> ## Content Index
> Fetch the complete content index at: https://www.process-one.net/llms.txt
> Use this file to discover other available public pages before exploring further.

# ejabberd 26.03
- URL: https://www.process-one.net/blog/ejabberd-26-03/
- Published: 2026-03-25T17:14:04.000Z
- Updated: 2026-04-13T14:00:36.000Z
- Description: We are pleased to announce another bugfix release: ejabberd 26.03. This brings support for roster pre-approval, and more than 100 commits with bugfixes all around, many of them dedicated to the new mod_invites, including also many security fixes.
- Author: Jérôme Sautret
- Tags: ejabberd, Release, XMPP

If you are upgrading from a previous version, there is a change in the SQL schemas, please read below. There are no changes in configuration, API commands or hooks.

**Contents:**

- **[Changes in SQL schemas](#sql)**
- **[SASL channel binding changes](#sasl)**
- **[ChangeLog](#changelog)**
- **[Acknowledgments](#ack)**
- **[Improvements in ejabberd Business Edition](#ebe)**
- **[ejabberd 26.03 download & feedback](#download)**

## Changes in SQL schema

This release adds a new column to the `rosterusers` table in the SQL database schemas to support roster pre-approval. This task is performed automatically by ejabberd by default.

However, if your configuration file has disabled [update\_sql\_schema](https://docs.ejabberd.im/admin/configuration/toplevel/?ref=process-one.net#update%5Fsql%5Fschema) toplevel option, you must perform the SQL schema update manually yourself. Those instructions are valid for MySQL, PostgreSQL and SQLite, both default and new schemas:

```sql
ALTER TABLE rosterusers ADD COLUMN approved boolean NOT NULL DEFAULT false;
ALTER TABLE rosterusers ALTER COLUMN approved DROP DEFAULT;

```

You can ignore the second query on SQLite.

##  SASL channel binding changes

This version adds the ability to configure the handling of the client flag *'wanted to use channel-bindings but was not offered one'*. By default, ejabberd aborts connections that present this flag, as this could indicate the presence of a rogue MITM proxy between the server and the client that strips the exchanged data of information required for this.

This can cause problems for servers that use a proxy server which terminates the TLS connection (i.e. there is a MITM proxy, but it is approved by the server administrator). To handle this situation, we have added code to ignore this flag if the server administrator disables channel binding handling by disabling the `-PLUS` authentication mechanisms in the configuration file:

```yaml
disable_sasl_mechanisms:
  - SCRAM-SHA-1-PLUS
  - SCRAM-SHA-256-PLUS
  - SCRAM-SHA-512-PLUS

```

We also ignore this flag for SASL2 connections if offered authentication methods filtered by available user passwords did disable all `-PLUS` mechanisms.

##  ChangeLog

#### Core

- Fix MySQL authentication for TLS connections that required auth plugin switch
- Improve handling of scram *'wanted to use channel-bindings but was not offered one'* flag
- Add ability for mod\_options values to depend on other options
- Don't fail to classify stand-alone chat states
- Fix some warnings compiling with Erlang/OTP 29 ([#4527](https://github.com/processone/ejabberd/issues/4527?ref=process-one.net))
- `ejabberd_ctl`: Document how to set empty lists in ejabberdctl and WebAdmin
- `ejabberd_http`: Add handling of `Etag` and `If-Modified-Since` headers to files served by `mod_http_upload`
- `ejabberd_http`: Ignore whitespaces at end of host header
- SQL: Add ability to mark that column can be null in e\_sql\_schema
- Tests: Add tests for SASL2
- Tests: Make table cleanup in test more robust

#### Modules

- `mod_fast_auth`: Offered methods are based on available channel bindings
- `mod_http_api`: Always hide password in log entries
- `mod_mam`: Call `store_mam_message` hook for messages that `user_mucsub_from_muc_archive` was filtering out
- `mod_mam_sql`: Only provide the new XEP-0431 `fulltext` field, not old custom `withtext`
- `mod_muc_room`: Fix duplicate stanza-id in muc mam responses generated from local history ([#4544](https://github.com/processone/ejabberd/issues/4544?ref=process-one.net))
- `mod_muc_room`: Fix hook name in commit 7732984 ([#4526](https://github.com/processone/ejabberd/issues/4526?ref=process-one.net))
- `mod_pubsub_serverinfo`: Don't use `gen_server:call` for resolving pubsub host
- `mod_roster`: Add support for roster pre-approval ([#4512](https://github.com/processone/ejabberd/issues/4512?ref=process-one.net))
- `mod_roster`: Fix display of groups in WebAdmin when it's a list
- `mod_roster`: in WebAdmin page, first execute SET actions, later GET
- `mod_roster_mnesia`: Improve transformation code

