Release 2026-03-24 - (expected chart version 5.29.0)

[zebot]

[2026-03-24] (Chart Release 5.29.0)

Release notes

• Helm chart refactoring: several core services were migrated from wire-server subcharts into the umbrella chart templates (charts/wire-server/templates).

  Moved as core services:

  • background-worker
  • brig
  • cannon
  • cargohold
  • galley
  • gundeck
  • proxy
  • spar

  As a result, dependency tags for moved services are obsolete for the current wire-server chart, because these services are no longer resolved through requirements.yaml dependencies. In particular, tags.brig, tags.galley, tags.cannon, tags.cargohold, tags.gundeck, tags.proxy, and tags.spar are no longer needed for wire-server deployments.

  Operator note: during upgrade, rendered manifests will show metadata/source changes (for example chart labels and template source paths). This is expected from the inlining refactor and may trigger a one-time rollout due to checksum annotation changes.

  Compatibility note: for standard wire-server deployments this is not expected to be breaking, because the moved core services were not toggled off via tags in default/in-repo environments. However, this is a breaking change for custom deployments that previously disabled any of these services via wire-server dependency tags (tags.<service>: false), because those tags are now obsolete after inlining. (WPB-23830 Merge service helm charts with wire-server chart #5085)

• Rate-limit status codes in nginz and cannon's embedded nginz are now configurable via Helm values.

  Compatibility note: the default remains 420, so this does not change behavior for existing deployments and requires no direct operator action. (WPB-23913 rate limit http status code config for nginz and cannon #5124)

• Remove the old metallb wrapper chart. This hasn't been published or updated
  for quite some time. Even the Docker images weren't available anymore. (Delete metallb chart (and related docs) #5111)

API changes

• Require admin password for refreshing app cookies (POST /teams/:tid/apps/:uid/cookies). ([WPB-21432] app refresh cookie requires password #5129)

• Add "app" attribute to GET /list-users, GET /users/:dom/:uid; make GET /teams/:tid/apps, GET /teams/:tid/apps/:uid return same schema as GET /list-users. ([WPB-23644] add app data to get /list-users #5070)

• GET /teams/:tid/search response contains user types now (app or regular). ([WPB-23644] refactor user type in wire-subsystems #5074)

• • remove pict attribute from GetApp
  • remove metadata attribute from GetApp
  • inline GetApp fields into NewApp
  • make CreatedApp.user contain UserProfile (which includes app info)
  • rename GetApp to AppInfo
  • remove AppInfo.{name,assets,accentId} (redundant user data) ([WPB-23644] mopup #5115)

• Create new API version V16 and finalize API version V15. ([WPB-23841] Create new API version V16 and finalize API version V15. #5121)

Features

• Add meetings listings endpoint /meetings/list. (WPB-21964: Add Wire Meetings list #5109)

• Add Wire Meetings add invitation endpoint POST /meetings/:domain/:id/invitations (WPB-24074: Add Wire Meetings add invitation endpoint #5132)

• Add Wire Meetings delete invitation endpoint POST /meetings/:domain/:id/invitations/delete (WPB-24075: Add Wire Meetings delete invitation endpoint #5136)

Bug fixes and other updates

• Claiming key packages for a deleted user now returns a client error instead of a server error (WPB-23257 fix: claiming key package for a deleted user causes a 500 #5113)

• backoffice/stern: fix Swagger UI for comma-separated list query parameters (WPB-23262 backoffice/stern: fix Swagger UI for comma-separated list query parameters #5108)

• Streamlined and fixed team feature config validateSAMLemails (WPB-23441 fix: validate saml emails feature not correctly targeted #5114)

• When the admin creates a new app cookie, all previous ones must be revoked. ([WPB-24033] invalidate old app cookies #5149)

• charts/elasticsearch-index: Allow configuring postgresql (charts/elasticsearch-index: Allow configuring postgresql #5092)

• charts/wire-server: Fix nil pointer errors in merged subchart templates when optional values (brig.turn, rabbitmq TLS, cassandraBrig/cassandraGalley) are not provided (fix: adding Helm nil guards for optional values #5112)

• Improve error message when failing to parse group ID (Group ID parse error #5089)

Documentation

• Updated docs for the team feature validateSAMLemails (WPB-24006 rename validate sam lemails to require external email verification and deprecate legacy feature flag endpoint #5118)

Internal changes

• The status code for rate limit responses from nginz and cannon is now configurable and set to 420 per default (WPB-23913 rate limit http status code config for nginz and cannon #5124)

• Add curl to integration test failure reports. ([WPB-22549] Add curl to integration test failure reports. #5048)

• Add UserType fields in various data types. ([WPB-23644] refactor user type in wire-subsystems #5074)

• Progressively move away from singletons to type class to allow progressive migration to wire-subsystems of Galley's actions.
  Drop Galley.Intra.Util,Galley.Effects, Galley.API.MLS.Commit, and Galley.API.Push.
  Break dependencies to Opts/Env.
  Split ConversationSubsystem.Interpreter Galley.API.Federation (WPB-23789: Wrap Galley updateLocalConversation #5075, WPB-23789: Split performAction in Galley #5081, WPB-23789: Introduce type class for Galley/Action #5086, WPB-23789: Migrate ensureAllowed to type class for Galley/Action #5087, WPB-23789: Migrate skipConversationRoleCheck & channelAdminOverride to type class for Galley/Action #5098, WPB-23789: Drop Galley.Intra.Util #5101, WPB-23789: Drop Galley.Effects #5102, WPB-23789: Drop Galley.API.MLS.Commit #5103, WPB-23789: Drop Galley.API.Push #5104, WPB-23789: Break dependencies to Opts/Env #5110, WPB-23789: Split ConversationSubsystem.Interpreter #5145, WPB-23789: Split Galley.API.Federation #5148)

• Logging Wire-Client, Wire-Client-Version and Wire-Config-Hash headers in nginz (WPB-23816 log wire client and wire client verison headers in nginz #5123)

• Refactor scripts to alleviate SonarQube warnings (WPB-23896: Handle SonarQube last blocker and high/medium warnings #5097)

• Consumable notifications are now disabled (WPB-23942 prevent rabbit mq queues creation for client notifications #5116)

• The fields code, label, and message where added to the inconsistent group state error response of POST /mls/commit-bundels (#PR_NOT_FOUND)

• Refactor Category: from ADT to Text. ([WPB-23990] refactor category #5120)

• Moved TeamVisibilityStore operations into TeamStore (WPB-24149 move team search visibility to wire subsystems #5137)

• Moved TeamNotificationStore to wire-subsystems (WPB-24151 move team notifications store to wire subsystems #5138)

• Moved CustomBackendStore to wire-subsystems (WPB-24152 move custom backends code to wire subsystems #5135)

• Moved TeamMemberStore, interpreter, and ListItems interpreters for Team to wire-subsystems (WPB-24178 move team member store to wire subsystems #5140)

• sbomqs has been unused for years now. Thus, dropping it from our Nix env. (remove unused sbomqs #5144)

• Adjust the default Nix flake devShell such that nix develop is usable. (Fix nix develop #5127)

• Create and upload SBOMs for Helmfile, docker-compose and Helm charts. (SBOMs for Helmfile, docker-compose and Helm charts #5122)