Appwrite 2.4 is now available for self-hosting. This version includes important security updates. We strongly recommend upgrading your instance to apply these fixes.
This release includes:
- Custom profile photos. Users can upload and remove their own photo, and it is served ahead of the OAuth2, Gravatar and initials fallbacks
- Webflow as an OAuth2 provider
- Push messages straight to a user with the Appwrite push provider, without registering a device target
- Webhook delivery IDs that stay the same across retries, and retries that only resend to the endpoints that failed
- Outbound requests to user-supplied URLs refuse private addresses, with
_APP_ALLOWED_INTERNAL_ADDRESSESto allow specific hosts - User JWTs that only work in the project that issued them, and OAuth2 callbacks checked against the browser that started the flow
- Retention for ClickHouse's own logs, so idle installs stop growing by hundreds of MB a day
- Appwrite Console 1.2.55, with profile photos, the Webflow provider, CLI and MCP onboarding, and the breached password policy
The Appwrite Assistant is retired in this release. Before upgrading, check the upgrade notes if you run behind a public load balancer, use the GitHub integration, or reach private hosts for OAuth2, webhooks or messaging.
See the migration guide to upgrade your instance.
For the complete list of updates and fixes, check out the release notes on GitHub.