# Zulip Server changelog > The self-hosted server and web app behind Zulip's threaded team chat. - Vendor: Zulip - Category: Communication - Official site: https://zulip.com/self-hosting/ - Tracked by: What's New (https://whatsnew.fyi/product/zulip-server) - Harvested from: GitHub (zulip/zulip) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### 12.2 — Zulip Server 12.2 - Date: 2026-08-10 - Version: 12.2 - Original notes: https://github.com/zulip/zulip/releases/tag/12.2 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/12.2 - **security** — Guest users could receive new messages sent to public channels they were not subscribed to by registering an event queue with appropriate parameters, and existing event queues continued to deliver such messages after a guest lost access to the channel - **security** — Insufficient access checks in message draft creation allowed a guest to gain access to the profile information of any other user in organizations that limit which users guests can see - **security** — In organizations with web-public channels enabled, logged-out visitors could read the custom profile field values of every user in the organization - **security** — The OpenID Connect authentication backend did not consult the email_verified claim, allowing a misconfigured identity provider to log a user into an account belonging to someone else - **security** — The message rendering endpoint did not enforce the message content length limit, allowing an authenticated user to consume excessive server resources - **fixed** — Mattermost import tool now correctly preserves text that resembles an HTML tag such as or in imported messages - **changed** — Mattermost imports are considerably faster - **fixed** — Fixed crashes in some database migrations that run when upgrading from Zulip 11.x _Released 2026-08-10_ - GHSA-5r8f-gq2h-fcgp: Guest users could receive new messages sent to public channels they were not subscribed to, by registering an event queue with appropriate parameters. Existing event queues also continued to deliver such messages after a guest lost access to the channel. This vulnerability was discovered in an internal audit, and independently reported by Anthony Green of GreenHat Security. - GHSA-vwqp-7j32-xfg5: Insufficient access checks in message draft creation allowed a guest to gain access to the profile information of any other user in the organization. This issue only impacted organizations that limit which users guests can see. This vulnerability was reported by @JebeenLee. - GHSA-3m37-hwq6-jrj8: In organizations with web-public channels enabled, logged-out visitors could read the custom profile field values of every user in the organization. This vulnerability was reported by Jaeyoon Kim (@jaeyoon-kim-dev) of System Security Lab, SKKU. - GHSA-xw9h-9rcm-hx4m: The OpenID Connect authentication backend did not consult the `email_verified` claim, so a misconfigured identity provider sending an untrusted `email` claim with `email_verified=false` could log a user into an account belonging to someone else. This vulnerability was reported by @JebeenLee. - GHSA-m257-w4r5-5rmf: The message rendering endpoint (`POST /json/messages/render`) did not enforce the message content length limit, allowing an authenticated user to consume excessive server resources. This vulnerability was reported by @Team-Atlanta. - Fixed the Mattermost import tool silently discarding text that resembles an HTML tag (e.g., `` or ``) from imported messages. Mattermost imports are also considerably faster as a result of this change. - Fixed crashes in some database migrations that run when upgrading from Zulip 11.x. ### 12.1 — Zulip Server 12.1 - Date: 2026-06-26 - Version: 12.1 - Original notes: https://github.com/zulip/zulip/releases/tag/12.1 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/12.1 - **changed** — When the `require_e2ee_push_notifications` setting is enabled, legacy push notifications are now skipped entirely, rather than sent with redacted content - **fixed** — Fixed signing up via an external authentication method (e.g., SAML) in organizations that require an invitation to join: pending email invitations are now honored, not just multiuse invite links - **fixed** — Fixed a long-standing bug where new users present in the LDAP directory could not sign up via an external authentication method (e.g., SAML); registration silently redirected back to the login page - **fixed** — Fixed an error preventing the data exports panel in organization settings from loading for organizations that had been imported from another Zulip server - **fixed** — Fixed quoting or viewing the source of messages in public channels the user is not subscribed to - **fixed** — Fixed user typeaheads