Release 2026-09-18 - (expected chart version 5.36.0)

CHANGELOG.md

@@ -1,3 +1,74 @@
+# [2026-09-18] (Chart Release 5.36.0)
+
+## Release notes
+
+
+* `preventAdminlessGroups` is unlocked by default (#5496)
+
+
+## API changes
+
+
+* Finalize API version v18 and create development version v19. (#5531, #5536)
+
+
+## Features
+
+
+* Add federation support for `preventAdminlessGroups` system notifications, with capability-aware handling for older remote backends. (#5525, #5540)
+
+* Add `ssoIdpChangeDetectionEnabled` to `GET /system/settings`. (#5527)
+
+* Change the default value of totalLimitBytes from one terrabyte to unlimited (#5519)
+
+* Meeting events (`meeting.create`, `meeting.update`, `meeting.delete`, `meeting.member-add`) are now delivered to all push channels, including native push (APNs/FCM), so offline or backgrounded clients learn about meeting changes via native push instead of waiting for the next foreground sync. (#5537)
+
+* Support migrating user data to postgresql from cassandra (#5324)
+
+
+## Bug fixes and other updates
+
+
+* Revoking a pending SCIM invitation now removes the associated Brig account and
+  Spar SCIM metadata synchronously, allowing the same SCIM user to be invited
+  again. (#5510)
+
+* MLS message validation has been hardened. (#5517)
+
+* Account pages now use the correct backend URL and CSP header on each multi-ingress domain. This applies to both ingress charts: `nginx-ingress-services` no longer includes the account-pages host in its generic CSP snippet, and `wire-ingress` (envoy-gateway) no longer injects a Content-Security-Policy response header on the account-pages route. The same fix is applied to the webapp route in `wire-ingress`, which had the same problem (`nginx-ingress-services` already skipped it). (#5534)
+
+* Deleted SCIM users could still have pending team invitations. These are now
+  deleted (invalidated) with the SCIM user. (#5492)
+
+* Postgresql connection strings with mismatched host/port counts in service
+  configurations now lead to immediate failure with a clear error message instead
+  of silently producing an erroneous connection. (#5494)
+
+
+## Documentation
+
+
+* Remove cabal update from build steps and fix some typos in developer docs (#5523)
+
+
+## Internal changes
+
+
+* Script listing all commits and releases in which given files have been touched. (#5509)
+
+* MLS commit-bundles are processed with less sequential I/O: proposal references are resolved from a single store read, client and client-store updates fan out concurrently, and welcome pushes no longer block the response. (#5528)
+
+* Add diagnostic logging for failed MLS commit-bundle operations, including typed failures and exceptions during commit-lock handling. (#5544)
+
+
+## Federation changes
+
+
+* Add an opt-in policy for dropping queued federation notifications when the target backend supports no compatible API version. (#5501)
+
+* Remove stale local memberships when a remote conversation is definitively reported as not found. (#5504)
+
+
 # [2026-08-27] (Chart Release 5.35.0)
 
 ## Release notes

cassandra-schema.cql

@@ -738,7 +738,7 @@ CREATE TABLE brig_test.rich_info (
     AND crc_check_chance = 1.0
     AND default_time_to_live = 0
     AND extensions = {}
-    AND gc_grace_seconds = 864000
+    AND gc_grace_seconds = 86400
     AND max_index_interval = 2048
     AND memtable_flush_period_in_ms = 0
     AND min_index_interval = 128
@@ -848,7 +848,7 @@ CREATE TABLE brig_test.service_team (
     AND crc_check_chance = 1.0
     AND default_time_to_live = 0
     AND extensions = {}
-    AND gc_grace_seconds = 864000
+    AND gc_grace_seconds = 86400
     AND max_index_interval = 2048
     AND memtable_flush_period_in_ms = 0
     AND min_index_interval = 128
@@ -874,7 +874,7 @@ CREATE TABLE brig_test.service_user (
     AND crc_check_chance = 1.0
     AND default_time_to_live = 0
     AND extensions = {}
-    AND gc_grace_seconds = 864000
+    AND gc_grace_seconds = 86400
     AND max_index_interval = 2048
     AND memtable_flush_period_in_ms = 0
     AND min_index_interval = 128
@@ -1088,7 +1088,7 @@ CREATE TABLE brig_test.user (
     AND crc_check_chance = 1.0
     AND default_time_to_live = 0
     AND extensions = {}
-    AND gc_grace_seconds = 864000
+    AND gc_grace_seconds = 86400
     AND max_index_interval = 2048
     AND memtable_flush_period_in_ms = 0
     AND min_index_interval = 128
@@ -1137,7 +1137,7 @@ CREATE TABLE brig_test.user_handle (
     AND crc_check_chance = 1.0
     AND default_time_to_live = 0
     AND extensions = {}
-    AND gc_grace_seconds = 864000
+    AND gc_grace_seconds = 86400
     AND max_index_interval = 2048
     AND memtable_flush_period_in_ms = 0
     AND min_index_interval = 128

