What changed in Rocket.Chat from 7 to 8

Release 8.8.0

Release Date: September 3, 2026 Support Window: Supported until March 31, 2027

Summary

Security and Compliance

Security improvements, authentication changes, data protection, and vulnerability fixes.

A new Force end-to-end encryption on private rooms setting under Administration > Workspace > End-to-end encryption encrypts every new private room and locks the toggle on in the create-channel and create-team dialogs. Public rooms are unaffected and federated rooms are exempt. Users can now hide their presence and status message from specific people, chosen from the user menu or My Account > Profile. Anyone on that list sees them as offline, and hidden status is excluded from lookups and search. Rooms managed by Attribute Based Access Control can show classification banners, defined as JSON under Administration > Workspace > General > Attribute Based Access Control. SAML gains an Import IdP metadata action under Administration > Workspace > SAML that parses a metadata URL and prefills the connection fields, plus sign-in through the system browser on mobile and desktop. LDAP and SAML still work in 8.8.0 without a Premium plan, but from 9.0.0 they require a license with the ldap-enterprise or saml-enterprise module. Password reset requests from the Forgot password form are now rate limited, and imports from a public file URL are checked against the SSRF protection allowlist. Fixes cover POST /v1/logout leaving sessions active in My Account > Device Management, room access checks erroring for callers without a resolved identity, and unescaped visitor names in the Omnichannel queue preview. An undisclosed security hotfix for thread message retrieval and real-time notification subscriptions applies on upgrade.

Messaging and Collaboration

Features and fixes related to messaging, channels, discussions, and communication workflows.

The draft message indicator is now on for everyone, so rooms and threads holding unsent text are marked in the sidebar, side panel, and Threads list. Drafts survive room switches and reloads, and Drafts in sidebar is gone from My Account > Feature Preview. The Threads panel now loads replies a page at a time as you scroll, so long threads open quickly. Screen sharing for voice calls is generally available. Users can join internal calls without a working microphone, enable it later from the call widget, and see share, hold, and transfer controls only when the call supports them. Diverted SIP calls are recorded as transfers, and caller names from the SIP integration are preserved. Federated conversations between servers work again, including first contact, older history, thumbnails, paging, and invitations. Other fixes: read receipts on thread replies, discussion reply counts that ignore hidden system messages, restored reading position when you return to a room, Jump to message across rooms, deep links (?msg=), suggestion popups that stayed open, line breaks lost in very long messages, real names in reaction lists, idle users flipping back to Online, room search for anonymous visitors, editing Omnichannel tags, business hours set to 00:00 to 23:59 closing early, and excessive history loading in contextual bars. The conditions entry of the selector parameter on Omnichannel autocomplete lookups is deprecated and now logs a warning.

Platform and Extensibility

Developer platform, APIs, integrations, and application framework improvements.

A native Model Context Protocol (MCP) server ships in alpha. Admins turn the endpoint on in the AI Center administration area and choose the minimal or extended tool set. Both controls are off by default, and access requires a license with the AI add-on plus the new access-mcp permission. REST endpoints now cover the two-factor, audit, custom OAuth, thread-read, message-send, and push-test flows that were realtime-only. The audit endpoints need a license with auditing, and setting up an authenticator app under My Account > Security now asks for an existing second factor. Integrations calling the replaced realtime methods keep working until 9.0.0 but log a deprecation warning. chat.syncMessages accepts an optional fromTs parameter, sent with lastUpdate, that bounds the sync window. Channel, group, session, license, and role endpoints now validate request bodies against a schema and return a consistent error payload. Callers that relied on loose validation may see new failures. The default Apps-Engine runtime changes from Deno to Node.js unless APPS_ENGINE_RUNTIME_BACKEND is set to deno. App action buttons now accept role name as well as _id and support room-scoped roles, including owner, moderator, leader, and custom room roles.

Data, Storage, and Infrastructure

Database, performance, storage, and system-level improvements.

The remaining first-generation sidebar and side panel components were replaced with their current versions, keeping the same look and behavior. The sidebar now scrolls when the room list is taller than the window, so rooms below the fold can be reached again.

