Starting with Mattermost v12.0 (October 2026), atmos/camo is no longer supported as an image proxy

Announcements
1

Why is atmos/camo support being dropped?

The atmos/camo project has been archived and is no longer maintained.

What will I see if I have atmos/camo configured?

If your config.json has ImageProxySettings.ImageProxyType set to atmos/camo, the server will log a configuration error on startup and fail to stat. The RemoteImageProxyURL and RemoteImageProxyOptions settings are also removed and will be ignored.

What are my options?

  • Switch to the built-in local image proxy. Set ImageProxySettings.ImageProxyType to local in your configuration. The local proxy is built into Mattermost, requires no external service, and provides strong protection against mixed-content image requests.

  • Disable the image proxy. Set ImageProxySettings.Enable to false if you do not require image proxying in your deployment.

What protections does the built-in local image proxy offer?

The local proxy includes the following mitigations:

  • SVG content blocking

  • Security response headers (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options)

When does this take effect?

Support for atmos/camo is removed in Mattermost v12.0 (October 2026). We recommend updating your configuration before upgrading.