Loomio - Package Updates

Package Updates

[1.18.5]

Update loomio to 3.1.7
Full Changelog
Fix: Upgrade Undici to address published HTTP client security advisories.
Fix: Block SSRF bypasses using IPv4-compatible, NAT64, Teredo, and 6to4 addresses.
New: Support light and dark color preferences in compatible email clients.
New: Configure theme gradients, surface text colors, application bars, and navigation drawers.
Fix: Include non-secret subgroups in parent-group exports and improve group imports.
Fix: Process bulk invitation requests of 2,000 or more addresses before the request timeout.
Fix: Stop blocked inbound emails from creating administrator notifications.
Fix: Improve browser error reporting, forms, and chat integration feedback.

Package Updates

[1.18.6]

Package Updates

[1.19.0]

Update loomio to 3.2.0
Full Changelog
Loomio 3.2.0 introduces detached anonymous voting, configurable vote-reason requirements, typo-tolerant search, and an API access page. It also includes improvements to poll threads, subscription limits, administration, email replies, self-hosted deployments, and the user manual.
Read the technical summary and the anonymous voting user guide.
Poll authors can require reasons for Disagree and Block responses.
Open and scheduled polls remain visible in their threads.
Subscription thread limits include standalone polls and discarded threads.
Search finds likely matches for misspelled words while preserving permissions.
Group coordinators have an API access page with User API credentials and group IDs. API requests use the Authorization: Bearer header.
Administrators have a dashboard and updated user, group, subscription, API, and job management pages.
Inline image attachment links are repaired automatically, with a dry-run and queued repair task available for operators.
Production assets are preserved across deployments and built into the Docker image. Rails is upgraded to 8.1.

Package Updates

[1.20.0]

Update loomio to 3.3.0
Full Changelog
This release completes the transition to detached anonymous voting. It removes the stance-based anonymous voting implementation retained temporarily by 3.2.0 and prevents that legacy poll format from being stored again.
This release closes and converts every remaining legacy anonymous poll before removing the old storage model. This includes open, scheduled, discarded, archived, and polls without a closing time. The migration can take significant time on an instance with many legacy anonymous polls; do not interrupt it.

Package Updates

[1.20.1]

Package Updates

[1.20.2]

Update loomio to 3.3.2
Full Changelog
Fix: Enforce each poll type's complete score, choice-count, and ranking rules before storing a ballot
Fix: Reject negative choice scores in the application and database
New: Keep emailed sign-in links and codes valid for 24 hours by default

Package Updates

[1.20.3]

Update loomio to 3.3.999
Full Changelog
New: Add notification occurrence, delivery, and consolidation-state tables without replacing legacy tables
New: Allow notification history to be consolidated online in resumable batches before upgrading to Loomio 3.4

Package Updates

[1.21.0]

Update loomio to 3.4.1
Full Changelog
Fix: Block private IPv4 destinations represented as IPv4-mapped IPv6 addresses
Fix: Render fetched link-preview titles and descriptions as plain text
Fix: Prevent rich-text media and task attributes from being reparsed as HTML
New: Separate topic timeline items from notification processing
New: Record each in-app, email, and chatbot delivery for its recipient and channel
eventable_type and eventable_id become itemable_type and itemable_id.
Nested parents use parent_topic_items instead of parent_events.
Timeline items no longer include custom_fields or recipient_message.
Group JSON exports contain topic_items instead of events, and include notification_deliveries alongside logical notifications.
The Rails Event model and events table are replaced by TopicItem and topic_items.

Package Updates

[1.21.1]

Update loomio to 3.4.2
Full Changelog
New: Select a parent group or related subgroup as the source audience when inviting people to a group
New: Use Loomio in Belarusian
Fix: Notify only newly added participants when expanding an anonymous poll's electorate
Fix: Apply the correct permissions when announcing to groups
Fix: Recheck group access before rendering previously cached group data
Fix: Complete client reload recovery without reporting a second route error
Fix: Restore the option to save and refresh Chargify-backed subscriptions
Fix: Return the correct topic-item response after editing a poll response in place

Package Updates

[1.22.0]

Update loomio to 3.5.1
Full Changelog
Fix: Restrict thread email and push notification audiences to current group members and invited thread guests
Fix: Clarify email-only notification labels in thread navigation
New: Install Loomio from supported browsers and open it in its own window
New: Enable browser push notifications and test each browser's connection
New: Choose separate email and push notification levels for account defaults, groups, and threads
New: Receive unseen notifications in daily, every-second-day, or weekly catch-up emails
New: Customize the sidebar help link with optional environment variables
Fix: Keep email unsubscribe links working with the new notification settings
Fix: Ask coordinators to select reminder recipients after reopening a poll instead of announcing it automatically
Fix: Open standalone poll search results, unavailable document previews, tasks, tags, and announcement forms reliably

Package Updates

[1.23.0]

Update loomio to 3.6.0
Full Changelog
Fix: Escape user-controlled notification values in email, Matrix, Slack, and Markdown chatbot output
Fix: Reject unsafe URL schemes produced by server-rendered Markdown
Fix: Limit stored reaction values while retaining complex Unicode emoji sequences
Fix: Keep web push available without promoting app installation or reload prompts
New: Create a complete Oatmilk Cooperative demo workspace when demo groups are enabled
New: Show recent visible activity on user profiles
Fix: Stop discarded groups pending permanent deletion from accepting activity or delivering pending notifications
Fix: Make group deletion, account merging, and legacy-data cleanup safer and more recoverable
Fix: Support Safari 16 in current client builds
There are no intended breaking B2 or B3 API changes. Operators with custom database maintenance or reporting that refers directly to removed legacy tables or the old groups.archived_at column must update it before deployment.

Cloudron Forum