charts/nginx-ingress-services/templates/ingress.yaml

@@ -1,3 +1,7 @@
+{{- $accountPagesDns := "" -}}
+{{- if .Values.accountPages.enabled -}}
+{{- $accountPagesDns = required "Need a 'config.dns.accountPages' name when accountPages.enabled is true." .Values.config.dns.accountPages -}}
+{{- end -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -46,6 +50,13 @@ metadata:
       if ($http_host = "{{ .Values.config.dns.webapp }}") {
         set $skip_csp 1;
       }
+      {{ if .Values.accountPages.enabled }}
+      # Like the webapp, account-pages provides multi-ingress aware CSP headers
+      # itself, so the approximation below must not overwrite them.
+      if ($http_host = "{{ $accountPagesDns }}") {
+        set $skip_csp 1;
+      }
+      {{ end }}
       if ($uri ~ "^(/v[0-9]+)?/sso/(finalize-login|initiate-login)(/[a-zA-Z0-9-]*)?$|^/favicon\.ico$") {
         set $skip_csp 1;
       }
@@ -91,7 +102,7 @@ spec:
       - {{ .Values.config.dns.teamSettings }}
 {{- end }}
 {{- if .Values.accountPages.enabled }}
-      - {{ .Values.config.dns.accountPages }}
+      - {{ $accountPagesDns }}
 {{- end }}
     secretName: {{ include "nginx-ingress-services.getCertificateSecretName" . | quote }}
   rules:
@@ -142,7 +153,7 @@ spec:
                   number: {{ .Values.service.teamSettings.externalPort }}
 {{- end }}
 {{- if .Values.accountPages.enabled }}
-    - host: {{ .Values.config.dns.accountPages }}
+    - host: {{ $accountPagesDns }}
       http:
         paths:
           - path: /

charts/wire-ingress/README.md

@@ -103,7 +103,7 @@ name overrides, etc.) can be found in `values.yaml`.
 | `config.ingressClass` | |
 | `ingressName` | Replaced by `config.domains[].name` — see [Multi-ingress (multiple backend domains)](#multi-ingress-multiple-backend-domains) |
 | `config.isAdditionalIngress` | Implicit — every `config.domains` entry after the first is an additional ingress |
-| `config.renderCSPInIngress` | CSP is injected automatically on additional domains; opt out per-domain with `config.domains[].renderCSP: false` |
+| `config.renderCSPInIngress` | CSP is injected automatically on additional domains (team-settings route only); opt out per-domain with `config.domains[].renderCSP: false` |
 | `config.dns.base` | Replaced by `config.domains[].base` (used for the per-domain CSP wildcard) |
 | `tls.verify_depth` | Envoy Gateway `ClientTrafficPolicy` does not expose a direct verify-depth knob; the CA chain itself controls this |
 | `tls.enabled` | Removed — had no effect; all routes are always TLS-terminated |
@@ -250,8 +250,12 @@ config:
 
 First entry = primary (listener `https`, un-suffixed names, no injected CSP — apps set their own).
 Each additional entry gets its own listener `https-<name>`, cert/secret, suffixed routes, and an
-injected per-domain CSP header on the webapp/team-settings/account-pages routes (opt out with
-`renderCSP: false`).
+injected per-domain CSP header on the team-settings route (opt out with `renderCSP: false`).
+
+The webapp and account-pages routes never get an injected CSP, on any domain: both apps emit
+correct per-domain headers themselves, and the injected header would replace them with a weaker
+approximation. This matches the hosts the legacy `nginx-ingress-services` chart skips in its CSP
+snippet. Team-settings does not yet support this, hence the approximation there.
 
 Multi-ingress is mutually exclusive with federation: `config.domains` cannot be
 combined with `federator.enabled: true`. Use federation with a single backend

charts/wire-ingress/templates/_helpers.tpl

@@ -86,7 +86,9 @@ Multi-domain: `config.domains` is a list; the FIRST entry is the primary
 (its resources keep the un-suffixed names, and its frontend apps set their own
 CSP so no CSP is injected). Every additional entry gets a `-<name>` suffix, its
 own Gateway listener (`https-<name>`), its own certificate/secret, and — being
-an "additional ingress" — a per-domain CSP header injected on the app routes.
+an "additional ingress" — a per-domain CSP header injected on the team-settings
+route. The webapp and account-pages routes never get an injected CSP: those
+apps set multi-ingress aware headers themselves (see the httproute templates).
 
 Each entry has: suffix, section, hostname, https, ssl, webapp, teamSettings,
 accountPages, fakeS3, base, secretName, certName, issuerName, issuerKind,
@@ -183,6 +185,10 @@ for multi-ingress domains (charts/nginx-ingress-services/templates/ingress.yaml)
 where the primary domain's frontend apps set CSP themselves but additional
 domains need the header set at the front door.
 
+Only the team-settings route uses this. The webapp and account-pages routes are
+excluded, matching the `$skip_csp` hosts in the nginx chart's snippet, because
+those apps emit correct per-domain headers on their own.
+
 Call with a dict: {https, ssl, base, websockets (bool)}.
 */}}
 {{- define "wire-ingress.cspHeader" -}}

charts/wire-ingress/templates/httproute-account-pages.yaml

@@ -30,14 +30,11 @@ spec:
         - path:
             type: PathPrefix
             value: /
-      {{- if $domain.csp }}
-      filters:
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Content-Security-Policy
-                value: {{ include "wire-ingress.cspHeader" (dict "https" $domain.https "ssl" $domain.ssl "base" $domain.base "websockets" $root.Values.websockets.enabled) | quote }}
-      {{- end }}
+      {{/* No CSP header is injected here. Unlike team-settings, account-pages
+      sets multi-ingress aware CSP headers itself, and a ResponseHeaderModifier
+      "set" filter would replace them with the weaker approximation from
+      wire-ingress.cspHeader. This mirrors the legacy nginx-ingress-services
+      chart, which skips its CSP snippet for this host. */}}
       backendRefs:
         - name: account-pages-http
           port: {{ $root.Values.service.accountPages.externalPort }}

charts/wire-ingress/templates/httproute-webapp.yaml

@@ -30,14 +30,11 @@ spec:
         - path:
             type: PathPrefix
             value: /
-      {{- if $domain.csp }}
-      filters:
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Content-Security-Policy
-                value: {{ include "wire-ingress.cspHeader" (dict "https" $domain.https "ssl" $domain.ssl "base" $domain.base "websockets" $root.Values.websockets.enabled) | quote }}
-      {{- end }}
+      {{/* No CSP header is injected here. Unlike team-settings, the webapp
+      sets multi-ingress aware CSP headers itself, and a ResponseHeaderModifier
+      "set" filter would replace them with the weaker approximation from
+      wire-ingress.cspHeader. This mirrors the legacy nginx-ingress-services
+      chart, which skips its CSP snippet for this host. */}}
       backendRefs:
         - name: webapp-http
           port: {{ $root.Values.service.webapp.externalPort }}

charts/wire-ingress/values.yaml

@@ -125,8 +125,10 @@ gateway:
 # the un-suffixed names, and its frontend apps set their own CSP). Every
 # additional entry gets its own Gateway HTTPS listener (`https-<name>`), its own
 # certificate/secret, and — being an "additional ingress" — a per-domain
-# Content-Security-Policy header injected on the webapp/team-settings/
-# account-pages routes (mirrors the legacy nginx-ingress-services behaviour).
+# Content-Security-Policy header injected on the team-settings route (mirrors
+# the legacy nginx-ingress-services behaviour). The webapp and account-pages
+# routes are left alone: those apps set multi-ingress aware CSP headers
+# themselves, and injecting here would overwrite them.
 #
 # config.dns and config.domains are mutually exclusive; config.domains wins.
 #
@@ -153,7 +155,7 @@ gateway:
 #         https: nginz-https.red.example.org
 #         ssl: nginz-ssl.red.example.org
 #         webapp: webapp.red.example.org
-#       # renderCSP: false                   # optional: disable the injected CSP for this domain
+#       # renderCSP: false                   # optional: disable the injected CSP (team-settings) for this domain
 #       tls:
 #         # secretName: ""                   # optional TLS secret name override (defaults to a per-domain name)
 #         issuer:                            # optional per-domain cert-manager issuer override (defaults to tls.issuer)

charts/wire-server/templates/background-worker/configmap.yaml

@@ -84,6 +84,7 @@ data:
     migrateConversationCodes: {{ .migrateConversationCodes }}
     migrateTeamFeatures: {{ .migrateTeamFeatures }}
     migrateDomainRegistration: {{ .migrateDomainRegistration }}
+    migrateUsers: {{ .migrateUsers }}
     migrationOptions:
 {{ toYaml .migrationOptions | indent 6 }}
 

