<![CDATA[Loomio - Package Updates]]>You can use this thread to track updates to the Loomio package.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/8833/loomio-package-updatesRSS for NodeMon, 17 Aug 2026 17:33:47 GMTFri, 17 Mar 2023 14:52:11 GMT60<![CDATA[Reply to Loomio - Package Updates on Sat, 08 Aug 2026 16:35:42 GMT]]>[1.18.6]

  • jobs have moved to Solid Queue
  • channels is unused and hocuspocus is part of main project
]]>https://forum.cloudron.io/post/127941https://forum.cloudron.io/post/127941Sat, 08 Aug 2026 16:35:42 GMT<![CDATA[Reply to Loomio - Package Updates on Wed, 05 Aug 2026 06:25:19 GMT]]>[1.18.5]

  • Update loomio to 3.1.7
  • Full Changelog
  • Fix: Upgrade Undici to address published HTTP client security advisories.
  • Fix: Block SSRF bypasses using IPv4-compatible, NAT64, Teredo, and 6to4 addresses.
  • New: Support light and dark color preferences in compatible email clients.
  • New: Configure theme gradients, surface text colors, application bars, and navigation drawers.
  • Fix: Include non-secret subgroups in parent-group exports and improve group imports.
  • Fix: Process bulk invitation requests of 2,000 or more addresses before the request timeout.
  • Fix: Stop blocked inbound emails from creating administrator notifications.
  • Fix: Improve browser error reporting, forms, and chat integration feedback.
]]>https://forum.cloudron.io/post/127729https://forum.cloudron.io/post/127729Wed, 05 Aug 2026 06:25:19 GMT<![CDATA[Reply to Loomio - Package Updates on Sat, 01 Aug 2026 07:11:00 GMT]]>[1.18.4]

  • Update loomio to 3.1.5
  • Full Changelog
  • New: Subscribe a Loomio group to an external email mailing list.
  • Fix: Prevent duplicate threads and staff forwards when a mail server retries delivery.
  • Fix: Preserve the SMTP envelope recipient when an email is delivered through a mailing list or forwarding address.
  • New: Convert a group thread to a direct thread while retaining access for its participants.
  • Fix: Require Bearer authentication for the trusted server API so API keys are not accepted in URLs or request bodies.
  • New: Discover Loomio's user and server API documentation through /llms.txt.
]]>https://forum.cloudron.io/post/127576https://forum.cloudron.io/post/127576Sat, 01 Aug 2026 07:11:00 GMT<![CDATA[Reply to Loomio - Package Updates on Thu, 30 Jul 2026 15:36:59 GMT]]>[1.18.3]

  • Update loomio to 3.1.4
  • Full Changelog
  • Rails and Active Storage have been upgraded from 8.0.5 to 8.0.5.1 to address CVE-2026-66066 / GHSA-xr9x-r78c-5hrm.
  • API and session authentication boundaries reject unsafe token handling and sensitive serialization.
  • User-controlled outbound requests reject private, loopback, link-local, and cloud-metadata destinations.
  • User-controlled translated content and Markdown links are protected against executable markup and unsafe URI schemes.
  • Direct-upload endpoints require an authenticated Loomio session and apply upload limits.
  • Inbound email authentication results are used to avoid attributing spoofed messages to group members.
  • Discussion and poll templates can now be exported and imported as JSON.
  • Typing @ in the rich-text or Markdown editor now opens mention suggestions immediately.
  • The interface, application branding, icons, typography, navigation, and error pages have been refreshed.
  • Copy for AI has been renamed Copy Markdown to describe the exported format directly.
]]>https://forum.cloudron.io/post/127488https://forum.cloudron.io/post/127488Thu, 30 Jul 2026 15:36:59 GMT<![CDATA[Reply to Loomio - Package Updates on Sat, 25 Jul 2026 19:17:16 GMT]]>[1.18.2]

