Mattermost Changelog¶

Security Update¶

• Mattermost v4.0.0 contains multiple security fixes ranging from low to high severity. Upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy.

Highlights¶

Improvements¶

Bug Fixes¶

• Emoji picker now closes in Firefox when clicking outside of it.
• [...] menu no longer disappears in the comment thread when hovering over another post.
• New direct messages received while in no teams do not show as unread after rejoining a team.
• Fixed JavaScript errors when receiving messages when not belonging to a team.
• An empty push notification no longer sent for messages only containing file attachments.
• Custom emoji search results no longer filter by creator’s first and last name.
• /expand and /collapse slash commands now properly collapse images in website link previews.
• Group Message channels that are favorited can now be closed.
• Deactivated users now properly listed in Direct and Group Message channels in the left-hand sidebar.
• Fixed search in team and channel Manage Members dialog.
• File upload cancelled if you click “x” on thumbnail while file is uploading in your message draft.
• Status no longer appears offline after joining a new team.
• An empty push notification is no longer sent for messages only containing file attachments.
• Center channel maintains scroll position when new messages are received in the channel.
• Deleting the focused post in permalink view now sends user to normal channel view.
• Max Users per Team setting in System Console > Users and Teams no longer includes inactive users.

Compatibility¶

API v4 Changes¶

• Mattermost 4.0 has a stable release of API v4 endpoints. It is recommended that any new integrations use the v4 endpoints. For more details, and for a complete list of available endpoints, see https://api.mattermost.com/.
• All APIv3 endpoints are scheduled for removal on January 16, 2018.

Added routes (API v4)

• GET at /teams/invite/{invite_id}
  • To retrieve information about a team (including the name and id) corresponding to an invite_id.

Modified routes (API v4)

• DELETE at /teams/{team_id}
  • Added an optional query parameter, permanent, to permanently delete a team for compliance reasons.
• GET at /users
  • Added the sort query parameter to add basic sorting when selecting users on a team.
• GET at /emoji
  • Added paging to the /emoji call for increased performance.
• POST at /teams/{team_id}/import
  • Updated to return a JSON body with the import results under a results JSON field to allow more data to be returned in the future without breaking changes.

Websocket Event Changes¶

Added:

• channel_updated that occurs each time channel information is updated (such as name or header), so that the changes are propagated across clients.
• channel_viewed that occurs each time you view a channel, propagating the event to all clients and devices and syncing unreads.

Known Issues¶

• Google login fails on the Classic mobile apps.
• Edge overlays desktop notification sound and system notification sound.
• Clicking on a channel during the tutorial makes the tutorial disappear.
• User can receive a video call from another browser tab while already on a call.
• Search autocomplete picker is broken on Classic Android app.
• Jump link in search results does not always jump to display the expected post.
• First load of the emoji picker is slow on low-speed connections or on deployments with hundreds of custom emoji.
• Scrollbar is sometimes not visible in the left-hand sidebar after switching teams.
• Certain code block labels don’t appear while scrolling on iOS mobile web.
• Outgoing webhooks do not fire when posts have no text content.
• A public channel doesn’t always show up in another browser tab or client until after refresh.
• Null values in Slack attachments cause a 500 error for incoming webhooks.
• Keyboard shortcut CTRL/CMD+SHIFT+A does not close Account Settings.
• Deleted message doesn’t clear unreads or unread mentions.
• Changing the search term in the More Direct Messages modal doesn’t reset the page.
• Status may sometimes get stuck as away or offline in High Availability mode with IP Hash turned off.
• Cannot delete or edit parent posts in right-hand side reply threads.
• Empty cells in Markdown tables render incorrectly.
• platform user deleteall CLI command expects a user as an argument.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• 94117nl, abustany, alexrford, asaadmahmood, ccbrown, coreyhulen, cpanato, crspeller, dmeza, enahum, ftKnox, grundleborg, hmhealey, it33, jasonblais, JeffSchering, jwilander, kkamdooong, lindalumitchell, megos, meilon, moonmeister, pieterlexis, saturninoabril, VeraLyu, ZJvandeWeg

/mattermost-mobile

• asaadmahmood, csduarte, enahum, hmhealey, lfbrock, omar-dev

/mattermost-redux

• 94117nl, csduarte, enahum, grundleborg, hmhealey, jarredwitt, jwilander, saturninoabril

/mattermost-api-reference

• cpanato, grundleborg, hmhealey, jasonblais, jwilander, Vaelor, ZJvandeWeg

/docs

• 94117nl, acgustafson, amyblais, ccbrown, crspeller, esethna, it33, jasonblais, JeffSchering, jwilander, kjkeane, megos, pieterlexis

/desktop

• yuya-oc

/mattermost-kubernetes

• coreyhulen

/mattermost-push-proxy

• coreyhulen, ftKnox

/mattermost-docker

• pichouk, tejasbubane

/mattermost-load-test

• crspeller, JeffSchering

Highlights¶

Improvements¶

Bug Fixes¶

• Dragging and dropping a file onto the left-hand sidebar no longer navigates away from Mattermost to open the file in the browser.
• Textbox will no longer overlap the center pane message area as it expands when typing.
• Fixed an issue where statuses could get stuck online after quitting the desktop app or closing the browser window in some cases.
• Profile pictures uploaded on mobile are now rotated in their correct orientation.
• The System Console help text for Minimum Password Length no longer dynamically updates as the input is changed.
• Fixed an issue where the autocomplete list may appear underneath a modal overlay.
• Updated error text when uploading a profile picture that is in an unsupported image format.
• Joined channels no longer appear in the “More...” channels list.
• Wide markdown images no longer cause horizontal scrolling in the center pane.
• Fixed theme styling for button active states.
• Fixed an issue where channels sometimes did not appear read if the channel was in focus when a new message was received.
• Fixed an issue where the autocomplete list would not close after using a slash command.
• Removed the system warning message that appears if mentioning a user that is not a member of a group message.
• Fixed an issue where wide embedded images produce horizontal scroll.
• Fixed a Javascript error that would occur when opening the System Console > SAML page.
• Removed the Channel Admin user interface in Team Edition since the policy restrictions are only available in Enterprise Edition.
• Adding a reaction to an ephemeral message no longer throws a Javascript error.
• Fixed an issue where clicking autocomplete suggestions would not populate the search box with the appropriate text.
• Fixed an issue where the System Console users list ignored the search term after selecting a team from the filter.
• Channel header messages no longer appear cut-off if using a slash.
• Corrected the formatting of the “Edited” indicator in the right-hand sidebar.
• Fixed the positioning of the pin icon and channel header on Edge.

Compatibility¶

API Changes¶

• Mattermost 3.10 has a release candidate of APIv4 endpoints. To see the complete list of available endpoints, see https://api.mattermost.com/v4/.
• All APIv3 endpoints are scheduled for removal six months after APIv4 is stable.

Modified routes (APIv4)

• /system/ping updated to return 500 Internal Server Error with {"status": "unhealthy"} in the response body when GoroutineHealthThreshold is set in config.json and the number of goroutines on the server exceeds that threshold. If the number of goroutines is below the threshold or GoroutineHealthThreshold is not set in config.json, 200 OK is returned with no response body.

Known Issues¶

• Google login fails on the mobile apps.
• Edge overlays desktop notification sound and system notification sound.
• Status appears offline briefly after joining a new team.
• User popover can get cropped in the center channel on iOS.
• Clicking on a channel during the tutorial makes the tutorial disappear.
• Custom emoji search results filter by the creator’s first/last name in addition to the emoji name.
• Reactions are displayed on messages deleted by other users.
• User can receive a video call from another browser tab while already on a call.
• Search autocomplete picker is broken on Android.
• Jump link in search results does not always jump to display the expected post.
• First load of the emoji picker is slow on low-speed connections.
• Emoji picker for reactions doesn’t always position correctly.
• Scrollbar is sometimes not visible in the left-hand sidebar after switching teams.
• New direct messages received while in no teams do not show as unread after joining a team.
• User is not logged out immediately when logging self out from Active Sessions list.
• Certain code block labels don’t appear while scrolling on iOS mobile web.
• CTRL+SHIFT+K doesn’t toggle modal open and closed.
• Deactivated users do not appear in the Direct Message and Group Message sidebar channel list.
• Outgoing webhooks do not fire when posts have no text content.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• asaadmahmood, coreyhulen, cpanato, crspeller, dmeza, doh5, enahum, grundleborg, harshavardhana, hmhealey, jasonblais, jwilander, kulak-at, saturninoabril, tjuerge

/docs

• cpanato, crspeller, esethna, hmhealey, it33, jasonblais, JeffSchering, jwilander, kjkeane, lindy65, mikedaniel18

/mattermost-api-reference

• 94117nl, cpanato, hmhealey, jwilander, senk

/mattermost-redux

• 94117nl, cpanato, enahum, jarredwitt, jwilander

/mattermost-mobile

• asaadmahmood, cpanato, csduarte, enahum, hmhealey, lfbrock, rthill

/desktop

• yuya-oc

/mattermost-docker

• carlosasj, FingerLiu, mkdbns, pichouk, xcompass

/android

• coreyhulen, der-test, lfbrock

/mattermost-selenium

• doh5, lindalumitchell

/gorp

• jwilander

/ios

• coreyhulen, PrestonL

/mattermost-kubernetes

• coreyhulen

Security Update¶

• Mattermost v3.9.0 contains a low severity security update. Upgrading to Mattermost v3.9.0 is highly recommended.

Highlights¶

Improvements¶

Bug Fixes¶

• Long custom emoji names no longer float out of the emoji picker.
• Deleted custom emojis no longer stay in “recently used” section of the emoji picker.
• The maximum length of the “Position” field increased to 64 characters in the database. The previous limit caused problems with LDAP synchronization.
• Pinning a post in center channel no longer changes pinned posts list in the right-hand sidebar.
• Pinning a post in center channel now adds the pinned post badge to search results.
• Fixed error message text for Edit URL field in channel creation dialog.
• Disabled config file watcher while running from makefile.
• Fixed Go client’s GetTeamByName() function.
• Recent mentions search now properly includes @[username] in the search.
• Updated error message when entering a password longer than maximum number of characters.
• Don’t send the same message multiple times when hitting “Retry” on a failed post.
• Fixed the help text for the channel purpose in private channels.
• When ability to change the header is restricted, “Set a Header” option is no longer shown in the channel intro.
• Mention notifications now trigger if the word is formatted in bold, italic or strikethrough, and won’t if it’s inside a code block.
• In mobile view, Manage Members menu option no longer reads “View Members” for channel admins.
• Usernames with dots now get mention notifications when followed by a comma or other symbol.
• Deactivated users are no longer listed in the “Manage Members” modal.
• Collapsible Account Setting menus now open properly in iOS Safari and Chrome browsers.
• Removing an expired license now removes the blue bar header message.
• “Next” button in More Channels list now takes you to the top of the next page, instead of the bottom.
• Blue bar “Preview Mode” header message now disappears after enabling email notifications.
• Full name is now editable in Account Settings if the first and last name attributes are not specified in System Console > Authentication > LDAP.
• Added a back button to pinned posts list on the right-hand sidebar.
• “Pinned” icon no longer overlaps text on consecutive posts or replies that have Markdown headings.
• Uploading a profile picture on iOS no longer throws an error.
• Fixed group message names in channel switcher (CTRL/CMD+K) for group messages that are not in your sidebar.
• Channel notification preferences no longer appear saved when clicking Cancel.
• Channel creation permissions aren’t set to channel admins when it doesn’t exist.

Compatibility¶

Database Changes¶

OAuthAccessData Table:

• Added Scope column

PasswordRecovery Table:

• Removed PasswordRecovery table and moved entries to a common token store

API Changes¶

• Mattermost 3.9 has a release candidate of APIv4 endpoints. To see the complete list of available endpoints, see https://api.mattermost.com/v4/.
• All APIv3 endpoints to be removed six months after APIv4 endpoints are stable.

Websocket Event Changes¶

• Added preferences_changed and preferences_deleted to sync preferences between browser tabs, between different browsers, and across devices when a preference is changed or deleted.

Known Issues¶

• Google login fails on the mobile apps.
• Slack import doesn’t add merged members/e-mail accounts to imported channels.
• User can receive a video call from another browser tab while already on a call.
• Sequential messages from the same user appear as separate posts on mobile view.
• Search autocomplete picker is broken on Android.
• Jump link in search results does not always jump to display the expected post.
• First load of the emoji picker is slow at low connections.
• Emoji picker for reactions doesn’t always position correctly.
• Scrollbar is sometimes not visible in the left-hand sidebar after switching teams.
• Emoji picker is sometimes cut off on comment threads on the right-hand sidebar.
• User status can get stuck online after quitting the desktop app or closing the browser window.
• New direct messages received while in no teams do not show as unread after joining a team.
• Profile picture uploaded from mobile appears rotated.
• User is not logged out immediately when logging self out from Active Sessions list.
• Certain code block labels don’t appear while scrolling on iOS mobile web.
• System Console user list filter does not show accurate results if applied after entering a search query.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• asaadmahmood, coreyhulen, cpanato, crspeller, doh5, enahum, grundleborg, gstraube , hmhealey, jasonblais, JeffSchering, justinwyer, jwilander, lindalumitchell, prixone, Rudloff, R-Wang97, saturninoabril, simon0191, VeraLyu

/docs

• enahum, esethna, fjarlq, it33, ivernus, jasonblais, JeffSchering, justinwyer, lindy65, senk

/mattermost-api-reference

• cpanato, crspeller, dagit, hmhealey, jwilander, saturninoabril

/mattermost-redux

• enahum, jarredwitt, jwilander

/desktop

• jasonblais, jnugh, yuya-oc

/mattermost-mobile

• asaadmahmood, cpanato, csduarte, enahum, jasonblais, lfbrock

/mattermost-docker

• esethna, pichouk, xcompass

/mattermost-push-proxy

• coreyhulen

/mattermost-selenium

• doh5, lindalumitchell, coreyhulen

/mattermost-kubernetes

• coreyhulen

/gcm

• coreyhulen, csduarte

Notes on Patch Release¶

• v3.8.3, released 2017-07-16
  • Mattermost v3.8.3 contains a high severity security fix for an OAuth SSO vulnerability and two additional fixes for low severity security issues. Upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy.
• v3.8.2, released 2017-04-21
  • Changed the client to use window.location.origin instead of siteURL, fixing WebSocket connection issues with Mattermost 3.8 upgrade.
  • Fixed a few APIv4 endpoints in support of the next React Native mobile app release.
• v3.8.1, released 2017-04-19
  • Mattermost v3.8.1 contains a security update and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy.
  • Fixed an issue with Site URL sometimes breaking the OAuth2 login flow, including login using GitLab.
  • Reverted a change preventing LDAP usernames from beginning with a number.
  • Fixed a permission issue with group message channel creation.
• v3.8.0, released 2017-04-16
  • Original 3.8 release

Security Update¶

• Mattermost v3.8.0 contains multiple security updates. Upgrading to Mattermost v3.8.0 is highly recommended.

Highlights¶

Improvements¶

Bug Fixes¶

• Fixed line wrapping of the timestamp in Account Settings > Security > View Access History.
• Fixed an inconsistent error message when creating a channel with a display name of one or two characters.
• Removed the duplicate “Back” button on the Team Creation page.
• The AltGR key no longer triggers keyboard shortcuts.
• Saving a team name without making changes no longer throws an error message.
• Group messages are now sorted alphabetically with direct messages.
• The “Create Channel” button will now only appear in the “More Channels” modal when the user has the permission to create channels.
• The Town Square channel menu no longer has redundant dividers with certain combinations of System Console > Policy settings.
• Fixed an issue where some conversations would not trigger the channel to appear unread in the left-hand sidebar.
• Fixed an issue where usernames sometimes did not appear when hovering over reactions.
• Fixed an issue where link previews would sometimes cause a horizontal scroll bar to appear.
• iOS code blocks no longer wrap to the next line.
• Removed an extra border in Markdown tables on iOS.
• Usernames in the channel member list are now properly aligned.
• Fixed a console error that was thrown when switching teams.
• Fixed occasionial flickering of channel autocomplete.
• Link preview images no longer appear outside of the preview container.

Compatibility¶

Database Changes¶

Posts Table:

• Added IsPinned column

API Changes¶

New routes (APIv3):

• GET at /channels/{channel_id}/pinned
  • Returns the pinned posts in a channel
• POST at /channels/{channel_id}/posts/{post_id}/pin
  • Pins a post to a channel
• POST at /channels/{channel_id}/posts/{post_id}/unpin
  • Unpins a post from a channel

Removed routes (APIv3):

• GET at /channels/more (replaced by /channels/more/{offset}/{limit})
• POST at /channels/update_last_viewed_at (replaced by /channels/view)
• POST at /channels/set_last_viewed_at (replaced by /channels/view)
• POST at /users/status/set_active_channel (replaced by /channels/view)

Websocket Event Changes¶

Added:

• added_to_team that occurs when the current user is added to a team by another user.

Modified

• Added a seq field to websocket events that increments with each event sent to the client.

Known Issues¶

• “Pinned” icon sometimes overlaps image posts.
• Full name is not editable in Account Settings if the first and last name attributes are removed from System Console > Authentication > LDAP.
• Usernames with dots do not get mention notifications when followed by a comma.
• Slack import doesn’t add merged members/e-mail accounts to imported channels.
• User can receive a video call from another browser tab while already on a call.
• Sequential messages from the same user appear as separate posts on mobile view.
• Search autocomplete picker is broken on Android.
• Jump link in search results does not always jump to display the expected post.
• Blue bar “Preview Mode” header message sometimes does not disappear after enabling email notifications.
• Removing an expired license may not remove the blue bar header message until a refresh.
• First load of the emoji picker is slow at low connections.
• Emoji picker for reactions doesn’t always position correctly.
• Deleted custom emoji stay in “recently used” section of the emoji picker.
• Scrollbar is sometimes not visible in the left-hand sidebar after switching teams.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform:

• aautio, asaadmahmood, bonespiked, bradhowes, coreyhulen, cpanato, crspeller, doh5, enahum, esethna, grundleborg, hmhealey, jasonblais, JeffSchering, jostyee, jwilander, kaakaa, lindalumitchell, prixone, R-Wang97, saturninoabril, VeraLyu

/docs:

• coreyhulen, esethna, it33, jasonblais, JeffSchering, jwilander, lindy65, Rohlik

/mattermost-redux:

• enahum, hmhealey, jarredwitt, jwilander

/mattermost-api-reference:

• cpanato, grundleborg, hmhealey, jwilander, saturninoabril, senk

/mattermost-mobile:

• csduarte, enahum, hmhealey, jasonblais, JeffSchering, lfbrock, saturninoabril

/mattermost-selenium:

• coreyhulen, lindalumitchell

/desktop:

• jasonblais, yuya-oc

/mattermost-docker:

• xcompass

/mattermost-kubernetes:

• coreyhulen

/mattermost-load-test:

• crspeller, csduarte

Notes on Patch Release¶

• v3.7.5, released 2017-04-27
  • Fixed a number of low to moderate severity security issues, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
    • Note: The System Console > Configuration > Site URL field is now mandatory. Set the Site URL in the System Console, or in the gitlab.rb file if you are using GitLab Mattermost.
• v3.7.4, released 2017-04-13
  • Fixed a number of low to high severity security issues, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
• v3.7.3, released 2017-03-23
  • Fixed a high severity security issue, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
  • Fixed an issue with telemetry data collection
• v3.7.2, released 2017-03-17
  • Fixed an issue with LDAP, SAML, and OAuth logins where 1 and 2 character usernames displayed incorrectly
• v3.7.1, released 2017-03-16
  • Fixed an issue where some System Console > Policy settings were incorrectly applied to Team Edition, breaking the System Console UI
• v3.7.0, released 2017-03-16
  • Original 3.7 release

Security Update¶

• Mattermost v3.7.0 contains a security update. Upgrading to Mattermost v3.7.0 is highly recommended.

Highlights¶

Improvements¶

Bug Fixes¶

• Fixed an error where a channel would no longer load after using a GitLab built-in Mattermost slash command /project issue show <number>
• Outdated results in modal searches are now properly discarded
• Fixed order of channels on the sidebar
• Fixed search highlighting for wildcard searches and hashtags
• Clicking “Send message” link in profile popover in a comment thread, now properly opens the direct message channel
• Fixed channels missing from “More Channels” modal after leaving them
• Fixed webhook messages not appearing in channels the creator wasn’t in
• Angled brackets around mailto links now longer autolink
• Fixed an issue where “New messages below” bubble didn’t disappear properly on mobile view
• Fixed CLI panic on platform channel create command if team does not exist
• Team invite link now directs user to a private team after account creation with LDAP
• Create a New Team menu option is now in the Main Menu for System Admins when team creation is disabled
• Fixed the response for malformed command execute request
• New message indicator no longer appears for ephemeral posts
• Fixed emoji aliases not showing up in autocomplete
• Mention badge now properly updates on the team sidebar when switching teams
• (at)-mention preceeded by a “#”-symbol now displays correctly
• Don’t allow APIs to create user accounts that start with a number preventing them from signing in
• Using a mouse to choose an emoji from the autocomplete now works
• Fixed syntax highlighting on mobile
• Fixed inconsistent styling of file uploads between mobile and desktop
• Push notifications are no longer missing username when preferences set to “For all activity”
• Fixed a bug where the Go driver was using a wrong URL for /users/claim/email_to_oauth route

Compatibility¶

Database Changes from v3.6 to v3.7¶

Posts Table:

• Added EditAt column

API Changes from v3.6 to v3.7¶

New routes (APIv3):

• POST at /channels/create_group
  • Creates a new group message channel
• POST at /hooks/incoming/update
  • Updates an incoming webhook
• POST at /hooks/outgoing/update
  • Updates an outgoing webhook
• GET at /teams/{team_id}/...
  • Returns a post list, based on the provided channel and post ID.
• POST at /channels/{channel_id}/update_member_roles
  • Updates the user’s roles in a channel

Websocket Event Changes from v3.6 to v3.7¶

Added:

• channel_create that occurs each time a channel is created
• group_added that occures when a new group message channel is created

Removed:

• view_channel that occurred when a new message was received

Known Issues¶

• Slack import doesn’t add merged members/e-mail accounts to imported channels
• User can receive a video call from another browser tab while already on a call
• Sequential messages from the same user appear as separate posts on mobile view
• Edge overlays desktop notification sound with system notification sound
• Search autocomplete picker is broken on Android
• Jump link in search results does not always jump to display the expected post
• Running CLI without access to logs causes panic
• Switching channels with CTRL/CMD+K doesn’t work properly when using the mouse
• Reacting to a deleted message in the right-hand sidebar throws an error
• Sometimes no email verification is sent to the new email address after changing your email in Account Settings. A workaround is to sign in with the new email address and hitting “Resend Email” on the “Email not verified” page
• Clicking “Load more messages” sometimes brings you to the bottom of the page
• Switching to a channel with unreads sometimes doesn’t jump to the correct scrolling position

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• aautio, akihikodaki, andreistanciu24, asaadmahmood, ayadav, AymaneKhouaji, bjoernr-de, coreyhulen, cpanato, CrEaK, crspeller, DavidLu1997, debanshuk, enahum, erikgui, favadi, gig177, grundleborg, hmhealey, it33, jasonblais, jazzzz, JeffSchering, joannekoong, jostyee, jurgenhaas, jwilander, kaakaa, khawerrind, laur89, lfbrock, mikaoelitiana, morenoh149, mpoornima, pan-feng, pepf, Rudloff, ruzette, saturninoabril, senk, Zaicon, ZJvandeWeg

/api-reference

• debanshuk, enahum, jwilander, ruzette, Zaicon

/docs

• asaadmahmood, cpanato, crspeller, esethna, grundleborg, hmhealey, ilabdsf, it33, jasonblais, JeffSchering, jostyee, jwilander, lfbrock, lindy65, matmorel, senk, vladimirprieto, wget

/mobile

• asaadmahmood, csduarte, enahum, hmhealey, jasonblais, lfbrock

/docker

• darkrasid, nikosch86, xcompass

/desktop

• asaadmahmood, jasonblais, jnugh, yuya-oc

/selenium

• coreyhulen, esethna, lindalumitchell

/push-proxy

• coreyhulen, jostyee, it33

/load-test

• coreyhulen, crspeller

Notes on Patch Release¶

• v3.6.7, released 2017-04-27
  • Fixed a number of low to moderate severity security issues, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
    • Note: The System Console > Configuration > Site URL field is now mandatory. Set the Site URL in the System Console, or in the gitlab.rb file if you are using GitLab Mattermost.
• v3.6.6, released 2017-04-13
  • Fixed a number of low to high severity security issues, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
  • Fixed an issue where Direct Messages list didn’t always properly update in the left-hand sidebar
  • Upgraded MySQL driver for better performance
• v3.6.5, released 2017-03-23
  • Fixed a high severity security issue, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
• v3.6.4, released 2017-03-16
  • Fixed an issue where some System Console > Policy settings were incorrectly applied to Team Edition, breaking the System Console UI
• v3.6.3, released 2017-03-16
  • Fixed a security issue, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
• v3.6.2, released 2017-01-31
  • Fixed a high severity security issue, and upgrading is highly recommended. Details will be posted on our security updates page 14 days after release as per the Mattermost Responsible Disclosure Policy
  • Improved performance of web sockets and typing messages
  • Note: Some deployments using multiple URLs to reach Mattermost via proxy forwarding are reporting issues with the security fix in 3.6.2. The issue is being tracked in our ticketing system.
• v3.6.1, released 2017-01-19
  • Fixed a performance regression when sending many notifications at once (for example, when @all or @channel is used in a channel with many users)
  • Fixed an issue where the config flag for the CLI was not backwards compatible
  • Fixed an upgrade issue where for some databases, the Team Description index was not created properly
  • Fixed an issue with messages not showing up after computer wakes from sleep
• v3.6.0, released 2017-01-16
  • Original 3.6 release.

Security Update¶

• Mattermost v3.6.0 contains a security update. Upgrading to Mattermost v3.6.0 is highly recommended. Thanks to Julien Ahrens for contributing the security report through the Mattermost Responsible Disclosure Policy.

Highlights¶

Improvements¶

Bug Fixes¶

• Integrations that post to Direct Message channels now mark the channel as Unread
• @mention autocomplete will now filter on Chinese, Japanese, Korean names
• Text focus is now set on the text input area after channel creation
• Editing old posts no longer causes them to repost for other members of the channel
• Email invitation subject line no longer displays HTML characters in place of apostrophes in the team name
• Current user is no longer displayed in the direct messages modal
• Searching on direct messages modal now happens on typing rather than after hitting ENTER
• More Channels modal now resets search when opening and closing the dialog
• Channel switcher (CTRL/CMD+K) now works for direct message channels of users outside the team
• Using the command line to invite users no longer sends an invalid join team link
• Sleeping and waking your computer while logged into Mattermost no longer causes a console error
• Searching for users in double in quotes in the direct message modal no longer throws an error
• XML file preview no longer throws a JavaScript error
• User autocomplete in message box no longer matches against email
• Channel linking (with ~ shortcut) now works for channels you don’t belong to
• Fixed statistics for websockets and database connections in System Console > Site Statistics to work in High Availability mode
• Slash commands now work in newly created private channels without requiring a refresh
• Zapier app channel dropdown selector works again
• Fixed sign in errors for non-admin accounts when custom emojis are restricted to Team and System Admins
• Fixed encoding of file names when downloading attachments
• Unflagging or flagging a post in the right-hand sidebar no longer forces a scroll to the top of the flagged posts list
• User list in System Console > Teams is no longer blank on first load
• Fixed a bug where sometimes the right-hand sidebar would not display properly when switching to view another channel

Compatibility¶

Changes from v3.5 to v3.6:

Special Upgrade Note: (Enterprise Edition) If you previously had values set for RestrictPublicChannelManagement and RestrictPrivateChannelManagement, the new settings for RestrictPublicChannelCreation, RestrictPrivateChannelCreation, RestrictPublicChannelDeletion, and RestrictPrivateChannelDeletion will take those settings as their default values.

Database Changes from v3.5 to v3.6¶

Posts Table:

• Added HasReactions column

Teams Table:

• Added Description column

Users Table:

• Added Position column

Status Table:

• Removed ActiveChannel column

API Changes from v3.5 to v3.6¶

New routes:

• Added POST at /commands/update
  • Updates a slash command
• Added GET at /users/name/{username}
  • Returns a user matching the given username
• Added GET at /users/email/{email}
  • Returns a user matching the given email
• Added GET at /users/autocomplete
  • Returns a list of users on the system that have a username, full name, or nickname that match against the provided term
• Added GET at /teams/name/{team_name}
  • Returns team object for a given team name
• Added GET at /teams/{team_id}/channels/name/{channel_name}
  • Returns a channel for a given channel name
• Added POST at /teams/{team_id}/channels/{channel_id}/members/ids
  • Returns channel member objects for the channel and user IDs specified
• Added GET at /teams/members
  • Returns an array with the teams the current user belongs to
• Added GET at /teams/unread
  • Returns an array containing the amount of unread messages and mentions for the teams the current user belongs to
• Added POST at /teams/{team_id}/channels/view
  • Performs all actions related to viewing a channel, including marking channels as read, clearing push notifications, and updating the active channel
• Added POST at /teams/{team_id}/channels/{channel_id}/posts/{post_id}/reactions/save
  • Saves an emoji reaction for a post, returns the saved reaction if successful
• Added POST at /teams/{team_id}/channels/{channel_id}/posts/{post_id}/reactions/delete
  • Removes an emoji reaction for a post in the given channel, returns nil if successful
• Added GET at /teams/{team_id}/channels/{channel_id}/posts/{post_id}/reactions'
  • Returns a list of all emoji reactions for a post
• Added GET at /admin/invalidate_all_caches
  • Purge all the in-memory caches for things like sessions, accounts, channels; deployments using High Availability will attempt to purge all the servers in the cluster (this may adversely impact performance)
• Added GET at /channels/more/{offset}/{limit}
  • Returns a page of public channels the user is not in based on the provided offset and limit
• Added POST at /channels/more/search
• Returns a list of public channels the user is not in that match the search criteria
• Added GET at /channels/autocomplete
  • Returns a list of public channels that match the provided string

Deprecated routes:

• GET at /channels/more (replaced by /channels/more/{offset}/{limit}) to be removed in v3.7
• POST at /channels/update_last_viewed_at (replaced by /channels/view) to be removed in v3.8
• POST at /channels/set_last_viewed_at (replaced by /channels/view) to be removed in v3.8
• POST at /users/status/set_active_channel (replaced by /channels/view) to be removed in v3.8

Removed routes:

• POST at /teams/create_from_signup
• POST at /teams/signup

Changed routes:

• Updated teams/{team_id}/commands/execute endpoint request body field from channelId to channel_id

Websocket Event Changes from v3.5 to v3.6¶

Added:

• update_team that occurs each time the team info is updated
• reaction_added that occurs when an emoji reaction is added to a post
• reaction_removed that occurs when an emoji reaction is removed from a post

Known Issues¶

• Slack Import doesn’t add merged members/e-mail accounts to imported channels
• User can receive a video call from another browser tab while already on a call
• Video calls do not work with Chrome v56 and later
• Sequential messages from the same user appear as separate posts on mobile view
• Edge overlays desktop notification sound with system notification sound
• Deleting a message from a permalink view doesn’t show delete until refresh
• Search autocomplete picker is broken on Android

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• asaadmahmood, bjoernr-de, bolecki, brendanbowidas, CometKim, coreyhulen, cpanato, crspeller, debanshuk, enahum, esethna, fraziern, grundleborg, hmhealey, it33, jwilander, kaakaa, khawerrind, lfbrock, maruTA-bis, pepf, raphael0202, Rudloff, Yangchen1, ZJvandeWeg

/docs

• aureliojargas, axilleas, esethna, grundleborg, hmhealey, it33, jasonblais, JeffSchering, jwilander, kaakaa, lfbrock, lindy65, nils-werner, okin, quentinus95, qyra, shieldsjared, tejasbubane, Tethik, yangchen1, yumenohosi, yuya-oc, ZJvandeWeg

/mattermost-docker-preview

• cpanato, hyeseongkim, jasonblais, mattermost-build

/desktop

• jasonblais, jnugh, yuya-oc

/mattermost-mobile

• csduarte, enahum, hmhealey, it33, thomchop

/mattermost-load-test

• crspeller, it33

/mattermost-driver-javascript

• Mattermost-build

/android

• CometKim, coreyhulen, DavidLu1997, dmeza, esethna

/mattermost-webrtc

• enahum

/mattermost-api-reference

• CometKim, cpanato, enahum, grundleborg, hmhealey, jwilander, MartinDelille, trarbr, ZJvandeWeg

/mattermost-docker

• Andrey9kin, esethna, jasonblais

/ios

• esethna

/mattermost-push-proxy

• coreyhulen

Thanks also to those who reported bugs that benefited the release, in alphabetical order:

• bjoernr-de (#5079), S6066 (#5011)

Notes on Patch Release¶

• v3.5.1, released 2016-11-23
  • Security update to preventing cross-site scripting and remote code execution, thanks to Harrison Healey for reporting responsibly.
  • Fixed an issue where usernames would sometimes not appear beside posts and the reply arrow would throw an error.
  • The channel purpose is no longer cut off in the user interface of the More... channel menu.
  • Fixed a scroll issue where the center channel didn’t always scroll to the bottom when switching channels.
  • Fixed a server error that occurred when searching for users using an asterisk.
  • Fixed an issue where direct message channel headers would sometimes disappear.
  • “New Messages” indicator is fixed so it no longer remains visible after switching channels.
  • Fixed an issue where users could not join a public channel by navigating to the channel URL.
  • Email and push notifications are made asynchronous to fix a delay sending messages when HPNS was enabled.
  • Autocomplete timeout is decreased to make autocomplete more responsive to quick typing.
• v3.5.0, released 2016-11-16
  • Original 3.5 release.

Security Update¶

• Mattermost v3.5.1 contains multiple security updates. Upgrading to Mattermost v3.5.1 is highly recommended. Thanks to Alyssa Milburn and Harrison Healey for contributing security reports through the Mattermost Responsible Disclosure Policy.

Highlights¶

Improvements¶

Bug Fixes¶

• Files can now be sent in Direct Messages across teams
• Correct login method now shown in System Console user lists
• Channel switcher (CTRL/CMD+K) no longer throws an error when switching to a user outside of your current team
• Channel switcher (CTRL/CMD+K) now works for creating new Direct Message channels
• Channels on the left hand side now sort numerically, alphabetically, and based on locale
• Fixed incorrect error message when trying a team URL with one character
• /join no longer throws an error for non-admin accounts
• Added System Message when user joins Off-Topic channel
• Added the “View Members” option to the channel menu on mobile
• Send button is now visible on tablet sized screens

Compatibility¶

Changes from v3.4 to v3.5:

Database Changes from v3.4 to v3.5¶

FileInfo Table

• Added FileInfo table

Posts Table

• Added FileIds column
• Added indexes for DeleteAt

Channels Table, Commands Table, Emoji Table, Teams Table, IncomingWebhooks Table, OutgoingWebhooks Table

• Added indexes for CreateAt
• Added indexes for UpdateAt
• Added indexes for DeleteAt

TeamMembers Table

• Added indexes for DeleteAt

Sessions Table

• Added indexes for ExpiresAt
• Added indexes for CreateAt
• Added indexes for Last ActivityAt

Users Table

• Added indexes for CreateAt
• Added indexes for UpdateAt
• Added indexes for DeleteAt
• Added full text indexes for idx_users_all_txt: Username, FirstName, LastName, Nickname, Email
• Added full text indexes for idx_users_names_txt:Username, FirstName, LastName, Nickname

API Changes from v3.4 to v3.5¶

New routes:

• Added POST at /users/search
  • Search for user profiles based on username, full name and optionally team id.
• Added GET at /users/{offset}/{limit}
  • Retrieves a page of system-wide users
• Added POST at /teams/{team_id}/update_member_roles
  • Update a user’s roles for the specified team.
• Added GET at /teams/{team_id}/channels/{channel_id}/members/{user_id}
  • Retrieves the channel member for the specified user. Useful for fetching the channel member after updates are made to it. If the channel member does not exist, then return an error.
• Added GET at /teams/{team_id}/stats
  • Returns stats for teams which includes total user count and total active user count.
• Added GET at /teams/{team_id}/members/{offset}/{limit}
  • To page through team members
• Added POST at /teams/{team_id}/members/ids
  • Retrieves a list of team members based on user ids
• Added GET at /teams/{team_id}/members/{user_id}
  • Retrieves a single team member
• Added GET at /teams/{team_id}/posts/{post_id}/get_file_infos
  • Retrieves file attachment info for a post
• Added GET at /channels/{channel_id}/users/{offset}/{limit}
  • Retrieves profiles for users in the channel
• Added GET at /channels/{channel_id}/users/not_in_channel/{offset}/{limit}
  • Retrieves profiles for users not in the channel
• Added POST at /webrtc/token
  • Retrieves a valid token and servers to establish a webrtc connection between the peers

Moved routes:

• Updated GET at /channels/{channel_id}/extra_info to /channels/{channel_id}/stats
  • No longer returns a list of channel members and only returns the member count
• Updated POST at /users/profiles/{team_id} to /teams/{team_id}/users/{offset}/{limit}
  • Functionally performs the same, just moves it to match our other APIs that need a team ID.
• Updated GET at /members/{team_id} to /teams/{team_id}/members/{offset}/{limit}
  • Allows paging through team members

Removed routes:

• Removed GET at /users/direct_profiles
• Removed GET at /users/profiles_for_dm_list/{team_id}/{offset}/{limit}

Modified Routes

• Added POST at /users/{user_id}/update_roles
  • Only allows updating of system wide roles. If you want to update team wide roles, please use the new route /teams/{team_id}/update_member_roles

Changes to File Routes:

Routes used to get files and their metadata from the server have been changed substantially in 3.5 so that each file will be given a unique identifier to make them easier to use through the API. In addition, the Filenames field of each post has been deprecated in favor of the new FileIds field.

• The response type of GET at /teams/{team_id}/files/upload has been changed to return more information about the uploaded file. See the documentation for this route on api.mattermost.com for more information
• Split GET at /teams/{team_id}/files/get/{channel_id}/{user_id}/{filename} into:
  • GET at /files/{file_id}/get
    • Get a file
  • GET at /files/{file_id}/get_thumbnail
    • Get a small thumbnail for image files
  • GET at /files/{file_id}/get_preview
    • Get a medium-sized preview image for image files
• Updated GET at /teams/{team_id}/files/get_info/{channel_id}/{user_id}/{filename} to /files/{file_id}/get_info
• Updated GET at /teams/{team_id}/files/get_public_link to /files/{file_id}/get_public_link
• Added GET at /public/files/{file_id}/get
  • Get a file without logging in
  • The previous route GET at /public/files/get/{team_id}/{channel_id}/{user_id}/filename has been deprecated, but will remain available for files that were uploaded prior to 3.5

Known Issues¶

• Channel autolinking with ~ only works if you are a member of the channel
• Slack Import doesn’t add merged members/e-mail accounts to imported channels
• User can receive a video call from another browser tab while already on a call
• Video calls do not work with Chrome v56 and later
• Sequential messages from the same user appear as separate posts on mobile view
• Slash commands do not work in newly created private channels until a hard refresh
• Edge overlays desktop notification sound with system notification sound
• Pressing escape to close autocomplete clears the textbox on IE11
• Channel switcher doesn’t work for users outside of your current team
• Deleting a messages from a permalink view doesn’t show delete until refresh
• Channel dropdown selector no longer works in the Zapier App but the Channel ID can still be entered manually
• Search autocomplete picker is broken on Android
• Channel push notification preferences do not work for the inactive teams if you have multiple teams on a single server.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• alsma, asaadmahmood, coreyhulen, crspeller, DavidLu1997, digitaltoad, dmeza, enahum, esethna, grundleborg, harshavardhana, hmhealey, it33, jasonblais, jwilander, kaakaa, lfbrock, npcode, R-Wang97, Rudloff, S4KH, shieldsjared, thomchop, usmanarif, wget, yangchen1

/ios

• coreyhulen, lfbrock, thomchop

/desktop

• asaadmahmood, itsmartin, jasonblais, jcomack, jnugh, magicmonty, Razzeee, yuya-oc

/docs

• asaadmahmood, chikei, crspeller, erikthered, esethna, gabx, gmorel, grundleborg, hannaparks, harshavardhana, hmhealey, it33, jasonblais, JeffSchering, kunthar, lfbrock, lindy65, npcode, reach3r, Rudloff, rwillmer, shieldsjared, StraylightSky, thiyagaraj, yangchen1, yumenohosi, yuya-oc, Zhouzi

/mattermost-docker

• 5ak3t, npcode, rothgar

/android

• coreyhulen, DavidLu1997, dmeza, it33, mattchue

/mattermost-bot-sample-golang

• hmhealey, pneisen

/mattermost-load-test

• athingisathing, coreyhulen, crspeller, csduarte, enahum, it33, jasonblais

/mattermost-driver-javascript

• crspeller

/mattermost-api-reference

• coreyhulen, crspeller, hmhealey, jwilander

/mattermost-mobile

• dmeza, hmhealey, it33, jasonblais, mfpiccolo, thomchop

Highlights¶

Improvements¶

Bug Fixes¶

• Old public links are now invalidated when the salt is regenerated.
• Messages can now be flagged from the search results list
• Count of unread mentions are no longer mixed when switching between multiple teams.
• Recent Mentions search on mobile no longer contains @all
• For those using the mobile view on desktop, CTRL+ENTER now sends messages on mobile web view
• User removed from team now shows up in DM list under “Outside this team”
• Mentions update properly when team is switched

Compatibility¶

Changes from v3.3 to v3.4:

Special Note

(Only affects servers with public links enabled) After upgrading to v3.4, existing public links will no longer be valid. This is because in past versions, when the Public Link Salt was regenerated existing public links were not invalidated. Now, when the salt is regenerated, existing links are made invalid.

Database Changes from v3.3 to v3.4¶

Status Table

• Added Manual column.
• Added ActiveChannel column.

API Changes from v3.3 to v3.4¶

New routes:

• Added GET at /oauth/authorized
  • Returns the OAuth2 Apps authorized by the user. On success it returns a list of sanitized OAuth2 Authorized Apps by the user.
• Added POST at /oauth/"+clientId+"/deauthorize
  • Deauthorizes a user on an OAuth 2.0 app, where clientId corresponds to the application. Returns status OK on success or an AppError on fail.
• Added POST at /oauth/"+clientId+"/regen_secret
  • Generates a new OAuth App Client Secret, where clientId corresponds to the application. Returns an OAuth2 App on success. Must be authenticated as a user and the same user who registered the app or a System Admin.
• Added POST at /admin/ldap_test
  • Will run a connection test on the current LDAP settings. It will return the standard OK response if settings work. Otherwise it will return an appropriate error.
• Added POST at /users/status/set_active_channel
  • Sets the Status.ActiveChannel field which is used to tell if the user is actively viewing a channel or not.
• Added GET at /admin/recently_active_users/{teamId}
  • Returns a list of recent active users.

Known Issues¶

• Upgrading from 3.2 to 3.4 will be incomplete due to a migration code not being run properly. You can either:
  • Upgrade from 3.2 to 3.3 and then from 3.3 to 3.4, or
  • Upgrade from 3.2 to 3.4, then run the following SQL query to make Mattermost rerun upgrade steps that were not properly completed: UPDATE Systems SET Value = '3.1.0' WHERE Name = 'Version';
• Deleted messages don’t disappear from the channel for the user who deleted the message, if the message was previously edited and right hand sidebar is open.
• A single collapsed link or image preview re-opens after refresh.
• Files sent in private chat to members in a different team are not accessible.
• YouTube video links show as “Video not found” on Desktop App if “Allow mixed content” is turned on.
• “More” option under Direct Message list no longer shows count of team members not in your direct message list.
• On Firefox, CTRL/CMD+U keyboard shortcut to upload a file doesn’t work.
• Webhook attachments don’t show up in search results.
• Messages sometimes don’t appear deleted until the page is refreshed.
• When joining a channel from a public link, the page sometimes loads for a long time and requires a refresh.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• asaadmahmood, coreyhulen, crspeller, cybershambles, daizenberg, DavidLu1997, enahum, esethna, gramakri, grundleborg, hmhealey, HugoGiraudel, it33, jasonblais, joonsun-baek, jwilander, lfbrock, npcode, paranbaram, phrix32, R-Wang97, shieldsjared

/ios

• jasonblais, lfbrock

/desktop

• asaadmahmood, jasonblais, jgis, jnugh, Razzeee, St-Ex, yuya-oc

/docs

• asaadmahmood, coreyhulen, DavidLu1997, esethna, friism, hmhealey, it33, jasonblais, jwilander, kaakaa, lfbrock, lindy65, pmccarthy01, rudloff, shieldsjared, yangchen1

/mattermost-docker

• npcode, xcompass

/android

• coreyhulen, enahum, jasonblais, jwilander, lfbrock

/push-proxy

• jwilander

/mattermost-heroku

• it33, jwilander

Security Update¶

• Mattermost v3.3.0 contains security updates. Upgrading to Mattermost v3.3.0 is highly recommended.
• Thanks to Bastian Ike for contributing security reports through the Mattermost Responsible Disclosure Policy.

Highlights¶

Improvements¶

Bug Fixes¶

• The behavior of setting for Link Previews in Account Settings is no longer reversed.
• Hitting the URL of a private team you used to belong to now redirects properly.
• Search terms contained in hashtags are now highlighted in the search results.
• Fixed an issue with quick typesetting on IE-11 and Edge.
• Fixed an issue with uploading SAML certificates if the files were removed from config.json.
• Multiple files can now be selected on the file upload dialog of the desktop app.
• Fixed a scrolling issue with the channel switcher.
• Fixed system messages showing a small empty white box.
• Fixed a markdown formatting issue with multiple lists in a row.
• Team Admins can no longer demote System Admins.
• The channel header now respects the setting for Channel Display Mode.
• The System Console no longer freezes if accessing via URL when not logged in.
• Site Name is now restricted to 30 characters to avoid text overflow.
• Error is no longer thrown when switching between teams in the System Console.
• Invalid password error is thrown if System Admin resets a password to something that doesn’t meet the specified password requirements.
• Fixed the percentage loading indicator on the image preview modal.
• File upload overlay now appears on Edge.
• Maximum Users per Team and Minimum Password Length now default to reasonable values if a bad input is saved.
• Right-hand side now updates when a new profile picture is saved.
• Channels in the Channel Switcher are sorted by their handle if their display name is identical.
• Setting the length for mobile sessions is now fixed in the System Console.
• The “Test Connection” button in the System Console > Notifications > Email section now properly uses the saved SMTP password.
• System Admins no longer receive a JavaScript error if a new message is received while in the System Console.
• Dropdown in the Manage Members modal is no longer empty for System Admins.
• @all is now correctly highlighted if the trigger setting is selected in Account Settings.
• Fixed unformatted error message on account creation page if no creation methods are enabled.
• Corrected the formatting of some help text in the System Console.
• Color picker in Custom Theme settings now disappears once setting has been saved on mobile.
• System Console menu no longer cuts off long team names.

Compatibility¶

Changes from v3.2 to v3.3:

Database Changes from v3.2 to v3.3¶

OAuthAccessData Table

• Added ClientId column.
• Added UserId column.
• Removed AuthCode column.
• Set Unique key on ClientId and UserId columns.
• Removed index from idx_oauthaccessdata_auth_code column.
• Added indexes to idx_oauthaccessdata_client_id, idx_oauthaccessdata_user_id and idx_oauthaccessdata_refresh_token columns.

OAuthApps Table

• Added IconURL column.

OutgoingWebhooks Table

• Added TriggerWhen column.

Status Table

• Added Status table.

Users Table

• Removed LastActivityAt column.
• Removed LastPingAt column.
• Removed ThemeProps column.

API Changes from v3.2 to v3.3¶

Updated admin routes:

• Changed users/status from POST to GET

New admin routes:

• Added GET at /posts/flagged/{offset:[0-9]+}/{limit:[0-9]+}
  • Returns a list of posts that have been flagged by the user; offset is the offset to start the page at; limit is the max number of posts to return.
• Added GET at /admin/cluster_status
  • Returns a json with a status of each of the reachable nodes in the cluster
• Added GET at /oauth/list
  • Returns a list of OAuth 2.0 apps registered by the user
• Added GET at /oauth/app/{clientId:""}
  • Returns a Sanitized OAuth 2.0 application where clientId corresponds to the application
• Added POST at /oauth/delete
  • Returns status = OK if the OAuth 2.0 application owned by the current user was successfully deleted.
• Added GET at /oauth/access_token
  • Returns the access token for OAuth 2.0 application
• Added POST at /preferences/delete
  • Returns status = OK if the list of preferences owned by the current user were successfully deleted.
• Added POST at /admin/remove_certificate
  • Returns a map[string]interface{} if removing the x509 base64 Certificates and Private Key files used with SAML exists on the file system.

Known Issues¶

• Desktop apps sometimes require a refresh to solve 404 errors.
• Deleted messages don’t disappear from the channel for the user who deleted the message, if the message was previously edited and right hand sidebar is open.
• After receiving an error for creating a channel with one character, updated channel name is not saved.
• A single collapsed preview re-opens after refresh.
• Removed user from team still appears in DM list from the team.
• Files sent in private messages to members in a different team are not accessible.
• YouTube videos show as “Video not found” on Desktop App.
• “More” option under Direct Message list no longer shows count of team members not in your direct message list.
• /join sometimes throws an error.
• On Firefox, CTRL/CMD+U keyboard shortcut doesn’t work.
• Sometimes only the last character typed in the channel switcher appears.
• Webhook attachments don’t show up in search results.
• Count of unread mentions are sometimes mixed when switching between multiple teams.
• Office 365 login sometimes causes a bad token error.
• Messages sometimes don’t appear deleted until the page is refreshed.
• When joining a channel from a public link, the page sometimes loads for a long time and requires a refresh.
• After leaving a team, joining or creating a team sometimes causes an error.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• asaadmahmood, coreyhulen, crspeller, DavidLu1997, eadmund, enahum, esethna, hmhealey, jasonblais, jwilander, lfbrock, maruTA-bis5, Rudloff, samogot, yuters

/desktop

• jasonblais, jnugh, Razzeee, timroes, yuya-oc

/android

• coreyhulen, jasonblais

/ios

• coreyhulen, macdabby, jasonblais

/docs

• asaadmahmood, esethna, it33, jasonblais, lfbrock, lindy65

/mattermost-docker

• npcode

/mattermost-driver-javascript

• jwilander

/mattermost-bot-sample-golang

• coreyhulen, jasonblais

If we missed your name, please let us know at feedback@mattermost.com. Recognition is a manual process and mistakes can happen. We want to include anyone who’s made a pull request that got merged during the release.

Security Update¶

• Mattermost v3.2.0 contains multiple security updates. Upgrading to Mattermost v3.2.0 is highly recommended.
• Thanks to Bastian Ike, Mohammad Razavi, Steve MacQuiddy, Christer Mjellem Strand and Jonas Arneberg for contributing security reports through the Mattermost Responsible Disclosure Policy.

Highlights¶

Improvements¶

On-Boarding and Off-Boarding

• After account creation, users are automatically directed to the team where they were invited instead of the Team Selection page.
• “Get Team Invite Link” is now accessible on mobile.
• Users can now be removed from teams via the Main Menu > Manage Members modal.

System Console

• Updated labeling of System Console settings in the UI for consistency and accuracy.
• (Enterprise E20) High availability support via Reload Configuration from Disk and Recycle Database Connections buttons had help text added so they’re easier to understand.
• Allow System Admins to create teams even if team creation is disabled via the System Console.

Notifications

• Address displayed in the email notification footer is now configurable in the System Console.
• Direct Message desktop notifications now display with a “Direct Message” title.

Web UI

• Reply button and [...] menu now appear in a hovering UI element to increase the available margin width in the center channel.
• Right-hand sidebar can now be expanded when viewing threads or search results.
• Text emoticons now show up as the first entries in the autocomplete list
• @mention autocomplete now filters on nickname, full name, and username.
• Added an online indicator to the header of Direct Message channels.
• Added database type to the About Mattermost dialog.
• Removed unnecessary resizing when opening and closing the right hand sidebar.
• Removed jumping of the center channel when new messages are posted.
• Updated the channel info dialog to be more user friendly.

Enterprise E10, E20

• New command line tools added, such as adding and removing users from channels, and restoring previously deleted channels.
• Added a button to manually trigger AD/LDAP synchronization.
• Updating AD/LDAP Synchronization Interval to no longer require a server restart to take effect.
• Improved logging for AD/LDAP synchronization.
• Added validation to the AD/LDAP settings in the System Console so an error is triggered if required fields are missing.

Bug Fixes¶

• Privacy settings in the system console now refresh correctly when hiding email addresses or full names.
• Fixed the cross contamination of new channels created on different teams in the same browser.
• Updated the GitLab SSO error message for clarity if another Mattermost account is already associated with the GitLab account.
• Team creation via GitLab SSO no longer throws an error if email domains are restricted.
• Channel header no longer disappears after renaming a channel
• Testing the email connection in the System Console no longer throws an error.
• Multiline list items are now displayed correctly on new lines.
• Error message is updated when switching from email to GitLab SSO authentication that is already used by another account.
• Timestamps no longer require a page refresh when switching between 12h and 24h display formats.
• Hashtags containing ¿ are now returned with proper highlighting in search results.
• No longer require a page refresh before enabling compliance reporting in the System Console.
• @all no longer sends mentions if unselected in Account Settings.
• Users are no longer redirected to the switch teams page after changing authentication method from GitLab SSO to email.
• Invalid MFA token error message now clears correcly from the UI.
• Errors now correctly clear from the UI when changing passwords.
• System Console users list no longer throws an error when trying to demote a member from a System Admin.
• iOS radio buttons no longer stay selected when switching between options.
• Email addresses now display for System Admins even if hidden in the System Console.
• Code themes now save when updated via Account settings.
• File name is now displayed instead of the full path to the file in code snippet previews.
• Config settings are refreshed immediately when Reload Configuration from Disk is clicked.
• Preview feature checkboxes now reset after changes are canceled.
• Updated the markdown parser to fix poor handling of certain links.
• Error box highlighting on the claim AD/LDAP account page is fixed to only highlight the invalid input box.
• Errors in the system console are now properly aligned.
• Button to resend verification email no longer throws an error when clicked.
• Direct Messages modal loads faster since it is no longer cleared from memory each time it closes.
• Graphs in the System Console > Site Statistics now have the same start date for comparison.
• Fixed an issue where new languages are not added by default. Any server which is upgraded to Mattermost v3.1 will need to manually set System Console > Localization > Available Languages blank to have new languages added by default.
• Previously, a few shortcuts that used CTRL were overwriting existing messaging shortcuts in Mac. This has been changed so they only work with CMD. See documentation for more details.
• Email body now contains the siteURL when inviting a user by email via CLI (command line interface)
• YouTube videos now stop playing when collapsed.
• Fixed error when adding an incoming webhook to a public channel the user is currently not in.
• Error merssage displayed on password reset page is now formatted correctly.

Compatibility¶

Changes from v3.1 to v3.2:

Known Issues¶

• In System Console > Notifications > Email the “Test Connection” button does not properly use the saved SMTP password. The temporary workaround is to re-type your SMTP Server Password into the field prior to using the “Test Connection”, and then to “Save” afterwards.
• The behavior of setting for Link Previews in Account Settings is reversed.
• “More” option under Direct Message list no longer shows count of team members not in your direct message list.
• Webhook attachments don’t show up in search results.
• On Firefox, System Console sidebar completely disappears when an AD/LDAP setting is saved.
• On Firefox, CTRL/CMD+U keyboard shortcut doesn’t work.
• /join sometimes throws an error.
• Sometimes only the last character typed in the channel switcher appears.
• Formatting of multiple lists in a row breaks markdown.
• Hitting the URL of a private team you used to belong to shows a blank Team Selection page.
• Accessing the System Console URL when logged out causes the browser to hang.
• Youtube videos show as “Video not found” on Desktop App
• Search terms contained in hashtags are not highlighted in the search results.
• Files sent in private messages to members in a different team are not accessible.
• Center channel appears blank after initial page load on iOS.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• 42wim, apheleia, asaadmahmood, coreyhulen,crspeller, DavidLu1997, enahum, esethna, hmhealey, iansim, it33, jwilander, kevynb, lfbrock, samogot, tbalthazar, tehraven, thiyagaraj, yumenohosi

/ios

• coreyhulen

/desktop

• it33, jasonblais, magicmonty, Razzeee, yuya-oc

/docs

• apheleia, asaadmahmood, crspeller, esethna, Fonata, it33, jasonblais, lfbrock, lindy65, npcode, yangchen1

/mattermost-driver-javascript

• coreyhulen, crspeller, DavidLu1997, enahum, hmhealey, it33, samogot

/mattermost-docker

• npcode

/mattermost/push-proxy

• coreyhulen

If we missed your name, please let us know at feedback@mattermost.com. Recognition is a manual process and mistakes can happen. We want to include anyone who’s made a pull request that got merged during the release.

Security Update¶

• Mattermost v3.1.0 contains multiple security updates. Upgrading to Mattermost v3.1.0 is highly recommended.
• Thanks to Uchida Taishi for contributing security reports through the Mattermost Responsible Disclosure Policy.

Highlights¶

Improvements¶

iOS App

• Account Settings > Notifications option lets users to enable mobile push notifications for chosen activities.
• Push notifications sent even if a user is online on desktop.
• Removed auto-capitalization on login screen, so email is no longer capitalized.

Android App

• Account Settings > Notifications option lets users to enable mobile push notifications for chosen activities.
• Push notifications sent even if a user is online on desktop.
• Removed auto-capitalization on login screen, so email is no longer capitalized.

User Interface

• Account Settings > Display option lets users set channels to compact view.
• Autocomplete closes with ESC button.
• Sequential messages with a username also show profile pictures.
• Channel introduction message conforms to the channel width chosen in Account Settings > Display.
• The message ‘[user] is typing’ now uses the username instead of the display name.
• Date markers now show absolute time.

Performance

• Performance improvements to posting and replying.
• Online status in Direct Message list updated on first load.

Notifications

• @all mention added back with equivalent functionality to @channel.
• An email notification is now sent when username is changed.

Channels

• Removed the option to leave a channel for the last person in a private group, so private groups can no longer end up in an ownerless state.

Messaging

• Move link preview toggle out of preview feature list and add /collapse and /expand.

Localization

• New settings to configure localization options for teams, including default language.
• Mattermost Translation Server upgraded to better support localization process.

Integrations

• Integrations now support advanced formatting through message attachments.
• Added support for sending @channel notifications by using <!channel>.
• Added support for raw new lines in the text payload.
• Added validation for command trigger words.

Onboarding

• Slash command /invite_people [email address] sends an email invite to your Mattermost team.

Enterprise

• (E10 and higher): Added AD/LDAP synchronization to automatically deactivate Mattermost accounts after AD/LDAP accounts are deactivated. Previous behavior only checked AD/LDAP credentials on sign-in. Synchronization time defaults to one hour and is configurable from System Console > Synchronization Interval.
• (E20 and higher): Added support for high availability database configurations using read replicas and a manual failover process to deploy database reconfigurations without stopping the Mattermost server.

Bug Fixes¶

• Incoming webhooks have been made available in all public channels, and in private channels the user belongs to.
• A space between two named emojis is no longer required for correct rendering.
• Emojis now render inside parenthesis or brackets.
• Links that are enclosed with a right parenthesis now work properly.
• Search term highlighting now updates when search terms change but return the same posts.
• Search results now properly highlight for searches containing @username, non-latin characters, terms inside Markdown code blocks, and hashtags containing a dash.
• A single numbered item no longer resets numbering to 1.
• Previews for removed YouTube videos no longer throw a 404 error.
• Team and System Admins can now update channel settings after leaving and rejoining the channel.
• After initial load on iOS, centre channel no longer appears blank.
• When creating a team with a new account, channel introduction message is now displayed.
• Sidebar notification for direct messages now clear once viewed, regardless of which team you are in.
• Custom brand image size is now properly limited on IE11.

Compatibility¶

Changes from v3.0 to v3.1:

config.json

Multiple setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json or the System Console.

Changes to Team Edition and Enterprise Edition:

• Under LocalizationSettings in config.json:
  • Added "DefaultServerLocale": “en” to set default language for the system messages and logs
  • Added "DefaultClientLocale": “en” to set default language for newly created users and for pages where the user hasn’t logged in
  • Added "AvailableLocales": “en,es,fr,ja,pt-BR” to set which languages are available for users in Account Settings. The language specified in DefaultClientLocale should be included in this list.

Additional Changes to Enterprise Edition:

The following config settings will only work on servers with an Enterprise License that has the feature enabled.

• Under LdapSettings in config.json:
  • Added "SyncIntervalMinutes": "60" to allow system admins adjust how frequently Mattermost performs AD/LDAP synchronization to update users

Known Issues¶

• “More” option under Direct Message list no longer shows count of team members not in your direct message list.
• Emoji smileys ending with a letter at the end of a message do not auto-complete as expected.
• Incorrect formatting when a new line is added directly after a list.
• On Postgres databases, searching for websites and emails does not work properly and hashtags which end with an inverted questionmark aren’t properly highlighted.
• On Firefox, search results for hashtags are not properly highlighted.
• Clicking on a desktop notification from another team doesn’t open the team.
• Webhook attachments don’t show up in search results.
• On Firefox, System Console sidebar completely disappears when an AD/LDAP setting is saved
• On Firefox, CTRL/CMD+U keyboard shortcut doesn’t work
• Copying and pasting an image from a browser doesn’t work
• Youtube videos continue playing when collapsed
• Code theme under Account Settings > Display > Theme doesn’t save unless entered in vectorized form
• /join sometimes throws an error
• When upgrading to 3.X, syntax highlighting using Solarized code theme is lost
• In Compact view, clicking on a file in the first post in the right hand sidebar attempts to download the file
• Unable to leave a private channel in mobile view
• @all notifications received even after being unselected from notification options
• Channel header disappears after renaming a channel (fixed with channel switch)
• Updates to System Console > Privacy settings for existing users requires a session update
• Invalid config setting causes server to panic on start

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• apheleia, ArthurHlt, asaadmahmood, coreyhulen, crspeller, DavidLu1997, enahum, goofy-bz, gramakri, hmhealey, it33, jasonblais, jwilander, kevynb, khoa-le, lfbrock, rompic, ryoon, samogot, ScriptAutomate, tbalthazar, tehraven

/ios

• coreyhulen, lfbrock

/android

• coreyhulen, DavidLu1997, it33, lfbrock, nineinchnick

/desktop

• CarmDam, it33, jnugh, MetalCar, Razzeee, yuya-oc

/docs

• apheleia, coreyhulen, crspeller, DavidLu1997, enahum, esethna, hannaparks, hmhealey, it33, jasonblais, lfbrock, maxlmo, mkhsueh, npcode, TwizzyDizzy

/mattermost-driver-javascript

• coreyhulen, crspeller, enahum, jwilander

/mattermost-docker

• npcode, pierreozoux

/mattermost/push-proxy

• coreyhulen

/mattermost/mattermost-docker-preview

• crspeller

If we missed your name, please let us know at feedback@mattermost.com. Recognition is a manual process and mistakes can happen. We want to include anyone who’s made a pull request that got merged during the release.

Security Update¶

• Mattermost v3.0.3 contains multiple security updates. Upgrading to Mattermost v3.0.3 is highly recommended.
• Thanks to Yoni Ramon from the Tesla security team, Andreas Lindh and Uchida Ta for contributing security reports through the Mattermost Responsible Disclosure Policy.

Major Version Release¶

Mattermost 3.0 is a new major version of Mattermost with fundamental changes affecting Mattermost 2.x deployments. An understanding of the upgrade process from 2.x to 3.0, including manual steps, is required to upgrade successfully.

Highlights¶

Languages¶

• Added Japanese translation for user interface.

Improvements¶

iOS app

• Added support for multiple teams on the same server.
• Added autocorrect.
• Note: Users of Mattermost 3.0 server need to install new iOS 3.0 app. iOS 2.x apps are not compatible with Mattermost 3.0 server. Also, iOS 3.0 app is not compatible with Mattermost 2.x server.

Android app

• Added support for multiple teams on the same server.
• Added autocorrect.
• Note: Users of Mattermost 3.0 server need to install new Android 3.0 app. Android 2.x apps are not compatible with Mattermost 3.0 server. Also, Android 3.0 app is not compatible with Mattermost 2.x server.

User Interface

• Switched to new emoji set.
• Account Settings > Display option lets users set the channel view to full width.
• Smoother overlay transition when opening sidebar on mobile.
• Back and forward browser buttons can now move back and forward in channel history.

Integrations

• Moved webhooks and slash command settings to a new “Integrations” page.
• Added “Display Name” and “Description” to incoming and outgoing webhooks.
• Changed webhooks to always show the username and profile picture, even if posts are consecutive.
• Added a /msg command to open a direct message channel with another user.

Authentication

• Changed the user model so accounts are per server instead of per team.
• Updated the login flow so users can select which team to open after signing in.
• Combined Email, Username, and AD/LDAP options into one login box so users can enter their credentials and the system will identify which kind of authentication to use.
• GitLab SSO now creates an account from the “Sign In” button if an account previously did not exist.

Files and Attachments

• Added a preview for code files in the image viewer.

Notifications

• Added the option to enable full snippets in push notifications.

Search

• Changed searches to connect terms with “AND” instead of “OR”.

Enterprise:

• Added the ability to map nickname to an AD/LDAP field.
• Added the ability to filter AD/LDAP users, so only users selected by the filter can log in to Mattermost.
• Added the option to connect to AD/LDAP with TLS or STARTTLS
• Added the option to replace the “AD/LDAP username” login field placeholder text with custom text.
• Users can now switch between AD/LDAP and email login from Account Settings > Security > Sign-in Method.
• Added the option to sign up with AD/LDAP on the “Get Team Invite” link and email invite sign up pages.
• Added multi-factor authentication.
• Added compliance reporting and the option to generate daily compliance reports.
• Added custom branding, so System Admins can set a custom logo and text on the sign in page.
• Added a command line option to upload a license file.

Bug Fixes¶

• Posts from webhooks now fire notifications to the user who created the webhook.
• Edit post option no longer appears, but doesn’t work, on other users’ posts in the right-hand sidebar.
• Text input box does not stay scrolled to the bottom when drafting a long message in Firefox.
• Webhooks in search results now show the username/profile pic of the bot, instead of the user who set up the webhook.
• Outgoing webhooks triggers now work when followed by any type of white space, instead of only spaces
• “User is typing” message now follows Teammate Name Display setting
• Log in with GitLab on mobile now works in the case where there is a space after the email address
• Links in System Console > Legal and Support settings now open properly even if http or https is not included
• Timestamps are displayed in 12-hour format when set to 24-hour format.

Compatibility¶

Changes from v2.2 to v3.0:

iOS and Android

Mattermost iOS and Android app v3.0 requires Mattermost platform v3.0 and higher.

APIs

Web Service API is upgraded to Version 3 and previous Version 1 API is no longer supported. Golang driver, Javascript driver, incoming and outgoing webhooks and Slash commands continue to function as in previous release

config.json

Multiple setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json or the System Console.

Changes to Team Edition and Enterprise Edition:

• Under TeamSettings in config.json:
  • Added "EnableOpenServer": false to set whether users can sign up to the server without an invite.
  • Removed "EnableTeamListing": false since the team directory was replaced with new functionality.
• Under EmailSettings in config.json:
  • Added "PushNotificationContents": "generic" to set whether push notifications send a generic message (generic) or send a snippet of the conversation (full)
• Under SupportSettings in config.json, default support links were changed and need to be manually updated for existing installs:
  • Changed: "TermsOfServiceLink": "https://about.mattermost.com/default-terms/"
  • Changed: "PrivacyPolicyLink": "https://about.mattermost.com/default-privacy-policy/"
  • Changed: "AboutLink": "https://about.mattermost.com/default-about/"
  • Changed: "HelpLink": "https://about.mattermost.com/default-help/"
  • Changed: "ReportAProblemLink": "https://about.mattermost.com/default-report-a-problem/"
  • Changed: "SupportEmail": "feedback@mattermost.com"

Additional Changes to Enterprise Edition:

The following config settings will only work on servers with an Enterprise License that has the feature enabled.

• Under ServiceSettings in config.json:
  • Added "EnableMultifactorAuthentication": false to enable Multifactor Authentication
• Under TeamSettings in config.json:
  • Added "EnableCustomBrand": false to set whether custom branding of the login page is turned on.
  • Added "CustomBrandText": "" to set what text will show up on the login page, if "EnableCustomBrand": is set to true.
• Under LdapSettings in config.json:
  • Added "ConnectionSecurity":"" to set the type of connection security Mattermost uses to connect to AD/LDAP. Options are "" (no security), TLS or STARTTLS.
  • Added "UserFilter": "" (optional) to set an AD/LDAP Filter to use when searching for user objects.
  • Added "NicknameAttribute": "" to set the attribute in the AD/LDAP server that will be used to populate the nickname field in Mattermost.
  • Added "SkipCertificateVerification": false to set whether the certificate verification step for TLS or STARTTLS connections is skipped. (For testing purposes only. Should be set to false in production.)
  • Added "LoginFieldName": "" to set the help text in the login box (for example, AD/LDAP username or Company username).
• Added ComplianceSettings to config.json:
  • Added "Enable": false to set whether compliance reports are enabled.
  • Added "Directory": "./data/" to set where the reports are stored.
  • Added "EnableDaily": false to set whether Daily Reports are turned on.

Known Issues¶

• “More” option under Direct Message list no longer shows count of team members not in your direct message list.
• Emoji smileys ending with a letter at the end of a message do not auto-complete as expected.
• Incorrect formatting when a new line is added directly after a list.
• Searching for a username or hashtag containing a dot now returns the correct results.
• On Postgres databases, searching for websites, emails, and searching with quotations does not work properly.
• Search term highlighting doesn’t update when search terms change but return the same posts.
• Search results don’t highlight properly for searches containing @username, non-latin characters, terms inside Markdown code blocks, or hashtags containing a dash.
• Custom brand image size isn’t properly limited on IE11.

Contributors¶

Many thanks to all our contributors. In alphabetical order:

/platform

• alanmoo, ArthurHlt, asaadmahmood, augustohp, brunoqc, chengweiv5, Compaurum, coreyhulen, crspeller, CyrilTerets, DavidLu1997, enahum, FeliciousX, hauschke, hmhealey, insin, it33, jwilander, khoa-le, lfbrock, loafoe, maruTA-bis5, moogle19, olivierperes, pjgrizel, qcu, rodrigocorsi2, ryoon, samogot, stupied4ever, takashibagura, usmanarif, yumenohosi

/mattermost-docker

• npcode, xcompass, it33

/ios

• coreyhulen, it33

/android

• arusahni, JohnMaguire, lindy65, nicolas-raoul, ptersilie

/desktop

• asaadmahmood, it33, jeremycook, lloeki, mgielda, yuya-oc

/docs

• ajerezr, apheleia, asaadmahmood, crspeller, DavidLu1997, enahum, esethna, it33, lfbrock, lindy65, pjgrizel, schemacs

Security Update¶

• Mattermost v2.2.0 contains multiple security updates. Upgrading to Mattermost v2.2.0 is highly recommended.
• Thanks to Jim Hebert from Fitbit Security, Andreas Lindh, and Uchida Taishi for contributing security reports through the Mattermost Responsible Disclosure Policy.

Highlights¶

Languages¶

• Added French language translation (Beta) available from Account Settings > Display.

Improvements¶

User Interface

• New themes can be imported into Mattermost user interface from production documentation.

Bug Fixes¶

• Characters in some posts will no longer display as HTML entities, such as '

Known Issues¶

• Regression: Get Public Link downloads a file and does not product a public link.
• Edit post option appears, but doesn’t work, on other users’ posts in the right-hand sidebar.
• Text input box does not stay scrolled to the bottom when drafting a long message in Firefox.
• File name tooltip stays open after clicking to download.
• Unable to paste images into the text box on Firefox, Safari, and IE11.
• Archived channels are not removed from the “More” menu for the person that archived the channel until after refresh.
• First load of an empty channel does not display the introduction message.
• Search results don’t highlight searches for @username, non-latin characters, or terms inside Markdown code blocks.
• Searching for a username or hashtag containing a dot returns a search where the dot is replaced with the “or” operator.
• Hashtags containing a dash incorrectly highlight in the search results.
• Emoji smileys ending with a letter at the end of a message do not auto-complete as expected.
• Incorrect formatting when a new line is added directly after a list.
• Timestamps are displayed in 12-hour format when set to 24-hour format.
• Syntax highlighting code block is missing the label for Latex documents.
• Posts from webhooks do not fire notifications to the user who created the webhook.
• Theme color vector is not updated after making custom changes to a default theme.
• Search term highlighting doesn’t update on IE11 when search terms change but return the same posts.
• Team creation via SSO fails when email domain is restricted.

Contributors¶

Many thanks to all our external contributors. In no particular order:

• pjgrizel, tbolon , jblobel, rodrigocorsi2 , enahum, schemacs, raelga

Highlights¶

• New Android application now available.
• New desktop applications for Windows, Mac and Linux now in beta.
• Brazilian Portuguese translation added.

Security Update¶

Mattermost v2.1.0 contains a security update for a cross-site scripting vulnerability in Mattermost v1.2, v1.3, v1.4 and v2.0. Upgrading to Mattermost v2.1.0 is highly recommended. Thanks to Luke Arntson for the RPD report.

New Features¶

Android Application

• New Mattermost Android App supporting push notifications available for devices running Android 4.4.2+. Requires Mattermost server 2.1 and higher. See list of tested devices.

Desktop Application

• New Desktop Application for Windows, Mac, and Linux now available as a beta release.

Languages

• Added Portuguese language translation (Beta) available from Account Settings > Display.

Improvements¶

System Console

• Removed unused “Disable File Storage” option from the System Console as it is no longer relevant.
• Added a warning message if a system admin demotes themselves.
• System Console statistics now use a client store instead of fetching data and storing it in state.

Messaging

• Custom slash commands now support temporary messages that appear only to the user that issued the command.
• Username autocomplete list no longer suggests inactive users.

Mobile

• Significant responsiveness and speed improvements using fastclick.
• Team name and username are now shown in the LHS header.
• Added a button to go back to the team URL page from the login page.

Files and Images

• Increased the maximum size of image uploads to 24 megapixels.

User Interface

• Custom theme color selectors are now organized into categories.
• Add Members and Manage Members dialogs can now be filtered using a search bar.
• Deactivated members no longer appear in the channel members list.
• Keyboard focus is set to the text input box in the right-hand sidebar if a user clicks the reply icon.
• Permalinks are now displayed in a Copy Permalink dialog instead of a popover.
• Permalink option is now available from the [...] menu on messages and comments in the right-hand sidebar.
• Reply icon now only appears on-hover for messages that don’t have replies.
• Scroll bar now appears in the center channel.

Compatibility¶

Changes from v2.0 to v2.1:

Android

• Mattermost Android Application is for use with Mattermost platform v2.1 and higher.

config.json

• The following setting was added and can be modified under ServiceSettings in config.json or the System Console.
  • "AllowCorsFrom": "" to allow the system to serve HTTP requests to other domains specified.

Highlights¶

New Features¶

Localization

• Addition of localization support to entire user interface plus error and log messages
• Added Spanish language translation (Beta quality) available from Account Settings > Display

Slash Commands

• Added Slack-compatible slash commands to integrate with external systems

iOS

• iOS app added support for GitLab single sign-on
• iOS app added support for AD/LDAP single sign-on (Enterprise Edition only)

Android

• New open source Android application compatible with Mattermost 2.0 and higher

System Console

• Added Site Reports to view system statistics on posts, channels and users.

Improvements¶

Upgrading

• Mattermost v2.0 now upgrades from up to two previous major builds (e.g. v1.4.x and v1.3.x).

Files and Images

• Public links to images and files created by users no longer expire
• OGG attachments now play in preview window on Chrome and Firefox

Onboarding

• “Get Team Invite Link” option is disabled from the main menu if user creation is disabled for the team
• Tutorial colors improved to provide higher contrast with new default theme

Authentication

• Added ability to sign in with username as an alternative to email address
• Switching from email to SSO for sign in now updates email address to use the SSO email

System Console

• Added option to allow use of insecure TLS outbound connections to allow use of self-signed certificates
• Removed unused “Disable File Storage” option from System Console > File Storage
• Added warning if a user demotes their account from System Administrator

Search

• Hashtag search is no longer case sensitive
• System messages no longer appear in search results
• Date separator added to search results
• Moved the recent mentions icon to the right of the search bar

Messaging

• Changed the comment bubble to a reply arrow to make post replies and the right-hand sidebar more discoverable
• Time stamp next to sequential posts made by users now shows HH:MM instead of on-hover timestamp
• Code blocks now support horizontal scrolling if content exceeds the max width

User Interface

• Away status added to note users who have been idle for more than 5 minutes.
• Long usernames are now truncated in the center channel and right-hand sidebar
• Added more favicon sizes for home screen icons on mobile devices

Compatibility¶

Changes from v1.4 to v2.0:

iOS

Mattermost iOS app v2.0 requires Mattermost platform v2.0 and higher.

config.json

Multiple setting options were added to config.json. Below is a list of the additions and their default values on install. The settings can be modified in config.json or the System Console.

• Under ServiceSettings in config.json:
  • "EnableCommands": false to set whether users can create slash commands from Account Settings > Integrations > Commands
  • "EnableOnlyAdminIntegrations": true to restrict integrations to being created by admins only.
  • "EnableInsecureOutgoingConnections": false sets whether outgoing HTTPS requests can accept unverified, self-signed certificates.
  • Optional: "WebsocketSecurePort" : 443 sets the port on which the secured WebSocket will listen using the wss protocol. If this setting is not present in config.json, it defaults to 443.
  • Optional: "WebsocketPort": 80 sets the port on which the unsecured WebSocket will listen using the ws protocol. If this setting is not present in config.json, it defaults to 80.
• Under EmailSettings in config.json:
  • "EnableSignInWithEmail": true allows users to sign in using their email.
  • "EnableSignInWithUsername": false sets whether users can sign in with their username. Typically only used when email verification is disabled.

Localization

There are two new directories for i18n localization JSON files:

• platform/i18n for server-side localization files
• platform/web/static/i18n for client-side localization files

Release Highlights¶

New Features¶

Mobile Experience

• Date headers now show when scrolling on mobile, so you can quickly see when messages were sent
• Added “rapid scroll” support for jumping quickily to bottom of channels on mobile

Authentication

• Accounts can now switch between email and GitLab SSO sign-in options
• New ability to customize session token length

System Console

• Added Legal and Support Settings so System Administrators can change the default Terms of Service, Privacy Policy, and Help links
• Under Service Settings added options to customize expiry of web, mobile and SSO session tokens, expiry of caches in memory, and an EnableDeveloper option to turn on Developer Mode which alerts users to any console errors that occur

Improvements¶

Performance and Testing

• Added logging for email and push notifications events in DEBUG mode

Integrations

• Added support to allow optional parameters in the Content-Type of incoming webhook requests

Files and Images

• Animated GIFs autoplay in the image previewer

Notifications and Email

• Changed email notifications to display the server’s local timezone instead of UTC

User Interface

• Updated the “About Mattermost” dialog formatting
• Going to domain/teamname now goes to the last channel of your previous session, instead of Town Square
• Various improvements to mobile UI, including a floating date indicator and the ability to quickly scroll to the bottom of the channel

Compatibility¶

Release Highlights¶

New Features¶

Authentication

• Added unofficial SSO support for GitHub.com and GitHub Enterprise using GitLab UI

Archives

• Added permalink feature that lets users link to a post in the message archives
• Added ability to “Jump” to archives from a search result

Account Settings

• Added “Preview pre-release features” setting, to allow user to preview early features ahead of their official release
• Added “Display font” setting, so users can select which font to use

Messaging & Comments

• Added in-line previews for links from select websites and for URLs pointing to an image (enabled via Account Settings -> Advanced -> Preview pre-release features)
• Added emoji autocomplete

Extras

• Added /loadtest url tool for manually testing text processing

Improvements¶

Performance

• Updated getProfiles service to return less data
• Refactored several modals to use React-Boostrap
• Refactored the center channel

Messaging & Comments

• Added Markdown support for task lists
• Added “Help” link for messaging
• Added ability to preview a Markdown message before sending (enabled via Account Settings -> Advanced -> Preview pre-release features)

Onboarding

• Minor upgrades to tutorial

User Interface

• Visually combined sequential messages from the same user
• Added ability to rename “Town Square”
• Teammate name display option now applies to messages and comments
• Menus and search improved on mobile UI
• Switched to Emoji One style emojis

Compatibility¶

Security Notice¶

Mattermost v1.2.1 is a bug fix release addressing a security issue in v1.2.0 affecting a newly introduced outgoing webhooks feature. Specifically, in v1.2.0 there was a check missing from outgoing webhooks, so a team member creating outgoing webhooks could in theory find a way to listen to messages in private channels containing popular words like “a”, “the”, “at”, etc. For added security, Mattermost v1.2.1 now installs with incoming and outgoing webhooks disabled by default.

To limit the impact of this security issue, Mattermost v1.2.0 has been removed from the source repo. It is recommended that anyone who’s installed v1.2.0 upgrade to v1.2.1 via the procedure described in the Mattermost Upgrade Guide.

Release Highlights¶

Improvements¶

Onboarding

• New tutorial explaining how to use Mattermost for new users

Messaging and Notifications

• Users can now search for teammates to add to Direct Message list via More menu
• Users can now personalize Direct Messages list by removing users listed
• Link previews - Adding URL with .gif file adds image below message
• Added new browser tab alerts to indicate unread messages and mentions

Search

• Adding search term in:[channel_url_name] now limits searches within a specific channel
• Adding search term from:[username] now limits searches to messages from a specific user
• Tip explaining search options when clicking into search box

Integrations

• Outgoing webhooks now available
• Made available application template showing outgoing webhooks working with Mattermost and external application

User Interface

• Member list in Channel display now scrollable, and includes Message button to message channel members directly
• Added ability to edit previous message by hitting UP arrow
• Syntax highlighting added for code blocks
  • Languages include Diff, Apache, Makefile, HTTP, JSON, Markdown, Java, CSS, nginx, ObjectiveC, Python, XML, Perl, Bash, PHP, CoffeeScript, C, SQL, Go, Ruby, Java, and ini.
  • Use by adding the name of the language on the first link of the code block, for example: ```python
  • Syntax color theme can be defined under Account Settings > Appearance Settings > Custom Theme
• Updated Drag & Drop UI
• Added 24 hour time display option

Team Settings

• Added Team Settings option to include account creation URL on team login page
• Added Team Settings option to include link to given team on root page
• Ability to rotate invite code for invite URL

Extras

• Added /shrug KEYWORD command to output: ¯\_(ツ)_/¯ KEYWORD
• Added /me KEYWORD command to output: KEYWORD
• Added setting option to send a message on control-enter instead of enter

System Console

• New statistics page
• Configurable option to create an account directly from team page

Compatibility¶

• IE 11 new minimum version for IE, since IE 10 share fell below 5% on desktop
• Safari 9 new minimum version for Safari, since Safari 7 and 8 fell below 1% each on desktop

About Bug Fix Releases¶

This is a bug fix release (v1.1.1) and recommended only for users needing a fix to the specific issue listed below. All other users should use the most recent major stable build release (v1.1.0).

View more information on Mattermost release numbering.

Release Purpose¶

Release Highlights¶

Improvements¶

Integrations

• Improved support for incoming webhooks, including the ability to override a username and post as a bot instead

Documentation

• Added documentation on config.json and System Console settings
• Docker Toolbox replaces deprecated Boot2Docker instructions in container install documentation

Theme Colors

• Improved appearance of dark themes

System Console

• Client side errors now written to server logs
• Added “EnableSecurityFixAlert” option to receive alerts on relevant security fix alerts
• Various improvements to System Console UI and help text

Messaging and Notifications

• Replaced “Quiet Mode” in the Channel Notification Settings with an option to only show unread indicator when mentioned

Bug Fixes¶

• Fixed regression causing “Get Public Link” on images not to work
• Fixed bug where certain characters caused search errors
• Fixed bug where System Administrator did not have Team Administrator permissions
• Fixed bug causing scrolling to jump when the right hand sidebar opened and closed

Known Issues¶

• Slack import is unstable due to change in Slack export format
• Uploading a .flac file breaks the file previewer on iOS

Compatibility¶

Contributors¶

Many thanks to our external contributors. In no particular order:

• chengweiv5, pstonier, teviot, tmuwandi, driou, justyns, drbaker, thomas9987, chuck5, sjmog, chengkun, sexybern, tomitm, stephenfin

Release Highlights¶

New Features¶

Messaging, Comments and Notifications

• Full markdown support in messages, comments, and channel description
• Support for emoji codes rendering to image files

Files and Images

• Added ability to play video and audio files

System Console

• UI to change config.json settings
• Ability to view log files from console
• Ability to reset user passwords
• Ability for IT admin to manage members across multiple teams from single interface

User Interface

• Ability to set custom theme colors
• Replaced single color themes with pre-set themes
• Added ability to import themes from Slack

Integrations

• (Preview) Initial support for incoming webhooks

Improvements¶

Documentation

• Added production installation instructions
• Updated software and hardware requirements documentation
• Re-organized install instructions out of README and into separate files
• Added Code Contribution Guidelines
• Added new hardware sizing recommendations
• Consolidated licensing information into LICENSE.txt and NOTICE.txt
• Added markdown documentation

Performance

• Enabled Javascript optimizations
• Numerous improvements in center channel and mobile web

Code Quality

• Reformatted Javascript per Mattermost Style Guide

User Interface

• Added version, build number, build date and build hash under Account Settings -> Security

Licensing

• Compiled version of Mattermost v1.0.0 now available under MIT license

Bug Fixes¶

• Fixed issue so that SSO option automatically set EmailVerified=true (it was false previously)

Compatibility¶

A large number of settings were changed in config.json and a System Console UI was added. This is a very large change due to Mattermost releasing as v1.0 and it’s unlikely a change of this size would happen again.

Prior to upgrading the Mattermost binaries from the previous versions, the below options would need to be manually updated in your existing config.json file to migrate successfully. This is a list of changes and their new default values in a fresh install: