Rocket.Chat - Package Updates

[Package Updates]

[3.2.0]

• Update Rocket.Chat to 8.3.1
• Full Changelog
• (#​40080 by @​dionisio-bot) Fixes a bug that could remove all of a user's subscriptions when the user was re-added to a room while still banned.

[Package Updates]

[3.2.1]

• Update Rocket.Chat to 8.3.2
• Full Changelog
• (#​40130 by @​dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

[Package Updates]

[3.2.2]

• Pre install deno cache and make it rw in /run/

[Package Updates]

[3.3.0]

• Update Rocket.Chat to 8.4.0
• Full Changelog
• Adds file thumbnails with image preview to the message composer attachments
• Adds a new REST endpoint to accept or reject media calls without an active media session
• Adds externalIds field to livechat visitors for external platform identification.
• Adds a skipTranspile flag (default false) to webhook integrations. When set to true, the integration script is stored as-is without Babel transpilation matching the 9.0.0 default where Babel is removed entirely. Admins can flip the flag per-integration to validate strict-mode compatibility before upgrading. The field is deprecated and will be removed in 9.0.0.
• Updates omnichannel routing so agents with offline status are always excluded from assignment. The Livechat_enabled_when_agent_idle setting now only affects agents with away status.
• Introduces Cold Storage Archiving for Read Receipts to improve performance and scalability in large deployments.
• Fixed UI becoming unresponsive after clicking "See on Engagement Dashboard" from the workspace info card, which required a manual page refresh to recover.
• Fixes a bug that could remove all of a user's subscriptions when the user was re-added to a room while still banned.
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• Fixes an issue where the Omnichannel routing system ignored the Livechat_accept_chats_with_no_agents setting. Now, offline agents are correctly considered for assignment when the setting allows it.

[Package Updates]

[3.3.1]

• Update Rocket.Chat to 8.4.1
• Full Changelog
• (#40410 by @dionisio-bot) Disables SAML login when it is set to validate signatures without the proper configuration for it
• (#40459 by @dionisio-bot) Allows users to search for attribute values when assigning them to rooms
• (#40410 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

[Package Updates]

[3.3.2]

• Update Rocket.Chat to 8.4.2
• Full Changelog
• Ensures OAuth tokens are cleaned up after user deactivation
• Fixes the users.presence endpoint returning an empty array when called with multiple comma-separated IDs, caused by ajvQuery coercing the string into a single-element array after the OpenAPI migration (#40527 by @dionisio-bot)
• Ensures that deactivated users have their login tokens cleaned up in users.deactivateidle
• Ensures the Meteor method for translateMessage validates access and types
• Ensures the visitor token is not present in the visitors.info response
• Ensures the autotranslate.translateMessage endpoint checks for room access

[Package Updates]

[3.3.3]

• Update Rocket.Chat to 8.4.3
• Full Changelog
• (#40771 by @dionisio-bot) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited

[Package Updates]

[3.3.4]

• fix: deno cache for marketplace app installation

[Package Updates]

[3.4.0]

• Update Rocket.Chat to 8.5.0
• Full Changelog
• Swap usage of internal @rocket.chat/apps-engine internal APIs to @rocket.chat/apps package
• Adds 4 new permissions (assigned to admins by default) to control the visibility of each tab inside the ABAC Administration panel
• Adds new API endpoints custom-sounds.create and custom-sounds.update to manage custom sounds with strict file validation for size and specific MIME types to ensure system compatibility.
• Adds a new "Drafts" group to the sidebar, providing quick access to all rooms with unfinished messages.
• Ensures OAuth tokens are cleaned up after user deactivation
• Fixes an issue where thread content would disappear after clicking "Jump to recent messages".
• Fixes the users.presence endpoint returning an empty array when called with multiple comma-separated IDs, caused by ajvQuery coercing the string into a single-element array after the OpenAPI migration
• Ensures the visitor token is not present in the visitors.info response
• Sanitizes image URLs in rendered messages to block javascript:, data:, and vbscript: schemes matching the protection already applied to markdown links. Defense-in-depth against XSS via crafted markdown like ![label](javascript:...).
• Fixes action buttons added by apps being rendered in the Marketplace Menu rather than the User Menu

[Package Updates]

[3.4.1]

• Update Rocket.Chat to 8.5.1
• Full Changelog
• (#40917 by @dionisio-bot) Escapes HTML tags in exported data
• (#40891 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#40904 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint
• (#40938 by @dionisio-bot) Fixes an issue where description was incorrectly being used as alternative text for image attachments

[Package Updates]

[3.5.0]

• Update Rocket.Chat to 8.6.0
• Full Changelog
• Adds Virtru as an external attribute store option for attribute-based access control, selectable under Administration > Settings > ABAC, and deactivates users locked out in LDAP or Active Directory during sync.
• Added LibreTranslate as a message auto-translation provider, alongside Google, DeepL and Microsoft. LibreTranslate can be self-hosted, enabling fully on-premise / offline message auto-translation. Configure the instance URL (and optional API key) under Admin Settings Message Auto-Translate LibreTranslate and select it as the Service Provider.
• Added a new rooms.join REST endpoint that lets a user join any room type, replicating the behavior of the deprecated joinRoom DDP method.
• Introduces popout functionality for voice calls
• Fixes S3 file upload failing when the region setting is empty or the endpoint is configured without a URL scheme
• Fixes auto-translate not activating for users who set their language preference after joining rooms
• Fixes an issue that allowed users to create a DM and send messages to a deactivated account
• Fixes an issue where updating an app in quick succession could crash the server.
• Fixes an issue where editing or deleting a message in a federated room caused subsequent messages to stop syncing between servers
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

[Package Updates]

[3.5.1]

• Update Rocket.Chat to 8.6.1
• Full Changelog
• (#41234 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41243 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41308 by @dionisio-bot) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.
• (#41292 by @dionisio-bot) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user
• (#41276 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

[Package Updates]

[3.6.0]

• Update Rocket.Chat to 8.7.0
• Full Changelog
• Adds current field to DeviceManagementSession type and currentLoginToken parameter to aggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.
• Introduces a more secure and reliable server-side OAuth authentication flow.
• Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.
• Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new fips module, and FIPS status is now reported in server logs and statistics.
• Replaces proprietary emojis with native (unicode) emojis and increases available emoji set
• Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.
• Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself
• Fixes own account showing twice in navbar room search when searching by username
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.