Admin, Configuration, and Workspace Management

Administrative controls, configuration settings, and workspace management improvements.

Expected, client-safe errors are no longer reported to the channel set in Administration > Workspace > Logs > Log Exceptions to Channel when Log Level is Debug, so only genuine exceptions appear there. Dismissing a banner stored on your own user record, such as the new-version notice, no longer fails with a banner-not-found error. Missing German translations were added.

For further details, check out the release notes.

Details

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.66.0

Minor Changes

• (#41307) Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.

• (#41765) Accepts a role name in the when.hasOneRole and when.hasAllRoles filters of an app action button

• (#41474) Changes the default apps-engine runtime backend from deno to node. The previous behavior can be restored by setting the environment variable APPS_ENGINE_RUNTIME_BACKEND='deno'

• (#41788) Adds support for SAML authentication in the mobile and desktop apps via the system browser.

• (#41642) Deprecates LDAP and SAML authentication on workspaces without a Premium plan. Both keep working as they are today, but the admin settings now warn that version 9.0.0 will require a license including the ldap-enterprise or saml-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through either of them.

• (#41095) Adds a workspace setting Force end-to-end encryption on private rooms (E2E_Force_Encryption_For_Private_Rooms) under Admin → Settings → End-to-End Encryption. When enabled, every newly created private room is encrypted by default and users can no longer opt out: the encryption toggle in the create-room modal is locked on for private rooms, and the server rejects any attempt to create a private room with encrypted: false (e.g. via groups.create) with the error error-encrypted-private-rooms-enforced. Public rooms are unaffected. Federated rooms are exempt since federation does not support E2EE. Creating a discussion under an unencrypted private parent room is rejected with a dedicated error instructing the user to make the parent public or enable encryption on it, and the create-discussion dialog now surfaces creation errors as toasts.

• (#41355) Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list

• (#41082) Adds an AI add-on-gated native Model Context Protocol endpoint and its administration controls in AI Center

• (#41747) Adds status visibility, letting users hide their presence and status message from specific people they choose. Blocked people see that user as offline, indistinguishable from genuinely offline, and the block can be lifted at any time — changes apply live, without a reload.

• (#40736) Added three new REST endpoints under /v1/audit.* (EE-only, requires the auditing license) covering the audit flows that previously only existed as DDP methods:

  • GET /v1/audit.auditions?startDate=&endDate= → { auditions: IAuditLog[] } (replaces auditGetAuditions, can-audit-log)
  • POST /v1/audit.messages body { rid?, startDate, endDate, users, msg, type, visitor?, agent? } → { messages: IMessage[] } (replaces auditGetMessages, can-audit)
  • POST /v1/audit.omnichannelMessages body { startDate, endDate, users, msg, type, visitor?, agent? } → { messages: IMessage[] } (replaces auditGetOmnichannelMessages, can-audit)

  Each endpoint is rate-limited at 10 requests / 60s (matching the DDP DDPRateLimiter rules) and writes the same AuditLog entry the DDP methods produced. Dates are serialized as ISO strings on the wire. The DDP methods remain registered with deprecation logs pointing at the new routes until 9.0.0.

• (#41593) Added POST /v1/chat.readThread body { tmid }, which marks a single thread as read for the caller — clearing the thread from the subscription's unread list and running the beforeReadMessages / afterReadMessages callbacks. It replaces the readThreads DDP method, which stays registered with a deprecation log pointing at the new route until 9.0.0.

  POST /v1/subscriptions.read does not cover this: it takes { rid, readThreads? } and operates on the whole room, with no way to address one thread.

• (#40737) Adds two new REST endpoints completing the Custom OAuth admin surface:

  • POST /v1/settings.removeCustomOAuth body { name } → removes all Accounts_OAuth_Custom-<Name>-* setting documents (replaces the deprecated removeOAuthService DDP method).
  • POST /v1/settings.refreshOAuthServices (no body) → re-reads ServiceConfiguration entries from settings (replaces the deprecated refreshOAuthService DDP method).

