You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Dot release docs for server v11.10.1
Update deployment guides, server releases table, v11 changelog, and
version archive (Enterprise + Team Edition) for the v11.10.1 dot release.
SHA-256 checksums and the v11.10.1 changelog entry are left as TBD
placeholders and need to be filled in from the release artifacts.
Co-authored-by: Amy Blais <29708087+amyblais@users.noreply.github.com>
* Update mattermost-v11-changelog.md
* Update mattermost-v11-changelog.md
* Update important-upgrade-notes.rst
* Update important-upgrade-notes.rst
* Update important-upgrade-notes.rst
* Update mattermost-v11-changelog.md
* Update mattermost-v11-changelog.md
* Update mattermost-v11-changelog.md
* Update version-archive.rst
* Update deprecated-features.rst
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
| v11.10 | This migration adds a new composite index, ``idx_propertyvalues_groupid_updateat_id``, on the ``PropertyValues`` table covering the columns ``GroupID``, |
15
+
| v11.10 | Starting with v11.10.1, the updated ``glibc-openssl-fips`` bundle includes a new OpenSSL build that enforces the FIPS minimum key length of 112 bits for HMAC |
16
+
| | operations. The PostgreSQL driver (lib/pq) passes the database password as the HMAC key during SCRAM authentication, so a password shorter than 112 bits, or 14 |
17
+
| | ASCII characters, now causes a panic on connect rather than a graceful failure. Before upgrading, FIPS deployments should verify that the password in |
18
+
| | ``SqlSettings.DataSource`` is at least 14 characters and rotate it in PostgreSQL if it is shorter. Standard, non-FIPS builds are unaffected. |
| | This migration adds a new composite index, ``idx_propertyvalues_groupid_updateat_id``, on the ``PropertyValues`` table covering the columns ``GroupID``, |
16
21
| | ``UpdateAt``, and ``ID``. The ``PropertyValues`` table is part of the Properties/Custom Attributes feature introduced in recent Mattermost versions. This index |
17
22
| | improves query performance for lookups and range scans that filter or sort by ``GroupID`` and ``UpdateAt``, which are common access patterns for this feature. |
18
23
| | The index is created using ``CONCURRENTLY``, so the build process does not block concurrent reads or writes against the ``PropertyValues`` table. The migrations |
Copy file name to clipboardExpand all lines: source/product-overview/deprecated-features.rst
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,6 +16,7 @@ Mattermost Server v12.0 (October 2026)
16
16
- Starting with Mattermost Server v12.0 (October 2026), user sessions and personal access tokens (PATs) can no longer set post identity or display-override props. Some deployments have relied on forging props such as ``from_webhook`` with ``override_username`` and ``override_icon_url`` so posts appear under a custom name and icon — a pattern indistinguishable from impersonation. In v12.0, the server strips these props from client and PAT payloads and re-applies them only under verified integration authority. Posts are still created, but forged props are silently removed and the message appears as the authenticating user, with no error returned. Legitimate integrations are unaffected: incoming webhooks and slash commands can still override the username and icon when enabled in the System Console, and bots post as the bot account. Admins relying on PAT forging should migrate those scripts to an incoming webhook or bot account before upgrading. See the `forum post <https://forum.mattermost.com/t/starting-with-mattermost-v12-0-october-2026-user-and-personal-access-token-pat-sessions-can-no-longer-set-post-identity-or-display-override-props/26052>`_ for full details and migration options.
17
17
- Starting with Mattermost Server v12.0 (October 2026), deprecated interactive dialog ``date/datetime`` fields will be removed. Top-level ``min_date``, ``max_date``, and ``time_interval``, and ``datetime_config.allow_manual_time_entry``, will no longer be accepted; use ``datetime_config`` (with ``manual_time_entry``) instead. Legacy keys will be silently ignored.
18
18
- Starting with Mattermost Server v12.0 (October 2026), deprecated Slack compatibility type aliases and functions will be removed (``SlackAttachment``, ``SlackAttachmentField``, ``ParseSlackAttachment``, ``StringifySlackFieldValue``) from the go package. Use ``MessageAttachment``, ``MessageAttachmentField``, ``ParseMessageAttachment``, and ``StringifyMessageAttachmentFieldValue`` instead.
19
+
- Starting with Mattermost Server v12.0 (October 2026), a set of unused configuration settings will be removed: ``ElasticsearchSettings.BulkIndexingTimeWindowSeconds``, ``ClusterSettings.EnableExperimentalGossipEncryption``, ``ExperimentalSettings.ClientSideCertEnable``, ``TeamSettings.ExperimentalViewArchivedChannels``, ``CloudSettings.CWSMock``, ``PluginSettings.ChimeraOAuthProxyURL``, ``DataRetentionSettings.EnableBoardsDeletion``, ``DataRetentionSettings.BoardsRetentionDays``, ``SqlSettings.AtRestEncryptKey``, ``NativeAppSettings.EnableIntuneMAM``, and ``GuestAccountsSettings.AllowEmailAccounts``. Removed fields present in an existing ``config.json`` are ignored, and the server will start normally, so no configuration changes are required before upgrading. Admins using ``NativeAppSettings.EnableIntuneMAM`` should use ``IntuneSettings.Enable`` instead.
- Starting with v11.10.1, the updated ``glibc-openssl-fips`` bundle includes a new OpenSSL build that enforces the FIPS minimum key length of 112 bits for HMAC operations. The PostgreSQL driver (lib/pq) passes the database password as the HMAC key during SCRAM authentication, so a password shorter than 112 bits, or 14 ASCII characters, now causes a panic on connect rather than a graceful failure. Before upgrading, FIPS deployments should verify that the password in ``SqlSettings.DataSource`` is at least 14 characters and rotate it in PostgreSQL if it is shorter. Standard, non-FIPS builds are unaffected.
22
+
```
23
+
24
+
-**11.10.1, released 2026-08-25**
25
+
- Go runtime was updated from 1.26.4 to 1.26.7.
26
+
- Fixed an issue where the **Classification Markings** section in the **System Console** was accessible and configurable under an Enterprise license; it is now correctly gated behind an Enterprise Advanced license and shows an upgrade prompt for lower tiers.
27
+
- Fixed an issue where a single video attachment was hidden from a post when image previews were set to collapsed, leaving no filename, thumbnail, or expand control.
28
+
- Updated ``getFile`` API validation to check for content reviewer earlier.
29
+
- Updated Slack import to handle user matching differently depending on the import type.
30
+
- Updated the local image proxy to enforce a maximum size limit when fetching images directly.
31
+
- Added signing/verification for RelayState in SAML flow.
32
+
- Updated how team admin status is assigned when a user joins a team.
33
+
- Prevented a post belonging to Direct/Group Message from being quarantined.
34
+
- Updated how post and thread payloads handle interactive-message action data.
35
+
- Fixed an edge case in team invitation handling.
36
+
- Fixed an issue where certain role update requests for channel and team members were not fully validated.
37
+
- Enhanced team search to only display teams relevant and accessible to the requesting user.
@@ -499,11 +499,11 @@ If you want to check that the version of Mattermost you are installing is the of
499
499
500
500
We generally recommend installing Enterprise Edition, even if you don't currently need a license. This provides the flexibility to seamlessly unlock Enterprise features should you need them. However, if you only want to install software with a fully open source code base, then Team Edition is the best choice for you.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments