Loomio - Package Updates

[Package Updates]

[1.16.0]

• Update loomio_channel_server to 782f06e

[Package Updates]

[1.16.1]

• Update loomio to 3.0.10
• Full Changelog
• Unsubscribe from poll via email footer link - stance_created was missing the unsubscribe link
• Fix translations and ensure we don't have any missing placeholders
• Attempt to address stance voting bug, where poll option ids were from another poll
• Show error and offer to reload if loading fails
• return a "message was not delivered" email when people reply to notifications email address rather than reply-to value

[Package Updates]

[1.16.2]

• Update loomio to 3.0.11
• Full Changelog
• Rename Thread and Decision to Discussion and Poll by @robguthrie in #11995
• Add B2 API endpoint for creating comments by @etiennechabert in #11963
• update email settings page to see each group setting by @robguthrie in #11947
• automatic translation of user generated content by @robguthrie in #11954
• auto translate user content in emails by @robguthrie in #11982
• Add zh_CN locale by @robguthrie in #12008
• Fix RFC 2047 encoded email subject headers not being decoded by @etiennechabert in #11964
• addressing error: Invalid Stance: mismatched poll_options by @robguthrie in #11979
• Fix poll option deletion by preserving _destroy parameter by @etiennechabert in #12017
• Fix NoMethodError in avatar_kind for Rails 7.2 by @etiennechabert in #11949

[Package Updates]

[1.17.0]

• Update loomio_channel_server to 9408afb

[Package Updates]

[1.17.1]

• Update loomio to 3.0.12
• Full Changelog
• Upgrade to Tiptap v3 by @robguthrie in #12026
• Autotranslate off by default
• Add zh_tw locale
• fix for missing poll actions menu
• say "superseded" rather than "outdated" when someone changes their vote
• fix problem removing delegate status from user
• make user content h1's bolder

[Package Updates]

[1.17.2]

• Update loomio to 3.0.13
• Full Changelog

[Package Updates]

[1.17.3]

• Update loomio to 3.0.14
• Full Changelog
• I believe this release fixes #​11903 - the edit comment bug.

[Package Updates]

[1.17.4]

• Update loomio to 3.0.16
• Full Changelog
• The app would not boot due to redis and sidekiq connection_pool incompatibilities
• With FEATURES_DISABLE_EMAIL_LOGIN=1, and someone signs in via SSO, and they don't have a Loomio account we just create user and sign them in. No link/Create account screen (and no Terms of Service acceptance either).
• You can prevent users changing their name, email, username. Set LOOMIO_SSO_FORCE_USER_ATTRS=1
• How do people join? supports "Anyone can join. Meaning registered users can just click Join group - no invitation or approval required. Set FEATURES_DISABLE_CREATE_USER=1 and Group privacy to closed.
• List in group directory, means the group will show on /explore (also linked from the sidebar as Find a group. Set FEATURES_EXPLORE_PUBLIC_GROUPS=1

[Package Updates]

[1.17.5]

• Update loomio to 3.0.17
• Full Changelog
• Fix duplicate email crashes in OAuth and SAML SSO authentication
• remove unused canViewPublicGroups code
• Prevent non-members from seeing tags on closed groups
• remove hiredis gem

[Package Updates]

[1.17.6]

• Update loomio to 3.0.18
• Full Changelog
• Add LOOMIO_RESTRICT_EXPLORE_TO_SIGNED_IN_USERS by @​robguthrie in #​12143
• Add polls to vote on page by @​robguthrie in #​12142
• Replace invite-only terminology with direct discussions by @​robguthrie in #​12144
• fix for missing translation on invite only discussions page

[Package Updates]

[1.17.8]

• Update loomio_channel_server to 1cb973b

[Package Updates]

[1.17.9]

• Update loomio to 3.0.20
• Full Changelog
• Convert HAML view templates to Phlex
• Replace SocketIO with ActionCable (remove loomio_channel_server)
• Move hocuspocus server into the main Loomio repository
• Handle Matrix bot notfications from Rails app
• Fix OAuth login finding orphan identities instead of linked ones.
• Change user avatar email/print partial to say user name rather than initials - So you can give the print view of a thread to an AI chatbot and it can understand who is talking
• Add LOOMIO_VERIFY_PARTICIPANTS_ADMIN_ONLY to restrict verify participants to admins only - Recently we introduced the "Verify participants" feature on polls. This means you can audit who was invited to an anonyous poll (to ensure that the admin did not invite, eg fake accounts), without revealing how voters voted. This flag makes this feature only available to admins, for member privacy.
• Show specific errors in flash messages - Now when there is an error submitting a form, it will say what the problem is, rather than a generic "Please check the form".
• Add remove logo and cover photo to group settings - You can now remove your group logo if you want to.

[Package Updates]

[1.17.10]

• Update loomio to 3.0.21
• Full Changelog
• Changes to the Discussion and Poll templates UI. I've had people tell me they couldn't find how to create a template. Now there is a New template button, which opens the example templates page, you can use an example as the starting point for a new template.
• Fewer discussion templates in a group by default. Updates to the Sense Check poll options, so they're more helpful.
• Materialize default discussion templates as DB records by @​robguthrie in #​12182
• Discussion template UI improvements by @​robguthrie in #​12181
• Add opening_at to polls for scheduled voting by @​robguthrie in #​12174
• Poll template updates by @​robguthrie in #​12184
• This release also addresses a minor security issue, where a member of a group could see the names of secret subgroups they did not belong to, if they inspected the server responses of the reports controller.

