From 7ee4268b87ca04b56e28f3a757a7eb09220ea792 Mon Sep 17 00:00:00 2001 From: Amy Blais <29708087+amyblais@users.noreply.github.com> Date: Fri, 10 Jul 2026 09:10:43 +0300 Subject: [PATCH] MM-69392 - DCR changes upgrade notes --- .../upgrade/important-upgrade-notes.rst | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/source/administration-guide/upgrade/important-upgrade-notes.rst b/source/administration-guide/upgrade/important-upgrade-notes.rst index b5c3c4f368f..fa6bd01b6e3 100644 --- a/source/administration-guide/upgrade/important-upgrade-notes.rst +++ b/source/administration-guide/upgrade/important-upgrade-notes.rst @@ -12,7 +12,21 @@ We recommend reviewing the `additional upgrade notes <#additional-upgrade-notes> | If you're upgrading | Then... | | from a version earlier than... | | +====================================================+==================================================================================================================================================================+ -| v11.9 | Mattermost 11.9.0 introduces a schema change in the form of a new column added to the ``incomingwebhooks`` table. The ``incomingwebhooks`` table receives an | +| v11.9 | Mattermost v11.9 changes how redirect URI allowlist patterns are matched for OAuth Dynamic Client Registration (DCR). Patterns are now evaluated per URL | +| | component (scheme, host, path, and query) rather than as a whole-string glob. As a result, a pattern such as ``https://*.example.com/**`` no longer matches | +| | redirect URIs that include a query string (for example, ``https://app.example.com/callback?tenant=foo``); redirect URIs without a query string continue to | +| | match as expected. | +| | | +| | Admins using DCR with redirect URIs that include query strings must update their allowlist. To allow redirect URIs both with and without a query string, add | +| | two separate entries: | +| | | +| | - ``https://*.example.com/**`` — matches redirect URIs with no query string. | +| | - ``https://*.example.com/**?**`` — matches redirect URIs with any query string. | +| | | +| | A pattern that includes a query component (such as ``?**``) only matches URIs that also carry a query string; it will not match URIs without one. Both entries | +| | are required to cover both cases. | +| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+ +| | Mattermost 11.9.0 introduces a schema change in the form of a new column added to the ``incomingwebhooks`` table. The ``incomingwebhooks`` table receives an | | | ``AccessExclusiveLock`` when adding the column; however, because PostgreSQL 11+ treats ``ADD COLUMN`` with a non-volatile constant default as a metadata-only | | | operation, the lock is held for only microseconds and is not proportional to row count. All concurrent reads and writes are blocked only for the instant the | | | catalog entry is updated, then immediately released — impact to concurrent operations is negligible. Zero downtime is possible when upgrading to this release. |