Rocket.Chat - Package Updates

[Package Updates]

[3.3.2]

• Update Rocket.Chat to 8.4.2
• Full Changelog
• Ensures OAuth tokens are cleaned up after user deactivation
• Fixes the users.presence endpoint returning an empty array when called with multiple comma-separated IDs, caused by ajvQuery coercing the string into a single-element array after the OpenAPI migration (#40527 by @dionisio-bot)
• Ensures that deactivated users have their login tokens cleaned up in users.deactivateidle
• Ensures the Meteor method for translateMessage validates access and types
• Ensures the visitor token is not present in the visitors.info response
• Ensures the autotranslate.translateMessage endpoint checks for room access

[Package Updates]

[3.3.3]

• Update Rocket.Chat to 8.4.3
• Full Changelog
• (#40771 by @dionisio-bot) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited

[Package Updates]

[3.3.4]

• fix: deno cache for marketplace app installation

[Package Updates]

[3.4.0]

• Update Rocket.Chat to 8.5.0
• Full Changelog
• Swap usage of internal @rocket.chat/apps-engine internal APIs to @rocket.chat/apps package
• Adds 4 new permissions (assigned to admins by default) to control the visibility of each tab inside the ABAC Administration panel
• Adds new API endpoints custom-sounds.create and custom-sounds.update to manage custom sounds with strict file validation for size and specific MIME types to ensure system compatibility.
• Adds a new "Drafts" group to the sidebar, providing quick access to all rooms with unfinished messages.
• Ensures OAuth tokens are cleaned up after user deactivation
• Fixes an issue where thread content would disappear after clicking "Jump to recent messages".
• Fixes the users.presence endpoint returning an empty array when called with multiple comma-separated IDs, caused by ajvQuery coercing the string into a single-element array after the OpenAPI migration
• Ensures the visitor token is not present in the visitors.info response
• Sanitizes image URLs in rendered messages to block javascript:, data:, and vbscript: schemes matching the protection already applied to markdown links. Defense-in-depth against XSS via crafted markdown like ![label](javascript:...).
• Fixes action buttons added by apps being rendered in the Marketplace Menu rather than the User Menu

[Package Updates]

[3.4.1]

• Update Rocket.Chat to 8.5.1
• Full Changelog
• (#40917 by @dionisio-bot) Escapes HTML tags in exported data
• (#40891 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#40904 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint
• (#40938 by @dionisio-bot) Fixes an issue where description was incorrectly being used as alternative text for image attachments

[Package Updates]

[3.5.0]

• Update Rocket.Chat to 8.6.0
• Full Changelog
• Adds Virtru as an external attribute store option for attribute-based access control, selectable under Administration > Settings > ABAC, and deactivates users locked out in LDAP or Active Directory during sync.
• Added LibreTranslate as a message auto-translation provider, alongside Google, DeepL and Microsoft. LibreTranslate can be self-hosted, enabling fully on-premise / offline message auto-translation. Configure the instance URL (and optional API key) under Admin Settings Message Auto-Translate LibreTranslate and select it as the Service Provider.
• Added a new rooms.join REST endpoint that lets a user join any room type, replicating the behavior of the deprecated joinRoom DDP method.
• Introduces popout functionality for voice calls
• Fixes S3 file upload failing when the region setting is empty or the endpoint is configured without a URL scheme
• Fixes auto-translate not activating for users who set their language preference after joining rooms
• Fixes an issue that allowed users to create a DM and send messages to a deactivated account
• Fixes an issue where updating an app in quick succession could crash the server.
• Fixes an issue where editing or deleting a message in a federated room caused subsequent messages to stop syncing between servers
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

[Package Updates]

[3.5.1]

• Update Rocket.Chat to 8.6.1
• Full Changelog
• (#41234 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41243 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41308 by @dionisio-bot) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.
• (#41292 by @dionisio-bot) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user
• (#41276 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

[Package Updates]

[3.6.0]

• Update Rocket.Chat to 8.7.0
• Full Changelog
• Adds current field to DeviceManagementSession type and currentLoginToken parameter to aggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.
• Introduces a more secure and reliable server-side OAuth authentication flow.
• Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.
• Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new fips module, and FIPS status is now reported in server logs and statistics.
• Replaces proprietary emojis with native (unicode) emojis and increases available emoji set
• Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.
• Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself
• Fixes own account showing twice in navbar room search when searching by username
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.

[Package Updates]

[3.6.1]

• Update Rocket.Chat to 8.7.1
• Full Changelog
• (#41818 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
• (#41820 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41846) Fixes an issue where a MultiSelect option checkbox remained checked after the option was deselected
• (#41819 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
• (#41817 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

[Package Updates]

[3.7.0]

• Update Rocket.Chat to 8.8.0
• Full Changelog
• Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.
• Accepts a role name in the when.hasOneRole and when.hasAllRoles filters of an app action button
• Changes the default apps-engine runtime backend from deno to node. The previous behavior can be restored by setting the environment variable APPS_ENGINE_RUNTIME_BACKEND='deno'
• Adds support for SAML authentication in the mobile and desktop apps via the system browser.
• Deprecates LDAP and SAML authentication on workspaces without a Premium plan. Both keep working as they are today, but the admin settings now warn that version 9.0.0 will require a license including the ldap-enterprise or saml-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through either of them.
• Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list
• Adds status visibility, letting users hide their presence and status message from specific people they choose. Blocked people see that user as offline, indistinguishable from genuinely offline, and the block can be lifted at any time changes apply live, without a reload.
• Fixed app action buttons never matching a role scoped to Subscriptions owner, moderator, leader, or a custom one. The room was not being passed as the scope of the role check, so a button filtered by one of those roles stayed hidden even for a user who held it in the room.
• Fixed business hours closing for one minute a day when configured as 00:00-23:59. Work hours are set at minute granularity, but the finish time was treated as exclusive, so consecutive daily windows never met and the service dropped to closed for the whole 23:59 minute agents could not become available and the Livechat widget rendered the offline form. A work hour now stays open until the end of its finish minute.
• Fixes the composer popups (mentions, slash commands and emojis) staying open after programmatic changes to the composer text, such as canceling the edition of a message that contains a mention.