main
test_slack_importer: Re-focus Slack thread conversion tests.
thumbnail: Show the first few frames of large animated images.
Fix missing zerver/tests/__init__.py.
alert_words: Use bulk query for case-insensitive word deletion.
attachments: Removing an Attachment should remove its ImageAttachment.
upload: Add wrappers for externally-used backend methods.
auth: Reject OIDC logins with an unverified email address.
ruff: Fix ISC004 Unparenthesized implicit string concatenation in collection.
cache: Do not fail the request on cache-set failures.
streams: Fix checking metadata access for web-public streams.
streams: Support per-stream default for push notifications.
tests: Check for warnings from OpenAPI deprecated parameters.
channel-folders: Send event when reordering channel folders.
checks: Give settings.py advice under MANUAL_CONFIGURATION.
python: Reformat with Ruff formatter.
video_calls: Fix an error name and a typo in the docs.
custom_profile_fields: Rename internal "select" identifiers.
test_decorators: Fix request.POST mutation typing.
tests: Add set_user_role helper method to ZulipTestCase.
upload: Make upload backend instantiation lazy.
push_notifications: Delete E2EE device records on API key regeneration.
digest: Fix digest email context generation timing out.
portico: Describe the Zulip Foundation and current team.
drafts: Check that the sender can access the recipients of a DM draft.
push_notifications: Skip legacy notifications when E2EE is required.
test-helpers: Add helper to create a demo organization for a test.
send_email: Skip the ScheduledEmail table for 0-delay emails.
event_queue: Don't send new message events to unsubscribed guests.
markdown: Move convert_html_to_markdown to a new library file.
bots: Rename SERVICE_BOT_TYPES to MESSAGE_TRIGGERED_BOT_TYPES.
register: Improve idle_queue_timeout and document.
settings: Remove PREFER_DIRECT_MESSAGE_GROUP.
exception-reporter: Add ZulipExceptionReporterFilter with POST masking and settings removal.
requirements: Switch from circuitbreaker to pybreaker.
apps: Provide arm64 app build by default for macOS.
users: Optimize check_can_access_user.
ruff: Bump target-version from py38 to py310.
test_home: Sort expected_state_data_keys alphabetically.
tests: Use mocked language list to test languages without translation.
import: Reset module-level id maps at the start of each realm import.
integrations: Ignore disabled integrations in screenshot config test.
ruff: Fix B017 `assertRaises(Exception):` should be considered evil.
tests: Consistently JSON-encode ‘to’ parameter
message_edit: Compute topic_participant_user_ids for embeds.
llms_txt: Correct how to translate a conversation URL to API params.
email_mirror: Skip overlapping IMAP polls rather than piling up.
markdown: Fetch Dropbox folder/file previews asynchronously.
thumbnail: Improve logging for thumbnail failure case.
mattermost: Handle users without team in combine_into_one_realm mode.
message_cache: Remove is_incoming_1_to_1 recipient_id substitution.
CVE-2026-40300: Use allowlist for edit history moves-only visibility.
notifications: Fix AssertionError on moving messages with bot mentions.
user_topics: Match muted topics by joining, not a clause per topic.
message-move: Improve time limit error for "change_all" moves.
message_send: Return `message_url` and `message_link` in send response.
message_summary: Replace litellm with the OpenAI Python SDK.
CVE-2026-25742: Restrict topic access when spectator access is disabled.
direct_messages: Always use DM groups if they exist.
import_util: Filter out stale records from failed parallel downloads.
migration_status: Refactor `parse_migration_status`.
migrations: Fix invalid deleted user "email" field values.
zephyr: Remove Zephyr mirroring support.
variables: Correct instances of misspelled 'message'.
navigation_views: Add backend for navigation views in left sidebar.
user_agent: Parse User-Agent string using ua_parser library.
push_notifications: Skip enqueuing notif for users without push devices.
python: Normalize quotes with Black.
onboarding: Replace dict[str, Any] with dataclass.
api-docs: Document POST /realm/deactivate.
s3: Disable Smokescreen proxy for boto3 at startup in every process.
outgoing_webhook: Serialize widget_content to JSON string.
test_parallel: Swap to barriers instead of a crude sleep().
populate_db: Fix -o flag not spreading messages across days.
presence: Restore legacy fields on single-user presence endpoint.
push_registration: Match APNs tokens case-insensitively on cleanup.
ruff: Fix RUF059 Unpacked variable is never used.
soft_deactivation: Allow a dedicated queue for soft reactivations.
rate_limiter: Remove Tornado in-memory backend, use Redis.
reaction: Remove user object from reaction events.
refactor: Rename `huddle` to `direct_message_group` in non API.
realm: Handle plan_type set to a paid plan without Customer.
emoji: Make RealmEmoji.author non-nullable.
export: Update status of RealmExport rows while exporting.
linkifiers: Handle optional groups in expand_reverse_template.
playgrounds: Validate language input for spaces and reserved keywords.
scheduled_messages: Migrate to typed_endpoint.
mypy: Enable new error explicit-override.
test_reminders: Extract helper for silently-dropped-reminder asserts.
zerver: Remove now-unused report/ endpoints.
retention: Send events about message deletion via retention policy.
data_import: Use dataclass to handle attachment records.
api: Update saved snippets edit endpoint.
scheduled_messages: Skip failure DM for cross-realm system bot senders.
sync: Truncate simple text custom profile field values when too long.
ruff: Fix TRY401 Redundant exception object included in `logging.exception` call.
settings: Make SHARED_SECRET mandatory.
ruff: Fix UP035 Import from `collections.abc`, `typing` instead.
rate_limiter: Update Redis rate limiter to use in-server GCRA.
create_user: Stop creating personal recipients.
slack: Pass convert_slack_threads=True in self-serve flow.
soft_deactivation: Serialize per-user reactivation with a row lock.
queue: Rename queue_json_publish to queue_json_publish_rollback_unsafe.
tests: Move subscription properties test to new file.
tabbed-instructions: Delete activate_correct_tab.
thumbnail: Tolerate a missing content-type in missing_thumbnails.
timeout: Rename to unsafe_timeout.
requirements: Remove dateutil.
url_encoding: Encode * character so that it skips strong em markdown.
tornado: Report errors as JSON instead of rendering portico pages.
avatar: Add support to generate avatar using Jdenticon.
upload: Don't hold a read open on S3 objects during self-copy.
ruff: Enable B008 function-call-in-default-argument.
zerver: Migrate some files to typed_endpoint.
upload: Resolve avatar upload content type in the callers.
url_decoding: Add `parse_narrow_url`.
internal_url: Encode characters which get encoded by urllib.
portico: Remove redundant sidebar elements from API pages.
user_groups: Allow bots to access all user_groups API endpoints.
user_status: Allow bots with role=admin to change user status.
user_topics: Fix case-insensitive prefetched visibility-policy lookup.
users: Don't expose custom profile fields to spectators.
validator: Add check_iso_datetime.
webhooks: Add helper function to get data from external services.
welcome-bot: Only send message with custom text when testing.
ruff: Fix UP006 Use `list` instead of `List` for type annotation.
user_settings: Add support to bulk change user setting.