displaying "null" in place of a hidden email address - **fixed** — Fixed the member list in group settings being cut off, with no way to scroll through the full list of members - **fixed** — Fixed a server error when saving channel descriptions containing Dropbox links - **fixed** — Fixed GIF search returning an error for users with certain language settings - **changed** — Improved email gateway handling of long subjects: the full subject is now included in the message body when it is truncated to fit in a topic - **changed** — Improved Mattermost import tooling to handle attachment files missing from the export - **changed** — The topic summarization feature now uses the OpenAI Python SDK, rather than litellm; the `TOPIC_SUMMARIZATION_MODEL` setting now takes a plain model name, with OpenAI-compatible providers configured via the new `TOPIC_SUMMARIZATION_API_BASE` setting - **added** — Added an `OIDC_REQUIRE_LIMIT_TO_SUBDOMAINS` setting, like the existing `SAML_REQUIRE_LIMIT_TO_SUBDOMAINS` setting, to require each configured OIDC identity provider to declare which subdomains it can be used for - **added** — Added checks that the file upload storage backend is correctly configured - **changed** — Improved configuration checks and error messages for Helm and Docker deployments - **fixed** — Fixed `restore-backup` to preserve symlinked uploads and configuration directories - **fixed** — Fixed `restore-backup` failing on some systems where the PostgreSQL user did not have permission to read the restore scripts - **fixed** — Raised the locked-memory limit for PostgreSQL, fixing PostgreSQL 18 startup failures with io_uring on Linux kernels >= 6.14 - **fixed** — Fixed RabbitMQ setup in various scripts failing when a non-default `RABBITMQ_VHOST` was set - **added** — Added a timeout and debug logging for downloads of Puppet dependencies during installation and upgrade _Released 2026-06-26_ - When the `require_e2ee_push_notifications` setting is enabled, legacy push notifications are now skipped entirely, rather than sent with redacted content. - Fixed signing up via an external authentication method (e.g., SAML) in organizations that require an invitation to join: pending email invitations are now honored, not just multiuse invite links. - Fixed a long-standing bug where new users present in the LDAP directory could not sign up via an external authentication method (e.g., SAML); registration silently redirected back to the login page. - Fixed an error preventing the data exports panel in organization settings from loading, for organizations that had been imported from another Zulip server. This release includes a migration to fix problematic export records created by earlier versions. - Fixed quoting or viewing the source of messages in public channels the user is not subscribed to. - Fixed user typeaheads displaying “null” in place of a hidden email address. - Fixed the member list in group settings being cut off, with no way to scroll through the full list of members. - Fixed a server error when saving channel descriptions containing Dropbox links. - Fixed GIF search returning an error for users with certain language settings. - Improved email gateway handling of long subjects: the full subject is now included in the message body when it is truncated to fit in a topic. - Improved Mattermost import tooling to handle attachment files missing from the export. - The topic summarization feature now uses the OpenAI Python SDK, rather than litellm. Installations using `TOPIC_SUMMARIZATION_MODEL` must update their configuration: the setting now takes a plain model name, with OpenAI-compatible providers configured via the new `TOPIC_SUMMARIZATION_API_BASE` setting. - Added an `OIDC_REQUIRE_LIMIT_TO_SUBDOMAINS` setting, like the existing `SAML_REQUIRE_LIMIT_TO_SUBDOMAINS` setting. If enabled, each configured OIDC identity provider is required to declare which subdomains it can be used for. - Added checks that the file upload storage backend is correctly configured. - Improved configuration checks and error messages for Helm and Docker deployments. - Fixed `restore-backup` to preserve symlinked uploads and configuration directories. - Fixed `restore-backup` failing on some systems, where the PostgreSQL user did not have permission to read the restore scripts. - Raised the locked-memory limit for PostgreSQL, fixing PostgreSQL 18 startup failures with io_uring on Linux kernels >= 6.14 (e.g., Ubuntu 26.04). - Fixed RabbitMQ setup in various scripts failing when a non-default `RABBITMQ_VHOST` was set. - Added a timeout and debug logging for downloads of Puppet dependencies during installation and upgrade. - Improved documentation for Docker-based deployments. - Updated Python dependencies. ### 12.0 — Zulip Server 12.0 - Date: 2026-04-27 - Version: 12.0 - Original notes: https://github.com/zulip/zulip/releases/tag/12.0 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/12.0 - **added** — End-to-end encrypted mobile push notifications are now generally available and enabled if both server and client are modern - **changed** — Uploaded images and audio files now use the ![alt text](url) markdown syntax, which does not require a separate link element - **added** — Added a new organization setting for media preview size, controlling image and video thumbnail sizes in message content - **added** — Added support for using Jdenticons for default profile pictures, which are the default for new organizations - **changed** — Redesigned the Recent Conversations view with a new table layout, one-line conversation display, folder filter dropdown, improved column sizing and alignment, and better touchscreen support - **changed** — Redesigned channel-specific settings with a much cleaner view, a dedicated Permissions tab, and support for filtering by folder - **changed** — Emoji-only messages now render the emoji extra large - **added** — Linkifiers now support reverse linkification: pasting a URL matching a linkifier pattern auto-converts to its short text form - **added** — Added a jump-to-date picker in the message feed, accessible by clicking a date separator or the date in the conversation header bar - **added** — Added support for administrators to bulk-edit most settings for existing users via the Default user settings panel - **added** — Added Nextcloud Talk, Constructor Groups, and Webex as video call provider options - **added** — Added a Report message feature, with a configurable private channel for moderators to handle reports - **added** — Added demo organizations, which allow testing Zulip without sharing an email address - **changed** — Improved search typeahead with topic suggestions from all subscribed channels and nicer styling for channel/topic pair suggestions - **added** — Added many new default external account types for custom profile fields, made the URL pattern optional, and made external accounts available for matching users in typeahead - **added** — Added a beta data import tool for Microsoft Teams - **changed** — Migrated the help center to Starlight, the Astro-based static site generator, adding full-text search and a modernized design - **changed** — Reworked the Zulip Docker container and published the new version as https://ghcr.io/zulip/zulip-server with improved documentation and tests for Docker Compose and Helm deployments - **added** — Added a frequently used section to the web app emoji picker _Released 2026-04-27_ ###### Highlights - End-to-end encrypted mobile push notifications are now generally available and enabled if both server and client are modern. - Uploaded images and audio files now use the `![alt text](url)` markdown syntax, which does not require a separate link element. - Added a new organization setting for media preview size, controlling image and video thumbnail sizes in message content. - Added support for using Jdenticons for default profile pictures. Jdenticons render better in both Zulip themes and have less privacy risk than Gravatar, and are the default for new organizations. - Redesigned the Recent Conversations view with a new table layout, one-line conversation display, folder filter dropdown, improved column sizing and alignment, and better touchscreen support. - Redesigned channel-specific settings, with a much cleaner view and a dedicated "Permissions" tab. The channel settings panel now supports filtering by folder. - Emoji-only messages now render the emoji extra large. - Linkifiers now support reverse linkification: pasting a URL matching a linkifier pattern auto-converts to its short text form. - Added a jump-to-date picker in the message feed, accessible by clicking a date separator or the date in the conversation header bar. - Added support for administrators to bulk-edit most settings for existing users via the "Default user settings" panel. Administrators can choose to only edit settings for users who haven't already changed that setting. (Security and privacy settings cannot be edited by administrators). - Added Nextcloud Talk, Constructor Groups, and Webex as video call provider options. - Added a "Report message" feature, with a configurable private channel for moderators to handle reports. - Added demo organizations, which allow testing Zulip without sharing an email address. - Improved search typeahead with topic suggestions from all subscribed channels and nicer styling for channel/topic pair suggestions. - Added many new default external account types for custom profile fields, made the URL pattern optional, and