Release 2026-10-05 - (expected chart version 5.37.0)

[zebot]

[2026-10-05] (Chart Release 5.37.0)

Release notes

• Brig's emailSMS.general.emailSender now rejects domains whose final label starts with a digit, aligning validation with AWS SES requirements. (WPB-20524 activate/send returning 5xx error for invalid domain names #5550)

API changes

• The meetings endpoints (POST /meetings, PUT /meetings/{domain}/{id}, GET /meetings/{domain}/{id}, GET /meetings/list) expose a type field ("immediate" or "scheduled") on the meeting object starting at API version V19: required on create, optional on update (omitting it keeps the stored type). Meetings created via V15–V18 endpoints and all pre-existing meetings are scheduled. The V17/V18 endpoint shapes are unchanged. (WPB-28985: add wire meetings type #5556)

• The meetings endpoints (POST /meetings, PUT /meetings/{domain}/{id}, GET /meetings/{domain}/{id}, GET /meetings/list) expose a link field on the meeting object starting at API version V19: an https join link whose final path segment is the meeting's UUID. The field is present only when the meeting has a live join code; it is omitted otherwise (e.g. meetings created before this change, deployments whose code store cannot hold meeting codes, or multi-ingress deployments with no join-link URI configured for the user's domain). The V15-V18 endpoint shapes are unchanged. (WPB-28987: add meeting join link #5558)

Features

• Adminless group protection and automatic admin promotion now apply to channels as well as regular group conversations. (WPB-29162 auto promotion of admins should target groups and channels alike #5579)

• charts/wire-ingress: Set more secure TLS defaults (minimum TLS 1.3, allow post-quantum key exchange). Add support for a new FIPS_202205_tls_profile variable, which overrides TLS settings and can help with (but is alone not sufficient for) BSI's TR-02102-2 conformance. See the wire-ingress README for more details. (Envoy gateway: BSI TR-02102-2 TLS (FIPS2022) mode, and TLS 1.3+PQoptions by default #5480)

Bug fixes and other updates

• Check whether old passwords are shorter than 8 characters, and warn users, if they are. (WPB-11756 Check length when verifying user passwords #5543)

• An IdP could no longer be deleted once its issuer had been updated via the
  IdP management API (deletion failed with 404). (Fix: IdP deletion after issuer update #5548)

• Return an invalid-email error instead of a 500 response when SES rejects an activation email because of an invalid domain. (WPB-20524 activate/send returning 5xx error for invalid domain names #5550)

• Fix: always send MLS remove proposals when removing users from team conversations.

  This reproduces and fixes two related issues:

  1. Add collaborator A to team T, add A to conversation C, remove A from T, then add A back to T and to C. Problem: removal from T did not issue the MLS remove proposal, leaving inconsistent group state on the server and a silent failure to re-add the collaborator to the conversation.
  2. Remove a regular team member from its team. Their conversation membership was deleted before the step that issues remove proposals could see it, so the remaining members got the member-leave event but their MLS group kept the removed member's leaf. ([WPB-28977] Fix: add-remove-add collaborator to conv. #5555)

• Enable passing cspExtraConnectSrc value to nginx-ingress-services when working with multi-ingresses (renderCSPInIngress=True). It would be required for webapp to connect to third party sft servers. (fix: WPB-25750 Enable passing cspExtraConnectSrc value to nginx-ingress-services #5236)

• Tolerate invalid assets when migrating users to postgresql. These assets are simply ignored. (UserStore.Migration: Tolerate invalid assets #5569)

Documentation

• Document multi-ingress config settings for account-pages and improve the
  existing documentation of the webapp. Add a section for team-settings,
  explaining that it doesn't support multi-ingress (yet). (Document account-pages' multi-ingress configuration #5568)

Internal changes

• brig: migrate blacklist (BlockListStore) from Cassandra to PostgreSQL (WPB-22965: migrate blacklist to PostGreSQL #5409)

• Add diagnostic logging for rejected MLS commit bundles, including proposal type, target and held clients, group ID, and epoch. (WPB-27269 improvement of galley logs on client mismatch error #5566)

• Replace minio with garagehq in ./deploy/dockerephemeral/. ([WPB-29050] replace minio with garagehq for local devs #5567)

• Fix broken test setup due to unavailable minio image (Update integration tests: use minio mirror for fake-aws-s3 #5575) (overwritten by [WPB-29050] replace minio with garagehq for local devs #5567)

• Galley now publishes team events to the FIFO queue using the team ID as the message group, preserving ordering within each team while allowing events from different teams to be processed concurrently. (WPB-29185 [fix] team events SQS message grouping #5580)

• Migration of password reset from cassandra to postgres (WPB-22969: migrate password-reset to PostGreSQL #5412)

• The nginz image was missing from nix-docker-* SBOMs since it's built as a
  standalone flake derivation (#nginz) and not part of #wireServer.images*.
  The related SBOM script now takes any flake attrpath (attrset or single
  derivation) and gets called for both.

• Our local development setups (docker-compose environments) rely on
  minio/minio images. These were removed from Docker Hub. As they are still
  available from the official quay.io account, we're now sourcing them from
  there. (Use minio image from quay.io #5551) (overwritten by [WPB-29050] replace minio with garagehq for local devs #5567)