Rocket.Chat - Package Updates

[Package Updates]

[2.75.0]

• Update Rocket.Chat to 7.12.0
• Full Changelog
• (#37057) Adds an experimental API to the apps-engine that retrieves the ids of rooms the user is a member of
• (#37038) Introduce the RangeSettingInput component, providing a new visual input type for settings that accept a range of numeric values. This improves the user experience for adjusting range-based settings in the administration panel.
• (#37312) Replaces old Assign Extension button and modal by introducing a proper input in the user edit form.
• (#37073) Adds a warning modal in order to prevent the access-permissions permission from being removed from the last granted role in the permissions table. This hardening measure ensures that administrators cannot accidentally lock themselves out of the system's permission management screen.
• (#37154) Fixes a GUI crash happening in the admin user page when attempting to display an invalid custom field
• (#36973) Adds deprecation warning on livechat:returnAsInquiry with new endpoint replacing it; livechat/inquiries.returnAsInquiry
• (#37218) Adds deprecation warning on livechat:setupConnection
• (#37147) Fixes client crash on invalid message attachment fields payload.
• (#37235) Adds deprecation warning on sendFileLivechatMessage
• (#37158) Fixes crash in end-to-end encrypted rooms when sending a quote or message link referencing a message outside the room.

[Package Updates]

[2.75.1]

• Update Rocket.Chat to 7.12.1
• Full Changelog
• Bump @rocket.chat/meteor version.
• (#37436 by @dionisio-bot) Fixes the capture of lead's email or phone number when the visitor didn't have data already
• (#37440 by @dionisio-bot) Fixes a problem in apps-engine debug logs where only 2 depth levels were displayed for objects, which is often not enough for debugging purposes

[Package Updates]

[2.75.2]

• Update Rocket.Chat to 7.12.2
• Full Changelog
• Bump @rocket.chat/meteor version.
• (#37540 by @dionisio-bot) Fixes an issue where user-agent is not properly extracted from the DDP connection headers
• (#37520 by @dionisio-bot) Fixes client slowdown for users with large amount of channels

[Package Updates]

[2.76.0]

• Update Rocket.Chat to 7.13.1
• Full Changelog
• This release introduces foundational infrastructure for upcoming Attribute-Based Access Control (ABAC), with the key addition being the ability for admins to create, edit, and delete room attributes that will later power ABAC rules.
• The batch of fixes in this release improves stability across voice, teams, security, and UI.
• (#​37327) Adds complexity requirements to end-to-end encryption passphrase
• (#​36807 by @​tiagoevanp) Adds a deletedRooms field to the users.delete endpoint response, indicating which rooms were deleted as part of the user deletion process.
• (#​37547) Adds the getUserRoomIds method to the UserRead accessor in the Apps-Engine, graduating it from the experimental bridge to the stable user bridge.
• (#​37368) Allows users to enable TOTP-based two factor authentication without requiring a verified email address.
• (#​37119 by @​ergot-rp) Adds missing legend for fieldset in profile page to meet WCAG compliance
• (#​37524) Moves the expandable message composer out of feature preview
• (#​37378) Introduces in-chat messages for when a voice call ends
• (#​37276) Disables the delete message confirmation button to prevent the action from being triggered while the request is in progress

[Package Updates]

[2.76.1]

• Update Rocket.Chat to 7.13.2
• Full Changelog
• Bump @​rocket.chat/meteor version.
• (#​37876 by @​dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#​37883 by @​dionisio-bot) Ensures presence stays accurate by refreshing connections on heartbeats and removing stale sessions.

[Package Updates]

[2.76.2]

• Update Rocket.Chat to 7.13.3
• Full Changelog
• Bump @rocket.chat/meteor version.

[Package Updates]

[3.0.0]

• Update Rocket.Chat to 8.1.1
• Full Changelog
• This release introduces a wide set of breaking changes focused on removing deprecated, end-of-life, and legacy functionality.
• Support for MongoDB 5.0 and 6.0 has been discontinued, and workspaces must upgrade to MongoDB 8.2 before moving to Rocket.Chat v8.0.0, with a full backup strongly recommended.
• Several services, settings, and integrations have been removed, including Streamhub, database watchers, Tokenpass OAuth, Mobex and VoxTelesys SMS integrations, second-layer transport encryption, built-in logging tools, legacy Game Center and WebRTC Livechat calls, Off-the-Record messaging, Omnichannel Voice and Current Chats, and the old FreeSwitch-based VoIP architecture.
• Twilio is now the only supported SMS provider, and admins are expected to rely on the official Prometheus and Grafana monitoring stack for observability.
• On the API side, the /v1/users.createToken and /v1/e2e.updateGroupKey endpoints have been undeprecated, with added security requirements for token creation.
• Overall, this release cleans up long-standing deprecated features and shifts workspaces toward modern, supported alternatives, with full details available in the Deprecated and phasing out features documentation.

[girish]

Update to 8.2.0 is blocked by https://github.com/rocketchat/rocket.chat/issues/39328 . Submitted a PR - https://github.com/RocketChat/Rocket.Chat/pull/39497

[Package Updates]

[3.1.0]

• Update Rocket.Chat to 8.2.1
• Full Changelog
• (#​39508 by @​dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#​39517 by @​dionisio-bot) Fixes ssrf validation for oauth endpoints, which allows internal endpoints to be used during the auth flow.
• This release focuses on security, stability, and usability improvements.
• SSRF protection was strengthened by moving URL validation into the server-fetch package with built-in safeguards like internal IP blocking, DNS rebinding protection, stricter redirect handling, and optional safe overrides, plus a new workspace allowlist for specific domains, IPs, and ports.
• The minimum supported MongoDB version was raised to 8.0 to improve the support matrix's stability.
• Federation now includes an added validation layer that restricts usage to users with verified emails matching the configured domain.
• OpenAPI documentation generation was improved to correctly handle multiple HTTP methods under the same endpoint path.
• Apps-Engine now supports multiple file uploads, a new uploads.delete endpoint allows individual file deletion, and username formatting across the UI has been standardized to consistently include an @​ prefix.
• The release also delivers a broad set of reliability and security fixes. It resolves a persistent Enterprise plan active pop-up caused by a failing API request, ensures chat routing respects agent limits in microservices deployments, and adds a MongoDB TTL index to automatically expire statistics after one year to control storage growth.
• Several Apps-Engine issues were addressed, including lost logs in nested requests and broken dynamic route parameters.

[Package Updates]

[3.2.0]

• Update Rocket.Chat to 8.3.1
• Full Changelog
• (#​40080 by @​dionisio-bot) Fixes a bug that could remove all of a user's subscriptions when the user was re-added to a room while still banned.