  • Update loomio to 3.1.3
  • Full Changelog
  • The B2 and B3 APIs now support API keys in an HTTP bearer authorization header:
  • An unsubscribe token no longer authorizes private poll exports. Restricted boot responses omit the live-update channel token, and opening an unsubscribe link does not create a persistent session. Normal signed-in sessions and notification-preference changes are unchanged.
  • Announcement audience search and counts now enforce the permissions of the target group, thread, or poll. Announcing to a thread's group requires announcement permission.
  • Existing discussions, comments, and stances can no longer be reassigned to a different group, parent, or poll through update parameters. These constraints are enforced at shared service or model boundaries rather than only in the interface.
  • Identified polls now apply until_vote and until_closed result visibility consistently across API responses, attachments, exports, notifications, chatbots, server-rendered pages, and thread Markdown.
  • User-specific live-update payloads are serialized separately from payloads published to shared group and topic channels. Shared payloads do not carry current_user serialization context, preventing one recipient's private fields from being reused for other subscribers.
  • Deleting a reaction now also deletes its associated events and notifications, preventing stale activity records from referring to a reaction that no longer exists.
  • Demo cloning is limited to three clones per user per day and ten clone requests per IP address per hour. These limits do not affect normal group creation.
  • The following legacy numeric redirect routes have been removed: /discussions/:id, /groups/:id, /c/:id
  • Those incremental anonymous-security measures are repealed in Loomio 3.1.3. The release restores the established behavior for existing anonymous polls, including stance reasons, thread activity, notifications, bookmarks, tasks, translations, identifiers, ordering, and exports. Historical stance reasons and related content are retained.
]]>https://forum.cloudron.io/post/127205https://forum.cloudron.io/post/127205Sat, 25 Jul 2026 19:17:16 GMT<![CDATA[Reply to Loomio - Package Updates on Sat, 25 Jul 2026 08:07:56 GMT]]>[1.18.1]

  • Update loomio to 3.1.2
  • Full Changelog
  • This security release fixes additional anonymous-poll privacy issues and a group-membership scoping issue found during a continued review of Loomio 3.1.1.
  • Version-history responses for anonymous polls no longer expose a stance's database ID or its edit timestamp.
  • The per-poll CSV export no longer includes the database ID or the written reason for anonymous stances.
  • The group CSV and JSON exports no longer retain the database ID, written reason, or creation order of anonymous stances.
  • On-demand translation of a stance's reason now follows the same visibility rules as the poll itself.
  • Bookmarking another member's anonymous stance no longer reveals the voter's name or the stance's database ID.
  • Creating a task from text inside an anonymous stance no longer discloses the voter, the stance's database ID, or the reason.
  • Email and chatbot notifications about a new stance are no longer delivered before a poll set to hide results until it closes has closed.
  • The thread Markdown export no longer includes the exact submission time of anonymous stances.
  • The membership-list endpoint returned the members of a subgroup to administrators of a parent group even when the subgroup was configured to be hidden from parent members.
]]>https://forum.cloudron.io/post/127190https://forum.cloudron.io/post/127190Sat, 25 Jul 2026 08:07:56 GMT<![CDATA[Reply to Loomio - Package Updates on Wed, 22 Jul 2026 06:39:11 GMT]]>[1.18.0]

  • Update loomio to 3.1.0
  • Full Changelog
  • This release fixes an issue where metadata associated with anonymous poll responses could weaken ballot anonymity.
  • Polls can now host threaded discussion.
  • Loomio now includes a What's new page with a chronological history of user-facing features and improvements.
  • Signed-in users can bookmark threads, comments, polls, votes, and outcomes.
  • Parent groups and their subgroups now share one tag catalogue.
  • Thread members can copy a complete thread as structured Markdown for use with an AI assistant.
  • Loomio now uses Vuetify 4. This updates typography, spacing, menus, forms, buttons, dialogs, voting screens, thread events, group settings, member lists, email settings, and report controls.
  • Background jobs now use PostgreSQL-backed Solid Queue instead of Sidekiq.
  • Legacy /api/b1 routes are removed. API integrations should use /api/b2 or the appropriate server administration API.
  • A separate security advisory provides further technical details.
]]>https://forum.cloudron.io/post/127041https://forum.cloudron.io/post/127041Wed, 22 Jul 2026 06:39:11 GMT<![CDATA[Reply to Loomio - Package Updates on Mon, 11 May 2026 15:04:52 GMT]]>[1.17.12]

  • Update loomio to 3.0.24
  • Full Changelog
  • Fixed: Prevent comment authors from editing or restoring comments that an admin has discarded.
  • Fixed: Preserve group ownership when creating discussions from templates in grouped contexts.
  • Improved: Hardened deployment/runtime behavior with trusted ingress IP allowlisting and exec-based Docker startup processes.
  • Improved: Removed obsolete hocuspocus SQLite persistence and legacy document-list template calls.
  • Improved: Background jobs now avoid retrying forever for records that have already been deleted.
  • Maintenance: Updated dependencies including Devise, Vite, Bootsnap, Rollup, Sentry, Nokogiri, Puma, and tzinfo-data.
]]>https://forum.cloudron.io/post/124593https://forum.cloudron.io/post/124593Mon, 11 May 2026 15:04:52 GMT<![CDATA[Reply to Loomio - Package Updates on Mon, 27 Apr 2026 19:48:19 GMT]]>[1.17.11]

