[pull] master from mattermost:master

docs/main/administration-guide/manage/admin/abac-channel-access-rules.mdx

@@ -303,7 +303,7 @@ The auto-sync toggle is automatically disabled when:
 
 #### How quickly are membership changes applied?
 
-When you save access rules, membership sync job is created and changes are applied as soon as the job is completed. Additionally, Mattermost runs synchronization jobs on a schedule to handle attribute changes from external systems (LDAP, SAML). The interval is set by `AccessControlSettings.SyncJobIntervalSeconds` and defaults to 3600 seconds (60 minutes).
+When you save access rules, membership sync job is created and changes are applied as soon as the job is completed. Additionally, Mattermost runs synchronization jobs on a schedule to handle attribute changes from external systems (LDAP, SAML). The interval is set by `AccessControlSettings.SyncJobIntervalSeconds` and defaults to 3600 seconds (60 minutes). User attributes used for access control evaluation are refreshed on a separate schedule controlled by `AccessControlSettings.AttributeRefreshIntervalSeconds`, which defaults to 30 seconds.
 
 #### Will users be notified when they're removed from a channel?
 

docs/main/administration-guide/manage/admin/abac-team-channel-policies.mdx

@@ -114,7 +114,7 @@ If a System Admin adds a channel from another team to a policy that was previous
 
 ## Synchronization
 
-When you save a policy or modify channel assignments, Mattermost creates a membership synchronization job. Changes are applied as soon as the job completes. Synchronization also runs automatically on a schedule to handle attribute changes from external systems such as LDAP or SAML. The interval is set by `AccessControlSettings.SyncJobIntervalSeconds` and defaults to 3600 seconds (60 minutes).
+When you save a policy or modify channel assignments, Mattermost creates a membership synchronization job. Changes are applied as soon as the job completes. Synchronization also runs automatically on a schedule to handle attribute changes from external systems such as LDAP or SAML. The interval is set by `AccessControlSettings.SyncJobIntervalSeconds` and defaults to 3600 seconds (60 minutes). User attributes used for access control evaluation are refreshed on a separate schedule controlled by `AccessControlSettings.AttributeRefreshIntervalSeconds`, which defaults to 30 seconds.
 
 ## Troubleshooting and FAQs
 

docs/main/administration-guide/manage/admin/abac-team-membership.mdx

@@ -379,7 +379,7 @@ A team sync batch runs in the following order:
 
 **Mass-removal guardrail**: If a sync pass would remove more than 50% of a team's current members, the job sets a warning flag visible in the Sync Job Details \> Teams tab. The job is not blocked — all removals proceed — but the warning is surfaced for admin review.
 
-Team sync also runs automatically on a schedule to handle attribute changes propagated from LDAP or SAML. The interval is set by `AccessControlSettings.SyncJobIntervalSeconds` and defaults to 3600 seconds (60 minutes). The minimum accepted value is 60 seconds, and a change requires a server restart to take effect. The same interval governs channel membership sync.
+Team sync also runs automatically on a schedule to handle attribute changes propagated from LDAP or SAML. The interval is set by `AccessControlSettings.SyncJobIntervalSeconds` and defaults to 3600 seconds (60 minutes). The minimum accepted value is 60 seconds, and a change requires a server restart to take effect. The same interval governs channel membership sync. User attributes used for access control evaluation are refreshed on a separate schedule controlled by `AccessControlSettings.AttributeRefreshIntervalSeconds`, which defaults to 30 seconds. Set this value to 0 to disable periodic attribute refresh.
 
 ## Mutual exclusivity with group sync
 
@@ -417,7 +417,7 @@ No. Group sync and ABAC are mutually exclusive on a per-team basis. If a team is
 
 ### How quickly are membership changes applied?
 
-Saving rules in Team Settings or the System Console triggers an immediate team sync — **including when auto-add is off**, because enforcement (removal on private teams) runs regardless of the auto-add setting. Changes are applied as soon as the sync completes. A scheduled sync also runs on the interval set by `AccessControlSettings.SyncJobIntervalSeconds` (60 minutes by default) to process attribute changes from LDAP or SAML.
+Saving rules in Team Settings or the System Console triggers an immediate team sync — **including when auto-add is off**, because enforcement (removal on private teams) runs regardless of the auto-add setting. Changes are applied as soon as the sync completes. A scheduled sync also runs on the interval set by `AccessControlSettings.SyncJobIntervalSeconds` (60 minutes by default) to process attribute changes from LDAP or SAML. User attributes used for access control evaluation are refreshed on the interval set by `AccessControlSettings.AttributeRefreshIntervalSeconds` (30 seconds by default).
 
 ### Does System Admin role bypass team ABAC enforcement?
 

e2e-tests/.ci/server.generate.sh

@@ -58,7 +58,6 @@ services:
       MM_SERVICESETTINGS_ENABLESECURITYFIXALERT: "false"
       MM_CONNECTEDWORKSPACESSETTINGS_ENABLEREMOTECLUSTERSERVICE: "true"
       MM_CONNECTEDWORKSPACESSETTINGS_ENABLESHAREDWORKSPACES: "true"
-      MM_FEATUREFLAGS_ENABLEREMOTECLUSTERSERVICE: "true"
       MM_SQLSETTINGS_DATASOURCE: "postgres://mmuser:mostest_password@localhost:5432/mattermost_test?sslmode=disable&connect_timeout=10&binary_parameters=yes"
       MM_SQLSETTINGS_DRIVERNAME: "postgres"
       MM_EMAILSETTINGS_SMTPSERVER: "localhost"
@@ -298,7 +297,7 @@ $(if mme2e_is_token_in_list "playwright" "$ENABLED_DOCKER_SERVICES"; then
     # shellcheck disable=SC2016
     echo '
   playwright:
-    image: mcr.microsoft.com/playwright:v1.61.0-noble
+    image: mcr.microsoft.com/playwright:v1.62.0-noble
     entrypoint: ["/bin/bash", "-c"]
     command:
       - |

e2e-tests/cypress/tests/integration/channels/accessibility/accessibility_post_spec.js

@@ -42,7 +42,8 @@ describe('Verify Accessibility Support in Post', () => {
         cy.get('#postListContent', {timeout: TIMEOUTS.ONE_MIN}).should('be.visible');
     });
 
-    it('MM-T1479 Verify Reader reads out the post correctly on Center Channel', () => {
+    // To be addressed in MM-70414
+    it.skip('MM-T1479 Verify Reader reads out the post correctly on Center Channel', () => {
         const {lastMessage} = postMessages(testChannel, otherUser, 1);
         performActionsToLastPost();
 

e2e-tests/cypress/tests/integration/channels/files_and_attachments/upload_files_spec.js

@@ -27,6 +27,9 @@ describe('Upload Files', () => {
         // # Login as sysadmin
         cy.apiAdminLogin();
 
+        // # Ensure standard message display (download aria-label is omitted in compact)
+        cy.apiSaveMessageDisplayPreference('clean');
+
         // # Init setup
         cy.apiInitSetup().then((out) => {
             channelUrl = out.channelUrl;