slash/slash-server
slash/slash-server
3
0
Fork 0
Code Issues 3 Pull requests Projects Releases 3 Packages Wiki Activity Actions

Merge upstream mattermost v11.7.10 into slash/main #28

Merged
mohlec merged 27 commits from merge/upstream-2026-08-31 into slash/main 2026-09-01 17:05:09 +00:00
Conversation 0 Commits 27 Files changed 213 +12854 -10623
mohlec commented 2026-09-01 17:02:12 +00:00
Owner
Copy link

Merges upstream mattermost/release-11.7 through the v11.7.10 tag (dee04aa117, tagged 2026-08-21) into slash/main, which was at v11.7.9 (6e4777b430) since 2026-08-04.

23 commits. Follows the merge procedure in DIVERGENCE.md.

Why the tag and not the branch tip

The branch tip is 2 commits further along (Update dependencies (11.7) and a version bump to 11.7.11, which upstream has not tagged yet). Merging to the released tag avoids shipping an untagged pre-release version string. Those 2 commits come in at the next merge.

Zero conflicts

Step 2 of the procedure predicted a 3-file overlap. All three auto-merged, and both sides survived — verified by diffing the result against upstream and against pre-merge slash/main:

File Ours kept Upstream taken
server/public/model/config.go GroupUnreadChannelsDefaultOn (x2), DefaultTheme = "slash" Postgres test-password change
server/channels/api4/user.go All 4 license-gate removals (custom permission schemes, 3x guest accounts) MM-70115 OAuth-session guard on updateUserRoles
webapp/channels/webpack.config.js Both CopyPlugin entries (slash-theme.css, ai-agent-icon.svg) image-webpack-loader -> image-minimizer-webpack-plugin

No conflict appeared outside the predicted set.

webapp/channels/src/i18n/en.json was untouched upstream this round — the first merge where it has not conflicted.

Checks

  • scripts/check-branding.sh -> passed
  • en.json parses, 7,249 keys
  • Diffstat split: ci/e2e: 35 files +1096 -63 / product: 177 files +11748 -10551
  • Diverged-file count unchanged at 173, same shape by area

What is in it

Security and hardening, almost entirely:

  • Stop leaking message body via the Notifications API tag
  • MM-70240 post/thread payload sanitization
  • MM-70072 role validation for channel/team member updates; team admin assignment on join
  • MM-69881 size limit on the local image proxy's direct image fetch
  • MM-69889 RelayState handling in the SAML flow
  • MM-70016 team invitation edge case; MM-70040 team search filters; MM-70115 account-type switch; getFile validation order
  • DM/GM restriction on flagging a post
  • MM-69174 fix layout shift from images in posts (the one user-visible change)
  • Prepackage mattermost-plugin-agents v2.0.7; log instead of refusing to start on unsupported DB versions

Watch in CI

The webpack change is larger than "npm audit fix" suggests: it swaps the image pipeline and adds an svgo pass over src/ SVGs plus a sharp minimizer over emitted images. Our theme assets go through CopyPlugin, which bypasses module rules, so they should be unaffected — but build-webapp is the real check, and per the procedure that runs authoritatively after this merges.

Before merging

Two #TBD placeholders in DIVERGENCE.md need this PR's number.

After merging

echo dee04aa1179b6e3b6a7aca67b95ad0e7efefaa80 | sudo tee /opt/slash-upstream-watch/merged-base.sha

Then deploy per the slash-deploy RUNBOOK.

Merges upstream `mattermost/release-11.7` through the **v11.7.10** tag (`dee04aa117`, tagged 2026-08-21) into `slash/main`, which was at v11.7.9 (`6e4777b430`) since 2026-08-04. 23 commits. Follows the merge procedure in `DIVERGENCE.md`. ## Why the tag and not the branch tip The branch tip is 2 commits further along (`Update dependencies (11.7)` and a version bump to **11.7.11**, which upstream has not tagged yet). Merging to the released tag avoids shipping an untagged pre-release version string. Those 2 commits come in at the next merge. ## Zero conflicts Step 2 of the procedure predicted a 3-file overlap. All three auto-merged, and both sides survived — verified by diffing the result against upstream and against pre-merge `slash/main`: | File | Ours kept | Upstream taken | |---|---|---| | `server/public/model/config.go` | `GroupUnreadChannelsDefaultOn` (x2), `DefaultTheme = "slash"` | Postgres test-password change | | `server/channels/api4/user.go` | All 4 license-gate removals (custom permission schemes, 3x guest accounts) | MM-70115 OAuth-session guard on `updateUserRoles` | | `webapp/channels/webpack.config.js` | Both CopyPlugin entries (`slash-theme.css`, `ai-agent-icon.svg`) | `image-webpack-loader` -> `image-minimizer-webpack-plugin` | No conflict appeared outside the predicted set. `webapp/channels/src/i18n/en.json` was **untouched upstream this round** — the first merge where it has not conflicted. ## Checks - `scripts/check-branding.sh` -> passed - `en.json` parses, 7,249 keys - Diffstat split: `ci/e2e: 35 files +1096 -63` / `product: 177 files +11748 -10551` - Diverged-file count unchanged at **173**, same shape by area ## What is in it Security and hardening, almost entirely: - Stop leaking message body via the Notifications API tag - MM-70240 post/thread payload sanitization - MM-70072 role validation for channel/team member updates; team admin assignment on join - MM-69881 size limit on the local image proxy's direct image fetch - MM-69889 RelayState handling in the SAML flow - MM-70016 team invitation edge case; MM-70040 team search filters; MM-70115 account-type switch; getFile validation order - DM/GM restriction on flagging a post - MM-69174 fix layout shift from images in posts (the one user-visible change) - Prepackage `mattermost-plugin-agents` v2.0.7; log instead of refusing to start on unsupported DB versions ## Watch in CI The webpack change is larger than "npm audit fix" suggests: it swaps the image pipeline and adds an svgo pass over `src/` SVGs plus a sharp minimizer over emitted images. Our theme assets go through CopyPlugin, which bypasses module rules, so they should be unaffected — but `build-webapp` is the real check, and per the procedure that runs authoritatively after this merges. ## Before merging Two `#TBD` placeholders in `DIVERGENCE.md` need this PR's number. ## After merging ```bash echo dee04aa1179b6e3b6a7aca67b95ad0e7efefaa80 | sudo tee /opt/slash-upstream-watch/merged-base.sha ``` Then deploy per the slash-deploy RUNBOOK. 
Automatic Merge
* the main fix + unit tests

* add actual analysis-icu-less docker containers in CI to lock it down

* fix AppError test assertions

* fix CI search startup tests

* fix bulk processor flusher shutdown

* fix bulk shutdown test assertion

* Revert "add actual analysis-icu-less docker containers in CI to lock it down"

This reverts commit dfa9aacb08235047414096084543ffca980c7e65.

* simplify analysis-icu startup guidance

* fix OpenSearch bulk flusher shutdown

* linting fix

* query nodes directly for plugins instead of trying and catching err

* remove unneeded comments

(cherry picked from commit 929a2e9e3f)

Co-authored-by: Christopher Poile <cpoile@gmail.com>
Automatic Merge
Automatic Merge
Automatic Merge
Automatic Merge
Automatic Merge
* Stop leaking message body via the Notifications API tag

showNotification was passing the rendered chat body as the Web Notifications
API tag option. On Chromium-based browsers (Chrome, Edge, Brave), the tag is
serialised into the notification-activation command line via the
--notification-launch-id argument, where endpoint detection tooling such as
CrowdStrike Falcon FDR, Microsoft Defender for Endpoint, and Sysmon Event ID 1
captures the full process-start command line and forwards it to the customer's
SIEM. That meant private message content (including incident-response messages,
credentials accidentally pasted into chat, and customer PII) was being copied
into telemetry pipelines that were never in scope to receive it.

Use the title - which already carries only the sender / channel context - as
the tag instead. As a side benefit this is closer to the spec-intended use of
tag: subsequent notifications from the same conversation now replace the prior
one rather than stacking.

