Rocket.Chat - Package Updates

[Package Updates]

[3.6.1]

• Update Rocket.Chat to 8.7.1
• Full Changelog
• (#41818 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
• (#41820 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41846) Fixes an issue where a MultiSelect option checkbox remained checked after the option was deselected
• (#41819 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
• (#41817 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

[Package Updates]

[3.7.0]

• Update Rocket.Chat to 8.8.0
• Full Changelog
• Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.
• Accepts a role name in the when.hasOneRole and when.hasAllRoles filters of an app action button
• Changes the default apps-engine runtime backend from deno to node. The previous behavior can be restored by setting the environment variable APPS_ENGINE_RUNTIME_BACKEND='deno'
• Adds support for SAML authentication in the mobile and desktop apps via the system browser.
• Deprecates LDAP and SAML authentication on workspaces without a Premium plan. Both keep working as they are today, but the admin settings now warn that version 9.0.0 will require a license including the ldap-enterprise or saml-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through either of them.
• Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list
• Adds status visibility, letting users hide their presence and status message from specific people they choose. Blocked people see that user as offline, indistinguishable from genuinely offline, and the block can be lifted at any time changes apply live, without a reload.
• Fixed app action buttons never matching a role scoped to Subscriptions owner, moderator, leader, or a custom one. The room was not being passed as the scope of the role check, so a button filtered by one of those roles stayed hidden even for a user who held it in the room.
• Fixed business hours closing for one minute a day when configured as 00:00-23:59. Work hours are set at minute granularity, but the finish time was treated as exclusive, so consecutive daily windows never met and the service dropped to closed for the whole 23:59 minute agents could not become available and the Livechat widget rendered the offline form. A work hour now stays open until the end of its finish minute.
• Fixes the composer popups (mentions, slash commands and emojis) staying open after programmatic changes to the composer text, such as canceling the edition of a message that contains a mention.

[Package Updates]

[3.7.1]

• Update Rocket.Chat to 8.8.1
• Full Changelog
• Fixes Omnichannel rooms failing to register agent responses (and showing send errors on messages and file uploads that were actually delivered) when the room carried corrupted visitor activity data created by older app integrations