wireapp · zebot · Jul 7, 2026 · Jul 7, 2026 · Jul 8, 2026 · Jul 8, 2026
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Nix
-        uses: cachix/install-nix-action@v16
+        uses: cachix/install-nix-action@d56f3ce9be45c562799280e8a561fbbe8f36de44 # v16
 
       - name: Clone wire-docs and build
         run: |

@@ -1,5 +1,8 @@
 version: 0.4.0.0
-run-mode: replace
+# 'add' only touches files that have no header at all.  Existing headers
+# (and, importantly, the years in them) are left alone; see
+# https://github.com/wireapp/wire-server/pull/4851.
+run-mode: add
 source-paths:
   - libs
   - services
@@ -13,7 +16,9 @@ variables:
   organization: Wire Swiss GmbH
   email: opensource@wire.com
   project: This file is part of the Wire Server implementation.
-  year: "2025"
+  # only ever used for files that get a header added now, so this needs no
+  # maintenance and causes no churn in files that already have one.
+  year: "{{ _current_year }}"
 license-headers:
   haskell:
     file-extensions: ["hs", "hsc"]

@@ -19,7 +19,7 @@ calling-test demo-smtp elasticsearch-curator elasticsearch-external				\
 elasticsearch-ephemeral minio-external cassandra-external						\
 ingress-nginx-controller nginx-ingress-services reaper \
 k8ssandra-test-cluster ldap-scim-bridge wire-server-enterprise \
-wire-ingress 
+wire-ingress
 KIND_CLUSTER_NAME     := wire-server
 HELM_PARALLELISM      ?= 1 # 1 for sequential tests; 6 for all-parallel tests
 PSQL_DB               ?= backendA
@@ -276,15 +276,6 @@ formatf-all:
 formatc:
 	./tools/ormolu.sh -c
 
-# For any Haskell or Rust file, update or add a license header if necessary.
-# Headers should be added according to Ormolu's formatting rules, but please check just in case.
-.PHONY: add-license
-add-license:
-	command -v headroom
-	headroom run -a
-	@echo ""
-	@echo "you might want to run 'make formatf' now to make sure ormolu is happy"
-
 # without redirecting stdin/-out/-err, emacs does something weird that takes 3-5 seconds.
 .PHONY: treefmt
 treefmt:
@@ -356,9 +347,7 @@ cqlsh:
 
 .PHONY: psql
 psql:
-	@grep -q wire-server:wire-server ~/.pgpass || \
-	  echo "consider running 'echo localhost:5432:$(PSQL_DB):wire-server:posty-the-gres > ~/.pgpass ; chmod 600 ~/.pgpass '"
-	psql -h localhost -p 5432 $(PSQL_DB) -U wire-server -w || \
+	PGPASSWORD=posty-the-gres psql -h localhost -p 5432 $(PSQL_DB) -U wire-server -w || \
 	  echo 'if the database is missing, consider running "make postgres-reset", or setting $$PSQL_DB to the correct table space.'
 
 .PHONY: db-reset-package

@@ -1,6 +1,7 @@
 repository hackage.haskell.org
   url: https://hackage.haskell.org/
 index-state: 2023-10-03T15:17:00Z
+
 packages:
     integration
   , libs/bilge/

@@ -1005,6 +1005,30 @@ CREATE TABLE brig_test.team_invitation_info (
     AND read_repair = 'BLOCKING'
     AND speculative_retry = '99p';
 
+CREATE TABLE brig_test.team_scim_pending_user_email (
+    team uuid,
+    email text,
+    user uuid,
+    PRIMARY KEY ((team, email), user)
+) WITH CLUSTERING ORDER BY (user ASC)
+    AND additional_write_policy = '99p'
+    AND bloom_filter_fp_chance = 0.01
+    AND caching = {'keys': 'ALL', 'rows_per_partition': 'NONE'}
+    AND cdc = false
+    AND comment = ''
+    AND compaction = {'class': 'org.apache.cassandra.db.compaction.SizeTieredCompactionStrategy', 'max_threshold': '32', 'min_threshold': '4'}
+    AND compression = {'chunk_length_in_kb': '16', 'class': 'org.apache.cassandra.io.compress.LZ4Compressor'}
+    AND memtable = 'default'
+    AND crc_check_chance = 1.0
+    AND default_time_to_live = 0
+    AND extensions = {}
+    AND gc_grace_seconds = 864000
+    AND max_index_interval = 2048
+    AND memtable_flush_period_in_ms = 0
+    AND min_index_interval = 128
+    AND read_repair = 'BLOCKING'
+    AND speculative_retry = '99p';
+
 CREATE TABLE brig_test.unique_claims (
     value text PRIMARY KEY,
     claims set<uuid>
@@ -2450,6 +2474,8 @@ CREATE TABLE spar_test.scim_external (
 CREATE TABLE spar_test.scim_user_times (
     uid uuid PRIMARY KEY,
     created_at timestamp,
+    email_primary boolean,
+    email_type text,
     last_updated_at timestamp
 ) WITH additional_write_policy = '99p'
     AND bloom_filter_fp_chance = 0.1

