Add LIKE-based CJK (Chinese, Japanese, Korean) search support for PostgreSQL, gated behind a `CJKSearch` feature flag.
PostgreSQL's built-in full-text search (`to_tsvector`/`to_tsquery`) does not support CJK languages because it relies on whitespace-based tokenization, which doesn't work for logographic/syllabic scripts that don't use spaces between words. This PR adds a `LIKE`-based fallback for search terms containing CJK characters.
**How it works:** When the `CJKSearch` feature flag is enabled and a search term contains CJK characters (Han, Hiragana, Katakana, or Hangul), the query builder generates `LIKE '%term%'` clauses instead of `to_tsvector @@ to_tsquery` expressions. Case-sensitive `LIKE` is used rather than `ILIKE` since CJK scripts have no letter casing, which also allows potential use of standard B-tree indexes.
* Increase minimum version of NPM to 11
When we updated the Node.js version, I asked Saturn to make the Node/NPM
version checks looser because I didn't know about anything that would cause
the package-lock.json or package.json formats to change. It seems like NPM 10
is causing a few fields to be removed now, so we should require 11 to avoid
thrashing on that.
* And update the Node version
* Handled null column for scheduled post type in database
* [skip ci]
* CI
* CI
* Minor improvement
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-64490 - Add ABAC system console E2E tests
* split abac e2e tests in logical folders
* Export ABAC helpers from playwright-lib main package
* fix linter issues
* fix prettier
* fix linter
* revert unwanted changes to packa-lock
* Fix ABAC test to use refactored SystemConsoleSidebar API
* fix two failing tests
* fix prettier
* clean up before running the test to make them more reliable
* make create policy less flaky by adding better wait time
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
The "Channels" header was flashing and then disappearing when typing in
the Find Channels dialog (Ctrl/Cmd+K). This was caused by the
fetchUsersAndChannels method returning results without the groups
structure that was introduced in MM-62990.
Add validation to block updates that would create orphaned protected fields (protected=true but no source_plugin_id), which cannot be modified by anyone.
Includes test coverage for single and bulk update paths.
* fix: ensuring that webapp and mobile notifications decode special characters
* fix: linter error
* Replacing anonymous function with existing utility to escape regex
* Added missing characters to webapp handling, excluded markdown renderer from being affected
- Added tests that explicitly check for script injection
Race condition caused mousemove events to fire after reset() but before
cleanup, resulting in negative width calculations that CSS clamped to
min-width.
* MM-66909 - Fix BoR sender not seeing priority label on new post
* Use RequestContextWithMaster for BoR priority fetching
* fix linter
* Add BoR post priority unit test
* unique error code and remove webapp workaround
* fix translation
* remove unnecessary line
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-66442 - Add empty state message for ABAC channel modal
* fix translation and ts issue
* Remove empty filter controls border in channel modal
* extract and memoize message
* adjust modal header title style and text color
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-65975 - migrate team modal to generic modal
* add e2e tests to team settings
* apply self review fixes, organize test pom and clean code
* fix cypress tests
* Remove jest-junit and unignore build folder in web app packages
We don't actually use the file output by jest-junit, and I don't think we
have since we moved off of Jenkins for CI
* Move parcel-namer-shared into build folder
* MM-67323 Add loadSharedDependency API and script for plugins to use it
* Fix client and mattermost-redux packages missing const enums
* Change interface for webAppExternals
* Rename "Self-Deleting Messages" to "Burn-on-Read Messages"
Updated the Burn on Read feature naming in the System Console for consistency with the product terminology and made all Posts subsection titles translatable for better internationalization support.
- Renamed section title from "Self-Deleting Messages" to "Burn-on-Read Messages"
- Updated section description to clarify that messages delete after being read (removed "or sent")
- Added translation keys for all 6 Posts subsection titles
- Updated type definitions and UI components to support translatable subsection titles
Co-authored-by: Cursor <cursoragent@cursor.com>
* Linting
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* test: increase parallel tests and removed smoke tests both in cypress and playwright
* add duration and retest info
* indicate overall, first-pass and re-run run and test durations
* Respect user display preferences for date and time formatting
User Preference Support:
- Read isUseMilitaryTime preference from user settings
- Apply 24-hour format when enabled (14:00 instead of 2:00 PM)
- Apply 12-hour format when disabled (2:00 PM instead of 14:00)
- Pass useTime prop to Timestamp component with correct hourCycle/hour12
Date Formatting Consistency:
- Create formatDateForDisplay() utility in date_utils.ts
- Centralize date formatting logic (month: 'short', day/year: 'numeric')
- Use consistent "Jan 15, 2025" format across all date/datetime fields
- Replace DateTime.fromJSDate().toLocaleString() which varies by browser
Components Updated:
- DateTimeInput: Use isMilitaryTime for dropdown and selected time display
- DateTimeInput: Use formatDateForDisplay for date display
- AppsFormDateField: Use formatDateForDisplay instead of inline Intl code
Tests Added:
- 4 tests for user preference handling (military time, locale)
- 5 tests for formatDateForDisplay utility
- Updated snapshot for Timestamp changes
Benefits:
- Single source of truth for date formatting
- Easy to change format globally by updating one function
- Respects user preferences consistently
- Fixes inconsistency where datetime showed "1/1/2026" vs date showing "Jan 1, 2026"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add timezone and manual time entry support for datetime fields
Object Model:
- Create DialogDateTimeConfig with TimeInterval, LocationTimezone, AllowManualTimeEntry
- Add DateTimeConfig field to DialogElement
- Keep legacy MinDate, MaxDate, TimeInterval for fallback
Timezone Support (location_timezone):
- Display datetime in specific IANA timezone (e.g., "Europe/London", "Asia/Tokyo")
- Show timezone indicator: "🌍 Times in GMT"
- Preserve timezone through all operations
- Fix momentToString to clone before converting to UTC (prevents mutation)
- Use moment.tz array syntax for timezone-safe moment creation
- Generate time intervals starting at midnight in display timezone
Manual Time Entry (allow_manual_time_entry):
- Add parseTimeString() function supporting multiple formats:
- 12-hour: 12a, 12:30p, 3:45pm
- 24-hour: 14:30, 9:15
- Add TimeInputManual component with text input
- Conditional rendering: manual input OR dropdown
- No rounding for manual entry (exact minutes preserved)
- No auto-advance (validation only, show error for invalid format)
- Respects user's 12h/24h preference for placeholder
Critical Bug Fixes:
- Fix getTimeInIntervals to return Moment[] instead of Date[] (preserves timezone)
- Fix momentToString mutation: use .clone() before .utc()
- Use .clone() when calling .startOf('day') to preserve timezone
- Use moment.tz([...], timezone) array syntax instead of .tz().hour() mutation
- Display selected time using .format() instead of Timestamp component
- Fix null handling: optional fields start empty, show '--:--'
- Manual entry gets exact current time, dropdown gets rounded time
Component Updates:
- DateTimeInput: Add TimeInputManual component, parseTimeString, timezone handling
- AppsFormDateTimeField: Extract config, timezone indicator, pass timezone to child
- Modal components: Handle Moment | null signatures
- CSS: Add manual entry input styles with error states
Features:
- Timezone-aware time generation (dropdown starts at midnight in display TZ)
- Manual entry works with timezones (creates moments in correct TZ)
- Optional fields start empty (null value, no display default)
- Required datetime fields get rounded default from apps_form_component
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Fix momentToString mutation - clone before converting to UTC
Prevents .utc() from mutating the original moment object.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add E2E test for 12h/24h time preference support
Test MM-T2530H verifies that datetime fields respect user's display preference:
- Sets preference to 24-hour format
- Verifies dropdown shows times as 14:00, 15:00, etc.
- Verifies selected time displays in 24-hour format
- Changes preference to 12-hour format
- Verifies dropdown shows times as 2:00 PM, 3:00 PM, etc.
Uses cy.apiSaveClockDisplayModeTo24HourPreference() to set user preference.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Auto-round time to interval boundaries in DateTimeInput
Automatically rounds displayed time to timePickerInterval to ensure
consistent behavior across all callers.
Problem:
- DND modal and Custom Status modal showed unrounded times (e.g., 13:47)
- Should show rounded times (e.g., 14:00) to match dropdown intervals
- Some callers pre-rounded, others didn't (inconsistent)
Solution:
- Add useEffect in DateTimeInput that auto-rounds on mount
- Only calls handleChange if time needs rounding
- Uses timePickerInterval prop or 30-minute default
- Harmless for callers that already pre-round (no change triggered)
Behavior:
- DND modal: Now shows 14:00 instead of 13:47
- Custom Status: Still works (already pre-rounded, so no-op)
- Post Reminder: Still works (already pre-rounded, so no-op)
- Interactive Dialog: Still works (uses custom intervals)
Added 3 unit tests for auto-rounding behavior.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* lint fix
* Add deferred login cleanup to post_test.go 'not logged in' test
Ensures the test helper is logged back in after the logout test completes, preventing test state issues for subsequent tests.
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add unit tests for parseTimeString and timezone handling
parseTimeString tests (9 test cases):
- 12-hour format with AM/PM (12a, 3:30pm, etc.)
- 24-hour format (14:30, 23:59, etc.)
- Time without minutes (defaults to :00)
- Invalid hours, minutes, and formats
- Edge cases (midnight 12:00am, noon 12:00pm)
Timezone handling tests (3 test cases):
- Preserve timezone in getTimeInIntervals
- Generate intervals starting at midnight in timezone
- Timezone conversion pattern verification
Total: 12 new tests added (32 total in file)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add E2E tests and webhook support for timezone/manual entry
E2E Tests Added (MM-T2530O through MM-T2530S):
- MM-T2530O: Manual time entry basic functionality
- MM-T2530P: Manual time entry multiple formats (12a, 14:30, 9pm)
- MM-T2530Q: Manual time entry invalid format handling
- MM-T2530R: Timezone support dropdown (London GMT)
- MM-T2530S: Timezone support manual entry (London GMT)
Webhook Server Support:
- Added getTimezoneManualDialog() to webhook_utils.js
- Added 'timezone-manual' case to webhook_serve.js
- Dialog with 3 fields: local manual, London dropdown, London manual
Bug Fixes:
- Skip auto-rounding for allowManualTimeEntry fields (preserve exact minutes)
- Generate dropdown options even when displayTime is null (use currentTime fallback)
- Scope Cypress selectors with .within() to avoid duplicate ID issues
All tests passing (13 total datetime tests).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Fix ESLint no-multi-spaces in apps.ts
Remove extra spacing before comments to comply with ESLint rules.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Fix gofmt formatting in integration_action.go
Align Options, MultiSelect, and Refresh field spacing to match Go formatting standards.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* more lint fixes
* css lint fix
* i18n-extract
* lint fixes
* update snapshot
* Fix modal scroll containment for datetime fields
The .modal-overflow class was applying overflow: visible to .modal-body,
which broke scroll containment when datetime fields were present. This
caused the entire form to scroll instead of scrolling within the modal-body
viewport.
Changes:
- Remove .modal-body overflow override from .modal-overflow class to
preserve scroll containment while still allowing date/time popups to
display correctly via z-index
- Remove italic styling from timezone indicator for cleaner appearance
- Remove redundant "Time" label from manual time entry input (aria-label
is sufficient for accessibility)
- Add CSS rule to ensure "(optional)" label text is not bold
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* fixes for cypress tests
* fix for using timezone crossing dates
* fix dateonly strings parse failures
* regex fix
* linter fix
---------
Co-authored-by: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* Add support for channel mentions in webhook attachments
Implement client-side channel mention rendering in incoming webhook
attachments. Channel mentions (~channel-name) now render as clickable
links in attachment content fields (pretext, text, field values) while
correctly remaining as plain text in title/label fields.
* feat: filewillbedonwloaded hook
* feat: error popup
* chore: make generated pluginapi
* tests
* feat: different errors for different download types
* feat: allow toast positions
* fix: avoid using deprecated i18n function
* feat: add plugin API to show toasts
* feat: downloadType parameter
* tests: updated tests
* chore: make check-style
* chore: i18n
* chore: missing fields in tests
* chore: sorted i18n for webapp
* chore: run mmjstool
* test: fixed webapp tests with new changes
* test: missing mocks
* fix: ensure one-file attachments (previews) are handler properly as thumbnails
* chore: lint
* test: added new logic to tests
* chore: lint
* Add SendToastMessage API and FileWillBeDownloaded hook
- Introduced SendToastMessage method for sending toast notifications to users with customizable options.
- Added FileWillBeDownloaded hook to handle file download requests, allowing plugins to control access to files.
- Updated related types and constants for file download handling.
- Enhanced PluginSettings to include HookTimeoutSeconds for better timeout management.
* Update webapp/channels/src/components/single_image_view/single_image_view.tsx
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* chore: copilot reviews
* test: head requests
* chore: linted the webapp
* tests: fixed path
* test: fixed mocked args
* allow sending message to a connection directly
* fix: hook thread safety
* chore: formatting
* chore: remove configuration from system console
* chore: release version
* chore: update signature
* chore: update release version
* chore: addressed comments
* fix: update file rejection handling to use 403 Forbidden status and include rejection reason header
* Fix nil pointer panic in runFileWillBeDownloadedHook
The atomic.Value in runFileWillBeDownloadedHook can be nil if no
plugins implement the FileWillBeDownloaded hook. This causes a panic
when trying to assert the nil interface to string.
This fix adds a nil check before the type assertion, defaulting to
an empty string (which allows the download) when no hooks have run.
Fixes:
- TestUploadDataMultipart/success panic
- TestUploadDataMultipart/resume_success panic
* test: move the logout test last
* chore: restored accidential deletion
* chore: lint
* chore: make generated
* refactor: move websocket events to new package
* chore: go vet
* chore: missing mock
* chore: revert incorrect fmt
* chore: import ordering
* chore: npm i18n-extract
* chore: update constants.tsx from master
* chore: make i18n-extract
* revert: conflict merge
* fix: add missing isFileRejected prop to SingleImageView tests
* fix: mock fetch in SingleImageView tests for async thumbnail check
The component now performs an async fetch to check thumbnail availability
before rendering. Tests need to mock fetch and use waitFor to handle
the async state updates.
* refactor: move hook logic to app layer
* chore: update version to 11.5
* Scope file download rejection toast to the requesting connection
Thread the Connection-Id header through RunFileWillBeDownloadedHook and
sendFileDownloadRejectedEvent so the WebSocket event is sent only to the
connection that initiated the download, instead of all connections for
the user.
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* MM-66813 - Add server origin verification to mobile SSO callbacks
* Enhance mobile SSO security and deprecate code-exchange
* Update code-exchange deprecation to follow MM standards
* Use config SiteURL for srv param, fix flow terminology
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
The generation of notice-file is failing with
```
2026/02/16 10:20:39 NPM load failed @mattermost/shared
2026/02/16 10:20:39 Error occured while generating notice.txt @mattermost/shared:http status code 404 when downloading "https://registry.npmjs.org/@mattermost/shared"
```
This relates with https://github.com/mattermost/mattermost/pull/35065 because
the package is still local and isn't yet published in npm
So, this is ignores the shared package while it isn't published.
Eva Sarafianou