALTER TYPE`` statement; no user-table locks are acquired and no downtime is required for the upgrade.
|
||||
- Converted up to three classification-marking ``PropertyFields`` from type ``'select'`` to ``'rank'`` and backfilled rank ordering into their options; negligible performance impact.
|
||||
- Added ``rank``-type support to the ``AttributeView`` materialized view so ABAC policies can evaluate ranked property options; no performance impact expected on feature-flagged deployments.
|
||||
- Renamed ``system_classification`` and ``channel_classification`` entries in ``PropertyFields`` to the canonical name ``classification``; affects at most two rows with no performance impact.
|
||||
- Added an ``expiresat`` column and partial index to ``useraccesstokens`` to support PAT expiry enforcement, with no large-table impact or downtime required.
|
||||
- Added a ``SchemaVersion`` column to ``PropertyGroups`` with no large-table impact or downtime required.
|
||||
- Added a ``targetid`` column and ``idx_channelbookmarks_type_targetid`` index to ``channelbookmarks`` to support a new ``board`` bookmark type, with no impact to existing bookmarks or downtime required.
|
||||
- Added the ``ChannelGuards`` table and a ``PluginId`` index to support plugin-exclusive channel ownership, with no downtime or backwards-compatibility impact.
|
||||
|
||||
#### config.json
|
||||
New setting options were added to ``config.json``. Below is a list of the additions and their default values on install. The settings can be modified in ``config.json``, or the System Console when available.
|
||||
- **Changes to All plans:**
|
||||
- Under ``AccessControlSettings`` in ``config.json``, added ``EnforceDeviceIDConsistency`` configuration setting to enforce device ID consistency across sessions.
|
||||
- Under ``AccessControlSettings`` in ``config.json``, added ``TrustProxyDeviceIdentityHeader`` configuration setting to trust a proxy-supplied device identity header for session attribute collection.
|
||||
- **Changes to All plans:**
|
||||
- Under ``FileSettings`` in ``config.json``, added ``AzureStorageAccount``, ``AzureAccessKey``, ``AzureContainer``, ``AzurePathPrefix``, ``AzureEndpoint``, ``AzureSSL``, and ``AzureRequestTimeoutMilliseconds`` configuration settings for Azure Blob Storage filestore backend support.
|
||||
- Under ``FileSettings`` in ``config.json``, added ``AzureCloud``, ``ExportAzureCloud``, ``AzureAuthMode``, ``ExportAzureAuthMode``, and ``ExportAzurePresignExpiresSeconds`` configuration settings for Azure Blob Storage support.
|
||||
- Under ``FileSettings`` in ``config.json``, added ``ExtractContentTimeout`` configuration setting to limit how long a single uploaded document's content extraction occupies a worker (default 10 seconds).
|
||||
- Under ``ServiceSettings`` in ``config.json``, added ``MaximumPersonalAccessTokenLifetimeDays`` configuration setting to require personal access tokens to expire within a configured maximum lifetime (``0`` imposes no policy).
|
||||
|
||||
<Important>
|
||||
|
||||
If you upgrade from a release earlier than v11.8, please read the other [Important Upgrade Notes](https://docs.mattermost.com/administration-guide/upgrade/important-upgrade-notes.html). In case of an upgrade failure, please check the [Downgrade Guide](https://docs.mattermost.com/administration-guide/upgrade/downgrading-mattermost-server.html) and the [Recovery Guide](https://docs.mattermost.com/deployment-guide/backup-disaster-recovery.html) for rollback steps and interim mitigation strategy.
|
||||
|
||||
</Important>
|
||||
|
||||
### Improvements
|
||||
See [this blog post](https://mattermost.com/blog/mattermost-v11-9-0-is-now-available/) on the highlights in our latest release.
|
||||
|
||||
#### User Interface
|
||||
- Pre-packaged Jira plugin version [v4.7.1](https://github.com/mattermost/mattermost-plugin-jira/releases/tag/v4.7.1).
|
||||
- Pre-packaged Playbooks plugin version [v2.10.0](https://github.com/mattermost/mattermost-plugin-playbooks/releases/tag/v2.10.0).
|
||||
- Pre-packaged Agents plugin version [v2.4.2](https://github.com/mattermost/mattermost-plugin-agents/releases/tag/v2.4.2).
|
||||
- Pre-packaged [Calls plugin](https://docs.mattermost.com/end-user-guide/collaborate/make-calls.html) version [v1.12.1](https://github.com/mattermost/mattermost-plugin-calls/releases/tag/v1.12.1).
|
||||
- Pre-packaged Boards plugin version [v9.3.0](https://github.com/mattermost/mattermost-plugin-boards/releases/tag/v9.3.0).
|
||||
- Pre-packaged GitLab plugin version [v1.13.0](https://github.com/mattermost/mattermost-plugin-gitlab/releases/tag/v1.13.0).
|
||||
- Added zoom and pan support to the image file preview: use the scroll wheel to zoom at the cursor, click-and-drag to pan, and +/-/0 keyboard shortcuts (reported on webapp).
|
||||
- Added a toast notification for plugin-rejected file uploads, consistent with the existing notification for rejected downloads.
|
||||
- Added a Data Spillage Handling feature discovery page in the System Console for lower-tier licenses.
|
||||
- Added clearer validation messaging for invalid user attribute names in the System Console.
|
||||
- Incoming webhooks now show information about the last time they were triggered.
|
||||
- Threads started by a webhook are no longer highlighted for the user who owns the webhook.
|
||||
- Added user setting "Auto-follow threads on channel-wide mentions" (Settings → Notifications). When disabled, @channel/@all/@here mentions no longer force thread membership; users still receive mention notifications but must manually follow the thread.
|
||||
- Hardened the web app against crashes caused by components rendered by a plugin.
|
||||
|
||||
#### Plugins/Integrations
|
||||
- Implemented clickable action buttons inside post markdown for bots, webhooks, and plugins. Integrations bind ``mmaction://`` markdown links to actions defined in a new ``mm_blocks_actions`` post property.
|
||||
- Added channel bookmark type ``board`` with an optional ``target_id``. The bookmarks API rejects creating, updating, or deleting board bookmarks but allows reordering them when the caller has bookmark order permission.
|
||||
- Added a webapp hook ``registerChannelTypeOption``.
|
||||
- Added a ``MessagesWillBeConsumedWithContext`` plugin hook.
|
||||
- Added a ``ChannelWillBeUpdated`` plugin hook.
|
||||
- Added a ``ChannelWillBeRestored`` plugin hook.
|
||||
- Added a ``ScheduledPostWillBeCreated`` plugin hook.
|
||||
- Added a ``DraftWillBeUpserted`` plugin hook.
|
||||
- Added a webapp hook ``registerChannelIconOverride``.
|
||||
- Added a webapp hook ``registerChannelComposerBannerComponent``.
|
||||
- Added a webapp hook ``registerPostHeaderComponent``.
|
||||
- Added a webapp hook ``registerComposerPlaceholder``.
|
||||
- Added a webapp hook ``registerProductSwitcherMenuItem``.
|
||||
- Added ``RegisterChannelGuard`` and ``UnregisterChannelGuard`` plugin api methods.
|
||||
|
||||
#### Administration
|
||||
- Added [Azure Blob Storage](https://docs.mattermost.com/administration-guide/configure/azure-blob-storage.html) support.
|
||||
- Added Azure Blob Storage as a selectable backend in the File Storage and Export Storage admin console panels. The S3 Test Connection control is now backend-agnostic and validates the active driver.
|
||||
- Added an Azure Cloud selector to the Azure Blob Storage admin panels with built-in support for Azure Commercial and Azure Government endpoints. Choose "Custom Endpoint" to point at Azurite, a reverse proxy, or any other Azure cloud by providing the full Blob service URL.
|
||||
- Added a Microsoft Entra ID / ``DefaultAzureCredential`` authentication mode to the Azure Blob Storage admin panels alongside the existing shared-key path. Select "Default credential (Microsoft Entra ID)" to authenticate via managed identity, workload identity, service principal environment variables, or ``az login`` — whichever the host environment provides — with no access key required.
|
||||
- Added Azure Blob Storage support for the optional presigned export-download feature (``EnableExportDirectDownload``). Bulk-export downloads now generate a time-limited Shared Access Signature when the export backend is Azure, matching the existing S3 behavior. A new ``FileSettings.ExportAzurePresignExpiresSeconds`` configuration field controls the SAS lifetime (defaults to 6 hours, capped at Azure's 7-day SAS limit).
|
||||
- Added validation of the Azure file storage account name and routed Azure custom-endpoint requests through the standard outbound HTTP transport.
|
||||
- Added SAML connectivity status and error diagnostics to support packet output.
|
||||
- Added OAuth2/OpenID Connect provider connectivity status (GitLab, Google, Office365, OpenID) to the support packet diagnostics.
|
||||
- Added database diagnostics to the support packet, covering connection pool stats on every supported driver and PostgreSQL aggregate performance indicators (cache hit ratio, deadlocks, temp files, lock wait/idle activity, longest running query, and Posts autovacuum/dead tuples). Per-query timeouts and partial-failure handling keep packet generation resilient when individual pg_stat queries fail.
|
||||
- Personal access tokens can now be required to expire within a configured maximum lifetime via the new ``MaximumPersonalAccessTokenLifetimeDays`` System Console setting (non-zero = expiry required and capped to that many days; ``0``, the default, imposes no policy). The policy applies only to newly created tokens; bot tokens are exempt. The ``POST /users/{'{'}id{'}'}/tokens`` endpoint now accepts a client-supplied ``expires_at`` (Unix millis), and ``mmctl user token generate`` gained an ``--expires-in`` flag (e.g. ``--expires-in 90d``) for creating expiring tokens via CLI. Added an ``ExpiresAt`` column to the ``UserAccessTokens`` table and enforced expiry at token validation time. Expired personal access tokens are now rejected with HTTP 401 and reaped hourly by a new background job (``cleanup_expired_access_tokens``); audit events are emitted on rejection (``rejectExpiredUserAccessToken``) and reap (``expireUserAccessToken``). Tokens with ``ExpiresAt = 0`` remain non-expiring, preserving behavior for all pre-existing tokens. Added an expiry chooser to the **Personal Access Token** creation user interface in **Account Settings**, backed by the new ``ServiceSettings.MaximumPersonalAccessTokenLifetimeDays`` admin policy, which is now also configurable in the ``System Console`` under ``Integrations > Integration Management``. The token list (user and admin) shows each token's expiry and status (active / expired / disabled) with a warning when a token is within 7 days of expiry.
|
||||
- Added a pre-migration setup to fix incorrect database migration numbers that prevented upgrading Mattermost from v10.11 to v11.7.
|
||||
- Added a new ``FileSettings.ExtractContentTimeout`` setting (default 10 seconds) that limits how long a single uploaded document's content extraction occupies a worker, and moved document content extraction to a dedicated, non-blocking worker pool so it no longer delays file uploads for other users.
|
||||
- Stopped logging the email subject in the "sending mail" server log to prevent potential exposure of PII such as sender names from Direct Message and mention notifications.
|
||||
- Enabled CJK (Chinese, Japanese, Korean) search by default for PostgreSQL.
|
||||
- Added support for OpenSearch v3, while continuing to support OpenSearch v2.
|
||||
- User attributes can now be synced with AD/LDAP or SAML whether they are user-editable or admin-managed. When an attribute is synced, the "Editable by users" toggle is disabled; remove the sync link to change it again.
