Release 8.7.0#41493
Open
rocketchat-github-ci wants to merge 204 commits into
Open
Conversation
…m MediaCallRoomSection (#41043) Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nazareno Bucciarelli <84046180+nazabucciarelli@users.noreply.github.com> Co-authored-by: Julio Araujo <julio.araujo@rocket.chat> Co-authored-by: Nazareno Bucciarelli <bnazareno03@gmail.com>
Co-authored-by: Tasso Evangelista <tasso.evangelista@rocket.chat> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>
…ervices (#41153) Co-authored-by: Kevin Aleman <kaleman960@gmail.com>
Co-authored-by: Matheus Cardoso <matheus@cardo.so>
Co-authored-by: MartinSchoeler <martinschoeler8@gmail.com>
Co-authored-by: Douglas Gubert <douglas.gubert@gmail.com> Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>
Hacktron Security Check - SkippedReason: This PR exceeds Hacktron's 200-file review cap and will not be scanned. Split the PR into smaller changes for review coverage.
|
🦋 Changeset detectedLatest commit: ea64e17 The changes in this PR will be included in the next version bump. This PR includes no changesetsWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
Contributor
|
Important Review skippedToo many files! This PR contains 2631 files, which is 2331 over the limit of 300. To get a review, narrow the scope: Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (45)
📒 Files selected for processing (2955)
You can disable this status message by setting the |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #41493 +/- ##
==========================================
- Coverage 70.18% 68.59% -1.60%
==========================================
Files 3371 4134 +763
Lines 130443 160802 +30359
Branches 23026 29298 +6272
==========================================
+ Hits 91553 110303 +18750
- Misses 35568 45392 +9824
- Partials 3322 5107 +1785
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
7 issues found across 3000 files
Not reviewed (too large): apps/meteor/app/emoji-emojione/client/people-sprites.css (~8,729 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/meteor/app/apps/server/converters/users.ts">
<violation number="1" location="apps/meteor/app/apps/server/converters/users.ts:143">
P2: Invisible users reach Apps with `statusConnection: 'INVISIBLE'`, not the enum's `'invisible'` value, so Apps cannot reliably recognize their connection status. Add an explicit `case 'invisible': return UserStatusConnection.INVISIBLE` before the default.</violation>
</file>
<file name="apps/meteor/app/emoji/client/helpers.ts">
<violation number="1" location="apps/meteor/app/emoji/client/helpers.ts:178">
P2: Custom emoji names ending in `_toneN-N` disappear from search because mixed-tone normalization is applied regardless of package. Limit this normalization/filtering to native emoji entries so custom names remain searchable.</violation>
</file>
<file name="apps/meteor/client/components/SidebarToggler/SidebarTogglerBadge.tsx">
<violation number="1" location="apps/meteor/client/components/SidebarToggler/SidebarTogglerBadge.tsx:5">
P3: The newly exported `SidebarTogglerBadgeProps` type is not imported anywhere else in the codebase. This adds an unused export to the module's public surface, which can mislead consumers into thinking the type is part of a supported API contract. Either remove the `export` keyword if no external usage is planned, or add one if it will be consumed in a follow-up PR.</violation>
</file>
<file name="apps/meteor/app/apps/server/converters/settings.ts">
<violation number="1" location="apps/meteor/app/apps/server/converters/settings.ts:26">
P2: Apps reading settings receive no `section`, so grouped Rocket.Chat settings lose their grouping metadata. Map `setting.group` to the Apps-Engine `section` field instead.</violation>
</file>
<file name="apps/meteor/client/apps/gameCenter/GameCenterContainer.tsx">
<violation number="1" location="apps/meteor/client/apps/gameCenter/GameCenterContainer.tsx:32">
P3: `paddingBlock={16}` sets both padding-top and padding-bottom, adding spacing at the top that previously didn't exist. The old `pb={16}` only set padding-bottom. If the intent was to preserve the same visual layout while using logical properties, use `paddingBlockEnd={16}` instead.</violation>
</file>
<file name="apps/meteor/app/emoji-native/lib/generateEmojiData.ts">
<violation number="1" location="apps/meteor/app/emoji-native/lib/generateEmojiData.ts:122">
P2: Selecting a tone makes same-tone multi-person emoji disappear from the picker because it requests `:people_holding_hands_tone1:`, but this generates only `:people_holding_hands_tone1-1:`. Add the single-tone alias when every tone in a tuple is equal.</violation>
</file>
<file name="apps/meteor/client/components/UserCard/UserCardInfo.tsx">
<violation number="1" location="apps/meteor/client/components/UserCard/UserCardInfo.tsx:5">
P3: The change uses a logical CSS property (`marginBlock`) which is a good forward-looking direction for RTL support, but `mb` → `marginBlock` is not a 1:1 replacement — `mb` targets a single side while `marginBlock` targets both. If top margin was intentionally excluded before, the new property adds unintended space above.</violation>
</file>
Note: This PR contains a large number of files. cubic only reviews up to 200 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.
