Impact Score: 5/10
Appwrite 1.9.8 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: appwrite · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Appwrite 1.9.8. Source highlight: Appwrite 1.9.8 is a security patch for self-hosted deployments following the eMudhra certificate compromise. It retains Console 8.7.37 for compatibility with the 1.9 server APIs. Upgrading from 1.9.7 keeps the existing migration class and introduces no schema changes.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (1)
- Map 1.9.8 to migration V25, the same class as 1.9.7; no migration class is added.
🔧 Bug Fixes & Patches (2)
- **Security:** use patched CA trust in the runtime and independent Composer dependency-download stage (#14718).
- **Avatars:** update `enshrined/svg-sanitize` to 1.1.1 to address reported sanitizer advisories (#14718).
📄 View Raw Release Notes (Original Developer Log)
Appwrite 1.9.8 is a security patch for self-hosted deployments following the [eMudhra certificate compromise](https://blog.cloudflare.com/emudhra-certificate-compromise/). It retains Console 8.7.37 for compatibility with the 1.9 server APIs. Upgrading from 1.9.7 keeps the existing migration class and introduces no schema changes.
### Highlights
- Refresh outbound TLS trust so Appwrite rejects the compromised eMudhra certificate chains. TLS verification remains enabled.
- Update the SVG sanitizer to 1.1.1 to address its reported security advisories.
### Fixes
- **Security:** use patched CA trust in the runtime and independent Composer dependency-download stage (#14718).
- **Avatars:** update `enshrined/svg-sanitize` to 1.1.1 to address reported sanitizer advisories (#14718).
### Under the hood
- Require `ca-certificates` and `ca-certificates-bundle` at `20261020-r0` or newer and regenerate the certificate store.
- Map 1.9.8 to migration V25, the same class as 1.9.7; no migration class is added.
- Increment the response cache buster after the SVG sanitizer update so previously cached avatar and preview output is regenerated.
### Removed
No environment variables, collections, or public APIs are removed.
### Install
```bash
docker run -it --rm \
--publish 20080:20080 \
--volume /var/run/docker.sock:/var/run/docker.sock \
--volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
--entrypoint="install" \
appwrite/appwrite:1.9.8
```
### Upgrade
Back up your database and persistent storage before upgrading. From the parent directory of an existing 1.9.7 installation, run:
```bash
docker run -it --rm \
--publish 20080:20080 \
--volume /var/run/docker.sock:/var/run/docker.sock \
--volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
--entrypoint="upgrade" \
appwrite/appwrite:1.9.8
cd appwrite
docker compose exec appwrite migrate
```
The patch reuses migration V25. No new configuration is required. Outbound HTTPS endpoints that still present a compromised certificate chain will fail verification; those endpoints must replace their certificate chain.
**Full Changelog:** https://github.com/appwrite/appwrite/compare/1.9.7...1.9.8