Catalog / Appwrite

2.6.0

todaysecurityaddedfixedOriginal notes

Appwrite 2.6.0 brings image metadata controls, resource descriptions, database and storage fixes, and security updates to self-hosted deployments. It includes self-hosted Console 1.2.97, updated from 1.2.74. Back up your instance and run the migration after upgrading: this minor release includes schema updates.

Highlights

  • Remove location, device, and capture-time metadata from new image uploads using the bucket's Image metadata setting. Color profiles and orientation are preserved; stripping is off by default, applies within the read-buffer size limit, and is unavailable through the S3-compatible API (#14351).
  • Use resource descriptions through the API for databases, tables/collections, columns/attributes, indexes, buckets, functions, sites, variables, topics, and keys (#14471, #14595). This is an API addition; the pinned Console does not provide editors for every description field.
  • Configure periodic password changes from the Console's Auth policies page, and use custom password deny lists through the project policy API (#14602, #14499).
  • Refresh outbound TLS trust to reject the compromised eMudhra certificate chains; both the runtime base and independent Composer stage carry the fix (#14719).
  • Upgrade to self-hosted Console 1.2.97, including the bucket metadata setting, password-rotation policy card, time-of-day selection in date ranges, and one-minute chart intervals for short windows.

Fixes

  • API key security: hide key secrets unless the caller's effective scopes include keys.write (#14600, #14603).
  • Auth and redirects: correct redirect authority parsing and show password-breach UI only when a password is compromised (#14348; bundled Console update).
  • Databases: correct joined document IDs, join aliases, aggregate result shapes, legacy response formats, filtered totals, 64-bit validation, numeric-bound errors, relationship variables, and deleted-column errors (#14535, #14594, #14537, #14543, #14536, #14551, #14584, #14582, #14542, #14376).
  • Transactions and updates: handle deletes in the same transaction batch, include staged writes in list results, and fix bulk updates of unique fields (#14578, #14590, #14575).
  • Memberships: fix membership cursor pagination and support querying the caller's memberships (#14579, #14495).
  • Storage uploads: validate chunked-upload totals; avoid an extra native storage read when finalizing files; refresh upload metadata after stripping attempts; and improve upload/list performance (#14514, #14707).
  • Storage downloads and S3: stream native and S3 responses without buffering entire files; preserve range headers and the captured object version; fix single-part and selected-part multipart completion; delete prefixed buckets correctly; and support explicit path-style configuration for custom S3 endpoints (#14615, #14605, #14607, #14601, #14703, #14628).
  • Migrations: complete upgrades from 2.5.0 and preserve resource descriptions and bucket image-metadata settings when transferring projects (#14737).
  • Project deletion: remove a deleted project's stored data (#14626).
  • Deployments: redeploy through the resource's current Git installation and preserve custom domains during retention cleanup (#14666, #14663).
  • Functions: add Drizzle/Dodo Payments templates, persist synchronous executions correctly, and keep template pushes working on existing branches (#14665, #14652, #14549).
  • Messaging: correct APNs target/provider routing and legacy bundle-ID handling, bound messaging memory, retry transient SMTP failures, and handle permanent/custom SMTP refusals (#14589, #14592, #14438, #14544, #14545, #14609).
  • MQTT and realtime: enforce topic subscription and presence ownership permissions; stop sending to topic IDs incorrectly; revoke blocked users; and repair replay cursor, expiry, connection counting, and relationship payload behavior (#14460, #14396, #14580, #14411, #14412, #14410, #14606, #14349).
  • Cache and usage: surface unavailable caches and failed writes, retry failed usage work, fix usage attribute/column setup, and avoid unnecessary usage-index realignment (#14642, #14641, #14638, #14553, #14636, #14561, #14591).
  • Audit and webhooks: reduce queued audit payloads, keep audit cursor ordering stable, and record deliveries for unpublished webhooks (#14509, #14635, #14558).
  • Console: fix users/verified permission roles, nullable model fields, Sites create links, loader version labels, guest join loops, and empty project-card sparklines; remove the broken datacenter firewall preset (#14662, #14693, #14694, #14696, #14547, #14646, #14504; bundled Console update).
  • Installer and local services: give PostgreSQL sufficient shared memory and pass the server version to the Console in generated Compose files (#14451, #14547).

Under the hood

  • Update the runtime base to 2.2.5, the database library to 8.3.12, the bundled PHP SDK to 32.0.0, and the orchestrator to 2.2.4 (#14719, #14723, #14706, #14737).
  • Add relationship query support and raw-email messaging recipients through the API (#14502, #12675). The pinned Console does not expose every new API option.
  • Run inactive-project maintenance on a separate schedule, spreading work across slices and deferring it behind the deletes backlog. Configure the cadence with _APP_MAINTENANCE_INACTIVE_INTERVAL (default: seven days); scheduler and workers share _APP_MAINTENANCE_QUEUE_NAME (default: v1-maintenance) (#14695).
  • Centralize deployment-retention policy and add a realtime worker-exit hook (#14685, #14705).
  • Carry queue reliability and memory fixes, including orphaned Redis claim recovery and leaner job payloads (#14481, #14477, #14689).
  • Use the migration library now bundled in this repository and enforce SDK parameter ordering in generation (#14503, #14469, #14467).

Removed

  • Remove the broken datacenter firewall deny preset (#14504).
  • No environment variables are removed by this release.

Install

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
    appwrite/appwrite:2.6.0

Upgrade

Back up your database and persistent storage, and test the upgrade on a copy first. From the parent directory of your existing installation, run:

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="upgrade" \
    appwrite/appwrite:2.6.0
cd appwrite
docker compose exec appwrite migrate

Run the migration even when upgrading from 2.5.0. The updated V25 migration adds the resource-description and bucket stripMetadata fields and repairs presence-log schema. Reusing the class name does not mean there are no schema changes.

The installer supplies the ExifTool service for image metadata stripping. Custom deployments must set _APP_EXIFTOOL_HOST to a reachable ExifTool service before enabling the bucket setting. If the host is empty, the service is unreachable, or stripping returns an error, Appwrite stores the original upload with its metadata intact, even when stripping is enabled. Monitor the ExifTool service before relying on this setting to remove private metadata. Existing files are not rewritten.

For custom S3-compatible endpoints, _APP_STORAGE_S3_PATH_STYLE can force path-style requests (enabled) or bucket-addressing endpoints (disabled); an empty value infers the style. For a custom domain/CNAME pointing directly at a bucket, set it to disabled.

Outbound HTTPS endpoints presenting a compromised certificate chain must replace their certificate chain. TLS verification stays enabled.

Contributors

Thank you to @ChiragAgg5k and everyone who contributed to Appwrite 2.6.0 and the bundled Console releases.

Full Changelog: https://github.com/appwrite/appwrite/compare/2.5.0...2.6.0