Skip to content

MM-69392 - DCR changes upgrade notes #9089

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amyblais merged 1 commit into from
Jul 13, 2026
+15 −1
Merged

MM-69392 - DCR changes upgrade notes #9089

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion source/administration-guide/upgrade/important-upgrade-notes.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,21 @@ We recommend reviewing the `additional upgrade notes <#additional-upgrade-notes>
| If you're upgrading | Then... |
| from a version earlier than... | |
+====================================================+==================================================================================================================================================================+
| v11.9 | Mattermost 11.9.0 introduces a schema change in the form of a new column added to the ``incomingwebhooks`` table. The ``incomingwebhooks`` table receives an |
| v11.9 | Mattermost v11.9 changes how redirect URI allowlist patterns are matched for OAuth Dynamic Client Registration (DCR). Patterns are now evaluated per URL |
| | component (scheme, host, path, and query) rather than as a whole-string glob. As a result, a pattern such as ``https://*.example.com/**`` no longer matches |
| | redirect URIs that include a query string (for example, ``https://app.example.com/callback?tenant=foo``); redirect URIs without a query string continue to |
| | match as expected. |
| | |
| | Admins using DCR with redirect URIs that include query strings must update their allowlist. To allow redirect URIs both with and without a query string, add |
| | two separate entries: |
| | |
| | - ``https://*.example.com/**`` — matches redirect URIs with no query string. |
| | - ``https://*.example.com/**?**`` — matches redirect URIs with any query string. |
| | |
| | A pattern that includes a query component (such as ``?**``) only matches URIs that also carry a query string; it will not match URIs without one. Both entries |
| | are required to cover both cases. |
| +------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| | Mattermost 11.9.0 introduces a schema change in the form of a new column added to the ``incomingwebhooks`` table. The ``incomingwebhooks`` table receives an |
| | ``AccessExclusiveLock`` when adding the column; however, because PostgreSQL 11+ treats ``ADD COLUMN`` with a non-volatile constant default as a metadata-only |
| | operation, the lock is held for only microseconds and is not proportional to row count. All concurrent reads and writes are blocked only for the instant the |
| | catalog entry is updated, then immediately released — impact to concurrent operations is negligible. Zero downtime is possible when upgrading to this release. |
Expand Down
Loading