  • Update loomio to 3.0.22
  • Full Changelog
  • STV (Single Transferable Vote) poll type beta. Anonymous by default, results hidden until the poll closes. The form shows a warning asking users to report bugs and feedback on GitHub.
  • Cloudflare Turnstile challenge on password sign-in, login-token requests, signup, and trial creation. Admin login-link sign-in bypasses the challenge; sign-in with a login code also bypasses it.
  • Fixed SQL injection in HasTimeframe via timeframe_for.
  • Blocked SSRF in the link preview service; link previews now require auth and are throttled to 20/hour per user.
  • Direct upload size limit (25 MB trial, 1 GB paid); blocked dangerous uploads.
  • Bumped vue-i18n to 9.14.5 (XSS + prototype pollution).
  • Refresh a user's groups after joining or being added to a group.
  • Return a token error on session failure when a login token is pending; translate sessions errors server-side; surface server errors on login code entry.
  • Fix demo poll cloning (missing opening_at/opened_at).
  • Translation fixes: needs_a_rethink_meaning, "vote in" "vote on", German typo in discard.
]]>https://forum.cloudron.io/post/124068https://forum.cloudron.io/post/124068Mon, 27 Apr 2026 19:48:19 GMT<![CDATA[Reply to Loomio - Package Updates on Wed, 25 Feb 2026 04:28:08 GMT]]>[1.17.10]

  • Update loomio to 3.0.21
  • Full Changelog
  • Changes to the Discussion and Poll templates UI. I've had people tell me they couldn't find how to create a template. Now there is a New template button, which opens the example templates page, you can use an example as the starting point for a new template.
  • Fewer discussion templates in a group by default. Updates to the Sense Check poll options, so they're more helpful.
  • Materialize default discussion templates as DB records by @​robguthrie in #​12182
  • Discussion template UI improvements by @​robguthrie in #​12181
  • Add opening_at to polls for scheduled voting by @​robguthrie in #​12174
  • Poll template updates by @​robguthrie in #​12184
  • This release also addresses a minor security issue, where a member of a group could see the names of secret subgroups they did not belong to, if they inspected the server responses of the reports controller.
]]>https://forum.cloudron.io/post/120722https://forum.cloudron.io/post/120722Wed, 25 Feb 2026 04:28:08 GMT<![CDATA[Reply to Loomio - Package Updates on Sun, 15 Feb 2026 09:43:01 GMT]]>[1.17.9]

]]>https://forum.cloudron.io/post/120236https://forum.cloudron.io/post/120236Sun, 15 Feb 2026 09:43:01 GMT<![CDATA[Reply to Loomio - Package Updates on Tue, 10 Feb 2026 07:27:16 GMT]]>[1.17.8]

  • Update loomio_channel_server to 1cb973b
]]>https://forum.cloudron.io/post/119981https://forum.cloudron.io/post/119981Tue, 10 Feb 2026 07:27:16 GMT<![CDATA[Reply to Loomio - Package Updates on Wed, 04 Feb 2026 12:07:29 GMT]]>[1.17.6]

]]>https://forum.cloudron.io/post/119650https://forum.cloudron.io/post/119650Wed, 04 Feb 2026 12:07:29 GMT<![CDATA[Reply to Loomio - Package Updates on Wed, 28 Jan 2026 11:11:35 GMT]]>[1.17.5]

  • Update loomio to 3.0.17
  • Full Changelog
  • Fix duplicate email crashes in OAuth and SAML SSO authentication
  • remove unused canViewPublicGroups code
  • Prevent non-members from seeing tags on closed groups
  • remove hiredis gem
]]>https://forum.cloudron.io/post/119290https://forum.cloudron.io/post/119290Wed, 28 Jan 2026 11:11:35 GMT<![CDATA[Reply to Loomio - Package Updates on Tue, 27 Jan 2026 07:24:45 GMT]]>[1.17.4]

  • Update loomio to 3.0.16
  • Full Changelog
  • The app would not boot due to redis and sidekiq connection_pool incompatibilities
  • With FEATURES_DISABLE_EMAIL_LOGIN=1, and someone signs in via SSO, and they don't have a Loomio account we just create user and sign them in. No link/Create account screen (and no Terms of Service acceptance either).
  • You can prevent users changing their name, email, username. Set LOOMIO_SSO_FORCE_USER_ATTRS=1
  • How do people join? supports "Anyone can join. Meaning registered users can just click Join group - no invitation or approval required. Set FEATURES_DISABLE_CREATE_USER=1 and Group privacy to closed.
  • List in group directory, means the group will show on /explore (also linked from the sidebar as Find a group. Set FEATURES_EXPLORE_PUBLIC_GROUPS=1
]]>https://forum.cloudron.io/post/119204https://forum.cloudron.io/post/119204Tue, 27 Jan 2026 07:24:45 GMT<![CDATA[Reply to Loomio - Package Updates on Fri, 23 Jan 2026 07:55:59 GMT]]>[1.17.3]

]]>https://forum.cloudron.io/post/119011https://forum.cloudron.io/post/119011Fri, 23 Jan 2026 07:55:59 GMT<![CDATA[Reply to Loomio - Package Updates on Wed, 21 Jan 2026 07:28:06 GMT]]>[1.17.2]

]]>https://forum.cloudron.io/post/118902https://forum.cloudron.io/post/118902Wed, 21 Jan 2026 07:28:06 GMT<![CDATA[Reply to Loomio - Package Updates on Tue, 20 Jan 2026 05:21:18 GMT]]>[1.17.1]

]]>https://forum.cloudron.io/post/118813https://forum.cloudron.io/post/118813Tue, 20 Jan 2026 05:21:18 GMT<![CDATA[Reply to Loomio - Package Updates on Wed, 17 Dec 2025 07:27:07 GMT]]>[1.17.0]

  • Update loomio_channel_server to 9408afb
]]>https://forum.cloudron.io/post/117219https://forum.cloudron.io/post/117219Wed, 17 Dec 2025 07:27:07 GMT<![CDATA[Reply to Loomio - Package Updates on Tue, 02 Dec 2025 08:13:49 GMT]]>[1.16.2]

]]>https://forum.cloudron.io/post/116330https://forum.cloudron.io/post/116330Tue, 02 Dec 2025 08:13:49 GMT<![CDATA[Reply to Loomio - Package Updates on Thu, 06 Nov 2025 07:29:08 GMT]]>[1.16.1]

  • Update loomio to 3.0.10
  • Full Changelog
  • Unsubscribe from poll via email footer link - stance_created was missing the unsubscribe link
  • Fix translations and ensure we don't have any missing placeholders
  • Attempt to address stance voting bug, where poll option ids were from another poll
  • Show error and offer to reload if loading fails
  • return a "message was not delivered" email when people reply to notifications email address rather than reply-to value
]]>https://forum.cloudron.io/post/114939https://forum.cloudron.io/post/114939Thu, 06 Nov 2025 07:29:08 GMT<![CDATA[Reply to Loomio - Package Updates on Tue, 04 Nov 2025 06:47:30 GMT]]>[1.16.0]

  • Update loomio_channel_server to 782f06e
]]>https://forum.cloudron.io/post/114829https://forum.cloudron.io/post/114829Tue, 04 Nov 2025 06:47:30 GMT<![CDATA[Reply to Loomio - Package Updates on Fri, 31 Oct 2025 07:13:22 GMT]]>[1.15.1]

  • Update loomio to 3.0.9
  • Full Changelog
  • switch to dartsass-sprockets
  • improving print styles since vue3 upgrade
  • don't disable submit button when form is invalid, show errors on save
  • add missing error translations
  • dont show any value for '% of points' column for undecided voters. fixes
  • ensure we update outdated votes even when websocket is unavailable
  • fix some pt-br translations
  • fix translation for email settings
  • dashboard: fix check to display no polls message
  • ensure that unrecognised sender notifiations show up in-app
]]>https://forum.cloudron.io/post/114653https://forum.cloudron.io/post/114653Fri, 31 Oct 2025 07:13:22 GMT<![CDATA[Reply to Loomio - Package Updates on Thu, 30 Oct 2025 08:28:02 GMT]]>[1.15.0]

  • Update loomio_channel_server to 27ec2c2
]]>https://forum.cloudron.io/post/114590https://forum.cloudron.io/post/114590Thu, 30 Oct 2025 08:28:02 GMT