(james-project) 03/04: [RELEASE] 3.9.1 Upgrade instructions

[bt...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

chibenwa pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git

commit f04989373b4eb397ba10dfa3aace787af1e11b65
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Fri Sep 25 09:39:41 2026 +0200

    [RELEASE] 3.9.1 Upgrade instructions
---
 upgrade-instructions.md | 57 +++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 50 insertions(+), 7 deletions(-)

diff --git a/upgrade-instructions.md b/upgrade-instructions.md
index 6919c38238..360b7c5326 100644
--- a/upgrade-instructions.md
+++ b/upgrade-instructions.md
@@ -246,6 +246,56 @@ To add that column, run the following CQL command:
 ALTER TABLE james_keyspace.email_query_view ADD COLUMN thread_id UUID;
 ```
 
+## 3.9.1 version
+
+Changes to apply between 3.9.0 and 3.9.1 will be reported here.
+
+Change list:
+
+ - [WebAdmin now generates a password by default](#webadmin-now-generates-a-password-by-default)
+ - [JAMES-4160 LDAP with spring update](#james-4160-ldap-with-spring-update)
+ - [Glowroot removal](#glowroot-removal)
+
+### WebAdmin now generates a password by default
+
+Date: 25/09/2026
+
+Concerned products: all James servers exposing WebAdmin
+
+`webadmin.properties` gains a `password.generate` option, defaulting to `true`: when neither `password` nor
+`jwt.enabled` is configured, a random password is generated upon start up and written in the logs. WebAdmin is thus
+no longer unauthenticated out of the box, existing deployments included, and requests lacking the matching `Password`
+header will be rejected.
+
+Deployments relying on an unauthenticated WebAdmin need to either:
+
+ - configure a stable secret with `password` (comma separated values are supported) and send it in the `Password`
+ header of WebAdmin requests,
+ - or explicitly opt back into an unauthenticated WebAdmin:
+
+```
+password.generate=false
+```
+
+Note that the generated password changes upon each restart.
+
+### JAMES-4160 LDAP with spring update
+Date: 13/01/2026
+
+JIRA: https://issues.apache.org/jira/browse/JAMES-4160
+
+Users using Spring in addition with LDAP usersrepository needs to use `org.apache.james.user.ldap.LegacyReadOnlyUsersLDAPRepository` instead.
+
+### Glowroot removal
+
+Date: 25/09/2026
+
+Concerned products: all Guice based James docker images, helm chart
+
+The Glowroot agent is no longer bundled with James docker images. Deployments enabling it (`-javaagent:/root/glowroot.jar`
+within `JAVA_TOOL_OPTIONS`, helm chart `james.env.glowroot.enabled`) need to drop that configuration, and rely on the
+metrics James exposes instead.
+
 ## 3.9.0 version
 
 Changes to apply between 3.8.x and 3.9.0 will be reported here.
@@ -273,13 +323,6 @@ Change list:
  - [JAMES-4118 Cleanup message previews](#james-4118-cleanup-message-previews)
  - [JAMES-4128 Breaking Mailet API changes](#james-4128-breaking-mailet-api-changes)
 
-### JAMES-4160 LDAP with spring update
-Date: 13/01/2026
-
-JIRA: https://issues.apache.org/jira/browse/JAMES-4160
-
-Users using Spring in addition with LDAP usersrepository needs to use `org.apache.james.user.ldap.LegacyReadOnlyUsersLDAPRepository` instead.
-
 ### JAMES-4128 Breaking Mailet API changes
 Date: 02/04/2025
 


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org