  Both endpoints reuse the add-oauth-service permission and twoFactorRequired gates that the DDP methods already enforced. addOAuthService was already covered by the existing POST /v1/settings.addCustomOAuth — its DDP method now also logs a deprecation. The three legacy DDP methods remain registered until 9.0.0.

• (#40734) Adds five new REST endpoints covering the TOTP 2FA flows that previously only existed as DDP methods:

  • POST /v1/users.enableTotp → { secret, url } (replaces 2fa:enable)
  • POST /v1/users.disableTotp body { code } → { disabled } (replaces 2fa:disable)
  • POST /v1/users.validateTotp body { code } → { codes } (replaces 2fa:validateTempToken; also rotates non-PAT login tokens server-side)
  • POST /v1/users.regenerateTotpCodes body { code } → { codes } (replaces 2fa:regenerateCodes)
  • GET /v1/users.totpCodesRemaining → { remaining } (replaces 2fa:checkCodesRemaining)

  users.enableTotp and users.validateTotp require two-factor verification (twoFactorRequired) so enrolling a new TOTP device confirms the account owner's identity first — closing a 2FA-enrollment bypass where a hijacked session could register an attacker-controlled TOTP without verifying the existing 2FA. All five endpoints are rate-limited.

  The legacy DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0 removes them.

• (#41715) Adds an optional fromTs query parameter to chat.syncMessages, so it can be used as a replacement for the deprecated loadMissedMessages DDP method. It bounds the sync window and must be used together with lastUpdate; sending it with cursor pagination is rejected instead of being ignored.

• (#41954) Promotes Voice Call Screen Sharing to stable by removing the beta alert from its setting and enabling the "In-Room" call interface for every call regardless of screen-share availability.

Patch Changes

• (#41777) Fixed app action buttons never matching a role scoped to Subscriptions — owner, moderator, leader, or a custom one. The room was not being passed as the scope of the role check, so a button filtered by one of those roles stayed hidden even for a user who held it in the room.

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41784) Fixed business hours closing for one minute a day when configured as 00:00-23:59. Work hours are set at minute granularity, but the finish time was treated as exclusive, so consecutive daily windows never met and the service dropped to closed for the whole 23:59 minute — agents could not become available and the Livechat widget rendered the offline form. A work hour now stays open until the end of its finish minute.

• (#41664) Fixes the composer popups (mentions, slash commands and emojis) staying open after programmatic changes to the composer text, such as canceling the edition of a message that contains a mention.

• (#41795) Fixes client-safe errors being reported as exceptions to the channel configured in Log Exceptions to Channel when Log_Level is set to 2.

• (#40734) Migrates the TwoFactorTOTP account settings page from the five 2fa:* DDP methods to the new TOTP REST endpoints. DDP methods stay registered for external SDK/mobile clients with deprecation logs pointing at the new routes until 9.0.0.

• (#40736) Migrated the audit panel (AuditLogTable, useAuditMutation) from the three auditGet* DDP methods to the new /v1/audit.* REST endpoints. DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.

• (#40737) Migrates the Admin → OAuth services group page from useMethod (DDP) to useEndpoint (REST):

  • addOAuthService → existing POST /v1/settings.addCustomOAuth
  • removeOAuthService → new POST /v1/settings.removeCustomOAuth
  • refreshOAuthService → new POST /v1/settings.refreshOAuthServices

  DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.

• (#41593) Migrated the last two thread-read call sites (ThreadChat, useThreadMessagesQuery) from the readThreads DDP method to POST /v1/chat.readThread, and pointed the admin "send a test push to my user" setting at POST /v1/push.test instead of the push_test DDP method. Both DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.

  POST /v1/push.test now also returns the message translation key and its params, matching what the DDP method returned, so the admin setting still reports how many devices the test reached.

