docs/main/product-overview/mattermost-v11-changelog.mdx
import Inc0_common_esr_support_upgrade from './common-esr-support-upgrade.mdx';
<Inc0_common_esr_support_upgrade />
<Note>Platform and OS scope reflects reported and tested environments and may not represent all affected configurations.
</Note>SendBestEffort cluster messages logic to fall back to using TCP when their length is larger than a UDP datagram.ClusterReliableFallbackLength metric with the total length in bytes of the SendBestEffort calls (UDP) that had to fallback to TCP because of the message length.FileSettings.ExtractContentTimeout setting (default 10 seconds) that limits how long a single uploaded document's content extraction occupies a worker, and moved document content extraction to a dedicated, non-blocking worker pool so it no longer delays file uploads for other users. Added FileSettings.ExtractContentTimeout configuration setting.Breaking Changes
custom_profile_attributes to access_control, and CPA fields and values are migrated from the legacy property model to the v2 model. The functionality of the CPA feature is unchanged. Plugin developers that use CPA will need to register against the new group name.Version column (default 1) to the PropertyGroups table to differentiate PSAv1 legacy groups from PSAv2 groups, with no downtime or table rewrite required.posts.rootid and posts.channelid to 5000 and refreshes planner statistics, improving query plan accuracy for queries that filter or join on those columns with no table rewrite or downtime required.'BO' and 'BP', to the channel_type enum with no table rewrite or downtime required.LinkedFieldID column and index to PropertyFields, renamed the CPA property group to access_control, and narrowed the AttributeView materialized view to user-scoped attributes, with no large-table impact or downtime required.ViewedAt column and idx_recaps_user_id_viewed_at index to Recaps via metadata-only ADD COLUMN and CREATE INDEX CONCURRENTLY, with no table locks or downtime required.Discoverable column to Channels, a new ChannelJoinRequests table, and four concurrent partial/composite indexes to support channel join request workflows, with no downtime required.permission_level enum to add an admin value via a non-blocking catalog-only change, with no table locks, no data migration, and no downtime required.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
MobileEphemeralMode in config.json, added a Mobile Ephemeral Mode configuration section under System Console > Environment > Mobile Security, allowing admins to configure data persistence and cache management policies for mobile devices. Requires Enterprise Advanced license and MobileEphemeralMode feature flag.ElasticsearchSettings in config.json, added EnableSearchPublicChannelsWithoutMembership configuration setting to allow searching in public channels the user isn't a member of.TeamSettings in config.json, added EnableChannelCategorySorting configuration setting to add, edit, and remove managed categories.See this blog post on the highlights in our latest release.
Shift + ESC, that marks all channels, threads, and direct messages as read for a team on webapp / desktop app.react-beautiful-dnd with @atlaskit/pragmatic-drag-and-drop.EnableTesting must never be used in production.DefaultCategoryName to the user interface so admins can add, edit, and remove it easily.datetime_config.root_id to create posts in a thread./metrics endpoint.RegisterPluginForSharedChannels with different SiteURL values, enabling use cases such as multiple outbound transports or bridging to multiple external servers. A new UnregisterPluginRemoteForSharedChannels method allows removing a single remote without affecting others. Existing single-remote plugins continue to work without changes.client.Audit on pluginapi.Client for plugins to emit audit records via the server audit pipeline (server 10.10+) on Linux, macOS and Windows.Edit Attachments permission for controlling who can edit post attachments when editing a post. By default, the permission is granted to users who have the edit post permission.inCIDR and versionGT/versionGTE/versionLT/versionLTE/versionEQ for use in access control policies.server.process_id to support packet diagnostics to help correlate support data with OS-level logs and process monitoring tools such as ps, top, and systemd journal.go_version to support packet diagnostics, showing the Go runtime version the server binary was compiled with on Linux.open_file_descriptors and max_file_descriptors fields to the server section of the support packet diagnostics.yaml to help diagnose file descriptor exhaustion on Linux and macOS.container_cpu_limit and container_memory_limit_mb fields to support packet diagnostics to report cgroup v2 CPU and memory limits on Linux. Fields are omitted for non-containerized or non-Linux deployments.diagnostics.yaml in the support packet under notifications.email and notifications.push for mobile app.started_at and host_started_at fields to the support packet diagnostics to help diagnose server restart loops and container reboots.PermissionPolicies feature flag and the Enterprise Advanced license.user.session.