Impact Score: 5/10
Appwrite 1.9.0 โ Release Notes & Engineering Impact
Source available โ automated, not human-reviewed
Component: appwrite ยท Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
โก Executive Summary (TL;DR)
Appwrite 1.9.0. Source highlight: MongoDB support (#11312)
Who Does This Impact? (Role-Based Analysis)
๐ป Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
๐ Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
โ๏ธ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
โก Performance & Enhancements (3)
- Trusted headers โ Improved client IP resolution via _APP_TRUSTED_HEADERS env var
- Realtime performance improvements (#11251)
- Cache key improvements with attribute/index hash
๐ง Bug Fixes & Patches (6)
- User impersonation โ Admins can now impersonate users for debugging and support (#11533)
- Memory leak fixes in webhook/stats/event processing (#11067, #11241)
- OAuth fixes for custom domains, redirect schemes, and verified emails
- MFA recovery code validation fix
- VCS template flow, deployment, and comment fixes
- Schedule execution trigger and deletion fixes
๐ View Raw Release Notes (Original Developer Log)
## What's Changed
Database support
- MongoDB support (#11312)
Database features
- String types โ New varchar, text, mediumtext, and longtext attribute types (#11174)
- Int64 format โ Integer attributes support int64 format for large numbers (#11123)
- Collection/row storage size โ Expose column bytes used and bytes free per collection/table (#11254,
#11069)
- Cached document lists โ Document list queries can be cached with configurable TTL (#10832)
New admin APIs
- Webhooks API โ First-class webhooks management endpoints for creating, listing, and managing
webhook configurations (#11033, #11566)
- Schedules API โ New endpoints to view and manage scheduled tasks within projects (#11331)
- User impersonation โ Admins can now impersonate users for debugging and support (#11533)
- Public project variables โ Project environment variables can now be marked public and accessed
via API (#11577)
Realtime
- Query subscriptions โ Subscribe to realtime channels with query filters for targeted updates
(#11202, #11237)
- Realtime metrics โ Track connections, messages, and bandwidth in project usage stats (#11438,
#11488)
- TablesDB channels โ Explicit top level TablesDB events for realtime (#11404, #11430)
Auth & security
- Custom JWT duration โ Configure JWT expiration time when creating tokens (#11009)
- Resource-based API keys โ New key structure with granular resource permissions, custom IDs, and
list queries (#11003, #11277, #11278)
- Project labels โ Tag and organize projects with custom labels (#11056)
- Project status attribute โ Track project lifecycle state (#11291)
- Multiple application domains โ Support multiple domains per project for CORS and OAuth (#10911)
- Trusted console projects โ Mark projects as trusted for elevated access (#11248)
- Blocked user errors โ Changed from 401 to 403 for blocked users/resources (#11469)
- OAuth email verification โ Enforce email verification when linking OAuth2 providers (#10986)
- Tauri origin support โ tauri://localhost accepted as an allowed origin (#11589)
- Trusted headers โ Improved client IP resolution via _APP_TRUSTED_HEADERS env var
Compute
- Custom start command โ Sites and functions support custom start commands (#10842)
- Separate build/runtime specs โ Configure build and runtime resources independently (#10849)
- Deployment retention โ Automatic cleanup of old deployments with configurable limits (#10959)
- Async screenshots โ Screenshot generation moved to a dedicated worker (#11110)
- Stale execution cleanup โ Automatic cleanup of stale/orphaned function executions (#11146)
- Graceful worker shutdown โ Workers shut down cleanly without dropping jobs (#11104)
- Function queue job TTL โ 7-day TTL for functions queue to prevent unbounded growth (#11226)
Storage
- File encryption/compression parameters โ Configure per-file encryption and compression (#11135)
- `totalSize` on list responses โ List endpoints return total storage size (#11102)
Migrations
- Site migration โ Import sites from other Appwrite instances
- Messaging resource migration โ Migrate messaging resources between instances (#11495)
- Migration resource enums โ SDK enums for migration resource types
GraphQL
- Introspection toggle โ Enable/disable GraphQL introspection independently (#11159)
SDKs
- Rust SDK โ New official Rust SDK (#11614)
- Cursor plugin SDK โ SDK for Cursor IDE integration (#11371)
- Agent skills SDK โ SDK for AI agent integration
- Array param enums โ Enum support for array parameters across all SDKs
Installer
- New web installer UI โ Redesigned installer with light/dark modes, progress tracking SSL,
certificate checks, migrations built in (#11175, #11247)
Refactoring
- Migrated to Utopia Platform modules architecture โ all HTTP endpoints, workers, and tasks
organized into feature modules (#11035, #11049, #11057, #11103, #11208, #11398)
- Refactored auth to single instance pattern (#10872, #11130)
- Refactored usage metrics to stateless Bus event publisher pattern (#11449)
- Removed proxy container โ Traefik handled directly (#11039)
- Consolidated CI workflows with dynamic database/mode matrix (#11531, #11551)
- Upgraded PHPStan to v2 with full codebase baseline (#11550)
- Upgraded to PHPUnit 11/12 with PHP 8 attributes
Performance
- Sparse document updates โ updateDocument() sends only changed attributes (#11465)
- Domain caching via shared Swoole Tables instead of per-worker Config cache (#11346)
- Memory leak fixes in webhook/stats/event processing (#11067, #11241)
- SMTP keep-alive for connection reuse across mail jobs (#11496)
- Static file loading optimization with copy-on-write memory sharing
- Pre-parsed queries on hot paths
- Realtime performance improvements (#11251)
- Simplified repository authorization checks (#11616)
Notable Fixes
- OAuth fixes for custom domains, redirect schemes, and verified emails
- MFA recovery code validation fix
- CORS wildcard and preflight request handling
- Execution status and timeout reporting
- Relationship document validation
- Cache key improvements with attribute/index hash
- Realtime region handling and error resilience
- PostgreSQL race condition in shared mode project creation
- VCS template flow, deployment, and comment fixes
- Storage health error handling
- Schedule execution trigger and deletion fixes
- Abuse rate limiting reset on success
Upgrade Path
- Upgrade from 1.8.1 to 1.9.0. Use the database migration step in the web installer, the --migrate flag with the upgrade task, or manually run `docker compose exec appwrite migrate`.
## New Contributors
* @levivannoort made their first contribution in https://github.com/appwrite/appwrite/pull/10843
* @Ujjwaljain16 made their first contribution in https://github.com/appwrite/appwrite/pull/10925
* @VijaykumarPujar-tech made their first contribution in https://github.com/appwrite/appwrite/pull/10863
* @tejas-raskar made their first contribution in https://github.com/appwrite/appwrite/pull/10342
* @premtsd-code made their first contribution in https://github.com/appwrite/appwrite/pull/11193
* @Shivangisharma4 made their first contribution in https://github.com/appwrite/appwrite/pull/11185
**Full Changelog**: https://github.com/appwrite/appwrite/compare/1.8.1...1.9.0