# Appwrite 2.4.0 — Release & Upgrade Intelligence
- **Product:** Appwrite (https://appwrite.io)
- **Version:** 2.4.0
- **Released:** Oct 08, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/appwrite/updates/2.4.0/

## Executive Summary (TL;DR)
Appwrite 2.4.0. Source highlight: Appwrite 2.4 adds custom profile photos, Webflow sign-in, push messages straight to a user without a device target, and webhook delivery IDs with retries that only resend what failed. The Console gets CLI and MCP onboarding and a breached password policy. Outbound requests and sign-in tokens are loc

## New Features
- **Console 1.2.55.** Adds profile photos, the Webflow card, CLI and MCP onboarding, and the breached password policy. Databases with more than 100 tables now work, and manual uploads follow the server's size limit. The Assistant is gone.
- **Public load balancer:** forwarded client IPs are only trusted from `_APP_TRUSTED_PROXIES` (private ranges by default). If a public hop like Cloudflare sits in front of Appwrite, add its ranges to `_APP_TRUSTED_PROXIES`. If it sends the client IP in its own header, also set `_APP_TRUSTED_HEADERS` to that header (for example `cf-connecting-ip`); the header is only read from trusted proxies. Otherwise all clients look like that hop and share its rate limits. (#14048)
- **Private hosts:** OAuth2 and OIDC providers, webhooks, messaging webhooks and migration sources on private addresses need to be listed in `_APP_ALLOWED_INTERNAL_ADDRESSES`. Messaging providers no longer use `HTTP_PROXY` / `HTTPS_PROXY`. If your screenshots router is not `appwrite`, add it to `ALLOWED_HOSTS` on `appwrite-browser`. (#13998, #14127)

## Bug Fixes
- Databases with more than 100 tables open the right one, and pickers, Export / Import and the schema view list every table. (appwrite/vibes#461, appwrite/vibes#462, appwrite/vibes#464, #13908)
- Manual deployment uploads use `_APP_COMPUTE_SIZE_LIMIT` instead of fixed 10 MB and 100 MB caps. (appwrite/vibes#483, #13967, fixes #13916)
- Self-hosted GitLab and Gitea owners link to your own instance instead of `gitlab.com`. (appwrite/vibes#448, #13875, #13879)
- The breached password policy can be set under Auth, and each user's result shows in the Console. (appwrite/vibes#428)
- CLI and MCP installs count as onboarding stages, and skipped stages complete once done. (#13717, #13951, appwrite/vibes#373, appwrite/vibes#405, appwrite/vibes#506)
- The create bucket dialog, email template preview, project settings and Init page work again. (appwrite/vibes#460, appwrite/vibes#467, appwrite/vibes#473, appwrite/vibes#535)