Merge upstream mattermost/release-11.7 (v11.7.9) - 25 commits, security batch #22

Merged

mohlec merged 26 commits from merge/upstream-2026-08-04 into slash/main 2026-08-05 01:04:42 +00:00

Conversation 0 Commits 26 Files changed 235 +14885 -64319

mohlec commented 2026-08-05 01:01:16 +00:00

Owner

Copy link

Merges 25 upstream commits from mattermost/release-11.7 into slash/main.

Base 8092c1a86 (last merged, 2026-06-30) -> tip 6e4777b43 (v11.7.9).

Conflict surface

Far smaller than DIVERGENCE.md predicted. Only 3 files overlapped between upstream's changes and ours, and 2 auto-merged:

• webapp/channels/src/components/admin_console/admin_definition.tsx — auto-merged. Notable: the divergence doc flags this as the single highest-risk file (17 upstream commits).
• webapp/channels/src/components/integrations/bots/bots.tsx — auto-merged.
• webapp/channels/src/i18n/en.json — conflicted, 2 hunks.

The other high-churn files the doc warns about (config.go, api4/user.go) were not touched by this batch.

Conflict resolution

Both hunks were the expected branding-scrub-vs-upstream-text pattern. One needed a judgement call:

Key	Taken	Why
admin.oauth.dcrDescription	ours	Upstream text identical apart from the product name.
admin.oauth.dcrRedirectURIAllowlistDesc	upstream	Not a branding difference. Upstream rewrote this because 50ab3983c made allowlist matching URL-component-aware. Our text describes the old semantics and would now actively mislead admins about how their wildcards behave. Contains no product name.
bots.manage.help1	ours	Branding only.
bots.manage.load_error.full / .partial	upstream	Brand-new keys, no product name.

Verification

• en.json parses; 7249 keys.
• 0 keys introduced by this merge mention Mattermost. Count of Mattermost-bearing values unchanged at 3 (the AGPL attribution keep-list).
• scripts/check-branding.sh passes.

Diffstat is misleading — read this before reacting to it

The raw diff shows -64,319. Of that, 64,009 deletions are GitHub Actions and e2e scaffolding removed upstream in 73d679cbf (backported CI buildenv changes). Slash builds on Forgejo Actions; .forgejo/ has 0 files changed.

ci/e2e tooling : 143 files  +11641  -64009
product code   :  92 files   +3244    -310

+3244 / -310 across 92 files is the real change, which is right for 25 patch commits.

Contents — mostly security

• 8400e7cb6 Calls v1.11.6 — SDP zip-bomb DoS fix
• 8a56d5a6f MM-68773 — HTML encoding in proxied image URL
• 50ab3983c MM-69392 — DCR redirect URI allowlist matching made URL-component aware
• 96bfd7e57 MM-69408 — quadratic markdown autolink trimming (ReDoS)
• f52a22d0c MM-69857 — policy update endpoint scope enforcement
• 7acc6ce19 team-scope channel check on access policy unassign
• plus prepackaged plugin bumps (Boards 9.2.7, Playbooks 2.9.4 incl. FIPS, MS Calendar 1.6.2) and version bumps to 11.7.8 / 11.7.9

After merge

1. Advance the watcher baseline on the git server:

   echo 6e4777b430be15441e9e7e1ebdbe7eec4a648767 | sudo tee /opt/slash-upstream-watch/merged-base.sha
   

2. Update DIVERGENCE.md (per REPO-CONVENTIONS definition-of-done). Note its "25 diverged files" figure is stale — actual divergence is now 173 files, following the branding scrub.
3. Deploy — this is a security batch, worth not sitting on.

Merges 25 upstream commits from `mattermost/release-11.7` into `slash/main`. Base `8092c1a86` (last merged, 2026-06-30) -> tip `6e4777b43` (**v11.7.9**). ## Conflict surface Far smaller than `DIVERGENCE.md` predicted. Only **3 files** overlapped between upstream's changes and ours, and **2 auto-merged**: - `webapp/channels/src/components/admin_console/admin_definition.tsx` — auto-merged. Notable: the divergence doc flags this as the single highest-risk file (17 upstream commits). - `webapp/channels/src/components/integrations/bots/bots.tsx` — auto-merged. - `webapp/channels/src/i18n/en.json` — **conflicted**, 2 hunks. The other high-churn files the doc warns about (`config.go`, `api4/user.go`) were not touched by this batch. ## Conflict resolution Both hunks were the expected branding-scrub-vs-upstream-text pattern. One needed a judgement call: | Key | Taken | Why | |---|---|---| | `admin.oauth.dcrDescription` | **ours** | Upstream text identical apart from the product name. | | `admin.oauth.dcrRedirectURIAllowlistDesc` | **upstream** | Not a branding difference. Upstream rewrote this because `50ab3983c` made allowlist matching URL-component-aware. Our text describes the old semantics and would now actively mislead admins about how their wildcards behave. Contains no product name. | | `bots.manage.help1` | **ours** | Branding only. | | `bots.manage.load_error.full` / `.partial` | **upstream** | Brand-new keys, no product name. | ## Verification - `en.json` parses; 7249 keys. - **0** keys introduced by this merge mention Mattermost. Count of Mattermost-bearing values unchanged at **3** (the AGPL attribution keep-list). - `scripts/check-branding.sh` passes. ## Diffstat is misleading — read this before reacting to it The raw diff shows **-64,319**. Of that, **64,009 deletions are GitHub Actions and e2e scaffolding** removed upstream in `73d679cbf` (backported CI buildenv changes). Slash builds on Forgejo Actions; `.forgejo/` has **0** files changed. ``` ci/e2e tooling : 143 files +11641 -64009 product code : 92 files +3244 -310 ``` `+3244 / -310` across 92 files is the real change, which is right for 25 patch commits. ## Contents — mostly security - `8400e7cb6` Calls v1.11.6 — SDP zip-bomb DoS fix - `8a56d5a6f` MM-68773 — HTML encoding in proxied image URL - `50ab3983c` MM-69392 — DCR redirect URI allowlist matching made URL-component aware - `96bfd7e57` MM-69408 — quadratic markdown autolink trimming (ReDoS) - `f52a22d0c` MM-69857 — policy update endpoint scope enforcement - `7acc6ce19` team-scope channel check on access policy unassign - plus prepackaged plugin bumps (Boards 9.2.7, Playbooks 2.9.4 incl. FIPS, MS Calendar 1.6.2) and version bumps to 11.7.8 / 11.7.9 ## After merge 1. Advance the watcher baseline on the git server: ``` echo 6e4777b430be15441e9e7e1ebdbe7eec4a648767 | sudo tee /opt/slash-upstream-watch/merged-base.sha ``` 2. Update `DIVERGENCE.md` (per REPO-CONVENTIONS definition-of-done). Note its "25 diverged files" figure is stale — actual divergence is now **173 files**, following the branding scrub. 3. Deploy — this is a security batch, worth not sitting on.

mohlec added 26 commits 2026-08-05 01:01:17 +00:00

Cherry pick #37171 to release-11.7 (#37378) ... 903a746723

Automatic Merge

Fix: Scroll pop caused because of delayed correction. (#36879) (#37399) ... 705bdd7137

Automatic Merge

[MM-69656] Paginate Bot Accounts list so all bots load and are searchable (#37336) (#37416) ... cf4e93fa71

Automatic Merge

[MM-69394] fix for data retention teams endpoint (#37370) (#37467) ... eb1541e734

Co-authored-by: Christopher Poile <cpoile@gmail.com>

Revert "[MM-69394] fix for data retention teams endpoint (#37370) (#37467)" (#37485) ... 9c27d1df2a

Automatic Merge

Enforce team-scope channel check on access policy unassign for parity with assign (#37512) ... 7acc6ce190

Automatic Merge

[release-11.7] Backport CI buildenv + cache-warming changes (#37449) ... 73d679cbf0

* ci: standardize checkout action inputs across workflows (#36876)

* ci: standardize checkout action inputs across workflows

* ci: checkout in claude pipeline use default

* ci: make setup-go-work a Makefile prereq, remove explicit CI steps (#37268)

* ci: auto-build missing buildenv images for in-flight Go version bumps (#37286)

* ci: replace volatile e2e-platform-pkgs cache with shared webapp-setup (#37182)

* ci: replace volatile e2e-platform-pkgs cache with shared webapp-setup

* ci: replace volatile e2e-platform-pkgs cache in cypress template v2

* ci: tighten prep-deps comments

* fix: typo in webapp-setup comment

* chore(ci): warm node and npm caches daily; make CI jobs restore read-only (#37393)

* chore(ci): warm node and npm caches daily; make CI jobs restore read-only

Add daily scheduled workflows on master that warm two independent caches,
each in its own workflow mirroring its consumers:

- webapp-ci-cache-warm.yml warms the webapp node_modules cache
  (keyed on webapp/package-lock.json)
- e2e-ci-cache-warm.yml warms the E2E ~/.npm registry cache
  (keyed on the cypress/playwright/api lockfiles)

Webapp CI and the E2E/api CI jobs now restore these caches read-only instead
of writing them, so the daily jobs keep the caches warm. The E2E ~/.npm
restore is factored into a reusable restore-e2e-npm-cache composite action,
and webapp-setup gains a read-only mode for the node_modules cache.

* chore(ci): guard cache-warm workflows with a concurrency group

* chore(ci): drop unused node-cache-dependency-path output

* chore(ci): reuse webapp-setup for node_modules in e2e-tests-check

* Move e2e npm registry cache out of the node-cache- namespace (#37427)

The e2e npm registry cache keyed on node-cache-<os>-<arch>-npm-e2e-,
sharing the node-cache- prefix that actions/setup-node generates
automatically for its built-in npm cache (node-cache-<os>-<arch>-npm-).
Because the arch segment differs only by case (setup-node uses Node's
process.arch 'x64'; this action uses runner.arch 'X64') and GitHub matches
restore-key prefixes case-insensitively, the two buckets share a common
prefix. A future broad restore-key such as node-cache-<os>-<arch>-npm-
could then cross-restore one bucket's ~/.npm into the other.

Rename the key to e2e-npm-registry-<os>-<arch>-, giving it a distinct
namespace that is not a prefix of node-cache- in either direction and
matches the repo's content-descriptive e2e cache keys (e2e-cypress-deps-,
e2e-playwright-deps-, e2e-platform-pkgs-). Existing entries orphan and
age out; the daily warm job repopulates under the new key on next run.

* delete check-go-fix, -diff not supported on go1.25

* Adopt per-target .PHONY directives in server Makefiles (#37447)

* Converge generated-file CI checks on a single make generated target

The server-ci.yml workflow had many separate "run a make target, then fail
on any git diff" jobs, but make generated only covered a few of them, so the
target and CI drifted apart.

Expand make generated to regenerate every committed asset, adding
gen-serialized, migrations-extract, build-templates, mmctl-docs, and
modules-tidy, and collapse the per-asset check jobs into a single
check-generated job.

Split the backport migration guard into its own check-backport-migrations
job and make target, renaming the script to match.

* make generated

* git status --porcelain

* simplify permissions block given defaults

---------

Co-authored-by: Nuno Simões <nuno.simoes@mattermost.com>

Bumping prepackaged version of boards to 9.2.6 (#37538) ... 2045acd92c

Automatic Merge

Update latest patch version to 11.7.8 (#37547) ... c1311fbaf8

Co-authored-by: unified-ci-app[bot] <121569378+unified-ci-app[bot]@users.noreply.github.com>

MM-69408 - Fix quadratic markdown autolink trimming (#37201) (#37437) ... 96bfd7e573

Automatic Merge

MM-69392 - Make DCR redirect URI allowlist matching URL-component aware (#37170) (#37443) ... 50ab3983c1

Automatic Merge

[MM-69221] (#37301) (#37466) ... af9a2333b1

Automatic Merge

Reapply "[MM-69394] fix for data retention teams endpoint (#37370) (#37467)" (#37485) (#37551) ... 1dc6ee6bfd

Automatic Merge

Reserve image attachment height during thumbnail checks (#37007) (#37572) ... 20e46197f6

Automatic Merge

Update Playbooks plugin to v2.9.4 (incl. FIPS) (#37645) 8b23519a86

MM-68773 Fix bug with HTML encoding in proxied image URL (#36555) (#37680) ... 8a56d5a6f1

* MM-68773 Fix bug with HTML encoding in proxied image URL

* Remove some now-unneeded hasImageProxy props

(cherry picked from commit 25bf5edc4f)

Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>

[MM-68131] Prepackage Calls v1.11.6 (SDP zip-bomb DoS fix) (#37686) ... 8400e7cb60

Automatic Merge

Bumping prepackaged version of boards plugin to 9.2.7 (#37705) ... 52472c41e3

Automatic Merge

Automated cherry pick of #37595 (#37711) ... e331e17a89

Automatic Merge

Bumping prepackaged MS Calendar version to 1.6.2 (#37739) ... 9c90a0a676

Automatic Merge

Cherry pick #37570 to release-11.7 (#37733) ... 822e291a5d

* SEC-10179 Integrate test system IO for Playwright and Cypress (#36376)

* change retry to 1, fixed and disabled failed tests

* add v2 templates for Cypress and Playwright E2E tests with test system io integration

* add commenting to pr

* identify more playwrights to fix separately

* disable deletion-report.spec for separate fix

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

* fix: permission required by test-system-io actions (#36477)