#### mod\_invites

- Makefile: Run invites-deps only when files are missing
- Fix path to bootstrap files
- Check at start time the syntax of landing\_page option ([#4525](https://github.com/processone/ejabberd/issues/4525?ref=process-one.net))
- Send 'Link' http header ([#4531](https://github.com/processone/ejabberd/issues/4531?ref=process-one.net))
- Set meta.pre-auth to skip redirect\_url if token validated ([#4535](https://github.com/processone/ejabberd/issues/4535?ref=process-one.net))
- Many security fixes ([#4539](https://github.com/processone/ejabberd/issues/4539?ref=process-one.net))
- Add favicon and change color to match ejabberd branding
- Enable dark mode
- Add support for webchat\_url
- Migrate to bootstrap5 and update jquery
- No inline scripts
- Make format csrf token
- Add csrf token to failed post
- Include js/css deps in static dir
- Correct hashes for bootstrap 4.6.2
- Hint at type for landing\_page opt
- Many more security fixes ([#4538](https://github.com/processone/ejabberd/issues/4538?ref=process-one.net))
- Check CSRF token in register form
- Add integrity hashes to scripts and css
- Comment unused resources
- Add security headers
- Remove debug log of whole query parameters (including pw)
- Don't crash on unknown host from http host header
- Make creating invite transactional
- Set overuse limits ([#4540](https://github.com/processone/ejabberd/issues/4540?ref=process-one.net))
- Fix broken path when behind proxy with prefix ([#4547](https://github.com/processone/ejabberd/issues/4547?ref=process-one.net))

#### Container and Installers

- Bump Erlang/OTP 28.4.1
- make-binaries: Bump libexpat to 2.7.5
- make-binaries: Bump zlib to 1.3.2
- make-binaries: Enable missing crypto features ([#4542](https://github.com/processone/ejabberd/issues/4542?ref=process-one.net))

#### Translations

- Update Bulgarian translation
- Update Catalan and Spanish translations
- Update Chinese Simplified translation
- Update Czech translation
- Update French translation
- Update German translation

## Acknowledgments

We would like to thank the contributions to the source code, documentation, and translation provided for this release by:

- [Stefan Strigler](https://github.com/sstrigler?ref=process-one.net) for the roster pre-approval feature, [sponsored by NLnet](https://nlnet.nl/project/ejabberd-invites/?ref=process-one.net)
- [Stefan Strigler](https://github.com/sstrigler?ref=process-one.net) for the improvements in `mod_invites`
- [Holger Weiß](https://github.com/weiss?ref=process-one.net) for improvements in binary installers
- [Mr. EddX](https://github.com/MrEddX?ref=process-one.net) for updating the Bulgarian translation
- [Sketch6580](https://hosted.weblate.org/user/Sketch6580/?ref=process-one.net) for updating the Chinese (Simplified) translation
- [ffunk](https://github.com/hollymrklm?ref=process-one.net) for updating the Czech translation
- [Dyxux](https://github.com/dyxux?ref=process-one.net) for updating the French translation
- [Stefan Strigler](https://github.com/sstrigler?ref=process-one.net) for updating the German translation

And also to all the people contributing in the ejabberd chatroom, issue tracker...

## Improvements in ejabberd Business Edition

Customers of the [ejabberd Business Edition](https://www.process-one.net/en/ejabberd/), in addition to all those improvements and bugfixes, also get the following changes:

- Add p1db backend for [mod\_auth\_fast](https://docs.ejabberd.im/admin/configuration/modules/?ref=process-one.net#mod%5Fauth%5Ffast)
- Fix issue when cleaning MAM messages stored in p1db
- `mod_unread` fixes
- Web push fixes

### Full Changelog

[https://github.com/processone/ejabberd/compare/26.02...26.03](https://github.com/processone/ejabberd/compare/26.02...26.03?ref=process-one.net)

##  ejabberd 26.03 download & feedback

As usual, the release is tagged in the Git source code repository on [GitHub](https://github.com/processone/ejabberd?ref=process-one.net).

The source package and installers are available in [ejabberd Downloads](https://www.process-one.net/download/) page. To check the `*.asc` signature files, see [How to verify ProcessOne downloads integrity](https://www.process-one.net/blog/verifying-process-one-downloads-integrity/).

For convenience, there are alternative download locations like the [ejabberd DEB/RPM Packages Repository](https://repo.process-one.net/?ref=process-one.net) and the [GitHub Release / Tags](https://github.com/processone/ejabberd/tags?ref=process-one.net).

The `ecs` container image is available in [docker.io/ejabberd/ecs](https://hub.docker.com/r/ejabberd/ecs/?ref=process-one.net) and [ghcr.io/processone/ecs](https://github.com/processone/docker-ejabberd/pkgs/container/ecs?ref=process-one.net). The alternative `ejabberd` container image is available in [ghcr.io/processone/ejabberd](https://github.com/processone/ejabberd/pkgs/container/ejabberd?ref=process-one.net).

If you consider that you've found a bug, please search or fill a bug report on [GitHub Issues](https://github.com/processone/ejabberd/issues?ref=process-one.net).