What appwrite/appwrite shipped

Account switching arrives: one browser can now hold several signed-in accounts and switch between them. Push is announced with a new MQTT provider and docs. Encrypted buckets now encrypt every file of any size before it is stored. Catchall joins the Sites template gallery.

This week: account switching lets one browser hold several signed-in accounts and switch the active one, keeping each account's own sessions separate. Appwrite Push, the MQTT push provider, is announced with setup docs. Encrypted buckets now encrypt every file of any size before it reaches the storage device, in authenticated segments. Catchall, a shared test inbox built on Function email triggers, joins the Sites template gallery. Fixes cover hidden provider tokens in device responses, robots and humans returning 404 on API domains, and paid projects no longer locked over included usage.

This week: usage monitors and alerts, single-use TOTP codes, the last-owner rule enforced for every caller, migration writes capped to the creating key's scopes, MFA kept on when an unverified address is claimed, and the Start plan in 15 more countries.

This week brought usage monitors and alerts to projects: monitors watch usage, open alerts by email and in the console, and every alert is also a project event for webhooks, functions and realtime. Security fixes landed too: TOTP codes are single-use, the last-owner rule applies to every caller including API keys, migration writes are capped to the creating key's scopes, and claiming an unverified email or phone no longer turns MFA off. Screenshots after a project team change now load for the new team. Saved Indian cards without a mandate get a Set up auto-pay action, and the Start plan is offered in 15 more countries.

Appwrite 2.6.2 and 1.9.10 are out: security releases for self-hosted installs on the 2.6 and 1.9 lines. Hardening across auth, keys, databases, realtime, storage, functions, sites and messaging, plus a patched Brotli runtime. Upgrading is recommended.

Appwrite 2.6.2 and 1.9.10 are published as security releases for self-hosted deployments on the 2.6 and 1.9 lines. 2.6.2 brings the hardening merged since 2.6.1 across auth, API keys, databases, realtime, GraphQL, storage, VCS, functions, sites, migrations and messaging, and moves the runtime to a patched Brotli. 1.9.10 backports the same work to the 1.9 line. Appwrite Cloud is already patched, and self-hosted installs on either line should upgrade. Alongside the releases, this week fixed orphaned build output when deleting a deployment mid-build and made row and document upsert events valid for function and webhook subscriptions.

This week: audit event paging now sorts by a total order, key secrets are hidden without the keys write scope, deleting a project cleans up its S3 storage, and password policies accept custom deny lists. Client apps can list memberships, and joins without an alias read under thei

This week's changes: audit event finds now use a total order so cursor paging no longer skips or repeats rows; key secrets are hidden from callers without the keys write scope; deleting a project removes its S3 storage objects. Password policies support custom deny lists, the Account module adds listMemberships for client apps, joins without an alias read under their collection, and the usage adapter setup adds missing attributes and indexes. The Go SDK is now marked stable.

Appwrite 1.9.7 is out as a security patch: two migration paths closed, JWTs expire with their session, builds worker hardened. Also this week: interval schedules for functions, passkey sign-in in the console, and queue publishing that survives a NATS restart.

This week shipped Appwrite 1.9.7, a security patch for the 1.9 line. It closes two migration paths that could read data a user should not reach, expires JWTs together with their session, and hardens the builds worker. Upgrading from 1.9.6 needs no migration. Functions can now run on an interval of every N minutes instead of only a cron expression, and the console lets you configure None, Interval and Cron modes. Passkey sign-in is available in the console, and enabling passkeys asks for the domain, suggested from the project's web platforms. Queue publishing keeps retrying through a NATS server restart rather than dropping the publish, usage stats writes are batched, and CI now runs only the e2e lanes a change can affect.

This week: SSRF protection hardened, realtime impersonation fixed, ClickHouse logs capped, MQTT telemetry added, and 24 list endpoints gain total parameter for consistency.

Appwrite shipped significant security hardening this week: SSRF protection now built into the HTTP client to restrict OAuth, webhook, and avatar URL fetches; authorization flaws in storage resume, messaging subscribers, and MFA during impersonation closed; and realtime connections now properly track impersonator state changes. Infrastructure improvements include ClickHouse log table capping for long-running instances, MQTT broker telemetry via OpenTelemetry, and 24 list endpoints gaining the total parameter for API consistency.

This week we absorbed console, storage, CDN, and servers into packages, improved OAuth2 settings with prompt parameter support, enabled per-user push notifications without device targets, and fixed RFC 9110 range request handling.

This week brought significant progress on Appwrite's monorepo consolidation, absorbing console, storage, CDN, and servers packages directly into the codebase. We also shipped feature improvements: OAuth2 providers now support prompt parameters, push notifications work per-user without device targets, range requests comply with RFC 9110, and self-hosted VCS installations expose organization URLs. The infrastructure work reduces external dependencies while the feature work enhances developer experience across messaging and VCS integrations.

New in Appwrite: OTP-based email verification and password recovery for mobile apps, native MQTT push broker alternative to FCM, password-pwned detection, Redis igbinary caching, and pooled SMTP connections.

This week's Appwrite updates focus on authentication improvements and performance: OTP support for email verification and password recovery eliminates web redirects for mobile; a native MQTT 5.0 push broker offers self-hosted FCM alternative; password-pwned checking blocks breached passwords; Redis caching switches to igbinary codec; SMTP connections are pooled for efficiency; and the monorepo consolidation continues absorbing Utopia libraries.