Merge pull request #4616 from wireapp/release_2025-06-16_14_24

Release 2025-06-16 - (expected chart version 5.17.0)

Author: fisx

.envrc

@@ -9,7 +9,9 @@ nix_files=$(find . -name '*.nix' | grep -v '^./dist-newstyle')
 for nix_file in $nix_files; do
   watch_file "$nix_file"
 done
-store_paths=$(echo "$nix_files" | xargs nix-store --add ./nix)
+watch_file ./services/nginz/third_party/nginx-zauth-module/*
+watch_file ./libs/libzauth/**/*
+store_paths=$(echo "$nix_files" ./services/nginz/third_party/nginx-zauth-module/ ./libs/libzauth/ | xargs nix-store --add ./nix)
 layout_dir=$(direnv_layout_dir)
 env_dir=./.env
 

CHANGELOG.md

@@ -1,3 +1,63 @@
+# [2025-06-16] (Chart Release 5.17.0)
+
+## Release notes
+
+
+* Behavior of email validation in the context of SCIM user provisioning has changed: if your users receive a validation email on address change, you need to do nothing.  If they don't, the behavior changes: before this release, the email address was only used as SCIM external_id, not to send emails to the user, because there was no validation step.  With this release, the default behavior is that SCIM has the authority to auto-validate email addresses, and no further user action is needed.
+
+  Consider changing the `validateSAMLEmails` feature flag value for some teams, or the default for your instance accordingly.
+
+  The old behavior for `validateSAMLEmails == disabled` (no validation email, but also no valid email address) is not supported any more.  We suggest you use something as `external_id` that is not an email address if you want that.  (#4612)
+
+
+## API changes
+
+
+* Add a new endpoint `/mls/reset-conversation` which can be used to restore an MLS group that ended up in an invalid state for any reason. After resetting, the conversation has the same users, but the corresponding MLS group gets a new group ID and resets to epoch 0 with no clients.
+
+  Users on backends that don't support reset are kicked out of the conversation upon reset, and no such user can join afterwards.
+
+  A new event type `conversation.mls-reset` has been added, and is sent to all members of a conversation when it is reset. (#4558)
+
+
+## Features
+
+
+* Auto activate SAML emails if validateSAMLEmails feature is disabled (#4612)
+
+* Add update, delete, add/remove users to UserGroups. (#4600, #4604, #4605)
+
+* Send notifications on user group updates (#4600)
+
+* Team admin can add user to a channel (#4574)
+
+* Allow team admin to change the name of a channel (#4584)
+
+* Endpoint to get the current server time (#4606)
+
+* Add support for AWS Signature V4 authentication header to ZAuth (#4593)
+
+
+## Bug fixes and other updates
+
+
+* Do not allow ephemeral users to search for contacts (#4609)
+
+
+## Internal changes
+
+
+* Send cells notification when cells feature is updated (#4614)
+
+* Send message count to websocket on connect (#4608)
+
+* Add `proxy_connect_timeout` to nginz's configuration. Otherwise, not answering
+  services (e.g. due to network issues) can delay requests/response for a very
+  long time. (#4610)
+
+* nginz: Set `Z-Timestamp` header when proxying requests (#4593, #4611)
+
+
 # [2025-05-30] (Chart Release 5.16.0)
 
 ## Release notes

charts/cannon/conf/static/zauth.acl

@@ -1 +1,2 @@
-a (whitelist (regex "/await"))
+a (whitelist (regex "/await")
+             (regex "(/v[0-9]+)?/events"))

charts/nginz/templates/conf/_nginx.conf.tpl

@@ -31,6 +31,12 @@ http {
   keepalive_timeout 75;
   send_timeout 60;
 
+  # Without this timeout, requests/responses can be delayed for a very long
+  # time in case the proxied service does not answer (e.g. due to network
+  # issues.) When this timeout is reached nginz answers with HTTP 504 ("gateway
+  # timeout.")
+  proxy_connect_timeout 5;
+
   ignore_invalid_headers off;
 
   types_hash_max_size 2048;
@@ -329,6 +335,7 @@ http {
         proxy_set_header   Z-Provider     $zauth_provider;
         proxy_set_header   Z-Bot          $zauth_bot;
         proxy_set_header   Z-Conversation $zauth_conversation;
+        proxy_set_header   Z-Timestamp    $zauth_timestamp;
         proxy_set_header   Request-Id     $request_id;
         proxy_set_header   Z-Host         $host;
 

charts/nginz/values.yaml

@@ -685,6 +685,9 @@ nginx_conf:
       - all
       max_body_size: 70m
       body_buffer_size: 256k
+    - path: /mls/reset-conversation
+      envs:
+      - all
     - path: /mls/public-keys
       envs:
       - all

deploy/dockerephemeral/federation-v2.yaml

@@ -280,4 +280,4 @@ services:
       - /coredns-config/Corefile
     networks:
       coredns:
-        ipv4_address: 172.20.1.4
+        ipv4_address: 172.20.1.5

deploy/dockerephemeral/federation-v2/federator.yaml

@@ -25,5 +25,5 @@ optSettings:
   clientCertificate: "/etc/wire/federator/conf/integration-leaf.pem"
   clientPrivateKey: "/etc/wire/federator/conf/integration-leaf-key.pem"
   tcpConnectionTimeout: 5000000
-  dnsHost: 172.20.1.4
+  dnsHost: 172.20.1.5
   dnsPort: 53

integration/default.nix

@@ -81,6 +81,7 @@
 , transformers
 , transformers-base
 , unix
+, unix-time
 , unliftio
 , uuid
 , vector
@@ -183,6 +184,7 @@ mkDerivation {
     transformers
     transformers-base
     unix
+    unix-time
     unliftio
     uuid
     vector

integration/integration.cabal

@@ -168,9 +168,11 @@ library
     Test.MLS.Message
     Test.MLS.Notifications
     Test.MLS.One2One
+    Test.MLS.Reset
     Test.MLS.Services
     Test.MLS.SubConversation
     Test.MLS.Unreachable
+    Test.NginxZAuthModule
     Test.Notifications
     Test.OAuth
     Test.PasswordReset
@@ -292,6 +294,7 @@ library
     , transformers
     , transformers-base
     , unix
+    , unix-time
     , unliftio
     , uuid
     , vector

integration/test/API/Galley.hs

@@ -823,3 +823,9 @@ getSelfMember user conv = do
   (domain, cnv) <- objQid conv
   req <- baseRequest user Galley Versioned (joinHttpPath ["conversations", domain, cnv, "self"])
   submit "GET" req
+
+resetConversation :: (MakesValue user) => user -> String -> Word64 -> App Response
+resetConversation user groupId epoch = do
+  req <- baseRequest user Galley Versioned (joinHttpPath ["mls", "reset-conversation"])
+  let payload = object ["group_id" .= groupId, "epoch" .= epoch]
+  submit "POST" $ req & addJSON payload