made external accounts available for matching users in typeahead. - Added a beta data import tool for Microsoft Teams. - Migrated the help center to Starlight, the Astro-based static site generator, adding full-text search and a modernized design. - The Zulip Docker container has been reworked, and the new version published as https://ghcr.io/zulip/zulip-server. This resolves nearly all outstanding issues in the issue tracker, and adds tests and substantially more documentation, for both Docker Compose and Helm deployments. See the [upgrade notes](#upgrade-notes-for-120) for details. ###### Full feature changelog - Added a "frequently used" section to the web app emoji picker. - Added a channel-specific setting for who can create topics. - Added an organization setting to disable automated messages about channel events (e.g., channel description changes). - Added a Roles tab in group settings, detailing the permissions assigned to users with specific roles. - Added a `mentions:` search operator for finding messages that mention a specific user, distinct from `has:mention` which filters to messages mentioning yourself. - Added an icon button in recipient headers to copy the topic link. - Added an "unsupported browser" warning for ancient browser versions. - Added an `is:followed` filter for topics in the left sidebar. - Added image cropping support for realm logo, realm icon, and user avatar uploads. - When deactivating a user, administrators now have convenient options to delete their messages or scrub their profile information. - Added distinct "Deleted user" display for accounts that have been permanently deleted (unlike deactivated users, which preserves metadata and is reversible). - Added Discord as an authentication option. - Added SCIM support for syncing custom profile fields. - Th _[Truncated at 4000 characters — full notes: https://github.com/zulip/zulip/releases/tag/12.0]_ ### 12.0-beta2 — Zulip Server 12.0-beta2 - Date: 2026-04-26 - Version: 12.0-beta2 - Original notes: https://github.com/zulip/zulip/releases/tag/12.0-beta2 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/12.0-beta2 - Labels: Pre-release [Complete release notes](https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-12-0-beta2) ### 11.6 — Zulip Server 11.6 - Date: 2026-03-31 - Version: 11.6 - Original notes: https://github.com/zulip/zulip/releases/tag/11.6 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/11.6 - **security** — Fixed a vulnerability where a carefully crafted export tarball could cause the importing server to copy any file the zulip user could read into the uploads directory during import - **security** — Fixed a vulnerability where attachments originating from web-public channels would still be available without logging in even after web-public access was disabled - **security** — Fixed a vulnerability where the topic list API was accessible without logging in for web-public channels - **added** — Added imports for all LDAP object types to the new server settings.py template - **added** — Ensured that logrotate is installed in Docker - **changed** — Improved error messages when required settings were missing - **fixed** — Fixed upgrade-postgresql when extensions needed extra steps - **fixed** — Fixed configuration section names on error pages when proxies were misconfigured - **fixed** — Fixed generate incoming email address to respect the user's choice of sender - **added** — Added documentation for INSTALLATION_NAME setting when configuring outgoing email - **fixed** — Fixed a potential race condition when adding emoji - **fixed** — Fixed an error when the client attempted to upload a file with a NULL byte in its filename - **fixed** — Fixed restore-backup when restoring with a remote PostgreSQL instance with an explicit port - **fixed** — Fixed the Zulip version in Camo's user-agent lagging to the previous deploy's - **changed** — Adjusted the default PASSWORD_MIN_LENGTH setting to 8, up from 6 _Released 2026-03-31_ - CVE-2026-26058: A carefully crafted export tarball could cause the importing server to copy any file the `zulip` user could read into the uploads directory during import. This vulnerability was reported by Garett Kopcha (@0x5t). - CVE-2026-25742: Even after web-public access was disabled, attachments originating from web-public channels would still be available without logging in. A similar vulnerability existed for the topic list API. This vulnerability was reported by Sho Odagiri of GMO Cybersecurity by Ierae, Inc. - Added imports for all LDAP object types to the new server `settings.py` template. - Ensured that logrotate is installed, which it was not previously in Docker. - Improved error messages when required settings were missing. - Fixed `upgrade-postgresql` when extensions needed extra steps. - Fixed configuration section names on error pages when proxies were misconfigured. - Fixed “generate incoming email address” to respect the user’s choice of sender. - Added documentation for `INSTALLATION_NAME` setting when configuring outgoing email. - Fixed a potential race condition when adding emoji. - Fixed an error when the client attempted to upload a file with a NULL byte in its filename. - Fixed restore-backup when restoring with a remote PostgreSQL instance with an explicit port. - Fixed the Zulip version in Camo’s user-agent lagging to the previous deploy’s. - Adjusted the default `PASSWORD_MIN_LENGTH` setting to 8, up from 6. - Updated Python dependencies. - Updated puppet dependencies. - Updated translations from Weblate. ### 12.0-beta1 — Zulip Server 12.0-beta1 - Date: 2026-03-12 - Version: 12.0-beta1 - Original notes: https://github.com/zulip/zulip/releases/tag/12.0-beta1 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/12.0-beta1 - Labels: Pre-release [Complete release notes](https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-12-0-beta1) ### 11.5 — Zulip Server 11.5 - Date: 2026-02-05 - Version: 11.5 - Original notes: https://github.com/zulip/zulip/releases/tag/11.5 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/11.5 - **security** — Fixed stored XSS vulnerabilities in administrative actions on user profiles susceptible through group names or channel names - **added** — Offer a button when pasting to upload large pastes as a text file attachment - **changed** — Changed the camo User-Agent to report itself as Zulip Server along with its version - **fixed** — Fixed channel links for reminders in private channels - **fixed** — Worked around a bug in Safari 17 with certain Unicode characters in user names - **changed** — Improved the jump to first unread banner logic - **fixed** — Fixed the behavior of the down arrow keyboard shortcut when the last message was long - **fixed** — Fixed topic typeahead to never open downwards - **removed** — Removed some unnecessary permissions previously requested by the Slack integration - **changed** — Improved RocketChat import tooling - **changed** — Improved Mattermost import tooling - **fixed** — Fixed broken emoji in channel descriptions of imported organizations - **fixed** — Fixed imports from Zulip exports which lacked some avatar thumbnails - **changed** — Improved the initial installation experience when configuring proxies - **added** — Added a postfix.uninstall setting in zulip.conf to leave postfix installed for sites using Postfix as an outgoing mailserver - **added** — Added a application_server.custom_ca_path setting in zulip.conf to specify a custom CA to trust for OIDC servers with custom certificates - **changed** — Replaced ./manage.py checkconfig with ./manage.py check and added more config validations to the checks - **added** — Added additional validation of hostnames - **changed** — Started respecting memory limits set from cgroups for Docker usage - **changed** — Adjusted setup-certbot to run all hooks upon first install for Docker and sites moving from self-signed certs to Certbot _Released 2026-02-05_ - CVE-2026-24050: Some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. - Start offering a button, when pasting, to upload large pastes as a text file attachment. - Changed the camo `User-Agent` to report itself as Zulip Server, along with its version. - Fixed channel links for reminders in private channels. - Worked around a bug in Safari 17 with certain Unicode characters in user names. - Improved the “jump to first unread?” banner logic. - Fixed the behavior of the down arrow keyboard shortcut when the last message was long. - Fixed topic typeahead to never open downwards. - Removed some unnecessary permissions previously requested by the Slack integration. - Improved RocketChat import tooling. - Improved Mattermost import tooling. - Updated Slack export instructions. - Fixed broken emoji in channel descriptions of imported organizations. - Fixed imports from Zulip exports, which lacked some avatar thumbnails. - Improved the initial installation experience when configuring proxies. - Added a `postfix.uninstall` setting in `zulip.conf` to leave `postfix` installed, for sites which use Postfix as an outgoing mailserver. - Added a `application_server.custom_ca_path` setting in `zulip.conf` to specifying a custom CA to trust (e.g., for OIDC servers with custom certificates). - Replaced `./manage.py checkconfig` with `./manage.py check`, and added more config validations to the checks. - Added additional validation of hostnames. - Started respecting memory limits set from cgroups, for Docker usage. - Adjusted `setup-certbot` to run all