Re-trigger cubic
| console.warn( | ||
| `The user ${username} (${userId}) does not have a valid status (offline, online, away, or busy). It is currently: "${status}"`, | ||
| ); | ||
| return (!status ? UserStatusConnection.OFFLINE : status.toUpperCase()) as UserStatusConnection; |
Contributor
There was a problem hiding this comment.
P2: Invisible users reach Apps with statusConnection: 'INVISIBLE', not the enum's 'invisible' value, so Apps cannot reliably recognize their connection status. Add an explicit case 'invisible': return UserStatusConnection.INVISIBLE before the default.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/apps/server/converters/users.ts, line 143:
<comment>Invisible users reach Apps with `statusConnection: 'INVISIBLE'`, not the enum's `'invisible'` value, so Apps cannot reliably recognize their connection status. Add an explicit `case 'invisible': return UserStatusConnection.INVISIBLE` before the default.</comment>
<file context>
@@ -0,0 +1,146 @@
+ console.warn(
+ `The user ${username} (${userId}) does not have a valid status (offline, online, away, or busy). It is currently: "${status}"`,
+ );
+ return (!status ? UserStatusConnection.OFFLINE : status.toUpperCase()) as UserStatusConnection;
+ }
+ }
</file context>
Comment on lines
+178
to
+179
| const mixedTones = current.match(MIXED_TONE_SUFFIX); | ||
| const categoryName = current.replace(MIXED_TONE_SUFFIX, ''); |
Contributor
There was a problem hiding this comment.
P2: Custom emoji names ending in _toneN-N disappear from search because mixed-tone normalization is applied regardless of package. Limit this normalization/filtering to native emoji entries so custom names remain searchable.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/emoji/client/helpers.ts, line 178:
<comment>Custom emoji names ending in `_toneN-N` disappear from search because mixed-tone normalization is applied regardless of package. Limit this normalization/filtering to native emoji entries so custom names remain searchable.</comment>
<file context>
@@ -165,13 +175,19 @@ export const getEmojisBySearchTerm = (
tone = `_tone${actualTone}`;
}
+ const mixedTones = current.match(MIXED_TONE_SUFFIX);
+ const categoryName = current.replace(MIXED_TONE_SUFFIX, '');
+ if (mixedTones && !(actualTone > 0 && Number(mixedTones[1]) === actualTone)) {
</file context>
Suggested change
| const mixedTones = current.match(MIXED_TONE_SUFFIX); | |
| const categoryName = current.replace(MIXED_TONE_SUFFIX, ''); | |
| const mixedTones = emojiPackage === 'native' ? current.match(MIXED_TONE_SUFFIX) : null; | |
| const categoryName = mixedTones ? current.replace(MIXED_TONE_SUFFIX, '') : current; |
| value: setting.value, | ||
| public: setting.public, | ||
| hidden: setting.hidden, | ||
| group: setting.group, |
Contributor
There was a problem hiding this comment.
P2: Apps reading settings receive no section, so grouped Rocket.Chat settings lose their grouping metadata. Map setting.group to the Apps-Engine section field instead.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/apps/server/converters/settings.ts, line 26:
<comment>Apps reading settings receive no `section`, so grouped Rocket.Chat settings lose their grouping metadata. Map `setting.group` to the Apps-Engine `section` field instead.</comment>
<file context>
@@ -0,0 +1,54 @@
+ value: setting.value,
+ public: setting.public,
+ hidden: setting.hidden,
+ group: setting.group,
+ i18nLabel: setting.i18nLabel,
+ i18nDescription: setting.i18nDescription,
</file context>
| }; | ||
|
|
||
| const toneShortcodes = getShortcodes(skin.hexcode); | ||
| const fallbackShortcode = `${primaryShortcode}_tone${tones.join('-')}`; |
Contributor
There was a problem hiding this comment.
P2: Selecting a tone makes same-tone multi-person emoji disappear from the picker because it requests :people_holding_hands_tone1:, but this generates only :people_holding_hands_tone1-1:. Add the single-tone alias when every tone in a tuple is equal.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/emoji-native/lib/generateEmojiData.ts, line 122:
<comment>Selecting a tone makes same-tone multi-person emoji disappear from the picker because it requests `:people_holding_hands_tone1:`, but this generates only `:people_holding_hands_tone1-1:`. Add the single-tone alias when every tone in a tuple is equal.</comment>
<file context>
@@ -0,0 +1,141 @@
+ };
+
+ const toneShortcodes = getShortcodes(skin.hexcode);
+ const fallbackShortcode = `${primaryShortcode}_tone${tones.join('-')}`;
+ for (const code of [...toneShortcodes, fallbackShortcode]) {
+ emojiList[`:${code}:`] = skinEntry;
</file context>
| @@ -2,7 +2,7 @@ import { css } from '@rocket.chat/css-in-js'; | |||
| import { Box, Badge } from '@rocket.chat/fuselage'; | |||
| import type { ReactNode } from 'react'; | |||
|
|
|||
| type SidebarTogglerBadgeProps = { | |||
| export type SidebarTogglerBadgeProps = { | |||
Contributor
There was a problem hiding this comment.
P3: The newly exported SidebarTogglerBadgeProps type is not imported anywhere else in the codebase. This adds an unused export to the module's public surface, which can mislead consumers into thinking the type is part of a supported API contract. Either remove the export keyword if no external usage is planned, or add one if it will be consumed in a follow-up PR.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/client/components/SidebarToggler/SidebarTogglerBadge.tsx, line 5:
<comment>The newly exported `SidebarTogglerBadgeProps` type is not imported anywhere else in the codebase. This adds an unused export to the module's public surface, which can mislead consumers into thinking the type is part of a supported API contract. Either remove the `export` keyword if no external usage is planned, or add one if it will be consumed in a follow-up PR.</comment>
<file context>
@@ -2,7 +2,7 @@ import { css } from '@rocket.chat/css-in-js';
import type { ReactNode } from 'react';
-type SidebarTogglerBadgeProps = {
+export type SidebarTogglerBadgeProps = {
children?: ReactNode;
};
</file context>
Suggested change
| export type SidebarTogglerBadgeProps = { | |
| type SidebarTogglerBadgeProps = { |
| @@ -29,7 +29,7 @@ const GameCenterContainer = ({ handleClose, handleBack, game }: IGameCenterConta | |||
| </ContextualbarTitle> | |||
| {handleClose && <ContextualbarClose onClick={handleClose} />} | |||
| </ContextualbarHeader> | |||
| <ContextualbarContent pb={16}> | |||
| <ContextualbarContent paddingBlock={16}> | |||
Contributor
There was a problem hiding this comment.
