Rocket.Chat - Package Updates

[Package Updates]

[3.4.1]

• Update Rocket.Chat to 8.5.1
• Full Changelog
• (#40917 by @dionisio-bot) Escapes HTML tags in exported data
• (#40891 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#40904 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint
• (#40938 by @dionisio-bot) Fixes an issue where description was incorrectly being used as alternative text for image attachments

[Package Updates]

[3.5.0]

• Update Rocket.Chat to 8.6.0
• Full Changelog
• Adds Virtru as an external attribute store option for attribute-based access control, selectable under Administration > Settings > ABAC, and deactivates users locked out in LDAP or Active Directory during sync.
• Added LibreTranslate as a message auto-translation provider, alongside Google, DeepL and Microsoft. LibreTranslate can be self-hosted, enabling fully on-premise / offline message auto-translation. Configure the instance URL (and optional API key) under Admin Settings Message Auto-Translate LibreTranslate and select it as the Service Provider.
• Added a new rooms.join REST endpoint that lets a user join any room type, replicating the behavior of the deprecated joinRoom DDP method.
• Introduces popout functionality for voice calls
• Fixes S3 file upload failing when the region setting is empty or the endpoint is configured without a URL scheme
• Fixes auto-translate not activating for users who set their language preference after joining rooms
• Fixes an issue that allowed users to create a DM and send messages to a deactivated account
• Fixes an issue where updating an app in quick succession could crash the server.
• Fixes an issue where editing or deleting a message in a federated room caused subsequent messages to stop syncing between servers
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

[Package Updates]

[3.5.1]

• Update Rocket.Chat to 8.6.1
• Full Changelog
• (#41234 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41243 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41308 by @dionisio-bot) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.
• (#41292 by @dionisio-bot) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user
• (#41276 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

[Package Updates]

[3.6.0]

• Update Rocket.Chat to 8.7.0
• Full Changelog
• Adds current field to DeviceManagementSession type and currentLoginToken parameter to aggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.
• Introduces a more secure and reliable server-side OAuth authentication flow.
• Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.
• Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new fips module, and FIPS status is now reported in server logs and statistics.
• Replaces proprietary emojis with native (unicode) emojis and increases available emoji set
• Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.
• Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself
• Fixes own account showing twice in navbar room search when searching by username
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.

[Package Updates]

[3.6.1]

• Update Rocket.Chat to 8.7.1
• Full Changelog
• (#41818 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
• (#41820 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41846) Fixes an issue where a MultiSelect option checkbox remained checked after the option was deselected
• (#41819 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
• (#41817 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

[Package Updates]

[3.7.0]

• Update Rocket.Chat to 8.8.0
• Full Changelog
• Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.
• Accepts a role name in the when.hasOneRole and when.hasAllRoles filters of an app action button
• Changes the default apps-engine runtime backend from deno to node. The previous behavior can be restored by setting the environment variable APPS_ENGINE_RUNTIME_BACKEND='deno'
• Adds support for SAML authentication in the mobile and desktop apps via the system browser.
• Deprecates LDAP and SAML authentication on workspaces without a Premium plan. Both keep working as they are today, but the admin settings now warn that version 9.0.0 will require a license including the ldap-enterprise or saml-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through either of them.
• Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list
• Adds status visibility, letting users hide their presence and status message from specific people they choose. Blocked people see that user as offline, indistinguishable from genuinely offline, and the block can be lifted at any time changes apply live, without a reload.
• Fixed app action buttons never matching a role scoped to Subscriptions owner, moderator, leader, or a custom one. The room was not being passed as the scope of the role check, so a button filtered by one of those roles stayed hidden even for a user who held it in the room.
• Fixed business hours closing for one minute a day when configured as 00:00-23:59. Work hours are set at minute granularity, but the finish time was treated as exclusive, so consecutive daily windows never met and the service dropped to closed for the whole 23:59 minute agents could not become available and the Livechat widget rendered the offline form. A work hour now stays open until the end of its finish minute.
• Fixes the composer popups (mentions, slash commands and emojis) staying open after programmatic changes to the composer text, such as canceling the edition of a message that contains a mention.

[Package Updates]

[3.7.1]

• Update Rocket.Chat to 8.8.1
• Full Changelog
• Fixes Omnichannel rooms failing to register agent responses (and showing send errors on messages and file uploads that were actually delivered) when the room carried corrupted visitor activity data created by older app integrations

[Package Updates]

[3.8.0]

• Update Rocket.Chat to 8.9.0
• Full Changelog
• Deprecates Custom OAuth authentication on workspaces without a Premium plan. Custom OAuth services keep working as they are today, but their admin settings now warn that version 9.0.0 will require a license including the oauth-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through one of them.
• Deprecates the Gravatar integration. Default avatars fetched from Gravatar on user creation and Gravatar-based avatar suggestions in the profile settings will be removed in a future major release; a warning is now logged when they are used.
• Adds hybrid retrieval to AI Search. A single search balance setting decides how much semantic retrieval contributes relative to keyword search, so a workspace can find messages by meaning without losing exact matches on error codes, ticket ids or function names. An optional recency boost, disabled by default, promotes newer messages after relevance ranking.
• Introduces custom, user-defined categories to the sidebar (Enterprise only). Users can create, rename, delete and reorder categories (menu-driven), and move rooms into them via the room context menu or the room header.
• Adds a new POST /v1/chat.getMessages endpoint to fetch several messages at once by id, including messages from different rooms. The request fails if any of the messages belongs to a room the caller cannot read.
• Adds a new GET /v1/rooms.history endpoint to load a room's message history. Unlike the existing channels.history, groups.history, im.history and dm.history endpoints, it works with any room type through a single route, and can be used to read public channels anonymously when Accounts_AllowAnonymousRead is enabled.
• Fixes the Docker image crashing at boot on arm64 with Error loading shared library ld-linux-aarch64.so.1 while loading argon2.node. The Meteor bundle carries build/Release output compiled on the glibc-based CI host, and node-gyp-build prefers it over the musl binaries shipped under prebuilds/ in the same package, so the wrong one was selected at runtime.
• Fixes auto-translate continuing to translate messages with the previously selected service provider after switching providers, until the server was restarted or the feature was disabled and re-enabled.
• Fixes two factor authentication for SAML authentication method.
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

[Package Updates]

[3.8.1]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[3.8.2]

• Update Node.js to 24.22.1 for Broccoli2Shell

[Package Updates]

[3.8.3]

• Update Rocket.Chat to 8.9.1
• Full Changelog
• Fixes high database load on busy workspaces with the Engagement Dashboard enabled, where every sent or deleted message read all of the day's dashboard records
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• Fixes the server staying up without ever accepting connections when a step of its startup fails; it now logs the error and exits
• Fixes instances started at the same time on a new database hanging at startup on a duplicate key error while creating the GENERAL room or the rocket.cat user
• Bump the Node.js base image of the Docker images to 24.22.1 (the Debian image moves from bullseye to bookworm), which fixes a Brotli decoder out-of-bounds write (CVE-2026-111497).
• Fixes push and email notifications piling up under load because the server paused for 2 seconds after every 100 notifications, even when more were waiting
• Fixes high database load when many users disconnect at once, such as after a network outage or an instance restart
• Stops the presence service from writing and broadcasting the user's status on every connection heartbeat when the status did not change
• Fixes push notifications arriving minutes late under load when the push gateway is slow to answer; each server now sends many push notifications at once instead of one at a time
• Fixes app slash commands that declare a permission being listed and executed for users without that permission