Rallly - Package Updates

[Package Updates]

[2.13.1]

• Update rallly to 4.13.1
• Full Changelog
• Upgrade Next.js to 16.3.3 for the August 2026 security release (#3073)

[Package Updates]

[2.14.0]

• Update rallly to 4.14.0
• Full Changelog
• Enforce instance branding when the white label add-on is active (#3125)
• Add List-Unsubscribe headers and tokenized per-poll unsubscribe (#3148)
• Show role permissions in the invite member dialog (#3116)
• Activity log: event vocabulary and writes from every poll mutation (#3076)
• Add cookie consent banner, shown only when analytics are configured (#3114)
• Require both SMTP_USER and SMTP_PWD for authenticated SMTP (#3064)
• Unshare single-member spaces wrongly marked shared by backfill (#3118)
• Restore dark mode muted text hierarchy on popover surfaces (#3084)
• Fix muted icon color on the invite member button (#3097)
• Comments: fix mobile footer overlap and polish the sheet (#3082)

[Package Updates]

[2.15.0]

• Update rallly to 4.15.0
• Full Changelog
• Who this affects: instances using Microsoft sign-in on a multi-tenant endpoint which is the default. MICROSOFT_TENANT_ID defaults to common, so this applies unless you have set it to your own tenant ID. Instances set to a single tenant are unaffected, as are OIDC and Google.
• On a multi-tenant endpoint any tenant can assert any email address, so Rallly now needs Microsoft to confirm an address before creating an account from it. Microsoft only sends that confirmation if the app registration asks for it.
• This release does not break these sign-ins. If the claims are missing, Rallly still creates the account and logs a warning. A future release will refuse them. Add the claims now so that release is uneventful:
• Full instructions: https://support.rallly.co/self-hosting/single-sign-on#microsoft
• In previous versions, responses were soft-deleted. In this release responses are hard-deleted and previously soft-deleted responses are purged. Back up before upgrading.
• This release contains several security fixes. Upgrading is recommended. Advisories with full details, affected versions and credit to the reporters will follow shortly.
• Hosts can now invite participants by email from the Share dialog: send personal invite links, copy an invitee's link, remove a pending invite, and see when a link has been opened.
• Every response now carries an edit token, so the link in a confirmation email edits exactly the response it names. Hosts can still copy the invite link and hand it to someone who responded without leaving an email address.
• Full Changelog: https://github.com/lukevella/rallly/compare/v4.14.0...v4.15.0

[Package Updates]

[2.15.1]

• Update rallly to 4.15.1
• Full Changelog
• Send login code emails in the requester's language (#3275)

[Package Updates]

[2.15.2]

• Update rallly to 4.15.2
• Full Changelog
• Decouple registration from email login (#3337)

[Package Updates]

[2.15.3]

• Update rallly to 4.15.3
• Full Changelog
• Resolve Alberta, Manitoba and BC time zones consistently across engines (#3396)
• Link OIDC sign-ins to existing users by email (#3407)

[Package Updates]

[2.15.4]

• Update rallly to 4.15.4
• Full Changelog
• Critical security fix: remote code execution in poll preview images
• This patch fixes a critical vulnerability in an upstream dependency. Please upgrade as soon as possible.
• Rallly v4.8.0 through v4.15.3 ship a version of Next.js affected by GHSA-vcvr-r3jv-pc5j (critical, CVSS 9.5). The ImageResponse renderer from next/og can be made to execute code on the server when attacker-controlled text reaches the image it renders.
• Rallly uses that renderer for poll link previews at /api/og-image-poll, and the poll title and author come straight from the query string. That endpoint needs no sign-in, so anyone who can reach your instance can send a crafted request.
• This release upgrades Next.js from 16.3.3 to 16.3.8, which contains the fix. Nothing else changes.
• If you can't upgrade right away, block /api/og-image-poll at your reverse proxy until you can. Shared poll links will show no preview image in the meantime; nothing else is affected.
• Upgrade Next.js to 16.3.8 to patch next/og RCE (#3451)
• Full Changelog: https://github.com/lukevella/rallly/compare/v4.15.3...v4.15.4

[Package Updates]

[2.15.5]

• Update rallly to 4.15.5
• Full Changelog
• Upgrade Next.js to 16.4.2 to patch Server Actions DoS (#3564)

[Package Updates]

[2.16.0]

• Update rallly to 4.16.0
• Full Changelog
• Organizers can now add a Google Meet, Zoom, Microsoft Teams or Webex call to a poll. Rallly creates the meeting on the organizer's account when the poll is finalized and puts the join link in the event, the calendar invite and the confirmation emails.
• Finalizing is now a three step flow that shows the time zone and each option's votes. Participants are told how they voted in the confirmation email, and invites are sent in batches from a queue inside the app, so large polls no longer hold up the request. No cron is needed.
• Plain yes or no polls: the "if need be" vote can be turned off.
• One edit page for details, options and settings. Old edit links redirect to it, and each change appears in the poll's activity feed.
• Edit and Duplicate from the polls list.
• A refreshed interface with list views for polls, events, members and home.
• When removing a member, choose whether their polls are reassigned or deleted.
• The login page remembers which method you used last.
• The Control Panel tells you when an update is available and whether it fixes a security issue. Rallly checks api.rallly.co hourly, sending only the version and an anonymous instance ID. On a restricted network the check fails silently; see Corporate Networks.
• Rate limits: response submission is now limited to 200 per poll per hour. Counts are kept in memory. If you run your own reverse proxy, make sure it sets X-Real-IP to the visitor's address, or set RATE_LIMIT_ENABLED=false.

[Package Updates]

[2.17.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[2.17.1]

• Update rallly to 4.16.1
• Full Changelog
• Set GOOGLE_LOGIN_ENABLED=false or MICROSOFT_LOGIN_ENABLED=false to hide it. Meet, Teams and Google Calendar keep working. (#3590, reported in #3580)
• Guests now see an error when Rallly can't create a guest session (for example when cookies are blocked), instead of the vote, comment or poll failing on submit. (#3585)
• The polls and events lists load 50 at a time, with previous and next links, and show a single loading state. The members page loads the same way. (#3581, #3582, #3583)
• Email link scanners such as Safe Links no longer open a database connection for every link they check. (#3571)
• Faster poll list and member counts. (#3573, #3575)
• Rounded buttons on the login and other auth pages. (#3587, #3589)

[Package Updates]

[2.17.2]

• Update rallly to 4.16.2
• Full Changelog

[Package Updates]

[2.17.3]

• Update rallly to 4.16.3
• Full Changelog
• Poll times saved an hour off around daylight saving changes
• In the week view, the hour skipped when clocks go forward is shown as a hatched "Clocks go forward" band, and a slot can't start inside it.
• In the month view, the start time dropdown lists exactly the times that exist in the poll's time zone.
• Options you already saved are not changed. If you created a poll with times close to a daylight saving change, check its options.