Release 9.0.0 - #41490
Draft
rocketchat-github-ci wants to merge 318 commits into
Draft
Conversation
…ission (#40768) Co-authored-by: Julio Araujo <julio.araujo@rocket.chat>
Co-authored-by: Nazareno Bucciarelli <84046180+nazabucciarelli@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Nazareno Bucciarelli <bnazareno03@gmail.com>
…etViewRouter` from `MediaCallWidget` (#41613)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…41679) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#41677) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1675) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The three codeql-action steps (init, autobuild, analyze) were bumped by separate PRs. Merging them out of order left mixed versions in the workflow, and CodeQL fails when init and autobuild report different versions: Loaded a configuration file for version '4.37.1', but running version '4.37.4' Grouping them means a single PR bumps all three at once.
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…plify old patterns (#41616) Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>
Co-authored-by: Julio Araujo <julio.araujo@rocket.chat> Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>
![dionisio-bot[bot]](https://avatars.githubusercontent.com/in/257776?s=60&v=4){kind=small}
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #41490 +/- ##
==========================================
- Coverage 70.07% 68.84% -1.23%
==========================================
Files 3374 4134 +760
Lines 130824 158195 +27371
Branches 22915 28021 +5106
==========================================
+ Hits 91672 108906 +17234
- Misses 35832 44145 +8313
- Partials 3320 5144 +1824
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
sampaiodiego
marked this pull request as draft
August 12, 2026 14:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You can see below a preview of the release change log:
9.0.0
Engine versions
22.22.32.3.18.01.65.0Major Changes
(#41054) Removes
/ufslegacy endpoint for downloading files(#40142) Breaking: Stopped transpiling webhook integration scripts with Babel. Scripts now run as-is inside
isolated-vm(modern V8).Class method bodies are now in strict mode per the ES2015 spec. Scripts that relied on sloppy-mode behaviors provided by the previous Babel transpilation must be updated:
msg = buildMessage(...)inside a class method now throwsReferenceError. Addlet,const, orvar.thisin nested regular functions —function helper() { this.JSON.stringify(...) }now hasthis === undefinedinstead ofglobalThis. Use arrow functions or pass the dependency explicitly.arguments.callee— ThrowsTypeError. Use a named function expression instead.0777is now aSyntaxError. Use0o777.function(a, a) {}is now aSyntaxError.(#40856) Removes the WebDAV integration. All WebDAV accounts, settings, and file-picker functionality have been removed, and existing WebDAV settings are cleared from the database on upgrade
(#40883) Removes deleteCustomSound Meteor method
Removes insertOrUpdateSound and uploadCustomSound Meteor methods
Minor Changes
(#41307) Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.
(#40351) Adds
currentfield toDeviceManagementSessiontype andcurrentLoginTokenparameter toaggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.(#41474) Changes the default apps-engine runtime backend from
denotonode. The previous behavior can be restored by setting the environment variableAPPS_ENGINE_RUNTIME_BACKEND='deno'(#40721) ## Phishing-Resistant Multi-Factor Authentication
Introduces a more secure and reliable server-side OAuth authentication flow.
What’s New
OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
Enable this new setting
Accounts_OAuth_Use_Modern_Flowto use all of the above mentioned features.(#40890) Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.
(#39324) Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new
fipsmodule, and FIPS status is now reported in server logs and statistics.(#41019) Adds an alternative runtime runner for apps. It can be enabled via environment variable
APPS_ENGINE_RUNTIME_BACKEND='node'(#41355) Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list
(#41142) Adds inline JSON validation feedback to admin settings that hold JSON (
code: application/json), showing an error in the editor and blocking save while the value is malformed(#40916) Adds a new
licenses.validateREST endpoint that validates a Rocket.Chat license (V2 or V3 JWT) against the current workspace without applying it, so a license can be previewed before it is applied from the UI. A valid license responds with success; an invalid one responds with the validation behaviors that rejected it.(#39411) Replaces proprietary emojis with native (unicode) emojis and increases available emoji set
(#41148) Adds support for the
offlinelicense flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance.(#41120) Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.
(#40736) Added three new REST endpoints under
/v1/audit.*(EE-only, requires theauditinglicense) covering the audit flows that previously only existed as DDP methods:GET /v1/audit.auditions?startDate=&endDate=→{ auditions: IAuditLog[] }(replacesauditGetAuditions,can-audit-log)POST /v1/audit.messagesbody{ rid?, startDate, endDate, users, msg, type, visitor?, agent? }→{ messages: IMessage[] }(replacesauditGetMessages,can-audit)POST /v1/audit.omnichannelMessagesbody{ startDate, endDate, users, msg, type, visitor?, agent? }→{ messages: IMessage[] }(replacesauditGetOmnichannelMessages,can-audit)Each endpoint is rate-limited at 10 requests / 60s (matching the DDP
DDPRateLimiterrules) and writes the sameAuditLogentry the DDP methods produced. Dates are serialized as ISO strings on the wire. The DDP methods remain registered with deprecation logs pointing at the new routes until 9.0.0.(#40728) Deprecates the
logoutCleanUpDDP method and stops the client from calling it. The post-logout side effects (afterLogoutCleanUpCallback+Apps.IPostUserLoggedOut) now run server-side via a newAccounts.onLogouthandler and fromPOST /v1/users.logout, so both DDP and REST logout paths fire them without a client round-trip. The DDP method keeps its original implementation and registration with a deprecation log pointing at/v1/users.logoutuntil 9.0.0.(#41593) Added
POST /v1/chat.readThreadbody{ tmid }, which marks a single thread as read for the caller — clearing the thread from the subscription's unread list and running thebeforeReadMessages/afterReadMessagescallbacks. It replaces thereadThreadsDDP method, which stays registered with a deprecation log pointing at the new route until 9.0.0.POST /v1/subscriptions.readdoes not cover this: it takes{ rid, readThreads? }and operates on the whole room, with no way to address one thread.(#40728) Added
POST /v1/cloud.connectWorkspace(replaces the deprecatedcloud:connectWorkspaceDDP method). Body is{ token }; auth-gated withmanage-cloudpermission. The legacy DDP method remains registered with a deprecation log pointing at the new route.(#40728) Added
POST /v1/integrations.clearHistoryandPOST /v1/integrations.replayOutgoing(replace the deprecatedclearIntegrationHistoryandreplayOutgoingIntegrationDDP methods). Bodies{ integrationId }and{ integrationId, historyId }respectively. Permissions (manage-outgoing-integrationsormanage-own-outgoing-integrations) are enforced the same way the DDP methods did. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.(#40728) Added
POST /v1/permissions.addRoleandPOST /v1/permissions.removeRole(replace the deprecatedauthorization:addPermissionToRoleandauthorization:removeRoleFromPermissionDDP methods). Body is{ permissionId, role }on both. The same per-user permission checks (access-permissions,access-setting-permissions) the DDP methods enforced are reused. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.(#40737) Adds two new REST endpoints completing the Custom OAuth admin surface:
POST /v1/settings.removeCustomOAuthbody{ name }→ removes allAccounts_OAuth_Custom-<Name>-*setting documents (replaces the deprecatedremoveOAuthServiceDDP method).POST /v1/settings.refreshOAuthServices(no body) → re-reads ServiceConfiguration entries from settings (replaces the deprecatedrefreshOAuthServiceDDP method).Both endpoints reuse the
add-oauth-servicepermission andtwoFactorRequiredgates that the DDP methods already enforced.addOAuthServicewas already covered by the existingPOST /v1/settings.addCustomOAuth— its DDP method now also logs a deprecation. The three legacy DDP methods remain registered until 9.0.0.(#40728) Extended
POST /v1/users.setAvatarto accept an optionalservicemultipart field. When provided, the value is stored as the user'savatarOrigin, matching what the deprecatedsetAvatarFromServiceDDP method did. The legacy DDP method remains registered with a deprecation log pointing at the new route.(#40734) Adds five new REST endpoints covering the TOTP 2FA flows that previously only existed as DDP methods:
POST /v1/users.enableTotp→{ secret, url }(replaces2fa:enable)POST /v1/users.disableTotpbody{ code }→{ disabled }(replaces2fa:disable)POST /v1/users.validateTotpbody{ code }→{ codes }(replaces2fa:validateTempToken; also rotates non-PAT login tokens server-side)POST /v1/users.regenerateTotpCodesbody{ code }→{ codes }(replaces2fa:regenerateCodes)GET /v1/users.totpCodesRemaining→{ remaining }(replaces2fa:checkCodesRemaining)users.enableTotpandusers.validateTotprequire two-factor verification (twoFactorRequired) so enrolling a new TOTP device confirms the account owner's identity first — closing a 2FA-enrollment bypass where a hijacked session could register an attacker-controlled TOTP without verifying the existing 2FA. All five endpoints are rate-limited.The legacy DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0 removes them.
(#40728) Added
POST /v1/users.verifyEmail(replaces the two-call DDP flow ofverifyEmail+afterVerifyEmail). Body is{ token }; the server resolves the user, marks the email verified, and runs the anonymous→user role swap in a single request. The deprecatedafterVerifyEmailDDP method keeps its registration with a deprecation log pointing at the new route.(#40916) Adds a manage license flow to the subscription admin page, allowing license verification before applying it and an option to remove the license. Note: From this point license management should be made in subscription page instead of the Enterprise settings page.
Patch Changes
(#41174) Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself
(#41152) Fixes own account showing twice in navbar room search when searching by username
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40734) Migrates the
TwoFactorTOTPaccount settings page from the five2fa:*DDP methods to the new TOTP REST endpoints. DDP methods stay registered for external SDK/mobile clients with deprecation logs pointing at the new routes until 9.0.0.(#40736) Migrated the audit panel (
AuditLogTable,useAuditMutation) from the threeauditGet*DDP methods to the new/v1/audit.*REST endpoints. DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.(#40737) Migrates the Admin → OAuth services group page from
useMethod(DDP) touseEndpoint(REST):addOAuthService→ existingPOST /v1/settings.addCustomOAuthremoveOAuthService→ newPOST /v1/settings.removeCustomOAuthrefreshOAuthService→ newPOST /v1/settings.refreshOAuthServicesDDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.
(#41593) Migrated the last two thread-read call sites (
ThreadChat,useThreadMessagesQuery) from thereadThreadsDDP method toPOST /v1/chat.readThread, and pointed the admin "send a test push to my user" setting atPOST /v1/push.testinstead of thepush_testDDP method. Both DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.POST /v1/push.testnow also returns themessagetranslation key and itsparams, matching what the DDP method returned, so the admin setting still reports how many devices the test reached.(#41285) Fixes the Slack importer storing shared files as raw URLs in the message body. Imported file messages now stay hidden until "Download Pending Files" button fetches them, then display as native attachments with image previews. Failed downloads (e.g. invalidated export links) are no longer silently saved as the file's content — they are counted as errors and can be retried.
(#41056) Added a
setUserRolesbridge method to the desktop API and pushed the logged-in user's roles to the desktop app. This lets the desktop client restrict supportedVersions messages (such as version-expiration warnings) to specific roles like admins, instead of showing them to every user. The push is reactive to role changes; desktop builds without the bridge method fall back to their own role lookup.(#41207) Fixes engagement dashboard loading unnecessary data into memory on startup
(#41173) Fixes the password policy allowing a maximum length lower than the minimum length to be saved — a combination that made it impossible to set any valid password. The server now rejects such configurations when password policy settings are saved and shows an error explaining the constraint.
(#41233) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41195) fix: Buttons from emoji picker misbehaving on clicks
An infinite render loop was preventing proper behavior when clicking on the emoji picker buttons. It was fixed by removing the unnecessary state update that was causing the loop and replacing multiple fires of the same mouseover event (when a mouseenter event was the right one to use). There is a chance this pre-existing bug was hidden by React 18's event delegation.
(#41158) Fixes agents' business-hour availability not being updated when they are removed from a department linked to a business hour while multiple business hours are enabled. The recomputation step always failed, leaving removed agents available (or unavailable) according to a business hour that no longer applied to them — and, on deployments running with
EXIT_UNHANDLEDPROMISEREJECTION(or in development/test mode), the unhandled rejection crashed the server process.(#41164) Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.
Also fixes agents keeping a business hour's availability after their department was removed from it: saving a business hour with a smaller department list unlinked the departments but never cleared the business hour from the removed departments' agents.
(#41472) Fixes the license provided via the
ROCKETCHAT_LICENSEenvironment variable not being applied when it is newer than the one persisted in the workspace.(#40351) Fixes error message being shown when logging out current device via Device Management despite successful logout.
(#41169) Fixes a race condition that left messages permanently undecryptable ("incorrect encryption key") in rooms created with encryption enabled. When several members opened such a room at the same time, each client could independently generate and distribute a different group key. Establishing the room key is now atomic (first-write-wins) on the server, and a client that loses the race discards its locally generated key and adopts the established one instead of encrypting with a divergent key.
(#41069) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41168) Fixes LDAP channel sync aborting the entire add/removal pass when a mapped channel could not be resolved, which prevented users from being removed from channels when "Auto Remove Users from Channels" was enabled.
(#41279) Fixes LDAP sync failing to merge an existing user matched by email, which caused a
Username already existserror when the user's username differed from the directory.(#41373) Fixes the server crashing during LDAP login or sync when the configured search settings produce an invalid LDAP filter (for example, an empty User Search Field). The operation now fails gracefully with a logged error instead of terminating the process.
(#41202) Disables more actions on message composer during public channel preview.
(#41480) Fixes an issue where the "user left" system message could be added to an Omnichannel conversation only after the forwarding process had already finished, causing it to appear out of order in the conversation history
(#41588) Fixes audio attachments not being seekable using the progress slider
(#41110) Passes the original message text to the message renderer so blocks without a dedicated renderer (e.g. tables on clients that don't render them yet) can degrade to their raw markup via the parser's
fallbacksource offsets, instead of disappearing.(#41074) Fixes an issue where the cursor jumped to the wrong position after inserting a mention at the start or middle of a message.
(#41304) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.
(#41089) Enables keyboard activation for Display menu radio buttons and checkboxes
(#41204) Changes the date columns in the Omnichannel Contact Center to show both the formatted date and the relative time: the Last Chat column in the contacts list, and the Started at and Last Message columns in the chats list
(#41341) Fixes a server crash when re-enabling the "Enable Push" setting after it was disabled. Push notifications are now fully reconfigured on re-enable, so settings changed while push was disabled are picked up as well.
(#40768) Ensures the
users.CreateTokenendpoint checks for theuser-generate-access-tokenpermission when generating a login token for another user(#41206) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room
(#41414) Restores Away as a selectable preset in the quick status menu, custom status modal, and account profile page.
(#41573) Marks the user session as logged out in the Sessions collection when logging out via
POST /v1/logout. Previously the session cleanup relied on an indirect chain throughwatch.users→Accounts.onLogoutthat could be broken by a race condition, leaving orphaned sessions visible in Device Manager.(#41145) Fixes the SAML Single Logout response so the
RelayStatematches the exact value received on the logout request, as required by the SAML specification, instead of using Rocket.Chat's own URL(#41254) Fixes the setup wizard being forced back into the registration step on the first start after an upgrade when
OVERWRITE_SETTING_Show_Setup_Wizard=completedis set, which affected air-gapped workspaces running offline licenses without cloud registration.(#41122) Adds keyboard navigation support in Room members list
(#41112) Returns
custom fieldson admin rooms detail view(#41484) Fixes an issue where deleted thread messages display as empty in thread context
(#41101) Improved
/v1/spotlightsearch performance: results return faster, and room searches now read from secondary database replicas when available, reducing load on the primary.(#41402) Fixes broken pagination on
rooms.bannedUsersand on omnichannel department listing endpoints, which ignored theoffsetparameter and always returned results from the first page. Also reduces payload over-fetching on several endpoints that unintentionally loaded full documents (rooms.hide, private group lookups, direct email replies, omnichannel auto-transfer), and removes the permissive model query typings that allowed these invalid find options to compile unnoticed.(#41229) Fixes dates showing one day earlier for users in negative UTC-offset timezones
(#41504) Fixed saving a livechat tag failing with "Invalid response" — the model mutated its return value with
_updatedAt, which the endpoint response schema rejects(#41200) Fixes an issue where the whole app remounts when VoIP availability changes
(#41574) Fixes reaction list modal showing blank entries (mobile) or usernames (web) instead of real names when
UI_Use_Real_Nameis enabled. The broadcast pipeline now enriches reactions with display names via batch query.Updated dependencies [c7aff48, b27e38c, 5f92f9a, 70c0ff0, 13b4a7b, eec6083, 4b34bd6, adc1570, 1bf84cb, 4b57346, 8d8cd01, 297df1a, 6ebabce, ffe1b64, 784c287, 4947601, 3cd7db6, 7b7f88f, 115dfe8, 719e3db, b2b5edf, 74d6cac, 4186deb, 4117a1d, 376c9d8, 73c3aec, 73c3aec, 73c3aec, 6dc66fb, 2052886, 73c3aec, 615ae2b, b2b5edf, 6edcdd7, 1cc7bbd, 6041285, e5da5d0, 2ec4d29, 70c0ff0, 1637a8b]: