chore(deps): update registry.rocket.chat/rocketchat/rocket.chat docker tag to v8.6.1 #880
peschmae
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/registry.rocket.chat-rocketchat-rocket.chat-8.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
8.3.1->8.6.1Release Notes
RocketChat/Rocket.Chat (registry.rocket.chat/rocketchat/rocket.chat)
v8.6.1Compare Source
Engine versions
22.22.32.3.18.01.64.1Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#41234 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41243 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41308 by @dionisio-bot) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.
(#41292 by @dionisio-bot) Ensures the
users.CreateTokenendpoint checks for theuser-generate-access-tokenpermission when generating a login token for another user(#41276 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room
Updated dependencies [89ab75ca9121feb289a0f5744a526361364b8867, c86d933c267e375b0b32585450cf513b6483c245]:
v8.6.0Compare Source
Release 8.6.0
Release Date: July 3, 2026
Support Window: Supported until January 31, 2027
Summary
Security and Compliance
Security improvements, authentication changes, data protection, and vulnerability fixes.
This release adds Virtru as an external attribute store option for attribute-based access control, selectable under Administration > Settings > ABAC, and deactivates users locked out in LDAP or Active Directory during sync. Sign-in with Apple is hardened with full identity token validation, the Apps Engine package parser is protected against prototype pollution, file deletion and the workspace fingerprint endpoint now require proper authorization, HTML is escaped in message exports and emailed data downloads, and incoming webhook integrations receive a bundled security hotfix, including an SSRF-related fix. Expired sessions now redirect to the login page, unverified users can resend their confirmation email from the login screen, personal access tokens configured to bypass two-factor authentication are accepted correctly, and PDF downloads from encrypted rooms keep their original format and filename.
Messaging and Collaboration
Features and fixes related to messaging, channels, discussions, and communication workflows.
Voice calls can now be popped out into a separate floating window that keeps all call controls while you navigate the workspace, LibreTranslate is available as an auto-translation provider alongside Google, DeepL, and Microsoft, and a new
rooms.joinAPI endpoint lets users join any room type, including discussions. Automatic translation now also covers users who joined rooms before setting a language preference, and direct messages with deactivated users become read-only. Fixes improve voice calls accepted from the mobile lock screen, bot assignment after agents reach their simultaneous chat limit, attachment accessibility and descriptions, message search with invalid regular expressions, false "Room not found" errors after reconnection, thread scrolling and reply behavior, jump-to-message after refresh, and overall UI stability across room, team, and account views.Platform and Extensibility
Developer platform, APIs, integrations, and application framework improvements.
A unified presence sync engine resolves user online status through a priority-based claim system with status expiration and previous-state restore, exposed via the users REST endpoint and Apps Engine user objects. Apps Engine room and user objects now include federation fields, a new endpoint removes custom sounds, and several REST endpoints were extended to mirror their deprecated DDP equivalents, which now log warnings and remain available until 9.0.0. Fixes address a server crash when a Marketplace app is updated twice in quick succession and a federation issue where editing or deleting a message stopped subsequent messages from syncing between servers.
Data, Storage, and Infrastructure
Database, performance, storage, and system-level improvements.
S3-compatible file uploads no longer fail when the region is empty or the bucket URL omits a scheme. Rooms open faster through parallelized and cached message-history loads, navbar search returns results sooner using cached subscriptions, and the Discussions list is virtualized for smoother scrolling and lower memory use on long lists.
Admin, Configuration, and Workspace Management
Administrative controls, configuration settings, and workspace management improvements.
Filipino (Tagalog) joins the available user and workspace language options, the workspace hashed URL now appears on the Manage > Workspace deployment card and in server startup logs, and avatar URL validation error messages preserve the exact URL submitted without additional encoding.
Engine versions
22.22.32.3.18.01.64.0Minor Changes
(#40826) Shows a confirmation modal when switching attribute store setting
(#40274) Adds the backend foundation for a unified presence engine with a priority-based claim system (internal > manual > external), status expiration, and previous state restore.
(#40634) Allows using Virtru as the attribute store for ABAC decisions.
Important
(#40900) Added LibreTranslate as a message auto-translation provider, alongside Google, DeepL and Microsoft. LibreTranslate can be self-hosted, enabling fully on-premise / offline message auto-translation. Configure the instance URL (and optional API key) under Admin → Settings → Message → Auto-Translate → LibreTranslate and select it as the Service Provider.
(#40532) Adds custom-sounds.delete API endpoint.
(#40711)
POST /v1/chat.deletenow accepts{ fileId, asUser? }as an alternative to{ msgId, roomId, asUser? }. WhenfileIdis provided the server resolves the owning message viaMessages.getMessageByFileIdbefore running the existing permission and deletion flow.(#40724) Added
POST /v1/e2e.requestSubscriptionKeys(replaces the deprecatede2e.requestSubscriptionKeysDDP method). Auth-gated, no body. Broadcastsnotify.e2e.keyRequestfor every encrypted room the caller is subscribed to without an E2E key, matching the DDP method's behavior. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.(#40724) Added
POST /v1/im.blockUser(replaces the deprecatedblockUser/unblockUserDDP methods). Body is{ roomId, block: boolean }—block: trueblocks the other DM participant,block: falseunblocks. Auth-gated and per-room via theRoomMemberActions.BLOCKdirective (DM-only). Both legacy DDP methods remain registered until 9.0.0 with deprecation logs pointing at the new route.(#40724) Added
POST /v1/settingsfor batched admin setting updates (replaces the deprecatedsaveSettingsDDP method). Body is{ settings: { _id, value }[] }. The endpoint requires authentication, enforces 2FA (twoFactorRequired: true), and runs the same per-setting permission chain (edit-privileged-settingORmanage-selected-settings+ per-id permission) and audit/notify side effects the DDP method already performed. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.(#40711)
GET /v1/spotlightnow mirrors the DDPspotlightmethod:usernames(comma-separated string),type(JSON-encoded{ users?, mentions?, rooms?, includeFederatedRooms? }) andridquery params;nickname/outside(users) anduids/usernames/fname(rooms);statuson each user is now optional — outside/federated users were already being returned without one and the previous required-field schema rejected them asResponse validation failed;Accounts_AllowAnonymousRead) to keep finding public channels through the navbar search.(#40711)
POST /v1/users.setPreferencesnow accepts an optionaldata.utcOffset(number) field. The value is stored at the user-document root viaUsers.setUtcOffset(not undersettings.preferences), matching what the legacyuserSetUtcOffsetDDP method did.(#40996) Added a new
rooms.joinREST endpoint that lets a user join any room type, replicating the behavior of the deprecatedjoinRoomDDP method. Unlikechannels.join, it resolves all room types through the sharedRoom.joinservice (access checks, join codes, federation and omnichannel rules). The client now usesrooms.joininstead ofchannels.join.(#40791) Exposes the
isFederatedandfederationfields for room and user objects in apps(#40202) Introduces popout functionality for voice calls
Patch Changes
(#40988) Added Tagalog (
tl) as a selectable interface language. It appears in the user's Account → Preferences → Localization → Language dropdown; interface strings fall back to English until translations are contributed (same approach as other not-yet-translated locales).Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40902) Fixes a memory leakage on the CodeMirror component (used by
code-typed settings)(#40759) Fixes S3 file upload failing when the region setting is empty or the endpoint is configured without a URL scheme
(#40702) Fixes
users.sendConfirmationEmailrejecting unauthenticated requests, which prevented unverified users from resending their verification email from the login screen(#40992) Fixes auto-translate not activating for users who set their language preference after joining rooms
(#40711) Migrate six client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):
loadMissedMessages→GET /v1/chat.syncMessagesjoinRoom→POST /v1/channels.join(channel-only; non-crooms now error via REST the same way they used to via DDP)userSetUtcOffset→POST /v1/users.setPreferences(newutcOffsetfield)deleteFileMessage→POST /v1/chat.delete(newfileIdbody shape)spotlight→GET /v1/spotlight(newusernames/type/ridquery params)listCustomSounds→GET /v1/custom-sounds.list(#40724) Migrate four client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):
deleteCustomSound→POST /v1/custom-sounds.deleteblockUser/unblockUser→POST /v1/im.blockUser(single toggle with{ roomId, block: boolean })saveSettings→POST /v1/settingse2e.requestSubscriptionKeys→POST /v1/e2e.requestSubscriptionKeys(#41017) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40767) Fixes an issue that allowed users to create a DM and send messages to a deactivated account
(#40857) Fixes non-deterministic comparator in team's channel desertion table
(#41009) Fixes an issue where updating an app in quick succession could crash the server.
(#41057) Fixes incoming integrations inability of reaching internal hosts by adding "ignoreSsrfValidation: true" to it
(#40788) Fixes error handling when using invalid regular expressions on message search
(#41007) Fixes the message list shifting when typing in the fully expanded message composer
(#40802) Escapes HTML tags in exported data
(#40982) Fixes an issue with embedded layout where users were able to receive VideoConf calls, causing the application to crash
(#40996) Fixed the "not subscribed" room screen not updating after joining a room. The join mutation invalidated a stale React Query key that no longer matched the open-room query, so the UI kept showing the join prompt until a manual page refresh. It now invalidates the correct
roomsreference key, so the room opens immediately after joining.(#40719 by @copilot-swe-agent) Fixes an issue that caused the UI to attempt to mark an unserved livechat room as read
(#41009) Fixes an issue where an app's bot user presence was incorrectly shown as Offline after updating it.
(#40849) Fixes the behavior when the login token expires to redirect the user to the login page
(#40842) Fixes an issue where temporary AD/LDAP lockouts would deactivate users on rocket.chat.
(#41046) Fixes an issue where editing or deleting a message in a federated room caused subsequent messages to stop syncing between servers
Note: this prevents the issue from happening, but does not restore rooms that are already affected. Recovering those requires a separate, one-time repair.
(#40956) fixes issue that caused threads to sometimes not scroll when sending messages
(#40684) Fixes an issue on ABAC audit page that sent local timestamps instead of UTC ones as filters to fetch audit logs
(#40889) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40706) Fixes missing permission check on the
POST /api/v1/fingerprintendpoint(#40991) Fixes rooms failing to open on transient network errors, and prevents a "Room Not Found" flash when opening a room with a local subscription
(#40635 by @copilot-swe-agent) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited
(#40839) Fixes an issue where
descriptionwas incorrectly being used as alternative text for image attachments(#41065) Fixes REST API endpoints that require two-factor authentication (such as
users.update) rejecting requests authenticated with a Personal Access Token created with "Ignore Two Factor Authentication", returningtotp-requiredeven though the token was meant to bypass the check. The two-factor authorization check now resolves the login token from the REST connection, sobypassTwoFactortokens are honored again.(#40954) Speeds up room opening by removing redundant work in the message history load. On the client, the prefetched first history batch no longer blocks on the message-list DOM before rendering, and the history pager no longer fires an extra
loadHistoryround trip just to reach a full page of visible messages when the latest page contains thread replies. On the server,loadHistoryreuses the already-fetched room document instead of querying it twice, and runs message normalization and the unread (first-unread + count) queries concurrently instead of sequentially.(#39273 by @metaloozee) Fixes an issue where ui crashes when message attachment fields contains non-string
valuefield(#40955) Fixes an issue where the channel selection modal would not load when removing a member from a team.
(#40864) Fixes an issue on
canAccessRoomwhereabacAttributeswere not fetched in some endpoint callsUpdated dependencies [6ae500ab8983b334d0df3e07925b610d0ff9d38c, 4319d3eda1df3cd45b8e2b7b2b193ae9798a9ade, 24dc6ec3cc19c2ef182a07e1f7c5368f67584d5c, 73e12e1707baea845395e0582892f65456598672, a7279cebc73edfa4b991eb593730c08e8f5e9001, ebc9c17b6ba63ee754320eadfba20c024c53c18f, 7380c44c751eff9ee624d80bf26370411ffed78b, a7279cebc73edfa4b991eb593730c08e8f5e9001, 3c47215f4724bf41a56950542feba7c2d5d9eb7f, 25722dbb970665c66d0acfee415650f96e52cd50, f4f361234f00bd44efe348df4355e9d3cf80efe0, 308e1c5c3a8f6432dc03472914f563d1c0d15bdf, 9a36221f1fbf5ca417325204637c9f32fe760443, f57901d91feaccedd00dee65b78775b20235825b, f57901d91feaccedd00dee65b78775b20235825b, f57901d91feaccedd00dee65b78775b20235825b, 9a36221f1fbf5ca417325204637c9f32fe760443, 9a36221f1fbf5ca417325204637c9f32fe760443, fa685d0ddfdf1167705a58b5d846a993144e3734, 6bd9182ae1d914a55e70866db43e8d2038f7be28, 6fa5378a940cbc809800b3c7d7c0639810bb0ab8, f63b965f82b0ddc590c633706f7c31c8c5251b53, 5d5edd8520ddb424bd336e3ec802c1f4a4e7d1ce, 9ab1cf6e088cc099f4fc2ba9460ce5dd41bd1dc2, ff751747f8a0637888364bde42ae18ac92a38768, 9861932cd7653c457a5b09e379fcb60a33947cf5]:
v8.5.2Compare Source
Engine versions
22.22.32.3.18.01.63.0Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#41235 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41244 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41293 by @dionisio-bot) Ensures the
users.CreateTokenendpoint checks for theuser-generate-access-tokenpermission when generating a login token for another user(#41277 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room
Updated dependencies [ac29d8a5fa4c032aa0dd9772eddaa060afd3e35e]:
v8.5.1Compare Source
Engine versions
22.22.32.3.18.01.63.0Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40917 by @dionisio-bot) Escapes HTML tags in exported data
(#40891 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40904 by @dionisio-bot) Fixes missing permission check on the
POST /api/v1/fingerprintendpoint(#40938 by @dionisio-bot) Fixes an issue where
descriptionwas incorrectly being used as alternative text for image attachmentsUpdated dependencies [01a184640f635866bf4c1c612696acc4eed62311]:
v8.5.0Compare Source
Summary
Security and Compliance
Security improvements, authentication changes, data protection, and vulnerability fixes.
This security update hardens access controls and token handling across translation, OAuth, Livechat, images, SAML/CAS login, and file uploads. It now enforces room membership before translated message content is returned, revokes OAuth tokens when users are deactivated, removes visitor tokens from
livechat/visitors.info, blocks unsafe inline image URLs, and applies stricter validation across SAML SSO, CAS login, OAuth token scoping, and file upload ownership/MIME checks. Integrations callingautotranslate.translateMessagewithout proper room access will now receive401or403responses. Integrations that relied on the token field from livechat/visitors.info must now get the token through the visitor-creation flow.Messaging and Collaboration
Features and fixes related to messaging, channels, discussions, and communication workflows.
This update improves usability, performance, accessibility, and calling stability across the workspace. It adds a new sidebar Drafts group for rooms with unsent messages, virtualizes the message list to improve performance in long conversations and threads, and fixes several thread navigation and scrolling issues. It also restores and stabilizes voice-call behavior, improves keyboard and assistive-tech support across exports, modals, and forms, and allows users to start audio or video recordings even after typing in the composer.
Omnichannel permissions and room details were also tightened by hiding the Delete all closed chats action from unauthorized users and restoring room-scoped custom fields in the Room Information sidebar. Additional fixes cover presence lookup, signed URL expiry fallback, timezone-aware timestamps, embedded mode entry behavior, portal/iframe rendering, and safe fallback for invalid message date formats.
Platform and Extensibility
Developer platform, APIs, integrations, and application framework improvements.
This update adds new REST APIs for custom sound creation and updates with upload validation, while deprecating the older custom sound Meteor methods. It also adds FreeSwitch extension lookup support, exposes room context in more UIKit interactions, and moves internal app-management code to a new package without changing the public Apps Engine API. Minor fixes include the default notification sound test button and User Dropdown UIKit button placement.
Data, Storage, and Infrastructure
Database, performance, storage, and system-level improvements.
This update improves performance and observability for large deployments. It adds optional room-scoped message search indexing, configurable markdown parse limits for very large messages, updated runtime and Docker base versions, cached user records for faster DDP permission checks, and expanded Prometheus metrics for HTTP, DDP, and queues. Runtime baseline updated to Node.js 22.22.3 and Meteor 3.4.1.
Admin, Configuration, and Workspace Management
Administrative controls, configuration settings, and workspace management improvements.
This update improves ABAC administration with a new tabbed admin page, granular per-tab permissions, better room lookup, and safer handling of ABAC-managed rooms. It also exposes ABAC attributes to apps through a new secure-fields permission and adds an experimental setting to route real-time communication through the Rocket.Chat SDK DDP client.
Engine versions
22.22.32.3.18.01.63.0Minor Changes
(#40343) Swap usage of internal @rocket.chat/apps-engine internal APIs to @rocket.chat/apps package
(#40408) Adds 4 new permissions (assigned to admins by default) to control the visibility of each tab inside the ABAC Administration panel
(#40341) Hides the room announcement, topic and description from the Administration > Rooms panel for ABAC managed rooms. In the channel sidebar Edit Channel form those fields stay visible to room members but are disabled, and the API rejects edits to them.
(#39617) Adds new API endpoints
custom-sounds.createandcustom-sounds.updateto manage custom sounds with strict file validation for size and specific MIME types to ensure system compatibility.(#40463) Allows apps with the right permission to read room's ABAC attributes.
(#40604) Adds the capability for fetching a user by their sip extension to the apps
(#38225) Adds a new "Drafts" group to the sidebar, providing quick access to all rooms with unfinished messages.
(#40397) Adds the
USE_ROOM_SEARCH_INDEXenvironment variable. When set totrue, the messages collection's text index is created as{ rid: 1, msg: 'text' }instead of the default{ msg: 'text' }. The compound shape lets per-room$textsearches useridas a prefix, dramatically reducing the portion of the index scanned on workspaces where global search is disabled.The index is reconciled on every startup: if the existing text index already matches the desired shape, nothing happens; otherwise the stale text index is dropped and the desired one is recreated. Unsetting the variable on a later boot reverts to the default shape.
(#40612) Adds
freeSwitchExtensionas a query parameter forapi/v1/users.info(#39858) Adds support to room information on ViewSubmit and ViewClose events for ContextualBar surface
(#40430) Adds a new admin setting
Use_RC_SDK(General → Use Rocket.Chat SDK) that opts the workspace into the experimental SDK-over-DDP transport. When enabled, the client routes Meteor DDP traffic through@rocket.chat/ddp-clientover a single WebSocket instead of the legacy Meteor stream. The flag is dormant by default; the server surfaces the value via a<meta name="rc-sdk-transport-enabled">tag, and the client also honors a per-tab?sdk_transport=on|offURL parameter and arc-config-sdk_transportlocalStorage key (URL > localStorage > meta tag).Patch Changes
(#39858) Fixes an issue that prevented BlockAction interactions from having room information when triggered in a ContextualBar surface
(#40524) Ensures OAuth tokens are cleaned up after user deactivation
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40537) Fixes an issue that allowed a room converted from private to public (while abac is disabled) to retain its abac attributes (if any)
(#39859) Fixes an issue where thread content would disappear after clicking "Jump to recent messages".
(#40063) Fixes the missing edited indicator for the main parent message in the thread panel to ensure visual consistency with the main channel view.
(#40357) Adds an accessible label to the system-messages multi-select in the channel edit panel so screen readers announce its purpose.
(#40100) Fixes intermittent "Channel Not Joined" screen when opening rooms in embedded mode.
(#40513) Fixes the
users.presenceendpoint returning an empty array when called with multiple comma-separated IDs, caused byajvQuerycoercing the string into a single-element array after the OpenAPI migration(#40496) Ensures that deactivated users have their login tokens cleaned up in users.deactivateidle
(#40405) Disables SAML login when it is set to validate signatures without the proper configuration for it
(#40423) Allows users to search for attribute values when assigning them to rooms
(#40335) Fixes test button not playing default sound in Notifications Preferences
(#40528) Ensures the Meteor method for translateMessage validates access and types
(#40420) Fixes Insert Timestamp relative time preview not updating on input changes and losing the user's locale after the first refresh tick.
(#40456) Fixes signed URL generation for S3 and Google Cloud Storage when the expiry setting is below 5 seconds, which previously caused expired or invalid preview URLs. Adds a dedicated URL expiry setting for Google Cloud Storage since it was incorrectly reusing the AWS S3 setting.
(#40501) Ensures the visitor token is not present in the visitors.info response
(#40405) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40613) Sanitizes image URLs in rendered messages to block
javascript:,data:, andvbscript:schemes — matching the protection already applied to markdown links. Defense-in-depth against XSS via crafted markdown like.(#40508) Ensures the autotranslate.translateMessage endpoint checks for room access
(#40448) Fixes action buttons added by apps being rendered in the Marketplace Menu rather than the User Menu
(#40635 by @copilot-swe-agent) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited
(#40499) Fixes an issue where some actions made by the abac service were not broadcasting to clients, which affected reactivity
(#40492) Fixes issue that displayed the 'Delete all closed chats' button when user lacks
remove-closed-livechat-roomspermission(#40393) Fixes a
date-fnscrash on routes that mount before the public settings stream finishes loading.useFormatDatewas passingString(undefined)(the literal"undefined") toformatDatewhileMessage_DateFormatwas momentarily unloaded —date-fnsrejects that token because it contains an unescapedn. The hook now uses'LL'as the default token viauseSetting's second argument, so the formatter always receives a valid format string.Updated dependencies [90f15e32ae843ed146ccf711ee3201408d1e8731, f7d47dd3517ec14ca2ec5c3c95fcdf9e1e2fb8b0, cdb264fec803e234a6ad2000018b31d4b2074e99, 2a927fa1362c9d4bb04bb8e26f23a6e3753d9cea, bede0e2528bb053cb913e93ccf30d78a1c84bc76, bede0e2528bb053cb913e93ccf30d78a1c84bc76, bede0e2528bb053cb913e93ccf30d78a1c84bc76, 4c3984593017d59edd631bf8ae4f35f9d3c3db36, 7f2bdf1809804de7a95c54c3892da30f058ee13d, b6b04aadfcc8558f888b334e37c46a77e5816237, ad7d42400ea36f1eb0aaf7cc3361c77fdabf9ebc, 4704bf81ca370f120af32185a7c55407a26f8514, d427b808c1f79d9d1baa05bb5b5ef805b6ef5f6d, ebc9babf55dd26613027c28dcacf77909116b342, f392d5cc8d956c199f557dcd6beb52094232499d, 2198d9ea565b06f92e3dec29891890086f62f9df, fac64728505b312d5da786e92d3134450ce4a7c1, 12897e25d0dc25b7373f5264d38f38a5a7444257, e45585b70a3a7b75434c88e4b2ea9af0a0764a76, 0b7a76367d650793c271160e01798ebbb5fe0d26, 51833064591b91140d17e403389e1abbc5d9ef7a, 2d32e52073dd1a68bd12a093b3a673ae297cb4ee, 2a927fa1362c9d4bb04bb8e26f23a6e3753d9cea, b1c2668b74bfb49ebaefe2f581b2f8be5d4d1dd6, 90f15e32ae843ed146ccf711ee3201408d1e8731, 22c8d3283f0ea3004fe94c51f8bb32dfb40a0f4f]:
v8.4.5Compare Source
Engine versions
22.22.22.3.18.01.62.0Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#41236 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41245 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41294 by @dionisio-bot) Ensures the
users.CreateTokenendpoint checks for theuser-generate-access-tokenpermission when generating a login token for another user(#41278 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room
Updated dependencies [bd5395461225863424e52ecc7ca6e1b0e6552135]:
v8.4.4Compare Source
Engine versions
22.22.22.3.18.01.62.0Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40918 by @dionisio-bot) Escapes HTML tags in exported data
(#40892 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40905 by @dionisio-bot) Fixes missing permission check on the
POST /api/v1/fingerprintendpoint(#40939 by @dionisio-bot) Fixes an issue where
descriptionwas incorrectly being used as alternative text for image attachmentsUpdated dependencies [42461654757b3b5b9fa454bf4867542170b48126]:
v8.4.3Compare Source
Engine versions
22.22.22.3.18.01.62.0Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40771 by @dionisio-bot) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited
Updated dependencies []:
v8.4.2Compare Source
Engine versions
22.22.22.3.18.01.62.0Patch Changes
(#40627 by @dionisio-bot) Ensures OAuth tokens are cleaned up after user deactivation
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40527 by @dionisio-bot) Fixes the
users.presenceendpoint returning an empty array when called with multiple comma-separated IDs, caused byajvQuerycoercing the string into a single-element array after the OpenAPI migration(#40559 by @dionisio-bot) Ensures that deactivated users have their login tokens cleaned up in users.deactivateidle
(#40539 by @dionisio-bot) Ensures the Meteor method for translateMessage validates access and types
(#40577 by @dionisio-bot) Ensures the visitor token is not present in the visitors.info response
(#40547 by @dionisio-bot) Ensures the autotranslate.translateMessage endpoint checks for room access
Updated dependencies [b0c593db9bc0bbbb603e673ddcdc48aad4f4e721, f422eb613d8cae43dc1e44d71b6ecb5a0a9c5d92, 3a3f0e1103bd0b8aaf93c16300ed664aed7a67a1]:
v8.4.1Compare Source
Engine versions
22.22.22.3.18.01.62.0Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40410 by @dionisio-bot) Disables SAML login when it is set to validate signatures without the proper configuration for it
(#40459 by @dionisio-bot) Allows users to search for attribute values when assigning them to rooms
(#40410 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
Updated dependencies [5b291c38600757482aaf261a02487abdf5f14007]:
v8.4.0Compare Source
Summary
Security and Compliance
Security improvements, authentication changes, data protection, and vulnerability fixes.
This release improves SAML logout validation, prevents banned users from bypassing federation re-invites, adds sensitive-field redaction for app logs, and fixes an RBAC issue that allowed broader access to app log endpoints.
Messaging and Collaboration
Features and fixes related to messaging, channels, discussions, and communication workflows.
Adds image previews, image alt text, composer formatting shortcuts, global keyboard shortcuts, and better screen reader announcements for search results. It also includes several messaging, Livechat, invitation, read receipt, notification, thread view, and UI fixes.
Platform and Extensibility
Developer platform, APIs, integrations, and application framework improvements.
Adds more control and visibility for developers and integrations, including per-webhook Babel transpilation settings, improved media call APIs, email filtering for user APIs, expanded settings actions, better DDP error handling, and improved app action behavior.
Data, Storage, and Infrastructure
Database, performance, storage, and system-level improvements.
Focuses on performance and package-size improvements. Read receipts can now be archived to cold storage, and the Docker image and frontend bundle dependencies were slimmed down.
Admin, Configuration, and Workspace Management
Administrative controls, configuration settings, and workspace management improvements.
Adds ABAC improvements through Virtru and LDAP sync, mobile ringing for voice calls, clearer Auto Away preference hints, avatar URL validation, custom sounds pagination, Outlook Calendar toggle enforcement, and fixes for admin UI stability and outdated messaging.
Engine versions
22.16.02.3.18.01.62.0Minor Changes
(#40181) Adds file thumbnails with image preview to the message composer attachments
(#40141) Adds a new REST endpoint to accept or reject media calls without an active media session
(#39535) Adds externalIds field to livechat visitors for external platform identification.
(#40160) Adds a
skipTranspileflag (defaultfalse) to webhook integrations. When set totrue, the integration script is stored as-is without Babel transpilation — matching the 9.0.0 default where Babel is removed entirely. Admins can flip the flag per-integration to validate strict-mode compatibility before upgrading. The field is deprecated and will be removed in 9.0.0.(#39495) Updates omnichannel routing so agents with
offlinestatus are always excluded from assignment. TheLivechat_enabled_when_agent_idlesetting now only affects agents withawaystatus.(#40093) Adds new API endpoints to load the user's current voice call state from the server
(#40096) Introduces redaction of potentially sensitive data in logs related to apps-engine
(#39989) Adds email search filter to
users.listandusers.infoendpoints.(#39845) Adds support for setting up Virtru as a PDP (Policy Decision Point) for ABAC.
(#38623 by @copilot-swe-agent) Introduces Cold Storage Archiving for Read Receipts to improve performance and scalability in large deployments.
Enterprise workspaces can now archive older read receipts into a dedicated cold storage collection, reducing the size of the primary read receipts dataset and improving query performance in environments with high message volumes.
This feature is disabled by default and can be enabled through the new setting:
Message → Read Receipts → Enable Read Receipts Cold Storage
This feature is especially recommended for deployments with high message throughput and long data retention requirements, where reducing the size of hot collections significantly improves overall system responsiveness.
(#39393 by @copilot-swe-agent) Added auto-wrap selected text in composer with matching delimiters
(#40075) Adds alternative text field to image uploads to improve accessibility
Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40058) Fixed UI becoming unresponsive after clicking "See on Engagement Dashboard" from the workspace info card, which required a manual page refresh to recover.
(#39741) Fixes empty notifications sent when a voice call ends
(#40095) LDAP
sync nowaction now syncs user's abac attributes too.(#39246) Fixes an issue where messages appeared as unread even when all active users had read them. Read receipts now correctly ignore deactivated users.
(#40125) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40051) Fixes user status indicator to show disabled state when presence broadcast is turned off
(#40061) Fixes a bug that could remove all of a user's subscriptions when the user was re-added to a room while still banned.
(#40053) Fixes Slack messages being incorrectly saved on import
(#38994) Adds SAML redirect validation by matching request parameters and configured IdP SLO
(#39986) Fixes an issue where the outlook calendar action isn't being reactive based on the setting
(#39868) Fixes app actions ignoring role filters and i18n translation
(#40078) Fixes "Reply in direct message" action not being shown when user has permission to create DMs but no existing conversation exists.
(#40169) Moves keyboard shortcuts from the contextual bar into a modal accessible from the user menu, and adds a hotkey to open it.
(#39883) Fixes the issue of the lacking MessageUpdater not being available to apps during runtime
(#40114) Fixes a bug preventing users to join a room after being banned and unbanned.
(#39823) Fixes an issue where the apps-engine updateStatusText method isn't updating the app user status text properly
(#39892) Fixes an issue where the expanded thread view was overlapping the navbar
(#40113) Fixes inability to use custom sounds pagination action buttons when the amount exceeds the specified limit
(#39985) Adds error feedback when clicking on a mentioned room you don't have access to
(#40175) Fixes an issue where the Omnichannel routing system ignored the
Livechat_accept_chats_with_no_agentssetting. Now, offline agents are correctly considered for assignment when the setting allows it.Updated dependencies [53e32c7df1bf40598d65d170fd50c55f752f2951, 53e32c7df1bf40598d65d170fd50c55f752f2951, 543b6c8cbde0d084a3a923acf4845b68db80206a, 43642220a5cc8124ecc6f3956150c42c5b390c90, 2632182e429d337325fe3b1e28ea52ab12d99591, 21cd54f87de5837fe6c999a44bd15be34b9fe905, 278b84f78360e53792a2e5d7620615039a0e15e9, 95a82f72dd45fc51d54bb1beed295315facf9109, 12c44d2db65af9f90c741da621164f5738fc19f5, 24b3671fe61b8b09c6a1b5dc6401b503b3fb92a0, 5cff1f41d388b036c77a8f774f233b1921e9066e, 9713af36f5c0d673f2d2093015f322341706bab0, 53e32c7df1bf40598d65d170fd50c55f752f2951, 53e32c7df1bf40598d65d170fd50c55f752f2951, f3fa3ee2f2e53b777de9abd466f1b76a1ec1b96c, 32f67f20fbcfdab051c7d2f99d8a7a3d18ebf474, e792aba7f56f1b2ece62951087591819995a1446, f3649b22edfe6497ec2d7f3d7b8ec655466ad4a6, c544b805d1c03f8eae9d061cd48838206207a7c9, 4e99ff6c1a99ac569cf444f9de9b5fe5ac3262b2, 8c0e16ca29b393cfa50b425520db48ba5a74f678, 95a82f72dd45fc51d54bb1beed295315facf9109, 9f38b54c671ba3f0583c0d248a2afe09652fcdf4, f4dfb8ddc2049692371aeb084110b5768151b5df, 2356c889ed82507e1dd1208fab6d4ab186701fef]:
v8.3.7Compare Source
Engine versions
22.16.01.43.58.01.61.1Patch Changes
Bump @rocket.chat/meteor version.
(#41237 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41246 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41295 by @dionisio-bot) Ensures the
users.CreateTokenendpoint checks for theuser-generate-access-tokenpermission when generating a login token for another user(#41280 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room
Updated dependencies [c15e433d35357f365ec5768d3420cb9c302b4bc4]:
v8.3.6Compare Source
Engine versions
22.16.01.43.58.01.61.1Patch Changes
Bump @rocket.chat/meteor version.
(#40919 by @dionisio-bot) Escapes HTML tags in exported data
(#40894 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40906 by @dionisio-bot) Fixes missing permission check on the
POST /api/v1/fingerprintendpointUpdated dependencies []:
v8.3.5Compare Source
Engine versions
22.16.01.43.58.01.61.1Patch Changes
Bump @rocket.chat/meteor version.
(#40770 by @dionisio-bot) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited
Updated dependencies []:
v8.3.4Compare Source
Engine versions
22.16.01.43.58.01.61.1Patch Changes
(#40628 by @dionisio-bot) Ensures OAuth tokens are cleaned up after user deactivation
Bump @rocket.chat/meteor version.
(#40561 by @dionisio-bot) Ensures that deactivated users have their login tokens cleaned up in users.deactivateidle
(#40540 by @dionisio-bot) Ensures the Meteor method for translateMessage validates access and types
(#40578 by @dionisio-bot) Ensures the visitor token is not present in the visitors.info response
(#40548 by @dionisio-bot) Ensures the autotranslate.translateMessage endpoint checks for room access
Updated dependencies [f5c50ca2ea991ef7bf4f41a0d05426df6ee98a03, ebf60544579f73cf113ba4efa5c29db0dc902999]:
v8.3.3Compare Source
Engine versions
22.16.01.43.58.01.61.1Patch Changes
Bump @rocket.chat/meteor version.
(#40411 by @dionisio-bot) Disables SAML login when it is set to validate signatures without the proper configuration for it
(#40415 by @dionisio-bot) Fixes Slack messages being incorrectly saved on import
(#40411 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
Updated dependencies [e7bf76778fd07b9b3cb83182d62175fe0e820e74]:
v8.3.2Compare Source
Engine versions
22.16.01.43.58.01.61.1Patch Changes
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40130 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
Updated dependencies [356a6026dda4821a3e28752def7c8619ac860975]:
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.