@@ -0,0 +1 @@
+V18 `PUT /conversations/{domain}/{conversation}/members` rejects replacements that would leave a regular group without an admin; V17 and older retain the legacy autopromotion behavior. (#5387)
@@ -15,6 +15,10 @@ get_pr_number() {
 
 for d in "$DIR"/*; do
     if [[ ! -d "$d" ]]; then continue; fi
+    # 99-pending: entries deferred out of the upcoming release. Since renaming a
+    # file breaks get_pr_number (git log does not follow renames), each parked
+    # entry must bake its PR number into its text, e.g. " (#1234)".
+    if [[ "$(basename "$d")" == "99-pending" ]]; then continue; fi
 
     entries=("$d"/*[^~])
 

@@ -5,5 +5,9 @@ shopt -s nullglob
 
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-rm -f "$DIR"/*/*
+for d in "$DIR"/*; do
+    [[ -d "$d" ]] || continue
+    if [[ "$(basename "$d")" == "99-pending" ]]; then continue; fi
+    rm -f "$d"/*
+done
 git add "$DIR"
@@ -26,6 +26,7 @@ spec:
         # An annotation of the configmap checksum ensures changes to the configmap cause a redeployment upon `helm upgrade`
         checksum/configmap: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
     spec:
+      automountServiceAccountToken: false
       volumes:
         - name: "backoffice-config"
           configMap:

@@ -14,6 +14,7 @@ spec:
       labels:
         {{- include "calling-test.selectorLabels" . | nindent 8 }}
     spec:
+      automountServiceAccountToken: false
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Chart.AppVersion }}"

@@ -166,7 +166,8 @@ spec:
 
       containers:
         - name: job-done
-          image: alpine:3.21.3
+          image: "{{ .Values.jobDoneImage.repository }}:{{ .Values.jobDoneImage.tag }}"
+          imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
         {{- if eq (include "includeSecurityContext" .) "true" }}
           securityContext:
             {{- toYaml .Values.podSecurityContext | nindent 12 }}

@@ -79,6 +79,15 @@ enableBrigMigrations: true
 enableGundeckMigrations: true
 enableSparMigrations: true
 
+# Image for the `job-done` container, which only runs a single `echo` to mark
+# the migration Job complete. Not a wire image, so it is versioned
+# independently of images.tag above. Override repository to pull from a
+# mirror registry, e.g. my-mirror.example/library/alpine
+# renovate: datasource=docker depName=alpine
+jobDoneImage:
+  repository: alpine
+  tag: "3.24.1"
+
 podSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:

@@ -19,6 +19,7 @@ spec:
         app: {{ template "demo-smtp.name" . }}
         release: {{ .Release.Name }}
     spec:
+      automountServiceAccountToken: false
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: "kubernetes.io/hostname"

@@ -18,6 +18,7 @@ spec:
       labels:
         component: {{ template "fullname" . }}
     spec:
+      automountServiceAccountToken: false
       containers:
       - name: es
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

@@ -61,8 +61,6 @@ spec:
             - {{ .Values.postgresqlPool.size | quote }}
             - --pg-pool-acquisition-timeout
             - {{ .Values.postgresqlPool.acquisitionTimeout | quote }}
-            - --pg-pool-aging-timeout
-            - {{ .Values.postgresqlPool.agingTimeout | quote }}
             - --pg-pool-idleness-timeout
             - {{ .Values.postgresqlPool.idlenessTimeout | quote }}
             {{- if hasKey $.Values.secrets  "pgPassword" }}

@@ -46,7 +46,6 @@ postgresql:
 postgresqlPool:
   size: 100
   acquisitionTimeout: 10s
-  agingTimeout: 1d
   idlenessTimeout: 10m
 
 postgresMigration:

@@ -17,6 +17,7 @@ spec:
       labels:
         app: {{ template "fullname" . }}
     spec:
+      automountServiceAccountToken: false
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: "kubernetes.io/hostname"

@@ -17,6 +17,7 @@ spec:
       labels:
         app: {{ template "fullname" . }}
     spec:
+      automountServiceAccountToken: false
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: "kubernetes.io/hostname"

@@ -19,6 +19,7 @@ spec:
       annotations:
         checksum/configmap: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
     spec:
+      automountServiceAccountToken: false
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: "kubernetes.io/hostname"

@@ -102,6 +102,13 @@ data:
       adminPort: 15672
       vHost: /
 
+    rabbitmq-v2:
+      host: rabbitmq.wire-federation-v2.svc.cluster.local
+      port: 5671
+      adminHost: rabbitmq.wire-federation-v2.svc.cluster.local
+      adminPort: 15672
+      vHost: /
+
     backendTwo:
 
       brig:

@@ -2,16 +2,21 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ include "nginx-ingress-services.getIngressName" . | quote }}
-  {{- if .Values.config.renderCSPInIngress }}
+  {{- if or .Values.ingress.annotations .Values.config.renderCSPInIngress }}
   annotations:
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if .Values.config.renderCSPInIngress }}
     {{- if not (hasPrefix "nginx" .Values.config.ingressClass) }}
         {{ fail "In ingress CSP header setting only works with a 'nginx' controller. (Rename it to 'nginx-*' if it is one.)" }}
     {{- end }}
     {{/* In the non-multi-ingress (default) case, frontend apps (webapp,
     account-pages, team-settings) set CSP headers on their own. Implementing
     this for multi-ingress would have been much work (due to some framework
-    specifics). Thus, we are setting an approximation of the webapp's CSP
-    headers here. The SAML flow would be broken by setting these headers, so we
+    specifics). Thus, we are setting an approximation of CSP headers here; for
+    all services/apps besides the webapp that provides multi-ingress support
+    for CSP. The SAML flow would be broken by setting these headers, so we
     leave them out for it. This is fine, because in the default case they
     aren't set for any backend API endpoint as well.
 
@@ -33,9 +38,18 @@ metadata:
     `/sso/finalize-login` is at the time of writing also used in Kalium,
     however not versioned. Though, because it is technically possible to use
     the endpoint versioned as well, it cannot hurt to be prepared for this.
+
+    N.B. the nginx config language does not support complex if-expressions -
+    like nested if-s. So, we need to fallback to a more clumsy approach.
     */}}
     nginx.ingress.kubernetes.io/configuration-snippet: |
-      if ($uri !~ "^(/v[0-9]+)?/sso/(finalize-login|initiate-login)(/[a-zA-Z0-9-]*)?$|^/favicon\.ico$") {
+      if ($http_host = "{{ .Values.config.dns.webapp }}") {
+        set $skip_csp 1;
+      }
+      if ($uri ~ "^(/v[0-9]+)?/sso/(finalize-login|initiate-login)(/[a-zA-Z0-9-]*)?$|^/favicon\.ico$") {
+        set $skip_csp 1;
+      }
+      if ($skip_csp != 1) {
         set $CSP "connect-src 'self' blob: data: https://*.giphy.com https://{{ .Values.config.dns.https }}";
         {{if .Values.websockets.enabled}}
         set $CSP "${CSP} wss://{{ .Values.config.dns.ssl }}";
@@ -58,6 +72,7 @@ metadata:
         set $CSP "${CSP} upgrade-insecure-requests";
         more_set_headers "content-security-policy: $CSP";
       }
+    {{- end }}
   {{- end }}
 spec:
   ingressClassName: "{{ .Values.config.ingressClass }}"

@@ -9,6 +9,9 @@ kind: Ingress
 metadata:
   name: federator-ingress
   annotations:
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
     nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"

@@ -6,6 +6,9 @@ kind: Ingress
 metadata:
   name: {{ include "nginx-ingress-services.getMinioIngressName" . | quote }}
   annotations:
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     nginx.ingress.kubernetes.io/server-snippet: |
       location /minio/ {
         return 403;

@@ -126,6 +126,9 @@ service:
   accountPages:
     externalPort: 8080
 
+ingress:
+  # Annotations added to the Ingress resources created by this chart.
+  annotations: {}
 config:
   ingressClass: "nginx"
 # You will need to supply some DNS names, namely

@@ -42,6 +42,9 @@ data:
       )
       "title" .Values.nginx_conf.deeplink.title
     }}
+    {{- with .Values.nginx_conf.deeplink.supportEmail }}
+    {{- $_ := set $deeplink "supportEmail" . }}
+    {{- end }}
     {{- if hasKey .Values.nginx_conf.deeplink "apiProxy" }}
     {{- $_ := set $deeplink "apiProxy" (dict
       "host" .Values.nginx_conf.deeplink.apiProxy.host
@@ -77,6 +80,9 @@ data:
       )
       "title" $config.title
     }}
+    {{- with $config.supportEmail }}
+    {{- $_ := set $deeplink "supportEmail" . }}
+    {{- end }}
     {{- if hasKey $config "apiProxy" }}
     {{- $_ := set $deeplink "apiProxy" (dict
       "host" $config.apiProxy.host
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		V18 `PUT /conversations/{domain}/{conversation}/members` rejects replacements that would leave a regular group without an admin; V17 and older retain the legacy autopromotion behavior. (#5387)