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.Posts.rootid and Posts.channelid to 5000, preventing query planner to choose the wrong index, which could cause full-table scans during bulk imports and other thread-heavy operations on large Posts tables.mmctl or the API. The channel_converted WebSocket event now includes the channel type.LoadPluginConfiguration did not apply default values for plugin settings declared inside sections in the plugin manifest.mmctl websocket command when the WebSocket connection failed on startup.OnSharedChannelsAttachmentSyncMsg / ReceiveSharedChannelAttachmentSyncMsg plugin API pair) were stored on the receiving server but did not appear in the corresponding post, because the saved FileInfo was given a new ID instead of preserving the sender's file ID referenced by the post.REST login now applies the same authentication criteria checks as the web one-time-link handler and password login.GET /api/v4/content_flagging/post/<post_id>/report endpoint for generating and downloading a content flagging report for a flagged post.GET /api/v4/teams/{team_id}/channels/recommended endpoint and an abac_match_only query parameter on GET /api/v4/users to support Membership Policy advisory semantics for public channels.POST /api/v4/users/{user_id}/demote to return 400 when user_id is a bot account; bot accounts cannot be converted to guests./api/v4/users/auth_data?value={auth_data}. Only available to sysadmins.POST /cel/simulate_users (simulatePolicyForUsers) API endpoint.channel_converted WebSocket event now includes the channel type, enabling clients to update the sidebar channel icon when a channel's privacy changes.AuditEventGenerateFlaggedPostReport for generating and downloading content flagging report for a flagged post.AuditEventMarkRecapsAsViewed for adding an unread badge to Recaps.AuditEventMarkMessagesRead and AuditEventMarkTeamRead for adding a new shortcut to mark all channels as read.AuditEventCreateBoard for integrated boards.AuditEventCreateChannelJoinRequest, AuditEventUpdateChannelJoinRequest and AuditEventWithdrawChannelJoinRequest for discoverable private channels.v1.26.3.x/text, @atlaskit/pragmatic-drag-and-drop, @atlaskit/pragmatic-drag-and-drop-hitbox, @atlaskit/pragmatic-drag-and-drop-react-drop-indicator, prometheus/common, Azure/azure-sdk-for-go, boxes-ltd/imaging and google/uuid, and removed anthonynsimon/bild from https://github.com/mattermost/mattermost/.SendBestEffort cluster messages logic to fall back to using TCP when their length is larger than a UDP datagram.ClusterReliableFallbackLength metric with the total length in bytes of the SendBestEffort calls (UDP) that had to fallback to TCP because of the message length.threadmemberships rows where the user is no longer a channel member; irreversible data-only migration that may run slowly on large instances.FileSettings.ExtractContentTimeout setting (default 10 seconds) that limits how long a single uploaded document's content extraction occupies a worker, and moved document content extraction to a dedicated, non-blocking worker pool so it no longer delays file uploads for other users. Added FileSettings.ExtractContentTimeout configuration setting.REST login now applies the same authentication criteria checks as the web one-time-link handler and password login.Edit Attachments for controlling who can edit post attachments when editing a post. By default the permission is granted to whoever has edit post permission./api/v4/users/{user_id}/demote now returns 400 when user_id is a bot account; bot accounts cannot be converted to guests.RegisterPluginForSharedChannels with different SiteURL values, enabling use cases like multiple outbound transports or bridging to multiple external servers. A new UnregisterPluginRemoteForSharedChannels method allows removing a single remote without affecting others. Existing single-remote plugins continue to work without changes.OnSharedChannelsAttachmentSyncMsg / ReceiveSharedChannelAttachmentSyncMsg plugin API pair) were stored on the receiving server but did not appear in the corresponding post, because the saved FileInfo was given a new ID instead of preserving the sender's file ID referenced by the post.ReceiveSharedChannelSyncMsg and ReceiveSharedChannelAttachmentSyncMsg) are now order-tolerant and idempotent: plugin remotes can now deliver a post and its file attachments in either order or concurrently, and at-least-once redeliveries no longer produce duplicate FileInfo rows.Breaking Changes
