Mattermost 10.5: Security Shift for Teams Choosing Between Slack and Discord

Mattermost v10.5, released in March 2025 alongside GitLab 17.10, prioritized security and performance over new user-facing features. This release is critical for teams evaluating self-hosted alternatives to cloud-based platforms like Slack and Discord. The update addresses a specific bug in the bundled Jira plugin v4.2.0 that could cause configuration settings to disappear, prompting administrators to upgrade directly to v4.2.1 or later versions. For organizations operating in regulated environments, this version reinforces Mattermost’s position as a sovereign collaboration tool designed for air-gapped networks where data sovereignty is non-negotiable.

Infrastructure Changes That Affect Deployment

The most significant operational change in v10.5 is the discontinuation of official server builds for Microsoft Windows. Administrators must migrate existing installations to Linux builds immediately to maintain access to future updates. This decision simplifies the support matrix but forces Windows-centric IT teams to reconsider their infrastructure choices. Additionally, the platform stopped supporting manual plugin deployment, requiring administrators to prepackage bundles rather than copying files directly into the server directory. This shift enforces stricter version control and reduces the risk of configuration drift in production environments.

Performance improvements are evident in the webapp, where PluginLinkComponent tooltips now unmount from the DOM by default. Plugins that register link tooltips via registerLinkTooltipComponent must handle mounting and unmounting scenarios correctly, as components only mount when a link is hovered or focused. This change significantly improves page load times and memory usage for servers with many active plugins. However, developers maintaining custom plugins need to audit their code to ensure compatibility with this new lifecycle management.

Compliance export functionality also underwent substantial restructuring. Instead of exporting a single zip file containing all batch directories, the system now exports a single directory with each batch as its own zip file. This new structure improves organization and allows for at least a 50% improvement in export performance. System administrators should review their data retention policies, as field semantic meanings were clarified and new fields added to the output formats. These changes aim to maintain backwards compatibility while fixing logic bugs found in previous versions.

Strategic Positioning Against Cloud Competitors

Mattermost targets enterprises and government bodies that require zero-trust, air-gapped collaboration, distinguishing it sharply from Slack and Discord. While Slack offers the best user experience and over 2,600 integrations, it remains a closed-source, cloud-dependent service. Discord provides generous free tiers and always-on voice channels ideal for developer communities, but it lacks enterprise compliance features like SSO and HIPAA certification. Mattermost fills the gap for teams needing full source code access, white-labeling capabilities, and strict data residency controls.

The pricing model reflects this focus on high-stakes deployments. Mattermost licenses are sold as prepaid annual subscriptions based on activated users, with each server requiring its own license key. High Availability configurations sharing a single database count as one server, but non-production environments like development and staging each need separate keys. Premier Support customers can obtain up to four non-production license keys, whereas others must contact their account team for assistance. This granular licensing approach ensures that every instance, whether federated or standalone, is accounted for in the security perimeter.

Critics argue that the cost for self-hosted instances can be prohibitive for smaller teams, with some reporting monthly fees around $400 for modest user counts. One user noted that paying such amounts for software running on their own hardware feels extortionate, especially when breaking changes have caused previously functional plugins to cease working. Despite these complaints, Mattermost continues to expand its mission into national security and critical infrastructure, offering native automatic channel translation and self-hosted AI options that keep sensitive data entirely within the organizational boundary.

For teams currently using Slack or Discord, the decision hinges on whether data sovereignty outweighs convenience. If your organization operates under DDIL conditions or strict data-residency rules, Mattermost is the only viable option among the three. The question remains whether the operational overhead of managing Linux servers and prepackaged plugins justifies the security guarantees for mid-sized companies without regulatory mandates.