• (#41653) Bumps patch-level dependency updates: react, react-dom and react-is to 19.2.8, ws to 8.21.3, nodemailer to 9.0.5, mailparser to 3.9.15, google-libphonenumber to 3.2.46, twitter-api-v2 to 1.29.1, ip-range-check to 0.2.1, esbuild to 0.28.2, @octokit/core to 7.0.7 and @octokit/plugin-throttling to 11.0.5, plus build and test tooling (@swc/core, ts-jest, rollup, html-webpack-plugin, @vitejs/plugin-react, @testing-library/user-event, and the @types/* packages). No behavior changes are expected.

• (#41876) Fixes room search (spotlight) failing for anonymous visitors when "Allow Anonymous Read" is enabled

• (#41481) Adds an Import IdP metadata option to SAML settings that fetches the Identity Provider metadata from a URL and prefills the matching setting fields — certificate, entry point and IDP SLO redirect URL, plus identifier format on Enterprise — for the admin to review before saving.

• (#41699) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41454) Fixes the message list silently loading the entire room history — and downloading its attachments — in the background when a full-width contextual bar (such as the thread view on small screens) hides it

• (#41805) Fixes the issue where the message list kept jumping to the latest messages instead of restoring the previous position when switching channels.

• (#41707) Fixes thread replies keeping the "sent" single checkmark after everyone had read the thread, only switching to the "viewed" double checkmark once a new message was sent in that thread.

• (#41744) Fixes canAccessRoom throwing when the user's _id is undefined

• (#41814) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41749) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

• (#41499) Fixes a reload loop when opening a link to an older message (?msg=): the room would flash the linked message and then keep loading until it hit the server rate limit (429) instead of settling. The room now opens positioned on the linked message, and when the linked message cannot be loaded the room settles on the most recent messages instead of retrying.

• (#41711) Fixes "Jump to message" not navigating to the message's room when the message belongs to a room other than the currently opened one (e.g. global search results).

• (#41717) Fixes federation endpoints rejecting valid requests, which broke:

  • room history backfill
  • image thumbnails
  • room message pagination
  • accepting an invite from another homeserver

• (#41573) Marks the user session as logged out in the Sessions collection when logging out via POST /v1/logout. Previously the session cleanup relied on an indirect chain through watch.users → Accounts.onLogout that could be broken by a race condition, leaving orphaned sessions visible in Device Manager.

• (#41595) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• (#41683) Fixed the sidebar not scrolling when its content is taller than the viewport — the inner wrapper was pinned to the scroll container's height instead of using it as a minimum, so overflowing content was clipped

• (#41755) Fixes POST /v1/banners.dismiss failing with Banner not found for banners stored in the user's record (such as the version update ones), which were never marked as read. The endpoint now marks them as read as the deprecated banner/dismiss method did, and only fails when the banner does not exist in the banners collection nor in the user's record.

• (#41673) Fixes the messages count displayed on a discussion taking into account system messages which are hidden inside of it, making the count higher than the number of messages actually visible after opening the discussion. The count now excludes every system message type hidden either globally or on the discussion itself. A hint was also added to the Hide system messages option of the room edit panel clarifying that the hidden messages are not included in the count.

• (#41484) Fixes an issue where deleted thread messages display as empty in thread context

• (#41504) Fixed saving a livechat tag failing with "Invalid response" — the model mutated its return value with _updatedAt, which the endpoint response schema rejects

• (#41702) Fixes discussion parent message count and last-message timestamp out of sync with the discussion

• (#41763) Drops @rocket.chat/string-helpers in favor of @rocket.chat/tools

• (#41574) Fixes reaction list modal showing blank entries (mobile) or usernames (web) instead of real names when UI_Use_Real_Name is enabled. The broadcast pipeline now enriches reactions with display names via batch query.

• (#41585) Fixes users being set back to online after a websocket reconnection (connection drop, network change, server restart) even though they had gone idle and never interacted with the UI again. The client now tracks the last UI interaction across connection drops and restates the away status as soon as the reconnected session is authenticated, instead of assuming the new session is online and restarting the idle countdown from scratch.

