Zulip on AWS 2.0.0: Major Version Bump to Zulip 12.0 with Security Fixes and a New Test Suite

May 2, 2026

Our AWS Marketplace Zulip pattern hits its 2.0.0 milestone, upgrading from Zulip 11.6 to Zulip 12.0 — picking up the CVE-2026-40300 message-edit-history fix, end-to-end encrypted mobile push notifications, and a redesigned Recent Conversations view.

We just published version 2.0.0 of the Zulip on AWS by FOSSonCloud pattern to AWS Marketplace. This is a major version bump for the pattern, taking Zulip from 11.6 to 12.0 — Zulip’s first major release of 2026, with new collaboration features, a security fix, and a small set of LDAP changes that affect existing operators.

What’s in this release

Zulip 12.0 (up from 11.6)

Zulip 12.0 shipped on 2026-04-27. The headline items:

  • End-to-end encrypted mobile push notifications are now generally available, enabled automatically when both server and client are modern
  • Redesigned Recent Conversations view with a new table layout and improved column handling
  • Redesigned channel settings with a dedicated “Permissions” tab and folder filtering
  • Bulk user-settings editing for administrators via a new “Default user settings” panel
  • “Report message” feature with a configurable private moderation channel
  • Demo organizations that let people test Zulip without an email address
  • New video call providers: Nextcloud Talk, Constructor Groups, and Webex
  • Jdenticons as default profile pictures for new organizations (replacing Gravatar)
  • Jump-to-date picker in the message feed and improved search typeahead with topic suggestions
  • Linkifiers support reverse linkification (URL-to-shorttext conversion)
  • Emoji-only messages now render the emoji extra large
  • Markdown change: uploaded images and audio files now use ![alt text](url) syntax
  • Microsoft Teams data import tool (beta)
  • New webhook integrations for Redmine, dbt Cloud, and n8n
  • PostgreSQL 18 and Ubuntu 26.04 are now supported upstream

Security

  • CVE-2026-40300 — the “Move history only” setting for message edit history visibility was incorrectly exposing original message content through the API. Fixed in 12.0.

Earlier upstream CVE fixes already carried by the pattern’s prior 11.6 release:

  • CVE-2026-26058 — export tarball vulnerability (fixed in 11.6)
  • CVE-2026-25742 — web-public channel attachment access vulnerability (fixed in 11.6)

Pattern-level changes

  • Versioned AMI parameter bumped to AsgAmiIdv200 (previously AsgAmiIdv130) — this is the parameter name change you’ll see in CloudFormation
  • common.mk pin bumped to 1.9.4
  • New test/integration/ pytest suite — adds a health check, SSM-driven realm bootstrap, and a REST API workflow test, giving us much higher confidence that future Zulip upgrades actually work end-to-end before they ship
  • Marketplace listing rebrand to “Zulip on AWS by FOSSonCloud” with the new FOSSonCloud logo
  • Flat Marketplace pricing at $0.02/hr across all instance dimensions

Fresh deployments

Just subscribe on AWS Marketplace and launch. You’ll need a Route 53 hosted zone and an ACM certificate in advance — the template provisions everything else, including Aurora PostgreSQL, ElastiCache Redis, RabbitMQ, the assets and avatars S3 buckets, and (optionally) the NLB-fronted SMTP path for incoming email.

What’s next

With the new integration test suite in place, our goal is to keep the gap between upstream Zulip releases and pattern releases tighter than it has been historically. If you hit anything in 2.0.0, please file an issue at GitHub.

As always, thanks to everyone running the pattern.

— FOSSonCloud