Loomio - Package Updates

[Package Updates]

[1.25.0]

• Update loomio to 3.9.0
• Full Changelog
• New: Sign in with a passkey without entering an email address, and manage passkeys from your profile
• Fix: Prevent account enumeration through ordinary sign-in, sign-in code requests, and account-merge verification
• Fix: Block deactivated sessions, enforce password attempt limits, and protect pending SSO identity links
• Fix: Show moved poll comments immediately when opening their destination discussion

[Package Updates]

[1.26.0]

• Update loomio to 3.10.0
• Full Changelog
• New: Set default vote weights for group members and adjust weights for individual polls
• Fix: Correct STV surplus transfers, rounding, quotas, and ties that can change election winners
• New: Read the user manual and guides in thirteen translated languages
• New: Search and manage voters and thread members from their invitation windows
• New: Receive HTML group exports by email when background generation finishes
• Fix: Reply to votes after voting and hide poll conversations in the thread interface until results are visible
• Fix: Open email notification settings without signing in while keeping email tokens out of profile APIs
• Fix: Use existing sign-in links on SSO-only sites and prompt people with missing profile names to complete them

[Package Updates]

[1.27.0]

• Update loomio to 3.11.0
• Full Changelog
• New: Configure subgroup visibility and joining separately, including joining without approval for parent group members
• Fix: Switching editor modes could lose formatting and Markdown edits. Conversion now preserves supported content and your latest edits
• Fix: Leaving a group could leave private polls and live updates accessible. Access now follows your current membership and is restored when you rejoin
• Fix: Polls could disappear from Need your vote when someone else voted. The filter now checks whether you have voted
• Fix: Deleting or deactivating an account could remove submitted votes from open polls. Those votes and their reasons now remain and continue to count
• Fix: Deeply nested replies could show the wrong parent. They now show the actual parent, with a warning if it has been deleted
• Fix: Changing a reaction created repeated notifications. Changes within two minutes now update the existing notification
• Fix: Concurrent changes could leave counts incorrect or publish replies before their parent counts were updated. Counts now update in the same transaction as their records
• Fix: Expired passkey sessions, incomplete poll dates, and failed form loads could interrupt editing. These cases now prompt sign-in, preserve the deadline, or show an error page

[Package Updates]

[1.27.1]

• Update loomio to 3.11.1
• Full Changelog
• Fix: Email sign-in codes could be rejected when the address used different capitalization. Codes now accept matching email addresses regardless of capitalization
• New: Retrieve User API groups, webhooks, and thread items in bounded pages with limit, offset, and the full matching count in meta.total
• Existing integrations must fetch subsequent pages to retrieve complete collections larger than the page size. meta.total reports the full matching count. Group and webhook pages use ascending ID order; thread item pages use ascending sequence order with ID as the tiebreaker. Related records included in responses do not count toward the primary-record limit.
• See the User API documentation for endpoint-specific behavior.

[Package Updates]

[1.27.2]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[1.28.0]

• Update loomio to 3.12.0
• Full Changelog
• New: Group coordinators can view invitation delivery history, including resends, custom messages, and recorded delivery problems
• New: Instance administrators can review and clear email address blocks, with an optional Amazon SES suppression check
• New: Gravatar is now an explicit profile picture choice; new accounts use initials unless a picture is uploaded
• Fix: JSON requests to the User API could lose poll options and the group ID. Creating or editing a poll now preserves the supplied fields
• Fix: Queued group exports could run after the requester's access was revoked. JSON and CSV exports now recheck access when prepared
• Fix: Adapting a default poll template could leave the original visible. The adapted version now replaces it in the group's template list
• Fix: Explicit self-mentions could be omitted or treated as replies. They now produce mention notifications in Markdown and rich text
• Fix: Visiting a discussion or poll could leave an invitation marked as pending. These visits now record acceptance
• Fix: Link previews could start unbounded downloads and concurrent requests. Preview fetching now has limits on batch size, response size, duration, and shared request volume
• Fix: The application page could lose its cache prevention directive. It now consistently sends Cache-Control: no-store

[Package Updates]

[1.29.0]

• Update loomio to 3.13.1
• Full Changelog
• Fix: Vulnerable dependencies blocked Haraka mail-relay image builds. Updated email authentication and HTTP libraries now pass the production dependency audit
• Fix: Malformed or duplicate From headers could avoid authentication failure handling. Messages sent to group email addresses with these headers are now held for approval
• New: Apply tags to polls, outcomes, and comments, then find them by tag
• New: Create accounts and manage group memberships and roles through the Server API
• Fix: Weighted quorum and eligible vote share requirements counted people. They now count vote weights
• Fix: Ruby's regular expression compiler and Crass's CSS parser had security flaws. Ruby 4.0.9 and Crass 1.0.8 include the fixes
• Fix: Finished background jobs accumulated because no worker processed the cleanup queue. Workers now run the hourly cleanup

[Package Updates]

[1.29.1]

• Update loomio to 3.13.2
• Full Changelog
• Fix: Tag migrations could block live traffic during search and summary rebuilds. These rebuilds now run in small background batches, scheduled ten minutes after migration
• Fix: Incoming emails could remain stuck after temporary processing errors. Routing now retries up to five times with increasing delays
• Fix: Members allowed to edit thread context were limited to tagging opening posts. They can now tag replies, polls, and outcomes too
• Upgrade web and worker processes before the scheduled backfill starts. An existing active backfill continues without queuing another pass. See the Upgrading Loomio guide.
• See the full changelog.

[Package Updates]

[1.30.0]

• Update loomio to 3.14.0
• Full Changelog
• New: Save discussions and polls as reusable templates; Save as template replaces Make a copy for polls.
• New: Restrict new attachments throughout a thread to thread admins and group admins.
• New: New threads and discussion templates allow multiple polls at once by default; existing settings are preserved.
• New: Authorized poll editors can change anonymity, voting method, and result visibility before voting opens.
• Fix: Saving polls rounded voting times down to the hour, and scheduled opening checks ran hourly. Selected minutes are now preserved, with opening and closing checked every minute.
• New: Invitation suggestions put the current group first, followed by delegates and connected chat rooms.
• New: Change your catch-up email schedule directly from an unsubscribe page.
• New: The User and Server APIs use /api/user0 and /api/server0, with compatibility paths for existing integrations.
• Fix: Search indexing delayed content saves. Index updates now run after saving in a prioritized background queue.
• Fix: Rack had multipart parsing, host validation, and static-header security flaws. Rack 3.2.8 includes the fixes.

[Package Updates]

[1.30.1]

• Update loomio to 3.14.1
• Full Changelog
• Fix: Rails and other dependencies contained security vulnerabilities. Updated versions include the Rails 8.1.4.1 security fixes.
• Fix: Time poll outcomes could display meeting times in the device's time zone rather than the profile's time zone. They now use the profile setting.
• New: The profile time-zone selector offers a compact regional list with translated labels and retains any currently saved or detected zone.
• Fix: Markdown mentions appeared as plain text, and autocomplete could leave the caret before the inserted handle. Mentions now render consistently with rich text, and typing continues after the handle.
• Fix: Collaborative editor initialization could duplicate content or restore stale drafts after a format change. Clients now initialize the same saved content consistently, including when the collaboration server is unavailable.
• Fix: Choosing Edit tags from the inbox could leave existing tags unselected. The form now shows the tags already assigned to the thread's opening post.
• Fix: Improved database query performance when loading notifications and reactions.
• New: Compose backup and restore scripts package the database, configuration, and supported local files into a portable archive.