Add a regression test covering the leak: the test pushes a body with a
plausible secret pattern (token=AKIA-...) and asserts the tag never echoes
any of it.



* Allow callers to pass an explicit notification tag

Threads channelId through dispatchNotification so per-conversation
notifications coalesce by a stable opaque id rather than the user-visible
title. The title remains as a safe fallback when callers do not supply a
tag, preserving the existing behaviour for the session-expired notification
emitted from login.tsx where no channel context exists.



* fix: explain desktop notification path

* Avoid title fallback for notification tags



* test: align notification action payload expectations



* test: align notification tag e2e expectation

---------



(cherry picked from commit befdb0175a)

Signed-off-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>
Co-authored-by: Vishal Kumar Singh <vishal.kr.singh2021@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Automatic Merge
Automatic Merge
Automatic Merge
Automatic Merge
Automatic Merge
* Log an error instead of refusing to start on unsupported Postgres, Elasticsearch, and OpenSearch versions (#37929)

(cherry picked from commit 27a5abe2d4)

* Adapt OpenSearch version test to the 11.7 max supported version (2)
Automatic Merge
Automatic Merge
Co-authored-by: Cursor <cursoragent@cursor.com>
* MM-69174 Fix most layout shift caused by images in posts (#37420)

* Add post_height.spec.ts and related assets

* Separate SizeAwareImage container rendering from utility buttons

* Commit some changes to let me revert afterwards

* Add consistent container to SizeAwareImage fallback (needs cleanup)

* Fixes all non-huge image link previews

* Remove border from Markdown images and reduce max-height to match other images

* Clean up SizeAwareImage and fix image controls always being visible

* Fix accidentally-removed image loader

* Fix malformed CSS and update unit tests

* Revert changes to ChannelView

* Update a11y of placeholder image

* Coderabbit feedback

* Additional Coderabbit feedback

* Update image sizes for Cypress test

* Stop propagation of handled events from SizeAwareImage

* Update E2E test for 11.7 version of multiple image attachment

* Update snapshots

* Copy another change from master to fix mock_file_server
Automatic Merge
Automatic Merge
* Change Postgres test password to mostest_password

* Fix wrong password
* Bump Go version to v1.26.7

* make generated

* Disable modernize linter

* Fix formatting errors

* Cherry-pick update-fixtures changes from e3fbf87

* Run TestGenerateMiniPreviewImage -update-fixtures

go test ./channels/app/imaging/... -run TestGenerateMiniPreviewImage -update-fixtures

* Run TestUploadFiles -update-fixtures

go test ./channels/api4/... -run TestUploadFiles -update-fixtures
E2E/Playwright: Fix file server host (#38073)
Some checks failed
e2e-tests-cypress-template.yml / E2E/Playwright: Fix file server host (#38073) (push) Failing after 0s
Details
e2e-tests-cypress.yml / E2E/Playwright: Fix file server host (#38073) (push) Failing after 0s
Details
e2e-tests-playwright-template.yml / E2E/Playwright: Fix file server host (#38073) (push) Failing after 0s
Details
e2e-tests-playwright.yml / E2E/Playwright: Fix file server host (#38073) (push) Failing after 0s
Details
dee04aa117
 
* fix: file server host

* fix: upload_files-spec

* update comments

* use file server url only
Zero conflicts. The predicted 3-file overlap (api4/user.go, model/config.go, webpack.config.js) auto-merged with both sides intact.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(divergence): en.json no longer conflicts at every merge
Some checks failed
Build Slash Webapp / build-webapp (pull_request) Has been cancelled
Details
Build Slash Webapp / branding-audit (pull_request) Has been cancelled
Details
724e20d5fd 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(divergence): fill in PR number for the 2026-08-31 merge
All checks were successful
Build Slash Webapp / branding-audit (pull_request) Successful in 33s
Details
Build Slash Webapp / build-webapp (pull_request) Has been skipped
Details
53169eec23 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mohlec merged commit 6cc2bb9d9a into slash/main 2026-09-01 17:05:09 +00:00
mohlec deleted branch merge/upstream-2026-08-31 2026-09-01 17:05:09 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
slash/slash-server!28
No description provided.