idx_accesscontrolpolicies_name_type) to the AccessControlPolicies table on (Name, Type) filtered to WHERE Type = 'parent'.PropertyFields and PropertyValues tables were modified, and a new Views table was created.role_updated WebSocket events to the affected team/channel instead of broadcasting globally.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
ExperimentalSetting in config.json, added EnableWatermark configuration setting to add watermarking toggle in the server.PasswordSettings in config.json, added PasswordFIPSMinimumLength configuration setting to require a minimum of 14 characters for passwords and for atmos/camo proxy and shared channel secrets.DatabaseSettings in config.json, added AnalyticsQueryTimeout configuration setting for use when running long analytics queries in the background.If you upgrade from a release earlier than v11.6, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
~channel autocomplete to prioritize channels with a matching display name.mattermost_search_engine_status metric that reports whether the Elasticsearch/Opensearch cluster is healthy (value = 1) or not (value = 0). If the cluster is not enabled, its value is reported as 1.--workers flag to the mmctl import process to control concurrency.manage_own_agent: Allows users to create and manage their own agents.manage_others_agent: Allows users to create and manage agents they didn't create, even if that user isn't one of the administrator users assigned to the agent by the creator.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.registerAIActionMenuItemComponent. The existing Rewrite feature is now accessed through this menu.UpdateUser when the user update operation returned an unexpected nil result (Sentry VF, 14 events).remote_id field on user objects could be set via the user patch API.GET /api/v4/channels/{channel_id}/views/{view_id}/posts to retrieve paginated posts for a specific view. Card posts are temporarily excluded from search results. Card posts now use collaborative permissions — any channel member can edit or delete any card without needing edit_others_posts/delete_others_posts permissions.ChannelMemberWillBeAdded (modify or reject a channel member addition), TeamMemberWillBeAdded (modify or reject a team member addition), and ChannelWillBeArchived (reject a channel archive).PUT /api/v4/system/e2e/ai_bridge, GET /api/v4/system/e2e/ai_bridge, and DELETE /api/v4/system/e2e/ai_bridge for E2E testing of AI features. These endpoints are only accessible when EnableTesting is true. Refactored internal AI-related logic to use a new AgentsBridge interface for improved testability. Added new DTOs in server/public/model for AI bridge information and test helpers.PUT /api/v4/channels/{channel_id}/members that sets the complete membership of a channel in a single call. The endpoint accepts a JSON object with members (desired user IDs) and an optional channel_admins (user IDs to designate as channel admins). The server computes the diff against current membership, adds or removes users as needed, and reconciles admin roles. Results are streamed back as NDJSON for progress tracking. Requires system admin permissions.ReceiveSharedChannelSyncMsg, ReceiveSharedChannelAttachmentSyncMsg, and ReceiveSharedChannelProfileImageSyncMsg. These allow plugins acting as shared channel remotes to sync posts, reactions, users, file attachments, and profile images into Mattermost, complementing the existing outbound OnSharedChannels hooks.AuditEventCreateView, AuditEventGetView, AuditEventUpdateView, AuditEventDeleteView, AuditEventListViewsForChannel, AuditEventUpdateViewSortOrder, AuditEventGetPostsForView, AuditEventCreatePropertyField, AuditEventDeletePropertyField, AuditEventGetPropertyFields, AuditEventPatchPropertyField, AuditEventGetPropertyValues, and AuditEventPatchPropertyValues for Integrated Boards.AuditEventSetChannelMembers for channel memberships.AuditEventCreateTeamAccessPolicy, AuditEventUpdateTeamAccessPolicy, AuditEventDeleteTeamAccessPolicy, AuditEventAssignTeamAccessPolicy, AuditEventUnassignTeamAccessPolicy, and AuditEventTriggerTeamPolicySync for team-level ABAC membership policies.v1.25.9.FileSettings.ExtractContentTimeout setting (default 10 seconds) that limits how long a single uploaded document's content extraction occupies a worker, and moved document content extraction to a dedicated, non-blocking worker pool so it no longer delays file uploads for other users. Added FileSettings.ExtractContentTimeout configuration setting.REST login now applies the same authentication criteria checks as the web one-time-link handler and password login.Edit Attachments for controlling who can edit post attachments when editing a post. By default the permission is granted to whoever has edit post permission.role_updated WebSocket events to the affected team/channel instead of broadcasting globally. No database downtime is expected for this upgrade. See the Important Upgrade Notes for more details.PUT /api/v4/channels/{channel_id}/members that sets the complete membership of a channel in a single call. The endpoint accepts a JSON object with members (desired user IDs) and an optional channel_admins (user IDs to designate as channel admins). The server computes the diff against current membership, adds or removes users as needed, and reconciles admin roles. Results are streamed back as NDJSON for progress tracking. Requires system admin permissions.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
ServiceSettings in config.json, added a configuration setting MinimumDesktopAppVersion to enforce a minimum Desktop App version that shows a warning screen when a user is on an older version.SSOSettings in config.json, added a configuration setting UsePreferredUsername to add support for OpenID Connect (OIDC) preferred_username profile field as the mapped Mattermost username for GitLab, OpenID and EntraID/M365. This feature can be enabled in the OpenID Connect tab in the System Console.ElasticsearchSettings in config.json, added a configuration setting EnableCJKAnalyzers to enable using CJK analysis plugins when installed.ElasticsearchSettings in config.json, added a configuration setting EnableSearchPublicChannelsWithoutMembership to allow searching public channel messages without channel membership.PrivacySettings in config.json, added UseAnonymousURLs to support creating teams and channels using anonymous URLs.EnableChannelScopeAccessControl configuration setting; channel-level ABAC is now controlled by main toggle and permissions only.ExperimentalAuditSettings.FileMaxSizeMB, FileMaxAgeDays, FileMaxBackups, FileCompress, and FileMaxQueueSize. These settings were never applied to the audit log file target. Use AdvancedLoggingJSON for fine-grained audit log configuration.If you upgrade from a release earlier than v11.5, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
SlackAttachment and SlackAttachmentField types to MessageAttachment and MessageAttachmentField. Old names are maintained as deprecated aliases for backward compatibility with plugins.datetime fields.redirect_to URL parameter was provided.NULL value in the Type column caused a SQL error when fetching the team's scheduled posts.Channels.GetMany and Channels.getByNames.RefreshedToken that matched the original invite token, preventing proper token rotation.system_admin role on new installations or after certain updates was missing the manage_oauth permission, preventing access to OAuth application management API endpoints. This change restores the permission to the default system_admin role and includes a migration to backfill it on affected existing servers.MinDate/MaxDate fields.operationId annotations to content_flagging endpoints.filewillbedownloaded and sendtoastmessage plugin API calls.v1.24.13.Edit Attachments for controlling who can edit post attachments when editing a post. By default the permission is granted to whoever has edit post permission.role_updated WebSocket events to the affected team/channel instead of broadcasting globally. No database downtime is expected for this upgrade. See the Important Upgrade Notes for more details.PUT /api/v4/channels/{channel_id}/members that sets the complete membership of a channel in a single call. The endpoint accepts a JSON object with members (desired user IDs) and an optional channel_admins (user IDs to designate as channel admins). The server computes the diff against current membership, adds or removes users as needed, and reconciles admin roles. Results are streamed back as NDJSON for progress tracking. Requires system admin permissions.RefreshedToken that matched the original invite token, preventing proper token rotation.system_admin role on new installations or after certain updates was missing the manage_oauth permission, preventing access to OAuth application management API endpoints. This change restores the permission to the default system_admin role and includes a migration to backfill it on affected existing servers.autotranslations workers per node to 64.translations.state and a new index idx_translations_state to the translations table.channelmembers.autotranslationdisabled to the channelmembers table.translations.objectType and changed the primary key (objectId, dstLang) to (objectId, objectType, dstLang) in the translations table.translations.channelid to the translations table.idx_translations_channel_updateat to the translations table.idx_translations_updateat from the translations table.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