|
||||
- Added [attribute value masking](https://docs.mattermost.com/administration-guide/manage/admin/abac-system-wide-policies.html) for access control policies: admins who don't hold specific attribute values see a masked placeholder (``--------``) instead of the raw value, with affected rule rows set to read-only and save/delete actions disabled. Applies to the table editor, CEL editor, and team settings modal. Requires Enterprise Advanced license.
|
||||
- Added support for iOS Calls ring for Direct/Group Message channels.
|
||||
- Expanded session attribute collection to include values provided by Desktop App and Mobile clients.
|
||||
- Removed legacy interactive dialog code path on webapp.
|
||||
- Added a channel-guard enforcement for scheduled posts and drafts.
|
||||
- Added Phase 8b, 8c, 8d, 8e, 8f, 8h, 12, and 12e of the ``mbe-tech-preview``.
|
||||
- Added a ``mattermost db ping`` [subcommand](https://docs.mattermost.com/deployment-guide/reference-architecture/deployment-scenarios/air-gapped-deployment.html) that waits for the database to become reachable, with configurable ``--timeout`` and ``--retry-interval`` flags.
|
||||
- Added a new "rank" [custom profile attribute](https://docs.mattermost.com/administration-guide/manage/admin/abac-system-wide-policies.html#define-access-control-policies) type whose options carry an explicit ordering. System Admins can create and manage ranked attributes in the **System Console** and assign ranked values to users, enabling attribute-based access control policies that compare clearance- or classification-style attributes with ordinal operators (for example, "is at least Secret") instead of enumerating every qualifying value.
|
||||
- Added a new ``ClusterReliableFallbackLength`` [metric](https://docs.mattermost.com/administration-guide/scale/performance-monitoring-metrics.html) with the total length in bytes of the ``SendBestEffort`` calls (UDP) that had to fallback to TCP because of the message length.
|
||||
- Made ``SendBestEffort`` cluster messages fall back to using TCP when their length is larger than a UDP datagram.
|
||||
- Added a license preview and diff view when uploading a new license in the System Console, allowing administrators to compare the new license's features with the current license before applying.
|
||||
- Added a new ``mattermost_system_server_info`` Prometheus metric that exposes the server version and build hash as labels.
|
||||
- Enabled support for [permission-action rules](https://docs.mattermost.com/administration-guide/manage/admin/attribute-based-access-control.html) (file upload, file download) on channel-scope access control policies, with a new "Simulate access" modal in System Console and Channel Settings that previews per-user, per-action decisions before saving. Requires the Enterprise Advanced license.
|
||||
|
||||
#### Performance
|
||||
- Benchmarking test results showed no significant difference: a +1.44% increase in the number of supported users for the new release, which lies within the ``[-5%, +5%]`` prediction interval. View the full raw data and methodology in our [Performance Reports repository](https://github.com/mattermost/performance-reports/tree/main/performance-comparisons/v11.9).
|
||||
- Improved the performance of concurrent logins by removing a global mutex in favour of database serialization for computing login attempts. This, in turn, fixed the semantics of the ``MaximumLoginAttempts`` setting, which is now honored across all nodes in the cluster: instead of allowing ``n*MaximumLoginAttempts`` attempts, with ``n`` the number of nodes, we now allow ``MaximumLoginAttempts`` attempts regardless of the number of nodes.
|
||||
- Reduced cluster send error logs from oversized ``plugin_statuses_changed`` WebSocket events.
|
||||
|
||||
### Bug Fixes
|
||||
- Fixed an issue where a file read failure while building a Global Relay compliance export could crash the server.
|
||||
- Fixed display of long usernames in the user account menu.
|
||||
- Fixed a white flash that appeared in the global header and left sidebar when switching between products (Playbooks/Boards) and Channels.
|
||||
- Fixed an issue where the AI actions toolbar separator was shown when no AI actions button was available.
|
||||
- Fixed an issue where the Incoming Webhooks list reordered entries between page navigations.
|
||||
- Fixed a JavaScript error when reviewers received content review updates for permanently removed flagged posts.
|
||||
- Fixed an issue where the Global Threads view showed only 1 quick reaction emoji in the post hover toolbar instead of 3 (reported on webapp).
|
||||
- Fixed IPv6 addresses containing hex segments (e.g. ``:beef:``) being incorrectly rendered as custom emoji in the web app.
|
||||
- Fixed a bulk-import failure ("ChannelMember not found") when a group-channel hash already existed but its membership was incomplete — for example with concurrent import workers, a prior import that crashed mid-loop, or a pre-existing group channel whose membership had drifted.
|
||||
- Fixed an issue where the content review bot Direct Message displayed an empty ``""`` block under "With comment" when the reporter or reviewer did not enter a comment.
|
||||
- Fixed incorrect encoding of image URLs containing query parameters when using an image proxy (reported on webapp).
|
||||
- Fixed an issue where the SAML metadata endpoint did not correctly pull the IDP public certificate.
|
||||
- Fixed an issue where selecting a new role for a team or channel linked to a group in the System Console would not update the role dropdown in the user interface.
|
||||
- Fixed an issue where importing direct or group message channels without scheme flags in the payload (notably from mmetl Slack exports) produced channel members with no effective role, breaking the message input for those channels on the web client.
|
||||
- Fixed the Membership Policies row action Edit option to open the membership policy editor.
|
||||
- Fixed the onboarding checklist button positioning when a bottom classification banner is visible.
|
||||
- Fixed a regression that made the Integrations and Custom Emoji pages illegible when using a dark theme (reported on webapp).
|
||||
- Fixed an issue where the Role and Permissions column values in the System Console Permission Policies (and Membership Policies) list ran together without a separator and were truncated mid-word instead of showing an ellipsis.