[Package Updates]

[1.17.11]

• Update loomio to 3.0.22
• Full Changelog
• STV (Single Transferable Vote) poll type beta. Anonymous by default, results hidden until the poll closes. The form shows a warning asking users to report bugs and feedback on GitHub.
• Cloudflare Turnstile challenge on password sign-in, login-token requests, signup, and trial creation. Admin login-link sign-in bypasses the challenge; sign-in with a login code also bypasses it.
• Fixed SQL injection in HasTimeframe via timeframe_for.
• Blocked SSRF in the link preview service; link previews now require auth and are throttled to 20/hour per user.
• Direct upload size limit (25 MB trial, 1 GB paid); blocked dangerous uploads.
• Bumped vue-i18n to 9.14.5 (XSS + prototype pollution).
• Refresh a user's groups after joining or being added to a group.
• Return a token error on session failure when a login token is pending; translate sessions errors server-side; surface server errors on login code entry.
• Fix demo poll cloning (missing opening_at/opened_at).
• Translation fixes: needs_a_rethink_meaning, "vote in" "vote on", German typo in discard.

[Package Updates]

[1.17.12]

• Update loomio to 3.0.24
• Full Changelog
• Fixed: Prevent comment authors from editing or restoring comments that an admin has discarded.
• Fixed: Preserve group ownership when creating discussions from templates in grouped contexts.
• Improved: Hardened deployment/runtime behavior with trusted ingress IP allowlisting and exec-based Docker startup processes.
• Improved: Removed obsolete hocuspocus SQLite persistence and legacy document-list template calls.
• Improved: Background jobs now avoid retrying forever for records that have already been deleted.
• Maintenance: Updated dependencies including Devise, Vite, Bootsnap, Rollup, Sentry, Nokogiri, Puma, and tzinfo-data.

[Package Updates]

[1.18.0]

• Update loomio to 3.1.0
• Full Changelog
• This release fixes an issue where metadata associated with anonymous poll responses could weaken ballot anonymity.
• Polls can now host threaded discussion.
• Loomio now includes a What's new page with a chronological history of user-facing features and improvements.
• Signed-in users can bookmark threads, comments, polls, votes, and outcomes.
• Parent groups and their subgroups now share one tag catalogue.
• Thread members can copy a complete thread as structured Markdown for use with an AI assistant.
• Loomio now uses Vuetify 4. This updates typography, spacing, menus, forms, buttons, dialogs, voting screens, thread events, group settings, member lists, email settings, and report controls.
• Background jobs now use PostgreSQL-backed Solid Queue instead of Sidekiq.
• Legacy /api/b1 routes are removed. API integrations should use /api/b2 or the appropriate server administration API.
• A separate security advisory provides further technical details.

[Package Updates]

[1.18.1]

• Update loomio to 3.1.2
• Full Changelog
• This security release fixes additional anonymous-poll privacy issues and a group-membership scoping issue found during a continued review of Loomio 3.1.1.
• Version-history responses for anonymous polls no longer expose a stance's database ID or its edit timestamp.
• The per-poll CSV export no longer includes the database ID or the written reason for anonymous stances.
• The group CSV and JSON exports no longer retain the database ID, written reason, or creation order of anonymous stances.
• On-demand translation of a stance's reason now follows the same visibility rules as the poll itself.
• Bookmarking another member's anonymous stance no longer reveals the voter's name or the stance's database ID.
• Creating a task from text inside an anonymous stance no longer discloses the voter, the stance's database ID, or the reason.
• Email and chatbot notifications about a new stance are no longer delivered before a poll set to hide results until it closes has closed.
• The thread Markdown export no longer includes the exact submission time of anonymous stances.
• The membership-list endpoint returned the members of a subgroup to administrators of a parent group even when the subgroup was configured to be hidden from parent members.

[Package Updates]

[1.18.2]

• Update loomio to 3.1.3
• Full Changelog
• The B2 and B3 APIs now support API keys in an HTTP bearer authorization header:
• An unsubscribe token no longer authorizes private poll exports. Restricted boot responses omit the live-update channel token, and opening an unsubscribe link does not create a persistent session. Normal signed-in sessions and notification-preference changes are unchanged.
• Announcement audience search and counts now enforce the permissions of the target group, thread, or poll. Announcing to a thread's group requires announcement permission.
• Existing discussions, comments, and stances can no longer be reassigned to a different group, parent, or poll through update parameters. These constraints are enforced at shared service or model boundaries rather than only in the interface.
• Identified polls now apply until_vote and until_closed result visibility consistently across API responses, attachments, exports, notifications, chatbots, server-rendered pages, and thread Markdown.
• User-specific live-update payloads are serialized separately from payloads published to shared group and topic channels. Shared payloads do not carry current_user serialization context, preventing one recipient's private fields from being reused for other subscribers.
• Deleting a reaction now also deletes its associated events and notifications, preventing stale activity records from referring to a reaction that no longer exists.
• Demo cloning is limited to three clones per user per day and ten clone requests per IP address per hour. These limits do not affect normal group creation.
• The following legacy numeric redirect routes have been removed: /discussions/:id, /groups/:id, /c/:id
• Those incremental anonymous-security measures are repealed in Loomio 3.1.3. The release restores the established behavior for existing anonymous polls, including stance reasons, thread activity, notifications, bookmarks, tasks, translations, identifiers, ordering, and exports. Historical stance reasons and related content are retained.