Autotranslation settings Enable, RestrictDMAndGM, Provider, TargetLanguages, Workers, TimeoutMs, LibreTranslate, and Agents to support auto-translations.DCRRedirectURIAllowlist under ServiceSettings to restrict OAuth Dynamic Client Registration redirect URIs with glob patterns and to return invalid_redirect_uri when any redirect URI is not allowlisted.If you upgrade from a release earlier than v11.4, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
mmctl license get command to retrieve and display current server license information.protected attribute on property fields to restrict write access to the managing plugin.access_mode attribute on property fields to manage read access.babel, [email protected] and jest@30.MM_FEATUREFLAGS_CJKSEARCH.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.ElasticSearch test connection failures.secret: true inside settings_schema.sections[] were not sanitized, potentially exposing secret values through the API.WebSocketClient from @mattermost/shared package being broken in Node.js environments.AuditEventCreateRecap, AuditEventGetRecap, AuditEventGetRecaps, AuditEventMarkRecapAsRead, AuditEventRegenerateRecap, and AuditEventDeleteRecap.AuditEventUpdateChannelMemberAutotranslation.AuditEventLoginWithDesktopToken.AuditEventListChannelBookmarksForChannel, AuditEventGetPinnedPosts, AuditEventGetFileThumbnail, AuditEventGetFileInfosForPost, AuditEventGetFileInfo, AuditEventGetFilePreview, AuditEventSearchFiles, AuditEventCreateEphemeralPost, AuditEventGetEditHistoryForPost, AuditEventGetFlaggedPosts, AuditEventGetPostsForChannel, AuditEventGetPostsForChannelAroundLastUnread, AuditEventGetPost, AuditEventGetPostThread, AuditEventGetPostsByIds, AuditEventGetThreadForUser, AuditEventNotificationAck, and AuditEventWebsocketPost.v1.24.13.react-intl and x/sys, and replaced avct/uasurfer with LumenResearch/uasurfer in https://github.com/mattermost/mattermost.RefreshedToken that matched the original invite token, preventing proper token rotation.system_admin role on new installations or after certain updates was missing the manage_oauth permission, preventing access to OAuth application management API endpoints. This change restores the permission to the default system_admin role and includes a migration to backfill it on affected existing servers.Breaking Changes
Recaps and RecapChannels. No database downtime is expected for this upgrade. See the Important Upgrade Notes for more details.If you upgrade from a release earlier than v11.3, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
MM_LOG_PATH environment variable to restrict log file locations. Log files must now be within a configured root directory.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.mscfb and msoleps dependencies./mute slash command could be used to enumerate private channels./api/v4/teams team creation API to omit the invite_id value in the response when the requesting user does not have permission to invite members to the new team.ImportSettings.Directory can no longer be modified through the REST API. Infrastructure operators can still modify this setting via configuration file, environment variables, or mmctl in local mode./api/v4/access_control_policies/{policy_id}/activate has been deprecated.AuditEventGenerateSupportPacket.v1.24.11.system_admin role on new installations or after certain updates was missing the manage_oauth permission, preventing access to OAuth application management API endpoints. This change restores the permission to the default system_admin role and includes a migration to backfill it on affected existing servers.Breaking Changes
Photoshop Document (PSD) files are now no longer inline previewed, they are treated as regular file attachments.
Mattermost v11.3.1 contains medium to high severity level security fixes. Upgrading to this release is recommended. Details will be posted on our security updates page 30 days after release as per the Mattermost Responsible Disclosure Policy.
Pre-packaged Boards plugin version v9.2.2.
Pre-packaged Playbooks plugin version v2.6.2.
Fixed an issue with PSD file previews.
Added a new MM_LOG_PATH environment variable to restrict log file locations. Log files must now be within a configured root directory.
Fixed an issue where the /mute slash command could be used to enumerate private channels.
Fixed an issue where users removed from a private team could still enumerate public channels in that team via the channel search API.
Fixed an issue with permalink embeds arriving from websocket messages.
Fixed a memory allocation issue by updating mscfb and msoleps dependencies.
Fixed an issue with memory use during integration actions.
/api/v4/access_control_policies/{policy_id}/activate has been deprecated.
Updated the POST /api/v4/teams team creation API to omit the invite_id value in the response when the requesting user does not have permission to invite members to the new team.
ImportSettings.Directory can no longer be modified through the REST API. Infrastructure operators can still modify this setting via configuration file, environment variables, or mmctl in local mode.
Fixed a permission validation issue when attaching files to posts.
Mattermost v11.3.1 contains no database or functional changes.
11.3.0, released 2026-01-16
Release Day: January 16, 2026
ReadReceipts and TemporaryPosts) that aggregate user attributes into a separate table. Added Type field for both Drafts and ScheduledPosts. No database downtime is expected for this upgrade. See the Important Upgrade Notes for more details.translations table and two new columns (channels.autotranslation, channelmembers.autotranslation). No database downtime is expected for this upgrade. See the Important Upgrade Notes for more details.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
ServiceSettings in config.json, added EnableBurnOnRead, BurnOnReadDurationSeconds, BurnOnReadMaximumTimeToLiveSeconds and BurnOnReadSchedulerFrequencySeconds.GuestAccountsSettings in config.json, added EnableGuestMagicLink.ServiceSettings in config.json, added AWSMeteringTimeoutSeconds. This configuration value can be used to set the timeout in seconds when connecting to the AWS marketplace metering service.NativeAppSettings in config.json, added EnableIntuneMAM, which can be edited in the System Console.registerRightHandSidebarComponent will need to implement additional code to support RHS popouts if their RHS component relies on plugin-specific state. See this forum post for full details.If you upgrade from a release earlier than v11.2, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
registerSidebarBrowseOrAddChannelMenuComponent, which allows users to add options to the BrowseOrCreateChannel menu.AdvancedLoggingJSON.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.control_access_policies/search endpoint and its documentation.Shift+Up in the channel textbox to reply to a thread could cause the right‑hand sidebar (RHS) reply textbox to not focus.TelemetryID could be temporarily missing on brand new High Availability clusters due to replica lag.LoginByEntraIdToken API endpoint for MSAL id_token authentication.report/posts API for retrieving posts for reporting.AuditEventRevealPost and AuditEventBurnPost.AuditEventSetActiveStatus.v1.24.6.aws/aws-sdk-go with aws/aws-sdk-go-v2, and replaced go-yaml/yaml with goccy/go-yaml. Added mattermost/mattermost-plugin-agents and removed fsnotify/fsnotify and html-to-markdown from https://github.com/mattermost/mattermost.Breaking Changes
Photoshop Document (PSD) files are now no longer inline previewed, they are treated as regular file attachments.
Mattermost v11.2.3 contains medium to high severity level security fixes. Upgrading to this release is recommended. Details will be posted on our security updates page 30 days after release as per the Mattermost Responsible Disclosure Policy.
Pre-packaged Boards plugin version v9.2.2.
Pre-packaged Playbooks plugin version v2.6.2.
Fixed an issue with PSD file previews.
Added a new MM_LOG_PATH environment variable to restrict log file locations. Log files must now be within a configured root directory.
Fixed an issue where the /mute slash command could be used to enumerate private channels.
Fixed an issue where users removed from a private team could still enumerate public channels in that team via the channel search API.
Fixed an issue with permalink embeds arriving from websocket messages.
Fixed a memory allocation issue by updating mscfb and msoleps dependencies.
/api/v4/access_control_policies/{policy_id}/activate has been deprecated.
Fixed an issue with memory use during integration actions.
Updated the POST /api/v4/teams team creation API to omit the invite_id value in the response when the requesting user does not have permission to invite members to the new team.
ImportSettings.Directory can no longer be modified through the REST API. Infrastructure operators can still modify this setting via configuration file, environment variables, or mmctl in local mode.
Fixed a permission validation issue when attaching files to posts.
Mattermost v11.2.3 contains no database or functional changes.
11.2.2, released 2026-01-15
11.2.1, released 2025-12-16
11.2.0, released 2025-12-16
OAuthApps table called isdynamicallyregistered. It has a default value of false. Also added three new columns to the OAuthAuthData table called resource, codechallenge and codechallengemethod. All columns default to ‘’. Also added a new column to the OAuthAccessData table called audience. It has a default value of ‘’. No database downtime is expected for this upgrade. See the Important Upgrade Notes for more details.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
ServiceSettings in config.json, added EnableDynamicClientRegistration configuration setting to control whether Dynamic Client Registration is enabled in your Mattermost instance. The default value is false.If you upgrade from a release earlier than v11.1, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
http.Flusher support to the plugin RPC layer.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.api/v4/posts/rewrite endpoint to enable AI-powered message rewriting. It accepts a message, an AI agent ID, and a rewrite action, and returns a JSON object with a rewritten_text field containing the rewritten text. The endpoint supports six predefined actions: shorten, elaborate, improve_writing, fix_spelling, simplify, and summarize. A custom action is also available, which requires a custom_prompt parameter to specify the desired transformation.GetFile GET api/v4/files/file_id endpoint to include two new query params: as_content_reviewer and flagged_post_id. These are used for the Data Spillage feature to allow content reviewers to download files from flagged posts./oauth/authorize endpoints called code_challenge and code_challenge_method in order to support PKCE with our OAuth authorization flow./.well-known/oauth-authorization-server so that OAuth clients can check what Mattermost supports. The endpoint returns a 501 error if ServiceSettings.EnableOAuthServiceProvider is disabled./api/v4/oauth/apps/register in order to support Dynamic Client Registration for OAuth. This allows any external OAuth client to automatically register an OAuth App within Mattermost without requiring authentication. The endpoint requires ServiceSettings.EnableOAuthServiceProvider and ServiceSettings.EnableDynamicClientRegistration to be enabled.GET /api/v4/agents and GET /api/v4/llmservices to allow authenticated clients to fetch available agents and LLM services.AuditEventRegisterOAuthClient.v1.24.6.Critical Fixes
Mattermost v11.1.1 contains a Critical severity level security fix in the Jira plugin. Upgrading to this release as soon as possible is highly recommended. Details will be posted on our security updates page 30 days after release as per the Mattermost Responsible Disclosure Policy.
Pre-packaged Jira plugin version v4.4.1.
Fixed an issue where thread popouts did not show the current user's status.
Fixed an issue where clicking on a permalink to a reply in another thread would not navigate the main window.
Fixed an issue where users could not add bots without an error message popping up.
Mattermost v11.1.1 contains no database or functional changes.
11.1.0, released 2025-11-14
Breaking Changes
ContentFlaggingCommonReviewers, ContentFlaggingTeamSettings, and ContentFlaggingTeamReviewers for storing Data Spillage settings. Added an index on ContentFlaggingTeamReviewers table to optimize fetching the team settings. No database downtime is expected for this upgrade. See the Important Upgrade Notes for more details.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
AutoTranslationSettings configuration settings section. The auto-translation feature will be available in a future release.If you upgrade from a release earlier than v11.0, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
Date and DateTime types for interactive dialogs.MultiForm and Element refresh support for interactive dialogs.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.POST /api/v4/groups/names.since parameter to the property value search method of the PluginApi.AuditEventFlagPost, AuditEventGetFlaggedPost, AuditEventPermanentlyRemoveFlaggedPost, AuditEventKeepFlaggedPost, AuditEventUpdateContentFlaggingConfig, and AuditEventSetReviewer.v1.24.6.@redux-devtools/extension and @types/react-is, and removed react-intl from https://github.com/mattermost/mattermost/.Critical Fixes
Mattermost v11.0.6 contains a Critical severity level security fix in the Jira plugin. Upgrading to this release as soon as possible is highly recommended. Details will be posted on our security updates page 30 days after release as per the Mattermost Responsible Disclosure Policy.
Pre-packaged Jira plugin version v4.4.1.
Mattermost v11.0.6 contains no database or functional changes.
11.0.5, released 2025-11-17
11.0.4, released 2025-10-28
Critical Fixes
Mattermost v11.0.4 contains Critical severity level security fixes. Upgrading to this release as soon as possible is highly recommended. Details will be posted on our security updates page 30 days after release as per the Mattermost Responsible Disclosure Policy.
Fixed an issue where plugin configuration settings were incorrectly sanitized, causing API endpoints and plugins to receive masked values instead of actual configuration values.
Pre-packaged Boards plugin v9.1.7.
Mattermost v11.0.4 contains no database or functional changes.
11.0.3, released 2025-10-27
11.0.2, released 2025-10-16
ServiceSettings.ExperimentalStrictCSRFEnforcement setting.11.0.1, released 2025-10-16
Breaking Changes
TeamSettings.ExperimentalViewArchivedChannels setting has been deprecated. Archived channels will always be accessible, subject to normal channel membership. The server will fail to start if this setting is set to false. To deny access to archived channels, mark them as private and remove affected channel members. See more details in this forum post.DisableDatabaseSearch is set to false. See more details in this forum post.registerPostDropdownMenuComponent hook in the web app’s plugin API has been removed in favour of registerPostDropdownMenuAction. See more details in this forum post.mattermost-omnibus release was v10.12. See more details in this forum post.include_removed_members option in api/v4/ldap/sync has been removed. Admins can use the LDAP setting ReAddRemovedMembers./api/v4/config/client endpoint has been deprecated.channel add - use channel users addchannel remove - use channel users removechannel restore - use channel unarchivechannel make-private - use channel modify --privatecommand delete - use command archivepermissions show - use permissions role showmmctl user email - use mmctl user edit emailmmctl user username - use mmctl user edit usernameExperimentalSettings.ClientSideCertEnable must be false to start the server./api/v4/teams/{team_id}/channels/search_archived has been deprecated in favour of /api/v4/channels/search with the deleted parameter.MaxOpenConns from 300 to 100 and MaxIdleConns from 20 to 50, establishing a healthier 2:1 ratio for better database connection management.AdvancedLoggingJSON configuration. See the Important Upgrade Notes for an example configuration.New setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json, or the System Console when available.
CloudSettings in config.json, added PreviewModalBucketURL.VerboseDiagnostics configuration setting as part of removing all telemetry support from Mattermost.BleveSettings configuration setting as part of removing Bleve.NotificationLogSettings as part of deprecating the separate notification log file.ClientSideCertCheck as part of removing the experimental certificate-based authentication feature.If you upgrade from a release earlier than v10.10, please read the other Important Upgrade Notes. In case of an upgrade failure, please check the Downgrade Guide and the Recovery Guide for rollback steps and interim mitigation strategy.
See this blog post on the highlights in our latest release.
EnableChannelScopeAccessControl setting is enabled.UserId and TeamId are now passed in interactive dialog submissions.auth_data is now shown in the System Console user details page.EmailNotificationWillBeSent plugin hook.registerPostDropdownMenuComponent API.mmctl user edit command.mmctl completion for a guide on how to set it up for your shell.mmctl cpa set of commands to manage Custom Profile Attributes.[-5%, +5%] prediction interval. View the full raw data and methodology in our Performance Reports repository.v1.24.6.simplebar-react, and removed go-sql-driver/mysql, blevesearch/bleve and axios from https://github.com/mattermost/mattermost.