|
||||
- Fixed an issue where a channel member removed by an attribute-based access control (ABAC) access-rule change could still appear in the Channel Info Members list until a full page reload, even though the member count was correct.
|
||||
- Fixed an issue where "Mark as Unread" from the channel sidebar did nothing when the most recent message in the channel was a system join/leave message (reported on MacOS / Desktop App).
|
||||
- Fixed an issue where channel admins saw "Failed to load this channel's permission policy" on the Permissions Policy tab when the channel had no access control policy configured.
|
||||
- [Fixed](https://docs.mattermost.com/end-user-guide/collaborate/react-with-emojis-gifs.html) custom emoji upload size and GIF frame limits.
|
||||
- Fixed file moves and copies on S3 file stores failing for files larger than 5 GiB (for example, finalizing an ``mmctl`` import upload of an import archive over 5 GiB) by using a server-side multipart copy.
|
||||
- Fixed an issue where a bot user created by a plugin could become the first system admin on a fresh install (reported on webapp and browser).
|
||||
- Fixed an issue where a custom classification selection was lost if a user selected a preset from the classification preset options.
|
||||
- Fixed validation for ``PUT /api/v4/users/{'{'}user_id{'}'}/auth`` to reject unknown auth services and prevent auth data on email/password users.
|
||||
- Fixed an issue that caused a flagged post to continue being visible for content reviewers until a refresh after deletion.
|
||||
- Preserved unknown permissions during migrations on downgrade.
|
||||
- Fixed an issue where channels with a permission-only access control policy (and no membership policy) were incorrectly hidden from the channel picker in the Invite People → Invite as Guest flow.
|
||||
- Tightened authorization on the OAuth deauthorization and personal access token management endpoints.
|
||||
- Tightened validation when updating channel member roles via the API.
|
||||
- Fixed an issue where the **Channel Settings Permissions Policy** rule editor cleared all entered fields (role, conditions, and permissions) when a validation error was shown on save.
|
||||
- Avoided saving stale configurations from the System Console by refreshing a system admin's snapshot of the configuration whenever it changed.
|
||||
- Fixed an issue where the Bot Accounts page loaded at most 200 bots, hiding newer bots from the list and search on servers with more than 200 bot accounts.
|
||||
|
||||
### API Changes
|
||||
- Added ``POST /file/test`` (``testFileStore``) API endpoint for backend-agnostic file store connection testing.
|
||||
- Added ``POST /file/s3_test`` (``testFileStore``) API endpoint.
|
||||
- Removed ``POST /file/s3_test`` (``testS3``) API endpoint.
|
||||
- Added ``GET /access_control/policy`` (``getTeamAccessControlPolicy``) API endpoint.
|
||||
- Added ``GET /sessions/attributes/manifest`` (``getSessionAttributesManifest``) API endpoint.
|
||||
- Added a new API file: ``team_abac_api_test.go``.
|
||||
- Added a new API file: ``team_membership_enforcement_test.go``.
|
||||
|
||||
### Audit Log Event Changes
|
||||
- Added ``AuditEventRejectExpiredUserAccessToken`` audit log event.
|
||||
|
||||
### Go Version
|
||||
- v11.9 is built with Go ``v1.26.4``.
|
||||
|
||||
## Release v11.8 - [Feature Release](https://docs.mattermost.com/product-overview/release-policy.html#release-types) \{#release-v11-8-feature-release}
|
||||
|
||||
- **11.8.4, released 2026-07-17**
|
||||
- Mattermost v11.8.4 contains medium to high severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/).
|
||||
- Pre-packaged Boards plugin version [v9.2.6](https://github.com/mattermost/mattermost-plugin-boards/releases/tag/v9.2.6).
|
||||
- Mattermost v11.8.4 contains no database or functional changes.
|
||||
- **11.8.3, released 2026-07-08**
|
||||
- Mattermost v11.8.3 contains a medium severity level security fix. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/).
|
||||
- Avoided saving stale configurations from the System Console by refreshing a system admin's snapshot of the configuration whenever it changed.
|
||||
@@ -67,6 +238,12 @@ New setting options were added to ``config.json``. Below is a list of the additi
|
||||
- Under ``ElasticsearchSettings`` in ``config.json``, added ``EnableSearchPublicChannelsWithoutMembership`` configuration setting to allow searching in public channels the user isn't a member of.
|
||||
- Under ``TeamSettings`` in ``config.json``, added ``EnableChannelCategorySorting`` configuration setting to add, edit, and remove managed categories.
|
||||
|
||||
<Important>
|
||||
|
||||
If you upgrade from a release earlier than v11.7, please read the other [Important Upgrade Notes](https://docs.mattermost.com/administration-guide/upgrade/important-upgrade-notes.html). In case of an upgrade failure, please check the [Downgrade Guide](https://docs.mattermost.com/administration-guide/upgrade/downgrading-mattermost-server.html) and the [Recovery Guide](https://docs.mattermost.com/deployment-guide/backup-disaster-recovery.html) for rollback steps and interim mitigation strategy.
|
||||
|
||||
</Important>
|
||||
|
||||
### Improvements
|
||||
|
||||
See [this blog post](https://mattermost.com/blog/mattermost-v11-8-0-is-now-available/) on the highlights in our latest release.
|
||||
@@ -196,6 +373,17 @@ See [this blog post](https://mattermost.com/blog/mattermost-v11-8-0-is-now-avail
|
||||
|
||||
## Release v11.7 - [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#release-types) \{#release-v11-7-extended-support-release}
|
||||
|
||||
- **11.7.7, released 2026-07-17**
|
||||
- Mattermost v11.7.7 contains low to high severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/).
|
||||
- Pre-packaged Playbooks plugin version [v2.9.2](https://github.com/mattermost/mattermost-plugin-playbooks/releases/tag/v2.9.2).
|
||||
- Pre-packaged Jira plugin version [v4.7.1](https://github.com/mattermost/mattermost-plugin-jira/releases/tag/v4.7.1).
|
||||
- Pre-packaged Boards plugin version [v9.2.6](https://github.com/mattermost/mattermost-plugin-boards/releases/tag/v9.2.6).
|
||||
- Tightened validation when updating channel member roles via the API.
|
||||
- Tightened authorization on the OAuth deauthorization and personal access token management endpoints.
|
||||
- Fixed an issue where a file read failure while building a Global Relay compliance export could crash the server.
|
||||
- Fixed an issue with plugin configuration loss on High Availability nodes with incomplete plugin sync.
|
||||
- Fixed an issue where the **Bot Accounts** page loaded at most 200 bots, hiding newer bots from the list and search on servers with more than 200 bot accounts.
|
||||
- Mattermost v11.7.7 contains no database or functional changes.
|
||||
- **11.7.6, released 2026-06-26**
|
||||
- Mattermost v11.7.6 contains low severity level security fixes. [Upgrading](https://docs.mattermost.com/upgrade/upgrading-mattermost-server.html) to this release is recommended. Details will be posted on our [security updates page](https://mattermost.com/security-updates/) 30 days after release as per the [Mattermost Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/).
|
||||
- Pre-packaged GitLab plugin version [v1.12.3](https://github.com/mattermost/mattermost-plugin-gitlab/releases/tag/v1.12.3).
|
||||
|
||||
@@ -16,6 +16,70 @@ Platform and OS scope reflects reported and tested environments and may not repr
|
||||
|
||||
</Note>
|
||||
|
||||
## 2.42.2 Release \{#release-v2-42-2}
|
||||
- Release Date: July 18, 2026
|
||||
- Server Versions Supported: Server v10.11.0+ is required. Self-Signed SSL certificates are not supported unless the user installs the CA certificate on their device.
|
||||
|
||||
### Compatibility
|
||||
- **Upgrade to server version v10.11.0 or later is required.** Support for server [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#extended-support-releases) (ESR) v10.5.0 has ended and upgrading to server ESR v10.11.0 or later is required. As we innovate and offer newer versions of our mobile apps, we maintain backwards compatibility only with supported server versions. Users who upgrade to the newest mobile apps while being connected to an unsupported server version can be exposed to compatibility issues, which can cause crashes or severe bugs that break core functionality of the app.
|
||||
- Android operating system 7+ [is required by Google](https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html).
|
||||
- iPhone 8+ devices and later with iOS 16.0+ are [required](https://support.apple.com/en-il/guide/iphone/iphe3fa5df43/16.0/ios/16.0).
|
||||
|
||||
### Bug Fixes
|
||||
- Fixed an issue where threads could appear blank when opened, and where the code viewer, About Mattermost, and timezone selection screens could display corrupted text.
|
||||
|
||||
### Known Issues
|
||||
- Users are unable to adjust the font size via the OS font size setting.
|
||||
- Some Google Pixel phones on Android 12+ might not continue past the login screen. This is a known issue with the OS, and the current workaround is to restart the device.
|
||||
|
||||
## 2.42.1 Release \{#release-v2-42-1}
|
||||
- Release Date: July 17, 2026
|
||||
- Server Versions Supported: Server v10.11.0+ is required. Self-Signed SSL certificates are not supported unless the user installs the CA certificate on their device.
|
||||
|
||||
### Compatibility
|
||||
- **Upgrade to server version v10.11.0 or later is required.** Support for server [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#extended-support-releases) (ESR) v10.5.0 has ended and upgrading to server ESR v10.11.0 or later is required. As we innovate and offer newer versions of our mobile apps, we maintain backwards compatibility only with supported server versions. Users who upgrade to the newest mobile apps while being connected to an unsupported server version can be exposed to compatibility issues, which can cause crashes or severe bugs that break core functionality of the app.
|
||||
- Android operating system 7+ [is required by Google](https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html).
|
||||
- iPhone 8+ devices and later with iOS 16.0+ are [required](https://support.apple.com/en-il/guide/iphone/iphe3fa5df43/16.0/ios/16.0).
|
||||
|
||||
### Bug Fixes
|
||||
- Fixed an issue when logging in with numeric only IDs.
|
||||
|
||||
### Known Issues
|
||||
- Users are unable to adjust the font size via the OS font size setting.
|
||||
- Some Google Pixel phones on Android 12+ might not continue past the login screen. This is a known issue with the OS, and the current workaround is to restart the device.
|
||||
|
||||
## 2.42.0 Release \{#release-v2-42-0}
|
||||
- Release Date: July 16, 2026
|
||||
- Server Versions Supported: Server v10.11.0+ is required. Self-Signed SSL certificates are not supported unless the user installs the CA certificate on their device.
|
||||
|
||||
### Compatibility
|
||||
- **Upgrade to server version v10.11.0 or later is required.** Support for server [Extended Support Release](https://docs.mattermost.com/product-overview/release-policy.html#extended-support-releases) (ESR) v10.5.0 has ended and upgrading to server ESR v10.11.0 or later is required. As we innovate and offer newer versions of our mobile apps, we maintain backwards compatibility only with supported server versions. Users who upgrade to the newest mobile apps while being connected to an unsupported server version can be exposed to compatibility issues, which can cause crashes or severe bugs that break core functionality of the app.
|
||||
- Android operating system 7+ [is required by Google](https://android-developers.googleblog.com/2017/12/improving-app-security-and-performance.html).
|
||||
- iPhone 8+ devices and later with iOS 16.0+ are [required](https://support.apple.com/en-il/guide/iphone/iphe3fa5df43/16.0/ios/16.0).
|
||||
|
||||
### Improvements
|
||||
- Added iOS PushKit + CallKit support for Mattermost Calls. The native iOS incoming-call user interface now appears when a call is received while the app is backgrounded, locked, or closed; users can answer or decline from the lock screen, get lock-screen / control-center controls during an active call, and the system handles audio routing. The Android microphone foreground service was reimplemented as part of `@mattermost/calls-native`, replacing the `@voximplant/react-native-foreground-service` dependency (no user-visible change on Android).
|
||||
- Added support for inline action buttons in markdown messages on mobile via the `mmaction://` link scheme. Buttons render in posts from bots, webhooks and server plugins, and trigger the same interactive dialog flow as the webapp.
|
||||
- Added Offline Persistence Timer support for Mobile Ephemeral Mode. Added settings for monitoring offline usage and honoring organizations to purge the Mattermost app data when needed. Ephemeral mode on mobile depends on the feature flag turned on for the server side.
|
||||
- Added support for conversation-entity backed agent posts (mattermost-plugin-agents v2.0), including server-computed approval state and per-requester tool call scoping.
|
||||
- Removed legacy interactive dialog code path.
|
||||
|
||||
### Bug Fixes
|
||||
- Fixed a user interface issue where custom status appeared misaligned in the channel header.
|
||||
- Fixed an issue with the copy code button color with header button theming across Sapphire and Denim themes.
|
||||
- Fixed an issue where an unsaved post could briefly reappear in Saved Messages.
|
||||
- Fixed an issue where pinned messages were displayed in the wrong order.
|
||||
- Fixed an issue where opening an archived channel could hang, and joining an archived channel failed on iOS.
|
||||
- Fixed an issue where scheduled messages with an invalid time displayed "Invalid Date".
|
||||
- Fixed an issue where an archived-channel banner could briefly flicker when dismissing dialogs.
|
||||
- Fixed an issue where archiving a channel redirected users to the channel list instead of keeping users in the archived channel (reported on iOS and Android).
|
||||
- Fixed an issue with the audio selector for Calls on Android devices.
|
||||
- Fixed an issue on Android where it was not possible to download logs or files from the gallery.
|
||||
|
||||
### Known Issues
|
||||
- Users are unable to adjust the font size via the OS font size setting.
|
||||
- Some Google Pixel phones on Android 12+ might not continue past the login screen. This is a known issue with the OS, and the current workaround is to restart the device.
|
||||
|
||||
## 2.41.3 Release \{#release-v2-41-3}
|
||||
- Release Date: July 7, 2026
|
||||
- Server Versions Supported: Server v10.11.0+ is required. Self-Signed SSL certificates are not supported unless the user installs the CA certificate on their device.
|
||||
|
||||
@@ -82,10 +82,11 @@ gantt
|
||||
v11.3 :done, 2026-01-16, 2026-04-15
|
||||
v11.4 :done, 2026-02-16, 2026-05-15
|
||||
v11.5 :done, 2026-03-16, 2026-06-15
|
||||
v11.6 :active, 2026-04-16, 2026-07-15
|
||||
v11.6 :done, 2026-04-16, 2026-07-15
|
||||
v11.7 & Desktop App v6.2 Extended Support :crit, 2026-05-15, 2027-05-15
|
||||
v11.8 :active, 2026-06-16, 2026-09-15
|
||||
v11.9 :active, 2026-07-16, 2026-10-15
|
||||
v11.10 :active, 2026-08-16, 2026-11-15
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
@@ -18,6 +18,38 @@ This changelog tracks User Interface (UI) and Accessibility (ADA) changes across
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Added zoom and pan support to the image file preview: use the scroll wheel to zoom at the cursor, click-and-drag to pan, and +/-/0 keyboard shortcuts (reported on webapp).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Added a toast notification for plugin-rejected file uploads, consistent with the existing notification for rejected downloads.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Added a Data Spillage Handling feature discovery page in the System Console for lower-tier licenses.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Added clearer validation messaging for invalid user attribute names in the System Console.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Incoming webhooks now show information about the last time they were triggered.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Threads started by a webhook are no longer highlighted for the user who owns the webhook.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Added user setting "Auto-follow threads on channel-wide mentions" (Settings → Notifications). When disabled, @channel/@all/@here mentions no longer force thread membership; users still receive mention notifications but must manually follow the thread.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.9</td>
|
||||
<td>(UI) Hardened the web app against crashes caused by components rendered by a plugin.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>v11.8</td>
|
||||
<td>(UI) Added a new keyboard shortcut, ``Shift`` + ``ESC``, that marks all channels, threads, and direct messages as read for a team on webapp / desktop app.</td>
|
||||
</tr>
|
||||
|
||||
@@ -19,17 +19,23 @@ Our package signing key has been moved away from Keybase. If you still reference
|
||||
<Tabs>
|
||||
<TabItem value="mattermost-enterprise" label="Mattermost Enterprise">
|
||||
|
||||
Mattermost Enterprise Edition v11.8.3 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-8-feature-release) - [Download](https://releases.mattermost.com/11.8.3/mattermost-11.8.3-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.8.3/mattermost-11.8.3-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `960131db16510e4b524a20775dad3ac42085445c2ef3b66e7a2809185a65cd5d`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.8.3/mattermost-11.8.3-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.8.3/mattermost-11.8.3-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/11.8.3/sbom-enterprise-v11.8.3.json](https://releases.mattermost.com/11.8.3/sbom-enterprise-v11.8.3.json)
|
||||
Mattermost Enterprise Edition v11.9.0 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-9-feature-release) - [Download](https://releases.mattermost.com/11.9.0/mattermost-11.9.0-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.9.0/mattermost-11.9.0-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `8b335213debfa817084870f09e28c3ecabb899cbfbf39a167d81dee68d96d6e3`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.9.0/mattermost-11.9.0-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.9.0/mattermost-11.9.0-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/11.9.0/sbom-enterprise-v11.9.0.json](https://releases.mattermost.com/11.9.0/sbom-enterprise-v11.9.0.json)
|
||||
|
||||
Mattermost Enterprise Edition v11.7.6 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-7-extended-support-release) - [Download](https://releases.mattermost.com/11.7.6/mattermost-11.7.6-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.7.6/mattermost-11.7.6-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `264fccda79d59d64874508ebe825cc2a59c1f68f1dae1d9bbee03525db3e3eda`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.7.6/mattermost-11.7.6-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.7.6/mattermost-11.7.6-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/11.7.6/sbom-enterprise-v11.7.6.json](https://releases.mattermost.com/11.7.6/sbom-enterprise-v11.7.6.json)
|
||||
Mattermost Enterprise Edition v11.8.4 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-8-feature-release) - [Download](https://releases.mattermost.com/11.8.4/mattermost-11.8.4-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.8.4/mattermost-11.8.4-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `a1809895094cae12c9d091b97380daf0fff9530ff61e50990aa03db58f67eaa1`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.8.4/mattermost-11.8.4-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.8.4/mattermost-11.8.4-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/11.8.4/sbom-enterprise-v11.8.4.json](https://releases.mattermost.com/11.8.4/sbom-enterprise-v11.8.4.json)
|
||||
|
||||
Mattermost Enterprise Edition v11.7.7 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-7-extended-support-release) - [Download](https://releases.mattermost.com/11.7.7/mattermost-11.7.7-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.7.7/mattermost-11.7.7-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `e498312ed51ab0d91a1b0f79bc927ef6b0b0b6cbc7905d8c96a7f9d329ea6d7c`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.7.7/mattermost-11.7.7-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.7.7/mattermost-11.7.7-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/11.7.7/sbom-enterprise-v11.7.7.json](https://releases.mattermost.com/11.7.7/sbom-enterprise-v11.7.7.json)
|
||||
|
||||
Mattermost Enterprise Edition v11.6.6 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-6-feature-release) - [Download](https://releases.mattermost.com/11.6.6/mattermost-11.6.6-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.6.6/mattermost-11.6.6-linux-amd64.tar.gz`
|
||||
@@ -79,11 +85,11 @@ Mattermost Enterprise Edition v10.12.4 - [View Changelog](https://docs.mattermos
|
||||
- GPG Signature: [https://releases.mattermost.com/10.12.4/mattermost-10.12.4-linux-amd64.tar.gz.sig](https://releases.mattermost.com/10.12.4/mattermost-10.12.4-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/10.12.4/sbom-enterprise-v10.12.4.json](https://releases.mattermost.com/10.12.4/sbom-enterprise-v10.12.4.json)
|
||||
|
||||
Mattermost Enterprise Edition v10.11.21 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v10-changelog.html#release-v10-11-extended-support-release) - [Download](https://releases.mattermost.com/10.11.21/mattermost-10.11.21-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/10.11.21/mattermost-10.11.21-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `e7adcb633a2beb781a60345e8e6ff127af372e8b29557a11192fff19975913dd`
|
||||
- GPG Signature: [https://releases.mattermost.com/10.11.21/mattermost-10.11.21-linux-amd64.tar.gz.sig](https://releases.mattermost.com/10.11.21/mattermost-10.11.21-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/10.11.21/sbom-enterprise-v10.11.21.json](https://releases.mattermost.com/10.11.21/sbom-enterprise-v10.11.21.json)
|
||||
Mattermost Enterprise Edition v10.11.22 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v10-changelog.html#release-v10-11-extended-support-release) - [Download](https://releases.mattermost.com/10.11.22/mattermost-10.11.22-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/10.11.22/mattermost-10.11.22-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `e2259cea0c6395334e1be3c745c615cc276145f1e078a884e1af6147e101fed1`
|
||||
- GPG Signature: [https://releases.mattermost.com/10.11.22/mattermost-10.11.22-linux-amd64.tar.gz.sig](https://releases.mattermost.com/10.11.22/mattermost-10.11.22-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://releases.mattermost.com/10.11.22/sbom-enterprise-v10.11.22.json](https://releases.mattermost.com/10.11.22/sbom-enterprise-v10.11.22.json)
|
||||
|
||||
Mattermost Enterprise Edition v10.10.3 - [View Changelog](https://docs.mattermost.com/about/mattermost-v10-changelog.html#release-v10-10-feature-release) - [Download](https://releases.mattermost.com/10.10.3/mattermost-10.10.3-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/10.10.3/mattermost-10.10.3-linux-amd64.tar.gz`
|
||||
@@ -615,17 +621,23 @@ The open source Mattermost Team Edition is functionally identical to the commerc
|
||||
|
||||
We generally recommend installing Enterprise Edition, even if you don't currently need a license. This provides the flexibility to seamlessly unlock Enterprise features should you need them. However, if you only want to install software with a fully open source code base, then Team Edition is the best choice for you.
|
||||
|
||||
Mattermost Team Edition v11.8.3 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-8-feature-release) - [Download](https://releases.mattermost.com/11.8.3/mattermost-team-11.8.3-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.8.3/mattermost-team-11.8.3-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `5c864ac5fc83f95f94d2c04a7f40eb9248e6118d84ec916f3e6290768e488aa9`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.8.3/mattermost-team-11.8.3-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.8.3/mattermost-team-11.8.3-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v11.8.3/sbom-mattermost-v11.8.3.json](https://github.com/mattermost/mattermost/releases/download/v11.8.3/sbom-mattermost-v11.8.3.json)
|
||||
Mattermost Team Edition v11.9.0 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-9-feature-release) - [Download](https://releases.mattermost.com/11.9.0/mattermost-team-11.9.0-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.9.0/mattermost-team-11.9.0-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `5f1172535f43a5444a0896e8ad3ca2dbef7b2c20ca4e616a92691eaca03ae05f`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.9.0/mattermost-team-11.9.0-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.9.0/mattermost-team-11.9.0-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v11.9.0/sbom-mattermost-v11.9.0.json](https://github.com/mattermost/mattermost/releases/download/v11.9.0/sbom-mattermost-v11.9.0.json)
|
||||
|
||||
Mattermost Team Edition v11.7.6 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-7-extended-support-release) - [Download](https://releases.mattermost.com/11.7.6/mattermost-team-11.7.6-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.7.6/mattermost-team-11.7.6-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `70aef239d1ab5c4503ecbc89329fb74256472bcca1ee656a50a102899e589c44`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.7.6/mattermost-team-11.7.6-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.7.6/mattermost-team-11.7.6-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v11.7.6/sbom-mattermost-v11.7.6.json](https://github.com/mattermost/mattermost/releases/download/v11.7.6/sbom-mattermost-v11.7.6.json)
|
||||
Mattermost Team Edition v11.8.4 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-8-feature-release) - [Download](https://releases.mattermost.com/11.8.4/mattermost-team-11.8.4-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.8.4/mattermost-team-11.8.4-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `553d6b36073125f84a283ccf4cc50c270a71be21024274b5c35e4a1d12bf49c1`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.8.4/mattermost-team-11.8.4-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.8.4/mattermost-team-11.8.4-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v11.8.4/sbom-mattermost-v11.8.4.json](https://github.com/mattermost/mattermost/releases/download/v11.8.4/sbom-mattermost-v11.8.4.json)
|
||||
|
||||
Mattermost Team Edition v11.7.7 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-7-extended-support-release) - [Download](https://releases.mattermost.com/11.7.7/mattermost-team-11.7.7-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.7.7/mattermost-team-11.7.7-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `8324eee1f979863883a9c8e71112f2ec127037da81f4efb90639b56187c6b0f7`
|
||||
- GPG Signature: [https://releases.mattermost.com/11.7.7/mattermost-team-11.7.7-linux-amd64.tar.gz.sig](https://releases.mattermost.com/11.7.7/mattermost-team-11.7.7-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v11.7.7/sbom-mattermost-v11.7.7.json](https://github.com/mattermost/mattermost/releases/download/v11.7.7/sbom-mattermost-v11.7.7.json)
|
||||
|
||||
Mattermost Team Edition v11.6.6 - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v11-changelog.html#release-v11-6-feature-release) - [Download](https://releases.mattermost.com/11.6.6/mattermost-team-11.6.6-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/11.6.6/mattermost-team-11.6.6-linux-amd64.tar.gz`
|
||||
@@ -675,11 +687,11 @@ Mattermost Team Edition v10.12.4 - [View Changelog](https://docs.mattermost.com/
|
||||
- GPG Signature: [https://releases.mattermost.com/10.12.4/mattermost-team-10.12.4-linux-amd64.tar.gz.sig](https://releases.mattermost.com/10.12.4/mattermost-team-10.12.4-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v10.12.4/sbom-mattermost-v10.12.4.json](https://github.com/mattermost/mattermost/releases/download/v10.12.4/sbom-mattermost-v10.12.4.json)
|
||||
|
||||
Mattermost Team Edition v10.11.21 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v10-changelog.html#release-v10-11-extended-support-release) - [Download](https://releases.mattermost.com/10.11.21/mattermost-team-10.11.21-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/10.11.21/mattermost-team-10.11.21-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `9d6a36976831d6bcd1881df3b09f18e7ad998e1cffceee29da0feb7497a69d6c`
|
||||
- GPG Signature: [https://releases.mattermost.com/10.11.21/mattermost-team-10.11.21-linux-amd64.tar.gz.sig](https://releases.mattermost.com/10.11.21/mattermost-team-10.11.21-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v10.11.21/sbom-mattermost-v10.11.21.json](https://github.com/mattermost/mattermost/releases/download/v10.11.21/sbom-mattermost-v10.11.21.json)
|
||||
Mattermost Team Edition v10.11.22 *Extended Support Release (ESR)* - [View Changelog](https://docs.mattermost.com/product-overview/mattermost-v10-changelog.html#release-v10-11-extended-support-release) - [Download](https://releases.mattermost.com/10.11.22/mattermost-team-10.11.22-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/10.11.22/mattermost-team-10.11.22-linux-amd64.tar.gz`
|
||||
- SHA-256 Checksum: `5aa384716f0ee2be99c03d4d5af8e488a090a63caca2b78f539a1e199fde5452`
|
||||
- GPG Signature: [https://releases.mattermost.com/10.11.22/mattermost-team-10.11.22-linux-amd64.tar.gz.sig](https://releases.mattermost.com/10.11.22/mattermost-team-10.11.22-linux-amd64.tar.gz.sig)
|
||||
- SBOM Download Link: [https://github.com/mattermost/mattermost/releases/download/v10.11.22/sbom-mattermost-v10.11.22.json](https://github.com/mattermost/mattermost/releases/download/v10.11.22/sbom-mattermost-v10.11.22.json)
|
||||
|
||||
Mattermost Team Edition v10.10.3 - [View Changelog](https://docs.mattermost.com/about/mattermost-v10-changelog.html#release-v10-10-feature-release) - [Download](https://releases.mattermost.com/10.10.3/mattermost-team-10.10.3-linux-amd64.tar.gz?src=arc)
|
||||
- `https://releases.mattermost.com/10.10.3/mattermost-team-10.10.3-linux-amd64.tar.gz`
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 68 KiB |
Reference in new issue
Block a user