RocketChat · rocketchat-github-ci · Jul 7, 2026 · Jul 7, 2026 · Jul 7, 2026 · Jul 7, 2026
diff --git a/.changeset/abac-classification-banners.md b/.changeset/abac-classification-banners.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': minor
+---
+
+Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.
diff --git a/.changeset/all-baths-cry.md b/.changeset/all-baths-cry.md
@@ -0,0 +1,8 @@
+---
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/models': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds `current` field to `DeviceManagementSession` type and `currentLoginToken` parameter to `aggregateSessionsByUserId`, allowing the sessions endpoint to identify and flag the caller's active session.
diff --git a/.changeset/apps-engine-runtime-default-node.md b/.changeset/apps-engine-runtime-default-node.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps': minor
+'@rocket.chat/meteor': minor
+---
+
+Changes the default apps-engine runtime backend from `deno` to `node`. The previous behavior can be restored by setting the environment variable `APPS_ENGINE_RUNTIME_BACKEND='deno'`
diff --git a/.changeset/atomic-model-operations.md b/.changeset/atomic-model-operations.md
@@ -0,0 +1,8 @@
+---
+'@rocket.chat/meteor': patch
+'@rocket.chat/core-typings': patch
+'@rocket.chat/model-typings': patch
+'@rocket.chat/models': patch
+---
+
+Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself
diff --git a/.changeset/better-results-press.md b/.changeset/better-results-press.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": major
+---
+
+Removes `/ufs` legacy endpoint for downloading files
diff --git a/.changeset/block-fallback-rendering.md b/.changeset/block-fallback-rendering.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/gazzodown": patch
+---
+
+Degrades blocks without a dedicated renderer to their raw markup instead of dropping them. When a block carries a `fallback` `[start, end]` offset span, `Markup`/`PreviewMarkup` slice the original message source (passed via the new optional `source` prop) and render that text. This avoids duplicating the markup into the AST while keeping unsupported blocks visible.
diff --git a/.changeset/breezy-moons-search.md b/.changeset/breezy-moons-search.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes own account showing twice in navbar room search when searching by username
diff --git a/.changeset/breezy-parts-kiss.md b/.changeset/breezy-parts-kiss.md
@@ -0,0 +1,32 @@
+---
+'@rocket.chat/web-ui-registration': minor
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/passport-x': minor
+'@rocket.chat/desktop-api': minor
+'@rocket.chat/models': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+## Phishing-Resistant Multi-Factor Authentication
+
+Introduces a more secure and reliable server-side OAuth authentication flow.
+
+### What’s New
+
+- **Improved OAuth login security**  
+  OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
+
+- **Built-in CSRF, state validation, and PKCE protection**  
+  OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
+
+- **Improved two-step verification with OAuth logins**  
+  Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
+
+- **Improved mobile & desktop app login**  
+  Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
+
+- **A new setting to enable/disable new OAuth Flow**
+  Enable this new setting `Accounts_OAuth_Use_Modern_Flow` to use all of the above mentioned features.
diff --git a/.changeset/bump-patch-1784768845125.md b/.changeset/bump-patch-1784768845125.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1784771780188.md b/.changeset/bump-patch-1784771780188.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1785461760418.md b/.changeset/bump-patch-1785461760418.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1785760239936.md b/.changeset/bump-patch-1785760239936.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/code-fence-trailing-backtick.md b/.changeset/code-fence-trailing-backtick.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/message-parser": patch
+---
+
+Fixes code fences failing to render when a line inside them ends with an inline-code backtick (e.g. `` - **Node**: `22.22.3` ``). A trailing backtick immediately before a line break could not be consumed as content, causing the whole ```` ``` ```` block to fall back to markdown parsing and split apart. Trailing 1-2 backticks before a line end (or EOF) are now treated as code content.
diff --git a/.changeset/ddp-migrate-batch5-totp-caller.md b/.changeset/ddp-migrate-batch5-totp-caller.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrates the `TwoFactorTOTP` account settings page from the five `2fa:*` DDP methods to the new TOTP REST endpoints. DDP methods stay registered for external SDK/mobile clients with deprecation logs pointing at the new routes until 9.0.0.