hooks upon first install, both for Docker, and for sites moving from self-signed certs to Certbot. - Degrade gracefully when `hunspell` stemming dictionaries are not installed (i.e. with a remote stock PostgreSQL) rather than requiring an install or configuration option. - Allowed files in `/etc/zulip` to be symlinks to other locations. - Start auto-generating Sphinx labels for documentation, not just header anchors. - Simplified how `CREATE SCHEMA` and `search_path` is configured in PostgreSQL. - Fixed a long-standing bug where metadata in S3 for attachments from the email gateway was incorrect. - Move character-set detection for text content to before S3 upload, so it is stored there. - Fixed a bug which mistakenly downloaded whole text file contents when attempting to guess their content-type. - Added per-message incoming email server logging, and adjusted log levels of other email server processes. - Added an `application_server.nginx_worker_processes` setting in `zulip.conf` to adjust the number of nginx `worker_processes`. - Improved Tornado resharding tooling. - Renamed GIF picker integrations to be generic. - Updated translations from Weblate. ### 11.4 — Zulip Server 11.4 - Date: 2025-10-23 - Version: 11.4 - Original notes: https://github.com/zulip/zulip/releases/tag/11.4 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/11.4 - **fixed** — Fixed a bug that could cause the incoming email server to crash on startup _Released 2025-10-23_ - Fixed a bug that could cause the incoming email server to crash on startup. ### 11.3 — Zulip Server 11.3 - Date: 2025-10-22 - Version: 11.3 - Original notes: https://github.com/zulip/zulip/releases/tag/11.3 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/11.3 - **removed** — Removed the Google blobs emoji set (deprecated since 2017); any users who had this preference will have it updated to the standard Google emoji set - **changed** — Updated incoming email server to automatically drop auto-replies, including out-of-office messages, if they are marked as such in their headers - **fixed** — Fixed a permissions issue with logfiles of the incoming email server - **fixed** — Fixed an unread count bug involving unreads in muted topics - **fixed** — Fixed some compose box transitions - **fixed** — Fixed several minor bugs in the inbox view - **fixed** — Fixed Gitea integration displaying the wrong actor for pull request events - **fixed** — Fixed a minor data corruption bug involving group-based permissions - **removed** — Removed a misleading emoji alias from CLDR for 🔯 - **changed** — Clarified validation of email addresses when registering for push notifications service - **changed** — Improved handling of imported Slack threads and bot email addresses _Released 2025-10-22_ - Removed the Google blobs emoji set (deprecated since 2017); any users who had this preference will have it updated to the standard Google emoji set. - Updated incoming email server to automatically drop auto-replies, including out-of-office messages, if they are marked as such in their headers. - Fixed a permissions issue with logfiles of the incoming email server. - Fixed an unread count bug involving unreads in muted topics. - Fixed some compose box transitions. - Fixed several minor bugs in the inbox view. - Fixed Gitea integration displaying the wrong actor for pull request events. - Fixed a minor data corruption bug involving group-based permissions. - Removed a misleading emoji alias from CLDR for 🔯. - Clarified validation of email addresses when registering for push notifications service. - Improved handling of imported Slack threads and bot email addresses. - Improved documentation for reverse proxies. - Improved documentation about recovering from database-only backups. - Improved API documentation for deleting messages. - Improved documentation for GitLab integration. - Added `rel="canonical"` links in headers of documentation pages, pointing to zulip.com documentation, to help search engines not index potentially stale self-hosted duplicates of pages. - Updated and reorganized security documentation. - Updated Python dependencies. ### 11.2 — Zulip Server 11.2 - Date: 2025-09-16 - Version: 11.2 - Original notes: https://github.com/zulip/zulip/releases/tag/11.2 - Permalink: https://whatsnew.fyi/product/zulip-server/releases/11.2 - **fixed** — Fixed a crash with the nightly cron job added in 11.1 to catch race conditions in subscriber counts - **changed** — Updated dependency for the new help center to prevent potential crashes when building _Released 2025-09-16_ - Fixed a crash with the nightly cron job added in 11.1 to catch race conditions in subscriber counts. - Updated dependency for the new help center, to prevent potential crashes when building.