Prepare self-hosting docs for Appwrite 2.6.0 and 2.6.1, and for the 1.9.8 and 1.9.9 maintenance releases on the legacy line.

2.6.0 and 1.9.8

• Update installation examples, generated Compose, database/environment docs and SDK compatibility rows for 2.6.0.
• Include the 1.9.8 upgrade instructions and compatibility rows. Keep Console 8.7.37 for the legacy line, and publish installer port 20080 in its upgrade command.
• Use a single security changelog entry (2026-10-21-1) covering patched eMudhra trust in both releases and the SVG sanitizer/cache update in 1.9.8. Link to each version's upgrade instructions and full GitHub release notes.
• Keep the complete bundled changes in the GitHub release notes. The changelog notes that 2.6.0 includes schema updates and requires migration.
• Fix the release helper's quote-sensitive version parser.

2.6.1 and 1.9.9

2.6.1 (#14745) and 1.9.9 (#14747) are precautionary maintenance releases that move the runtime to PHP 8.5.12. PHP 8.5.12 fixes CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). Appwrite is not affected by either one, because it serves requests through Swoole rather than PHP's web SAPIs (mod_php, PHP-FPM, CGI).

• Install snippets (installation and databases pages), the example tag and generated Compose (composeData.ts) move to 2.6.1, via bun run release:self-hosted 2.6.1 --appwrite=<release/2.6.1 checkout>. The Compose diff is the image tag and VITE_APPWRITE_VERSION only.
• The latest upgrade section becomes "Upgrading to 2.6.1" (one step from 1.9.6 or later, per Migration::$versions). It explains the precautionary PHP update, that from 2.6.0 only the images change, and keeps the 2.6.0 notes (schema changes, ExifTool, S3 path style, eMudhra) for anyone coming from 2.5.x or earlier. 2.6.0 joins the skipped-release links.
• The 1.9 section moves to 1.9.9 by hand, as docs(console): self-hosted 2.6.0, 2.6.1, 1.9.8 and 1.9.9 releases #14731 did for 1.9.8: one step from 1.9.8 (images only), and from 1.9.6/1.9.7 it also brings the 1.9.8 security fixes. Console stays at 8.7.37.
• The 1.9.x minor-upgrade example now reads 1.9.5 → 1.9.9 → 2.6.1.
• SDK compatibility rows: 2.6.1 copies 2.6.0's rows and 1.9.9 copies 1.9.8's, in both tables.
• New changelog entry 2026-10-21-2 for 2.6.1 and 1.9.9, linking the PHP advisories, both GitHub releases and both upgrade sections. Like the security entry, it has no cover and uses the generated title share image.
• Environment variables: unchanged. Neither release adds, removes or changes a variable (the 2.6.1 diff from 2.6.0 is the base image, version constant, READMEs and migration map).

Remaining 2.6.0/1.9.8 mentions are intentional: compatibility rows, the skipped-release link, the 2.6.0 schema note, the 1.9.8 fixes note and the security changelog entry.

Merge order

2.6.0 and 1.9.8 are published; 2.6.1 and 1.9.9 are not yet tagged or published. Merge this docs PR after 2.6.1 and 1.9.9 are published and the 2.6.x versioned specs have been generated; the 2.6.x API-reference pin (release:self-hosted --specs) and the final SDK compatibility review are still pending that step.

Validation

• All 12 generated Compose combinations (three databases × two worker topologies × AutoGravity on/off) pass docker compose config --quiet with the 2.6.1 data.
• Prettier passes on composeData.ts and the new changelog entry; lint:content passes.
• Dev server: /changelog/entry/2026-10-21-2, /changelog, /docs/advanced/self-hosting/installation and /docs/advanced/self-hosting/production/updates return HTTP 200 and render the 2.6.1 and 1.9.9 content.

Related server releases: #14730, #14726, #14745, #14747. Release-gate fixes for 2.6.0: #14737.

Screenshots

2.6.1 and 1.9.9 changelog entry:

Upgrading to 2.6.1:

Upgrading within the 1.9 line (1.9.9):

Earlier captures, before the 2.6.1/1.9.9 update (the combined security entry is unchanged; the two upgrade sections are now superseded by the ones above):

Related: appwrite-labs/cloud#6671