diff --git a/.changeset/ddp-migrate-batch6-audit-callers.md b/.changeset/ddp-migrate-batch6-audit-callers.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrated the audit panel (`AuditLogTable`, `useAuditMutation`) from the three `auditGet*` DDP methods to the new `/v1/audit.*` REST endpoints. DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.
diff --git a/.changeset/ddp-migrate-batch7-oauth-caller.md b/.changeset/ddp-migrate-batch7-oauth-caller.md
@@ -0,0 +1,11 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrates the Admin → OAuth services group page from `useMethod` (DDP) to `useEndpoint` (REST):
+
+- `addOAuthService` → existing `POST /v1/settings.addCustomOAuth`
+- `removeOAuthService` → new `POST /v1/settings.removeCustomOAuth`
+- `refreshOAuthService` → new `POST /v1/settings.refreshOAuthServices`
+
+DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.
diff --git a/.changeset/ddp-migrate-readthreads-pushtest.md b/.changeset/ddp-migrate-readthreads-pushtest.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrated the last two thread-read call sites (`ThreadChat`, `useThreadMessagesQuery`) from the `readThreads` DDP method to `POST /v1/chat.readThread`, and pointed the admin "send a test push to my user" setting at `POST /v1/push.test` instead of the `push_test` DDP method. Both DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.
+
+`POST /v1/push.test` now also returns the `message` translation key and its `params`, matching what the DDP method returned, so the admin setting still reports how many devices the test reached.
diff --git a/.changeset/deep-ways-poke.md b/.changeset/deep-ways-poke.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/core-typings': patch
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes the Slack importer storing shared files as raw URLs in the message body. Imported file messages now stay hidden until "Download Pending Files" button fetches them, then display as native attachments with image previews. Failed downloads (e.g. invalidated export links) are no longer silently saved as the file's content — they are counted as errors and can be retried.
diff --git a/.changeset/desktop-set-user-roles.md b/.changeset/desktop-set-user-roles.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/desktop-api': minor
+'@rocket.chat/meteor': patch
+---
+
+Added a `setUserRoles` bridge method to the desktop API and pushed the logged-in user's roles to the desktop app. This lets the desktop client restrict supportedVersions messages (such as version-expiration warnings) to specific roles like admins, instead of showing them to every user. The push is reactive to role changes; desktop builds without the bridge method fall back to their own role lookup.
diff --git a/.changeset/emoji-zwj-tag-sequences.md b/.changeset/emoji-zwj-tag-sequences.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/message-parser': patch
+---
+
+Fixes an issue in which some combined emojis like 😶‍🌫️, 😮‍💨 and 😵‍💫 were being displayed as two separate emojis, and the flags of some countries like England 🏴󠁧󠁢󠁥󠁮󠁧󠁿, Scotland 🏴󠁧󠁢󠁳󠁣󠁴󠁿 and Wales 🏴󠁧󠁢󠁷󠁬󠁳󠁿 were being displayed as a plain black flag
diff --git a/.changeset/empty-boxes-cross.md b/.changeset/empty-boxes-cross.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes engagement dashboard loading unnecessary data into memory on startup
diff --git a/.changeset/empty-garlics-reply.md b/.changeset/empty-garlics-reply.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/core-typings': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes the password policy allowing a maximum length lower than the minimum length to be saved — a combination that made it impossible to set any valid password. The server now rejects such configurations when password policy settings are saved and shows an error explaining the constraint.
diff --git a/.changeset/fancy-days-knock.md b/.changeset/fancy-days-knock.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
diff --git a/.changeset/fancy-deserts-mate.md b/.changeset/fancy-deserts-mate.md
@@ -0,0 +1,10 @@
+---
+'@rocket.chat/core-services': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/ai-search': minor
+'@rocket.chat/ui-client': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.
diff --git a/.changeset/fifty-candies-heal.md b/.changeset/fifty-candies-heal.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+fix: Buttons from emoji picker misbehaving on clicks
+
+An infinite render loop was preventing proper behavior when clicking on the emoji picker buttons. It was fixed by removing the unnecessary state update that was causing the loop and replacing multiple fires of the same mouseover event (when a mouseenter event was the right one to use). There is a chance this pre-existing bug was hidden by React 18's event delegation.
diff --git a/.changeset/fifty-turkeys-judge.md b/.changeset/fifty-turkeys-judge.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/eslint-config': minor
+---
+
+Upgrades ESLint to v10 and bumps plugins
diff --git a/.changeset/fips-mode-support.md b/.changeset/fips-mode-support.md
@@ -0,0 +1,13 @@
+---
+'@rocket.chat/meteor': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/federation-matrix': minor
+'@rocket.chat/account-service': minor
+'@rocket.chat/authorization-service': minor
+'@rocket.chat/ddp-streamer': minor
+'@rocket.chat/omnichannel-transcript': minor
+'@rocket.chat/presence-service': minor
+'@rocket.chat/queue-worker': minor
+---
+
+Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new `fips` module, and FIPS status is now reported in server logs and statistics.
diff --git a/.changeset/fix-business-hour-agents-availability.md b/.changeset/fix-business-hour-agents-availability.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes agents' business-hour availability not being updated when they are removed from a department linked to a business hour while multiple business hours are enabled. The recomputation step always failed, leaving removed agents available (or unavailable) according to a business hour that no longer applied to them — and, on deployments running with `EXIT_UNHANDLEDPROMISEREJECTION` (or in development/test mode), the unhandled rejection crashed the server process.
diff --git a/.changeset/fix-business-hour-dst-department-unlink.md b/.changeset/fix-business-hour-dst-department-unlink.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.
+
+Also fixes agents keeping a business hour's availability after their department was removed from it: saving a business hour with a smaller department list unlinked the departments but never cleared the business hour from the removed departments' agents.
diff --git a/.changeset/fix-deno-runtime-symlink.md b/.changeset/fix-deno-runtime-symlink.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/apps': patch
+---
+
+Fixes an issue that would cause apps to fail with 'Module not found' errors in some cases
diff --git a/.changeset/fix-license-env-precedence.md b/.changeset/fix-license-env-precedence.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': patch
+'@rocket.chat/license': patch
+---
+
+Fixes the license provided via the `ROCKETCHAT_LICENSE` environment variable not being applied when it is newer than the one persisted in the workspace.
diff --git a/.changeset/forty-stars-bathe.md b/.changeset/forty-stars-bathe.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes error message being shown when logging out current device via Device Management despite successful logout.
diff --git a/.changeset/four-tigers-clap.md b/.changeset/four-tigers-clap.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/models': patch
+'@rocket.chat/model-typings': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes a race condition that left messages permanently undecryptable ("incorrect encryption key") in rooms created with encryption enabled. When several members opened such a room at the same time, each client could independently generate and distribute a different group key. Establishing the room key is now atomic (first-write-wins) on the server, and a client that loses the race discards its locally generated key and adopts the established one instead of encrypting with a divergent key.
diff --git a/.changeset/fruity-items-fix.md b/.changeset/fruity-items-fix.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds an alternative runtime runner for apps. It can be enabled via environment variable `APPS_ENGINE_RUNTIME_BACKEND='node'`
diff --git a/.changeset/funny-wings-sell.md b/.changeset/funny-wings-sell.md
@@ -0,0 +1,10 @@
+---
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/ui-client': minor
+'@rocket.chat/models': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list
diff --git a/.changeset/gentle-cats-change.md b/.changeset/gentle-cats-change.md
@@ -0,0 +1,8 @@
+---
+'@rocket.chat/meteor': patch
+'@rocket.chat/core-typings': patch
+'@rocket.chat/model-typings': patch
+'@rocket.chat/models': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
diff --git a/.changeset/hungry-snakes-help.md b/.changeset/hungry-snakes-help.md
@@ -0,0 +1,7 @@
+---
+"@rocket.chat/i18n": minor
+"@rocket.chat/media-signaling": minor
+"@rocket.chat/ui-voip": minor
+---
+
+Removes voice calling microphone requirement for starting a successful call, allowing users to join as "listen-only".
diff --git a/.changeset/integration-scripts-no-babel.md b/.changeset/integration-scripts-no-babel.md
@@ -0,0 +1,13 @@
+---
+'@rocket.chat/meteor': major
+---
+
+**Breaking:** Stopped transpiling webhook integration scripts with Babel. Scripts now run as-is inside `isolated-vm` (modern V8).
+
+Class method bodies are now in strict mode per the ES2015 spec. Scripts that relied on sloppy-mode behaviors provided by the previous Babel transpilation must be updated:
+
+- **Implicit globals** — `msg = buildMessage(...)` inside a class method now throws `ReferenceError`. Add `let`, `const`, or `var`.
+- **`this` in nested regular functions** — `function helper() { this.JSON.stringify(...) }` now has `this === undefined` instead of `globalThis`. Use arrow functions or pass the dependency explicitly.
+- **`arguments.callee`** — Throws `TypeError`. Use a named function expression instead.
+- **Octal literals** — `0777` is now a `SyntaxError`. Use `0o777`.
+- **Duplicate parameter names** — `function(a, a) {}` is now a `SyntaxError`.
diff --git a/.changeset/json-setting-validation-feedback.md b/.changeset/json-setting-validation-feedback.md
@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/i18n": minor
+---
+
+Adds inline JSON validation feedback to admin settings that hold JSON (`code: application/json`), showing an error in the editor and blocking save while the value is malformed
diff --git a/.changeset/ldap-channel-sync-removal-abort.md b/.changeset/ldap-channel-sync-removal-abort.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes LDAP channel sync aborting the entire add/removal pass when a mapped channel could not be resolved, which prevented users from being removed from channels when "Auto Remove Users from Channels" was enabled.
diff --git a/.changeset/ldap-merge-email-lookup.md b/.changeset/ldap-merge-email-lookup.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes LDAP sync failing to merge an existing user matched by email, which caused a `Username already exists` error when the user's username differed from the directory.
diff --git a/.changeset/ldap-sync-crash-invalid-filter.md b/.changeset/ldap-sync-crash-invalid-filter.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes the server crashing during LDAP login or sync when the configured search settings produce an invalid LDAP filter (for example, an empty User Search Field). The operation now fails gracefully with a logged error instead of terminating the process.
diff --git a/.changeset/license-validate-preview.md b/.changeset/license-validate-preview.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/license': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds a new `licenses.validate` REST endpoint that validates a Rocket.Chat license (V2 or V3 JWT) against the current workspace without applying it, so a license can be previewed before it is applied from the UI. A valid license responds with success; an invalid one responds with the validation behaviors that rejected it.
diff --git a/.changeset/light-geckos-start.md b/.changeset/light-geckos-start.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Disables more actions on message composer during public channel preview.
diff --git a/.changeset/livechat-forward-ul-message.md b/.changeset/livechat-forward-ul-message.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where the "user left" system message could be added to an Omnichannel conversation only after the forwarding process had already finished, causing it to appear out of order in the conversation history
diff --git a/.changeset/lucky-donkeys-listen.md b/.changeset/lucky-donkeys-listen.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes audio attachments not being seekable using the progress slider
diff --git a/.changeset/message-content-body-source.md b/.changeset/message-content-body-source.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Passes the original message text to the message renderer so blocks without a dedicated renderer (e.g. tables on clients that don't render them yet) can degrade to their raw markup via the parser's `fallback` source offsets, instead of disappearing.
diff --git a/.changeset/moody-eggs-juggle.md b/.changeset/moody-eggs-juggle.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where the cursor jumped to the wrong position after inserting a mention at the start or middle of a message.
diff --git a/.changeset/nice-fans-cover.md b/.changeset/nice-fans-cover.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": minor
+---
+
+Replaces proprietary emojis with native (unicode) emojis and increases available emoji set
diff --git a/.changeset/offline-license-no-egress.md b/.changeset/offline-license-no-egress.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': minor
+'@rocket.chat/license': minor
+---
+
+Adds support for the `offline` license flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance.
diff --git a/.changeset/old-bats-sniff.md b/.changeset/old-bats-sniff.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps-engine': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.