P3: paddingBlock={16} sets both padding-top and padding-bottom, adding spacing at the top that previously didn't exist. The old pb={16} only set padding-bottom. If the intent was to preserve the same visual layout while using logical properties, use paddingBlockEnd={16} instead.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/client/apps/gameCenter/GameCenterContainer.tsx, line 32:
<comment>`paddingBlock={16}` sets both padding-top and padding-bottom, adding spacing at the top that previously didn't exist. The old `pb={16}` only set padding-bottom. If the intent was to preserve the same visual layout while using logical properties, use `paddingBlockEnd={16}` instead.</comment>
<file context>
@@ -29,7 +29,7 @@ const GameCenterContainer = ({ handleClose, handleBack, game }: IGameCenterConta
{handleClose && <ContextualbarClose onClick={handleClose} />}
</ContextualbarHeader>
- <ContextualbarContent pb={16}>
+ <ContextualbarContent paddingBlock={16}>
<iframe title={t('Apps_Game_Center')} style={{ position: 'absolute', width: '95%', height: '80%' }} src={game.url} />
</ContextualbarContent>
</file context>
| @@ -2,7 +2,7 @@ import { Box } from '@rocket.chat/fuselage'; | |||
| import type { ComponentProps } from 'react'; | |||
|
|
|||
| const UserCardInfo = (props: ComponentProps<typeof Box>) => ( | |||
| <Box mb={8} is='span' fontScale='p2' color='hint' withTruncatedText {...props} /> | |||
| <Box marginBlock={8} is='span' fontScale='p2' color='hint' withTruncatedText {...props} /> | |||
Contributor
There was a problem hiding this comment.
P3: The change uses a logical CSS property (marginBlock) which is a good forward-looking direction for RTL support, but mb → marginBlock is not a 1:1 replacement — mb targets a single side while marginBlock targets both. If top margin was intentionally excluded before, the new property adds unintended space above.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/client/components/UserCard/UserCardInfo.tsx, line 5:
<comment>The change uses a logical CSS property (`marginBlock`) which is a good forward-looking direction for RTL support, but `mb` → `marginBlock` is not a 1:1 replacement — `mb` targets a single side while `marginBlock` targets both. If top margin was intentionally excluded before, the new property adds unintended space above.</comment>
<file context>
@@ -2,7 +2,7 @@ import { Box } from '@rocket.chat/fuselage';
const UserCardInfo = (props: ComponentProps<typeof Box>) => (
- <Box mb={8} is='span' fontScale='p2' color='hint' withTruncatedText {...props} />
+ <Box marginBlock={8} is='span' fontScale='p2' color='hint' withTruncatedText {...props} />
);
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You can see below a preview of the release change log:
8.7.0
Engine versions
22.22.32.3.18.01.64.1-rc.0Minor Changes
(#40351) Adds
currentfield toDeviceManagementSessiontype andcurrentLoginTokenparameter toaggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.(#40721) ## Phishing-Resistant Multi-Factor Authentication
Introduces a more secure and reliable server-side OAuth authentication flow.
What’s New
OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
Enable this new setting
Accounts_OAuth_Use_Modern_Flowto use all of the above mentioned features.(#40890) Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.
(#39324) Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new
fipsmodule, and FIPS status is now reported in server logs and statistics.(#41019) Adds an alternative runtime runner for apps. It can be enabled via environment variable
APPS_ENGINE_RUNTIME_BACKEND='node'(#41142) Adds inline JSON validation feedback to admin settings that hold JSON (
code: application/json), showing an error in the editor and blocking save while the value is malformed(#40916) Adds a new
licenses.validateREST endpoint that validates a Rocket.Chat license (V2 or V3 JWT) against the current workspace without applying it, so a license can be previewed before it is applied from the UI. A valid license responds with success; an invalid one responds with the validation behaviors that rejected it.(#39411) Replaces proprietary emojis with native (unicode) emojis and increases available emoji set
(#41148) Adds support for the
offlinelicense flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance.(#41120) Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.
(#40728) Deprecates the
logoutCleanUpDDP method and stops the client from calling it. The post-logout side effects (afterLogoutCleanUpCallback+Apps.IPostUserLoggedOut) now run server-side via a newAccounts.onLogouthandler and fromPOST /v1/users.logout, so both DDP and REST logout paths fire them without a client round-trip. The DDP method keeps its original implementation and registration with a deprecation log pointing at/v1/users.logoutuntil 9.0.0.(#40728) Added
POST /v1/cloud.connectWorkspace(replaces the deprecatedcloud:connectWorkspaceDDP method). Body is{ token }; auth-gated withmanage-cloudpermission. The legacy DDP method remains registered with a deprecation log pointing at the new route.(#40728) Added
POST /v1/integrations.clearHistoryandPOST /v1/integrations.replayOutgoing(replace the deprecatedclearIntegrationHistoryandreplayOutgoingIntegrationDDP methods). Bodies{ integrationId }and{ integrationId, historyId }respectively. Permissions (manage-outgoing-integrationsormanage-own-outgoing-integrations) are enforced the same way the DDP methods did. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.(#40728) Added
POST /v1/permissions.addRoleandPOST /v1/permissions.removeRole(replace the deprecatedauthorization:addPermissionToRoleandauthorization:removeRoleFromPermissionDDP methods). Body is{ permissionId, role }on both. The same per-user permission checks (access-permissions,access-setting-permissions) the DDP methods enforced are reused. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.(#40728) Extended
POST /v1/users.setAvatarto accept an optionalservicemultipart field. When provided, the value is stored as the user'savatarOrigin, matching what the deprecatedsetAvatarFromServiceDDP method did. The legacy DDP method remains registered with a deprecation log pointing at the new route.(#40728) Added
POST /v1/users.verifyEmail(replaces the two-call DDP flow ofverifyEmail+afterVerifyEmail). Body is{ token }; the server resolves the user, marks the email verified, and runs the anonymous→user role swap in a single request. The deprecatedafterVerifyEmailDDP method keeps its registration with a deprecation log pointing at the new route.(#40916) Adds a manage license flow to the subscription admin page, allowing license verification before applying it and an option to remove the license. Note: From this point license management should be made in subscription page instead of the Enterprise settings page.
Patch Changes
(#41174) Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself
(#41152) Fixes own account showing twice in navbar room search when searching by username
(#41285) Fixes the Slack importer storing shared files as raw URLs in the message body. Imported file messages now stay hidden until "Download Pending Files" button fetches them, then display as native attachments with image previews. Failed downloads (e.g. invalidated export links) are no longer silently saved as the file's content — they are counted as errors and can be retried.
(#41056) Added a
setUserRolesbridge method to the desktop API and pushed the logged-in user's roles to the desktop app. This lets the desktop client restrict supportedVersions messages (such as version-expiration warnings) to specific roles like admins, instead of showing them to every user. The push is reactive to role changes; desktop builds without the bridge method fall back to their own role lookup.(#41207) Fixes engagement dashboard loading unnecessary data into memory on startup
(#41173) Fixes the password policy allowing a maximum length lower than the minimum length to be saved — a combination that made it impossible to set any valid password. The server now rejects such configurations when password policy settings are saved and shows an error explaining the constraint.
(#41233) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41195) fix: Buttons from emoji picker misbehaving on clicks
An infinite render loop was preventing proper behavior when clicking on the emoji picker buttons. It was fixed by removing the unnecessary state update that was causing the loop and replacing multiple fires of the same mouseover event (when a mouseenter event was the right one to use). There is a chance this pre-existing bug was hidden by React 18's event delegation.
(#41158) Fixes agents' business-hour availability not being updated when they are removed from a department linked to a business hour while multiple business hours are enabled. The recomputation step always failed, leaving removed agents available (or unavailable) according to a business hour that no longer applied to them — and, on deployments running with
EXIT_UNHANDLEDPROMISEREJECTION(or in development/test mode), the unhandled rejection crashed the server process.(#41164) Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.
Also fixes agents keeping a business hour's availability after their department was removed from it: saving a business hour with a smaller department list unlinked the departments but never cleared the business hour from the removed departments' agents.
(#41472) Fixes the license provided via the
ROCKETCHAT_LICENSEenvironment variable not being applied when it is newer than the one persisted in the workspace.(#40351) Fixes error message being shown when logging out current device via Device Management despite successful logout.
(#41169) Fixes a race condition that left messages permanently undecryptable ("incorrect encryption key") in rooms created with encryption enabled. When several members opened such a room at the same time, each client could independently generate and distribute a different group key. Establishing the room key is now atomic (first-write-wins) on the server, and a client that loses the race discards its locally generated key and adopts the established one instead of encrypting with a divergent key.
(#41069) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41168) Fixes LDAP channel sync aborting the entire add/removal pass when a mapped channel could not be resolved, which prevented users from being removed from channels when "Auto Remove Users from Channels" was enabled.
(#41279) Fixes LDAP sync failing to merge an existing user matched by email, which caused a
Username already existserror when the user's username differed from the directory.(#41373) Fixes the server crashing during LDAP login or sync when the configured search settings produce an invalid LDAP filter (for example, an empty User Search Field). The operation now fails gracefully with a logged error instead of terminating the process.
(#41202) Disables more actions on message composer during public channel preview.
(#41480) Fixes an issue where the "user left" system message could be added to an Omnichannel conversation only after the forwarding process had already finished, causing it to appear out of order in the conversation history
(#41110) Passes the original message text to the message renderer so blocks without a dedicated renderer (e.g. tables on clients that don't render them yet) can degrade to their raw markup via the parser's
fallbacksource offsets, instead of disappearing.(#41074) Fixes an issue where the cursor jumped to the wrong position after inserting a mention at the start or middle of a message.
(#41304) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.
(#41089) Enables keyboard activation for Display menu radio buttons and checkboxes
(#41204) Changes the date columns in the Omnichannel Contact Center to show both the formatted date and the relative time: the Last Chat column in the contacts list, and the Started at and Last Message columns in the chats list
(#41341) Fixes a server crash when re-enabling the "Enable Push" setting after it was disabled. Push notifications are now fully reconfigured on re-enable, so settings changed while push was disabled are picked up as well.
(#40768) Ensures the
users.CreateTokenendpoint checks for theuser-generate-access-tokenpermission when generating a login token for another user(#41206) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room
(#41414) Restores Away as a selectable preset in the quick status menu, custom status modal, and account profile page.
(#41145) Fixes the SAML Single Logout response so the
RelayStatematches the exact value received on the logout request, as required by the SAML specification, instead of using Rocket.Chat's own URL(#41254) Fixes the setup wizard being forced back into the registration step on the first start after an upgrade when
OVERWRITE_SETTING_Show_Setup_Wizard=completedis set, which affected air-gapped workspaces running offline licenses without cloud registration.(#41122) Adds keyboard navigation support in Room members list
(#41112) Returns
custom fieldson admin rooms detail view(#41101) Improved
/v1/spotlightsearch performance: results return faster, and room searches now read from secondary database replicas when available, reducing load on the primary.(#41402) Fixes broken pagination on
rooms.bannedUsersand on omnichannel department listing endpoints, which ignored theoffsetparameter and always returned results from the first page. Also reduces payload over-fetching on several endpoints that unintentionally loaded full documents (rooms.hide, private group lookups, direct email replies, omnichannel auto-transfer), and removes the permissive model query typings that allowed these invalid find options to compile unnoticed.(#41229) Fixes dates showing one day earlier for users in negative UTC-offset timezones
(#41200) Fixes an issue where the whole app remounts when VoIP availability changes
Updated dependencies [c7aff48, 5f92f9a, 70c0ff0, 13b4a7b, eec6083, 4b34bd6, adc1570, 1bf84cb, 4b57346, 8d8cd01, 297df1a, 6ebabce, ffe1b64, 784c287, 3cd7db6, 115dfe8, 719e3db, b2b5edf, 74d6cac, 4186deb, 4117a1d, 376c9d8, 73c3aec, 73c3aec, 73c3aec, 73c3aec, 615ae2b, b2b5edf, 1cc7bbd, 6041285, e5da5d0, 2ec4d29, 70c0ff0, 1637a8b]: