Appwrite 1.9.8 is a security patch for self-hosted deployments following the eMudhra certificate compromise. It retains Console 8.7.37 for compatibility with the 1.9 server APIs. Upgrading from 1.9.7 keeps the existing migration class and introduces no schema changes.

Highlights

• Refresh outbound TLS trust so Appwrite rejects the compromised eMudhra certificate chains. TLS verification remains enabled.
• Update the SVG sanitizer to 1.1.1 to address its reported security advisories.

Fixes

• Security: use patched CA trust in the runtime and independent Composer dependency-download stage (fix(1.9.x): remove compromised eMudhra CA trust #14718).
• Avatars: update enshrined/svg-sanitize to 1.1.1 to address reported sanitizer advisories (fix(1.9.x): remove compromised eMudhra CA trust #14718).

Under the hood

• Require ca-certificates and ca-certificates-bundle at 20261020-r0 or newer and regenerate the certificate store.
• Map 1.9.8 to migration V25, the same class as 1.9.7; no migration class is added.

Removed

No environment variables, collections, or public APIs are removed.

Install

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
    appwrite/appwrite:1.9.8

Upgrade

Back up your database and persistent storage before upgrading. From the parent directory of an existing 1.9.7 installation, run:

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="upgrade" \
    appwrite/appwrite:1.9.8
cd appwrite
docker compose exec appwrite migrate

The patch reuses migration V25. No new configuration is required. Outbound HTTPS endpoints that still present a compromised certificate chain will fail verification; those endpoints must replace their certificate chain.

Full Changelog: 1.9.7...1.9.8

Release preparation and validation

• Prepared from 1.9.x; candidate commit 709b5674f2. The exact release SHA must be recorded again after the prep PR merges.
• Legacy metadata checks pass: version constant, three install snippets in each README, compatible Console pin, V25 mapping, CHANGES.md, unchanged environment-variable definitions, and maintenance latest=false publishing guard. This branch predates bin/release and its installer reads the root Compose file; app/views/install/compose.phtml does not exist.
• Production image builds locally on arm64 with VERSION=1.9.8; runtime APP_VERSION_STABLE reports 1.9.8.
• Both patched CA packages resolve to 20261020-r0. Normal HTTPS succeeds and the compromised chains are rejected in the candidate images. Initial network timeouts were distinguished from TLS rejections and the affected probes were retried.
• Composer security audit reports no vulnerability advisories; Docker build checks, PHP syntax checks, and git diff --check pass.
• No schema migration or API metadata changes. APP_CACHE_BUSTER stays unchanged as required by current docs/releases.md; TLS trust changes do not alter cached response output.

Required before publishing

• Prep PR CI is green and the reviewed prep is merged into the maintenance branch.
• Fresh install gate with realistic data, unit tests, General and service E2E.
• Upgrade gate from 1.9.7 with persisted volumes and non-default ports; migration run twice; seeded data verified through public APIs.
• Record the final tested release SHA and gate evidence in the release test record.
• Review and merge the corresponding console/docs PR after the server release; regenerate the existing versioned specs from the published tag.

No GitHub release or version tag has been created. Publishing, release-branch merge-back, specs dispatch/merges, Console publishing, and upgrading oss.appwrite.org remain separate steps under docs/releases.md.

Console compatibility review: retain 8.7.37. Newer legacy Console versions introduce MFA policy and OAuth provider controls whose server endpoints are absent on 1.9.x. The old pinned Console is retained rather than exposing unsupported controls in a security backport.

Related: appwrite-labs/cloud#6671

Console/docs preparation: #14733.