* fix: permission required by e2e test-system-io actions (#36478)

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* chore(ci): consolidate openldap runner prep into a composite action (#36563)

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* ci: port test-system-io v2 templates from release-11.9

Bring Playwright/Cypress template-v2 in line with release-11.9 so they
include prepare-run/prep-deps caching, runner-prep-openldap, and pinned
mattermost-test-system-io action SHAs (1631d8fcea24). Bump Playwright
v2 workers to 10 to match 11.8/11.9. Prerequisite for cherry-picking
#37570 (testcontainers) onto release-11.7.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* E2E/Playwright: Add testcontainers to playwright-lib (#37570)

* add testcontainers to playwright-lib

* include retry mechanism for transient failures

* - Introduced a new command `testcontainers:up` in package.json to run Playwright tests with Testcontainers.
- Created a standalone Playwright configuration file `playwright.testcontainers-up.config.ts` for managing Testcontainers.
- Added a no-op test `testcontainers_up.spec.ts` to ensure the Testcontainers stack is up during the test run.
- Implemented a global setup script `testcontainers_up_global_setup.ts` to start and stop the Testcontainers stack.
- Updated dependencies in package.json, including adding `chalk` for logging.

* fix package-lock

* fix tsc and restore waiting for all migrations to complete

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

* fix(e2e): remove obsolete CRT intro modal dismiss from uiClickSidebarItem

The CRT tutorial modal was removed in MM-66470; dismissing
#genericModalLabel races and flakes MM-T4261_3.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* fix(e2e): sync Playwright navigations to live testcontainers baseURL

After restartMattermostContainer remaps the host port, relative page.goto
must follow testConfig.baseURL rather than the worker-start config value.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* fix(e2e): restore eslint-disable for axe empty fixture pattern

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* fix(e2e): ignore webhook assets in eslint; prettier README

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* fix(e2e): prettier-format testcontainers config helpers

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* ci(e2e): fully adopt test-system-io and lighten Playwright services

Port #37413: drop the dual v1/v2 dispatch path, promote the test-system-io
templates to the canonical names, and remove legacy calculate-results / AWS
artifact upload plumbing.

For Playwright testcontainers on this release, leave optional sidecars
(openldap, keycloak, elasticsearch, opensearch, minio, azurite, webhook)
off by default and remove the related service-specific specs that are not
part of the older suite.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* style(e2e): prettier stack.ts after optional webhook change

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* ci(e2e): grant contents:read to test-system-io workflow callers

Reusable Playwright/Cypress templates require contents:read. Without it
on the caller job, GitHub Actions fails the workflow at startup.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* ci: retrigger enterprise build after transient npm cache failure

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* test(e2e): align testcontainers feature flags with release docker-compose

Mirror MM_FEATUREFLAGS_* from e2e-tests/.ci/server.generate.sh for each
release, dropping flags that do not exist in that release's FeatureFlags
struct (or were never enabled in the compose stack).

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* ci: retrigger enterprise after flaky message_export Postgres failure

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* e2e(playwright): omit unset Testcontainers env keys; align release docs

When optional webhook/sidecars are off, .env.testcontainers no longer
writes PW_*=undefined. Docs match empty DEFAULT_TESTCONTAINERS_SERVICES.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* e2e(playwright): prettier-format lib/README.md table

Fixes CI npm run check (prettier) failures from the services table edit.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* ci: retrigger E2E after Cypress commit-status race

Orchestration reported 1 failed unit before retest; final summary was
100% but commit status stayed failure. Retrigger for a clean green.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

* e2e(cypress): keep tests/support/env import on release-11.7

#36376 switched message_deletion_spec to @/support/env, but this
release has no Cypress webpack @ alias (added later). That caused a
Webpack Module not found failure and a stuck failed commit status.

Co-authored-by: sabril <saturninoabril@users.noreply.github.com>

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: sabril <saturninoabril@users.noreply.github.com>
Co-authored-by: yasser khan <attitude3cena.yf@gmail.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>

MM-69857 - Keep parent imports and team scope system-managed on the policy update endpoint (#37625) (#37742) ... f52a22d0cf

Automatic Merge

fix: bot import panic when user exists without bot record (#36072) (#37785) ... d42004bb30

* Fix bot import panic when user exists without bot record

The original importBot error handler re-declared `var appErr *model.AppError`
inside the CreateBot failure block, shadowing the outer appErr with a typed nil
pointer. When errors.As received this (*model.AppError)(nil), it was a non-nil
interface — so instead of returning false, it called AppError.Unwrap() on the
nil receiver, causing a panic.

This commit:
- Fixes the variable shadowing that caused the panic
- Adds recovery logic: when CreateBot fails because the username is taken,
  look up the existing user and create/update just the bot record
- Fixes pre-existing silent error swallowing in Bot().GetByUsername — now
  distinguishes store.ErrNotFound from real database errors
- Fixes pre-existing bug where DisplayName changes on re-import were lost
  because DisplayName is stored in Users.FirstName, not the Bots table
- Adds logging at every step of the recovery path (Info for normal flow,
  Warn for fallback/error paths)
- Uses distinct variable names (saveErr/updateErr) in the Save→Update
  fallback to avoid the same class of variable-reuse hazard
- Adds comprehensive test suite (11 subtests) covering dry-run, apply,
  re-import, recovery, regression/panic guard, idempotency, DisplayName
  update, and plugin-owner edge cases

* Address review findings: tighten assertions, fix error ID, add coverage

- Use require.ErrorAs for store.ErrNotFound instead of generic require.Error
  in the dry-run test, so it catches only not-found rather than any store error
- Add time.Sleep before idempotent re-import to ensure any real write would
  produce a different UpdateAt timestamp at millisecond resolution
- Fix misleading error ID "app.bot.createbot.internal_error" to
  "app.bot.update.internal_error" in the Update fallback path
- Add test for non-username CreateBot failure (email conflict) to cover
  the error passthrough at line 907-908

* Add missing i18n translations for bot import error strings

Add translation entries for app.bot.update.internal_error,
app.import.import_bot.lookup_error, and
app.import.import_bot.user_not_found.error to fix enterprise CI
i18n check failure.

(cherry picked from commit 694e6f40dc)

Co-authored-by: Felipe Martin <812088+fmartingr@users.noreply.github.com>

Update latest patch version to 11.7.9 (#37787) ... 205d80ad55

Co-authored-by: unified-ci-app[bot] <121569378+unified-ci-app[bot]@users.noreply.github.com>

Automated cherry pick of #37388 (#37798) ... 6e4777b430

Automatic Merge

Merge upstream mattermost/release-11.7 (v11.7.9) into slash/main ... 55ba9d945e

25 upstream commits, base 8092c1a86 -> tip 6e4777b43.

Conflict surface was 3 files; 2 auto-merged (admin_definition.tsx,
integrations/bots/bots.tsx). Only webapp/channels/src/i18n/en.json
conflicted, in 2 hunks, both the expected branding-scrub-vs-upstream-text
pattern.

Resolution:
- admin.oauth.dcrDescription  -> ours (Slash); upstream text was identical
  apart from the product name.
- admin.oauth.dcrRedirectURIAllowlistDesc -> UPSTREAM. Not a branding
  difference: upstream rewrote this description because 50ab3983c changed
  the matching semantics to be URL-component-aware. Our text described the
  old behaviour and would now be actively wrong. Contains no product name.
- bots.manage.help1 -> ours (Slash).
- bots.manage.load_error.full / .partial -> new upstream keys, kept as-is
  (no product name).

Verified post-merge:
- en.json parses; 7249 keys.
- 0 new keys introduced by this merge mention Mattermost; the count of
  Mattermost-bearing values is unchanged at 3 (the AGPL attribution
  keep-list).
- scripts/check-branding.sh passes.

Notable upstream content: Calls v1.11.6 (SDP zip-bomb DoS fix), proxied
image URL HTML-encoding fix, DCR redirect URI allowlist hardening,
quadratic markdown autolink trimming fix.

mohlec merged commit 87f946c7c7 into slash/main 2026-08-05 01:04:42 +00:00

mohlec deleted branch merge/upstream-2026-08-04 2026-08-05 01:04:42 +00:00

mohlec referenced this pull request from a commit 2026-08-05 01:04:43 +00:00

Merge pull request 'Merge upstream mattermost/release-11.7 (v11.7.9) - 25 commits, security batch' (#22) from merge/upstream-2026-08-04 into slash/main

mohlec referenced this pull request 2026-08-05 01:09:25 +00:00

CI: build-server/build-webapp do not run on pull requests, so compile errors only surface after merge #23

mohlec referenced this pull request 2026-08-05 01:09:27 +00:00

docs: DIVERGENCE.md for v11.7.9 merge + correct the stale 25-file count #25

mohlec referenced this pull request from a commit 2026-08-05 01:09:28 +00:00

docs: update DIVERGENCE.md for the v11.7.9 merge

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

slash/slash-server!22

No description provided.