MM-69392 - DCR changes upgrade notes

source/administration-guide/upgrade/important-upgrade-notes.rst

@@ -12,6 +12,20 @@ We recommend reviewing the `additional upgrade notes <#additional-upgrade-notes>
 | If you're upgrading                                | Then...                                                                                                                                                          |
 | from a version earlier than...                     |                                                                                                                                                                  |
 +====================================================+==================================================================================================================================================================+
+| v11.9                                              | Mattermost v11.9 changes how redirect URI allowlist patterns are matched for OAuth Dynamic Client Registration (DCR). Patterns are now evaluated per URL         |
+|                                                    | component (scheme, host, path, and query) rather than as a whole-string glob. As a result, a pattern such as ``https://*.example.com/**`` no longer matches      |
+|                                                    | redirect URIs that include a query string (for example, ``https://app.example.com/callback?tenant=foo``); redirect URIs without a query string continue to       |
+|                                                    | match as expected.                                                                                                                                               |
+|                                                    |                                                                                                                                                                  |
+|                                                    | Admins using DCR with redirect URIs that include query strings must update their allowlist. To allow redirect URIs both with and without a query string, add     |
+|                                                    | two separate entries:                                                                                                                                            |
+|                                                    |                                                                                                                                                                  |
+|                                                    | - ``https://*.example.com/**`` — matches redirect URIs with no query string.                                                                                     |
+|                                                    | - ``https://*.example.com/**?**`` — matches redirect URIs with any query string.                                                                                 |
+|                                                    |                                                                                                                                                                  |
+|                                                    | A pattern that includes a query component (such as ``?**``) only matches URIs that also carry a query string; it will not match URIs without one. Both entries   |
+|                                                    | are required to cover both cases.                                                                                                                                |
++----------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
 | v11.8                                              | The Custom Profile Attributes property group is renamed from ``custom_profile_attributes`` to ``access_control``, and CPA fields and values are migrated from    |
 |                                                    | the legacy property model to the v2 model. The functionality of the CPA feature is unchanged. Plugin developers that use CPA will need to register against the   |
 |                                                    | new group name.                                                                                                                                                  |