Rocket.Chat - Package Updates

[Package Updates]

[3.6.1]

• Update Rocket.Chat to 8.7.1
• Full Changelog
• (#41818 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
• (#41820 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
• (#41846) Fixes an issue where a MultiSelect option checkbox remained checked after the option was deselected
• (#41819 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
• (#41817 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

[Package Updates]

[3.7.0]

• Update Rocket.Chat to 8.8.0
• Full Changelog
• Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.
• Accepts a role name in the when.hasOneRole and when.hasAllRoles filters of an app action button
• Changes the default apps-engine runtime backend from deno to node. The previous behavior can be restored by setting the environment variable APPS_ENGINE_RUNTIME_BACKEND='deno'
• Adds support for SAML authentication in the mobile and desktop apps via the system browser.
• Deprecates LDAP and SAML authentication on workspaces without a Premium plan. Both keep working as they are today, but the admin settings now warn that version 9.0.0 will require a license including the ldap-enterprise or saml-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through either of them.
• Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list
• Adds status visibility, letting users hide their presence and status message from specific people they choose. Blocked people see that user as offline, indistinguishable from genuinely offline, and the block can be lifted at any time changes apply live, without a reload.
• Fixed app action buttons never matching a role scoped to Subscriptions owner, moderator, leader, or a custom one. The room was not being passed as the scope of the role check, so a button filtered by one of those roles stayed hidden even for a user who held it in the room.
• Fixed business hours closing for one minute a day when configured as 00:00-23:59. Work hours are set at minute granularity, but the finish time was treated as exclusive, so consecutive daily windows never met and the service dropped to closed for the whole 23:59 minute agents could not become available and the Livechat widget rendered the offline form. A work hour now stays open until the end of its finish minute.
• Fixes the composer popups (mentions, slash commands and emojis) staying open after programmatic changes to the composer text, such as canceling the edition of a message that contains a mention.

[Package Updates]

[3.7.1]

• Update Rocket.Chat to 8.8.1
• Full Changelog
• Fixes Omnichannel rooms failing to register agent responses (and showing send errors on messages and file uploads that were actually delivered) when the room carried corrupted visitor activity data created by older app integrations

[Package Updates]

[3.8.0]

• Update Rocket.Chat to 8.9.0
• Full Changelog
• Deprecates Custom OAuth authentication on workspaces without a Premium plan. Custom OAuth services keep working as they are today, but their admin settings now warn that version 9.0.0 will require a license including the oauth-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through one of them.
• Deprecates the Gravatar integration. Default avatars fetched from Gravatar on user creation and Gravatar-based avatar suggestions in the profile settings will be removed in a future major release; a warning is now logged when they are used.
• Adds hybrid retrieval to AI Search. A single search balance setting decides how much semantic retrieval contributes relative to keyword search, so a workspace can find messages by meaning without losing exact matches on error codes, ticket ids or function names. An optional recency boost, disabled by default, promotes newer messages after relevance ranking.
• Introduces custom, user-defined categories to the sidebar (Enterprise only). Users can create, rename, delete and reorder categories (menu-driven), and move rooms into them via the room context menu or the room header.
• Adds a new POST /v1/chat.getMessages endpoint to fetch several messages at once by id, including messages from different rooms. The request fails if any of the messages belongs to a room the caller cannot read.
• Adds a new GET /v1/rooms.history endpoint to load a room's message history. Unlike the existing channels.history, groups.history, im.history and dm.history endpoints, it works with any room type through a single route, and can be used to read public channels anonymously when Accounts_AllowAnonymousRead is enabled.
• Fixes the Docker image crashing at boot on arm64 with Error loading shared library ld-linux-aarch64.so.1 while loading argon2.node. The Meteor bundle carries build/Release output compiled on the glibc-based CI host, and node-gyp-build prefers it over the musl binaries shipped under prebuilds/ in the same package, so the wrong one was selected at runtime.
• Fixes auto-translate continuing to translate messages with the previously selected service provider after switching providers, until the server was restarted or the feature was disabled and re-enabled.
• Fixes two factor authentication for SAML authentication method.
• Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)