Catalog / Appwrite

1.9.8

todaysecurityaddedfixedOriginal notes

Appwrite 1.9.8 is a security patch for self-hosted deployments following the eMudhra certificate compromise. It retains Console 8.7.37 for compatibility with the 1.9 server APIs. Upgrading from 1.9.7 keeps the existing migration class and introduces no schema changes.

Highlights

  • Refresh outbound TLS trust so Appwrite rejects the compromised eMudhra certificate chains. TLS verification remains enabled.
  • Update the SVG sanitizer to 1.1.1 to address its reported security advisories.

Fixes

  • Security: use patched CA trust in the runtime and independent Composer dependency-download stage (#14718).
  • Avatars: update enshrined/svg-sanitize to 1.1.1 to address reported sanitizer advisories (#14718).

Under the hood

  • Require ca-certificates and ca-certificates-bundle at 20261020-r0 or newer and regenerate the certificate store.
  • Map 1.9.8 to migration V25, the same class as 1.9.7; no migration class is added.
  • Increment the response cache buster after the SVG sanitizer update so previously cached avatar and preview output is regenerated.

Removed

No environment variables, collections, or public APIs are removed.

Install

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
    appwrite/appwrite:1.9.8

Upgrade

Back up your database and persistent storage before upgrading. From the parent directory of an existing 1.9.7 installation, run:

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="upgrade" \
    appwrite/appwrite:1.9.8
cd appwrite
docker compose exec appwrite migrate

The patch reuses migration V25. No new configuration is required. Outbound HTTPS endpoints that still present a compromised certificate chain will fail verification; those endpoints must replace their certificate chain.

Full Changelog: https://github.com/appwrite/appwrite/compare/1.9.7...1.9.8