charts/wire-server/templates/brig/configmap.yaml

@@ -396,5 +396,16 @@ data:
       setNomadProfiles: {{ index . "setNomadProfiles" }}
       {{- end }}
       setConsumableNotifications: false
+      {{- /* Raw spar multi-ingress inputs (schema: spar.config in values.yaml).
+             Brig derives ssoIdpChangeDetectionEnabled from them at runtime
+             (see Brig.Options.deriveSsoIdpChangeDetectionEnabled). Keep the
+             rendered keys in sync with its FromJSON instance. */}}
+      {{- with $.Values.spar }}
+      {{-   with .config }}
+      setSsoIdpChangeDetectionInputs:
+        multiIngressDomainConfigs: {{ .domainConfigs | default (dict) | toJson }}
+        idpCertFingerprintAllowlist: {{ .idpCertFingerprintAllowlist | default (list) | toJson }}
+      {{-   end }}
+      {{- end }}
     {{- end }}
   {{- end }}

charts/wire-server/templates/gundeck/configmap.yaml

@@ -63,6 +63,14 @@ data:
       {{- end }}
     {{- end }}
 
+    {{- if .postgresql }}
+    postgresql: {{ toYaml .postgresql | nindent 6 }}
+    postgresqlPool: {{ toYaml .postgresqlPool | nindent 6 }}
+    {{- if hasKey $.Values.gundeck.secrets "pgPassword" }}
+    postgresqlPassword: /etc/wire/gundeck/secrets/pgPassword
+    {{- end }}
+    {{- end }}
+
     # Gundeck uses discovery for AWS access key / secrets
     # For more details, check amazonka's documentation at:
     # https://hackage.haskell.org/package/amazonka-1.4.5/docs/Network-AWS.html#t:Credentials

charts/wire-server/templates/gundeck/secret.yaml

@@ -31,5 +31,8 @@ data:
   {{- if hasKey . "redisAdditionalWritePassword" }}
   redisAdditionalWritePassword: {{ .redisAdditionalWritePassword | b64enc | quote }}
   {{- end }}
+  {{- if hasKey . "pgPassword" }}
+  pgPassword: {{ .pgPassword | b64enc | quote }}
+  {{- end }}
   {{- end }}
 {{- end }}

charts/wire-server/values.yaml

@@ -260,10 +260,9 @@ galley:
               allowed_to_open_channels: team-members
             lockStatus: locked
         preventAdminlessGroups:
-          # This feature has known errors. Thus, it must stay disabled for now.
           defaults:
             status: disabled
-            lockStatus: locked
+            lockStatus: unlocked
             config:
               promotionStrategy: alphabetical
               deletionTimeoutDuration: 7d
@@ -314,7 +313,7 @@ galley:
               collabora:
                 edition: COOL
               storage:
-                totalLimitBytes: "1000000000000"
+                totalLimitBytes: "-1"
                 perUserQuotaBytes: "-1"
         allowedGlobalOperations:
           status: enabled
@@ -1026,6 +1025,10 @@ background-worker:
     # It's important to set `settings.postgresMigration.domainRegistration` to `migration-to-postgresql`
     # before starting the migration.
     migrateDomainRegistration: false
+    # This will start the migration of users
+    # It's important to set `settings.postgresMigration.users` to `migration-to-postgresql`
+    # before starting the migration.
+    migrateUsers: false
 
     backendNotificationPusher:
       pushBackoffMinWait: 10000 # in microseconds, so 10ms

deploy/dockerephemeral/docker-compose.yaml

@@ -290,7 +290,7 @@ services:
       POSTGRES_PASSWORD: "posty-the-gres"
       POSTGRES_USER: "wire-server"
       POSTGRES_DB: "backendA"
-    command: postgres -c max_connections=150
+    command: postgres -c max_connections=1000
 
   cassandra:
     container_name: demo_wire_cassandra

docs/src/developer/developer/api-versioning.md

@@ -282,7 +282,7 @@ When invoking an endpoint as a federation client, we need to make sure that all
 supported versions are covered. The `FederatorClient` monad has an
 `Alternative` instance which can be useful for this purpose: an action will fail
 (before even performing any request) if it refers to an endpoint whose version
-range does not contain the version that was negotiatted.
+range does not contain the version that was negotiated.
 
 For example, suppose that `get-user-clients` disappears in version 2, and
 clients are now supposed to use an endpoint called `get-clients-ng`, with