• (#41631) Fixes text rendering without line breaks when its length is higher than the value of the MESSAGE_MAX_PARSE_LENGTH environment variable

• • @rocket.chat/apps-engine@1.66.0
  • @rocket.chat/apps@0.9.0
  • @rocket.chat/i18n@4.0.0
  • @rocket.chat/pdf-worker@0.3.36
  • @rocket.chat/rest-typings@8.8.0
  • @rocket.chat/model-typings@2.5.0
  • @rocket.chat/core-typings@8.8.0
  • @rocket.chat/ui-client@34.0.0
  • @rocket.chat/models@2.5.0
  • @rocket.chat/media-calls@0.6.0
  • @rocket.chat/media-signaling@1.2.0
  • @rocket.chat/ui-voip@24.0.0
  • @rocket.chat/core-services@0.16.0
  • @rocket.chat/federation-matrix@0.2.1
  • @rocket.chat/message-types@0.1.2
  • @rocket.chat/tools@0.4.0
  • @rocket.chat/omnichannel-services@0.3.57
  • @rocket.chat/abac@0.3.2
  • @rocket.chat/ui-composer@5.0.0
  • @rocket.chat/omni-core@0.1.4
  • @rocket.chat/web-ui-registration@34.0.0
  • @rocket.chat/network-broker@0.2.39
  • @rocket.chat/omni-core-ee@0.0.25
  • @rocket.chat/presence@0.3.2
  • @rocket.chat/cron@0.1.60
  • @rocket.chat/ddp-client@1.1.2
  • @rocket.chat/fuselage-ui-kit@34.0.0
  • @rocket.chat/gazzodown@34.0.0
  • @rocket.chat/instance-status@0.1.60
  • @rocket.chat/server-fetch@0.2.4
  • @rocket.chat/ui-avatar@30.0.0
  • @rocket.chat/ui-contexts@34.0.0
  • @rocket.chat/ui-video-conf@34.0.0

Engine versions

• Node: 22.16.0
• Deno: 1.43.5
• MongoDB: 8.2
• Apps-Engine: 1.59.2

Patch Changes

• Bump @rocket.chat/meteor version.

• (#41857 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41850 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41841 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• • @rocket.chat/core-typings@8.1.8
  • @rocket.chat/rest-typings@8.1.8
  • @rocket.chat/abac@0.1.10
  • @rocket.chat/federation-matrix@0.0.19
  • @rocket.chat/license@1.1.17
  • @rocket.chat/media-calls@0.2.10
  • @rocket.chat/omnichannel-services@0.3.54
  • @rocket.chat/pdf-worker@0.3.36
  • @rocket.chat/presence@0.2.57
  • @rocket.chat/api-client@0.2.57
  • @rocket.chat/apps@0.6.10
  • @rocket.chat/core-services@0.12.10
  • @rocket.chat/cron@0.1.57
  • @rocket.chat/fuselage-ui-kit@27.0.8
  • @rocket.chat/gazzodown@27.0.8
  • @rocket.chat/http-router@7.9.24
  • @rocket.chat/message-types@0.1.0
  • @rocket.chat/model-typings@2.0.10
  • @rocket.chat/ui-avatar@23.0.8
  • @rocket.chat/ui-client@27.0.8
  • @rocket.chat/ui-contexts@27.0.8
  • @rocket.chat/ui-voip@17.0.8
  • @rocket.chat/web-ui-registration@27.0.8
  • @rocket.chat/models@2.0.10
  • @rocket.chat/server-cloud-communication@0.0.2
  • @rocket.chat/network-broker@0.2.36
  • @rocket.chat/omni-core-ee@0.0.22
  • @rocket.chat/ui-theming@0.4.4
  • @rocket.chat/ui-video-conf@27.0.8
  • @rocket.chat/instance-status@0.1.57
  • @rocket.chat/omni-core@0.0.22

Engine versions

• Node: 22.16.0
• Deno: 1.43.5
• MongoDB: 8.0
• Apps-Engine: 1.61.1

Patch Changes

• Bump @rocket.chat/meteor version.

• (#41855 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41844 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41863 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

• (#41826 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• • @rocket.chat/core-typings@8.3.8
  • @rocket.chat/rest-typings@8.3.8

Engine versions

• Node: 22.22.2
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.62.0

Patch Changes

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41854 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41842 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41862 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

• (#41825 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• • @rocket.chat/core-typings@8.4.6
  • @rocket.chat/rest-typings@8.4.6

Engine versions

• Node: 22.16.0
• Deno: 1.43.5
• MongoDB: 8.0
• Apps-Engine: 1.60.1

Patch Changes

• Bump @rocket.chat/meteor version.

• (#41856 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41849 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41864 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

• (#41840 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• • @rocket.chat/core-typings@8.2.8
  • @rocket.chat/rest-typings@8.2.8

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.63.0

Patch Changes

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41853 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41836 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41847 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

• (#41824 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• • @rocket.chat/core-typings@8.5.3
  • @rocket.chat/rest-typings@8.5.3

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.65.1

Patch Changes

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41818 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41820 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41846) Fixes an issue where a MultiSelect option checkbox remained checked after the option was deselected

• (#41819 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

• (#41817 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• • @rocket.chat/core-typings@8.7.1
  • @rocket.chat/rest-typings@8.7.1

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.64.1

Patch Changes

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41832 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

• (#41827 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41830 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

• (#41823 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

• • @rocket.chat/core-typings@8.6.2
  • @rocket.chat/rest-typings@8.6.2

Release 8.7.0

Release Date: August 6, 2026 Support Window: Supported until February 28, 2027

Summary

Security and Compliance

Security improvements, authentication changes, data protection, and vulnerability fixes.

This release adds phishing-resistant MFA and a modern server-side OAuth flow with CSRF protection, state validation, and PKCE, enabled via Accounts_OAuth_Use_Modern_Flow under Manage > Workspace > Settings > OAuth, along with new unauthenticated endpoints (loginCode.redeem, twoFactorChallenges.sendEmailCode, twoFactorChallenges.verifyChallenge) supporting OAuth sign-in completion and email or TOTP challenges. FIPS 140-3 compliant Docker images are now published for the monolith and all microservices; running in FIPS mode requires a license with the new fips add-on, and FIPS status is reported in server logs and workspace statistics. Permission enforcement is hardened across users.createToken, channels.convertToTeam, and teams.create, so callers without the required permissions now receive authorization errors where requests previously succeeded. Concurrent logins can no longer consume the same CAS login token, users can no longer delete integrations they don't own, SAML Single Logout now echoes the RelayState value as the specification requires, and fixes close vulnerabilities that could allow authentication bypass in SAML single sign-on and unauthorized impersonation through forged ephemeral messages. A race condition that could leave messages in a newly created encrypted room permanently undecryptable is also resolved.

Messaging and Collaboration

Features and fixes related to messaging, channels, discussions, and communication workflows.

Unified AI Search arrives as an opt-in feature preview, adding semantic message search and grounded AI-generated answers to the global search bar. Messages now support GitHub-style pipe-delimited tables and horizontal rules, a persistent audio player keeps playing across room navigation with a Now Playing card in the sidebar offering play/pause, seek, and playback speed controls, and the bundled emojione set is replaced with native Unicode emojis while legacy shortnames keep rendering through a compatibility map. The Omnichannel Contact Center date columns now show relative time, and the "Away" presence option returns to the user menu's quick status options. Fixes cover custom Omnichannel business hours surviving daylight saving changes and restarts, the "user left" system message appearing in correct chronological order after forwarding, Matrix-federated rooms no longer corrupting their event tree when a message is edited or deleted (already-affected rooms need a separate one-time repair), voice calls failing during initial connection when navigating rooms, keyboard accessibility in the Display menu and Members list, audio attachment seeking, and a batch of interface issues spanning mentions, quotes, the emoji picker, video controls, timezone-related date display, and avatar validation.

Platform and Extensibility

Developer platform, APIs, integrations, and application framework improvements.

Workspace admins can now run Rocket.Chat apps on an alternative Node.js runtime backend instead of the default Deno subprocess by setting APPS_ENGINE_RUNTIME_BACKEND to node, with identical app behavior under either backend. New REST endpoints for users.verifyEmail, cloud.connectWorkspace, integrations.clearHistory, and integrations.replayOutgoing replace their DDP equivalents, which now log deprecation warnings ahead of removal in 9.0.0, and avatar uploads through users.setAvatar support an optional service field preserving the original OAuth provider name. The web client now pushes the logged-in user's roles to the desktop app so version-support warnings target relevant roles. Fixes address apps failing with "Module not found" errors after a workspace upgrade, app startup EACCES errors in Docker deployments running under a custom UID, and corrected type definitions for federated users and UIKit interaction responses.

Data, Storage, and Infrastructure

Database, performance, storage, and system-level improvements.

Navbar search returns results faster and can read from secondary database replicas when available, the engagement dashboard no longer loads unnecessary data into memory on startup, and pagination on rooms.bannedUsers and Omnichannel department listings honors the offset parameter again. The web client's rendering baseline is upgraded to React 19 without user-facing changes, and URL preview embeds no longer flicker when new messages or reactions arrive.

Admin, Configuration, and Workspace Management

Administrative controls, configuration settings, and workspace management improvements.

XMPP federation bridge support lets licensed workspaces connect Rocket.Chat rooms to XMPP networks, configurable under Manage > Workspace > Settings > Federation after enabling native federation. Licensed airgapped workspaces now stop all outbound connections to Rocket.Chat Cloud and other services, the newest valid license is correctly applied at startup including via ROCKETCHAT_LICENSE, and a new Manage License flow in Administration > Subscription lets admins preview, apply, and remove a license with validation through the new licenses.validate endpoint before it is applied. Admin settings holding JSON now validate inline and block save while malformed, an invalid password-policy length combination is rejected with an explanatory error, and re-enabling the Enable Push setting no longer crashes the server. The Slack importer delivers shared files as native attachments with image previews, LDAP synchronization completes the full channel map even when a mapped channel is missing and merges email-matched users into existing accounts instead of failing, logging out the current device no longer shows a spurious error (with a new current field on sessions.list), and custom fields display again in the admin room detail view.

For further details, check out the release notes.

Details

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.65.1

Minor Changes

• (#40351) Adds current field to DeviceManagementSession type and currentLoginToken parameter to aggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.

• (#40721) ## Phishing-Resistant Multi-Factor Authentication

  Introduces a more secure and reliable server-side OAuth authentication flow.

  What’s New

  • Improved OAuth login security OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
  • Built-in CSRF, state validation, and PKCE protection OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
  • Improved two-step verification with OAuth logins Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
  • Improved mobile & desktop app login Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
  • A new setting to enable/disable new OAuth Flow Enable this new setting Accounts_OAuth_Use_Modern_Flow to use all of the above mentioned features.

• (#40890) Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.

• (#39324) Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new fips module, and FIPS status is now reported in server logs and statistics.

• (#41019) Adds an alternative runtime runner for apps. It can be enabled via environment variable APPS_ENGINE_RUNTIME_BACKEND='node'

• (#41142) Adds inline JSON validation feedback to admin settings that hold JSON (code: application/json), showing an error in the editor and blocking save while the value is malformed

• (#40916) Adds a new licenses.validate REST endpoint that validates a Rocket.Chat license (V2 or V3 JWT) against the current workspace without applying it, so a license can be previewed before it is applied from the UI. A valid license responds with success; an invalid one responds with the validation behaviors that rejected it.

• (#39411) Replaces proprietary emojis with native (unicode) emojis and increases available emoji set

• (#41148) Adds support for the offline license flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance.

• (#41120) Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.

• (#40728) Deprecates the logoutCleanUp DDP method and stops the client from calling it. The post-logout side effects (afterLogoutCleanUpCallback + Apps.IPostUserLoggedOut) now run server-side via a new Accounts.onLogout handler and from POST /v1/users.logout, so both DDP and REST logout paths fire them without a client round-trip. The DDP method keeps its original implementation and registration with a deprecation log pointing at /v1/users.logout until 9.0.0.

• (#40728) Added POST /v1/cloud.connectWorkspace (replaces the deprecated cloud:connectWorkspace DDP method). Body is { token }; auth-gated with manage-cloud permission. The legacy DDP method remains registered with a deprecation log pointing at the new route.

• (#40728) Added POST /v1/integrations.clearHistory and POST /v1/integrations.replayOutgoing (replace the deprecated clearIntegrationHistory and replayOutgoingIntegration DDP methods). Bodies { integrationId } and { integrationId, historyId } respectively. Permissions (manage-outgoing-integrations or manage-own-outgoing-integrations) are enforced the same way the DDP methods did. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.

• (#40728) Added POST /v1/permissions.addRole and POST /v1/permissions.removeRole (replace the deprecated authorization:addPermissionToRole and authorization:removeRoleFromPermission DDP methods). Body is { permissionId, role } on both. The same per-user permission checks (access-permissions, access-setting-permissions) the DDP methods enforced are reused. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.

• (#40728) Extended POST /v1/users.setAvatar to accept an optional service multipart field. When provided, the value is stored as the user's avatarOrigin, matching what the deprecated setAvatarFromService DDP method did. The legacy DDP method remains registered with a deprecation log pointing at the new route.

• (#40728) Added POST /v1/users.verifyEmail (replaces the two-call DDP flow of verifyEmail + afterVerifyEmail). Body is { token }; the server resolves the user, marks the email verified, and runs the anonymous→user role swap in a single request. The deprecated afterVerifyEmail DDP method keeps its registration with a deprecation log pointing at the new route.

• (#40916) Adds a manage license flow to the subscription admin page, allowing license verification before applying it and an option to remove the license. Note: From this point license management should be made in subscription page instead of the Enterprise settings page.

Patch Changes

• (#41174) Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself

• (#41152) Fixes own account showing twice in navbar room search when searching by username

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41285) Fixes the Slack importer storing shared files as raw URLs in the message body. Imported file messages now stay hidden until "Download Pending Files" button fetches them, then display as native attachments with image previews. Failed downloads (e.g. invalidated export links) are no longer silently saved as the file's content — they are counted as errors and can be retried.

• (#41056) Added a setUserRoles bridge method to the desktop API and pushed the logged-in user's roles to the desktop app. This lets the desktop client restrict supportedVersions messages (such as version-expiration warnings) to specific roles like admins, instead of showing them to every user. The push is reactive to role changes; desktop builds without the bridge method fall back to their own role lookup.

• (#41207) Fixes engagement dashboard loading unnecessary data into memory on startup

• (#41173) Fixes the password policy allowing a maximum length lower than the minimum length to be saved — a combination that made it impossible to set any valid password. The server now rejects such configurations when password policy settings are saved and shows an error explaining the constraint.

• (#41233) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41195) fix: Buttons from emoji picker misbehaving on clicks

  An infinite render loop was preventing proper behavior when clicking on the emoji picker buttons. It was fixed by removing the unnecessary state update that was causing the loop and replacing multiple fires of the same mouseover event (when a mouseenter event was the right one to use). There is a chance this pre-existing bug was hidden by React 18's event delegation.

• (#41158) Fixes agents' business-hour availability not being updated when they are removed from a department linked to a business hour while multiple business hours are enabled. The recomputation step always failed, leaving removed agents available (or unavailable) according to a business hour that no longer applied to them — and, on deployments running with EXIT_UNHANDLEDPROMISEREJECTION (or in development/test mode), the unhandled rejection crashed the server process.

• (#41164) Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.

  Also fixes agents keeping a business hour's availability after their department was removed from it: saving a business hour with a smaller department list unlinked the departments but never cleared the business hour from the removed departments' agents.

• (#41472) Fixes the license provided via the ROCKETCHAT_LICENSE environment variable not being applied when it is newer than the one persisted in the workspace.

• (#40351) Fixes error message being shown when logging out current device via Device Management despite successful logout.

• (#41169) Fixes a race condition that left messages permanently undecryptable ("incorrect encryption key") in rooms created with encryption enabled. When several members opened such a room at the same time, each client could independently generate and distribute a different group key. Establishing the room key is now atomic (first-write-wins) on the server, and a client that loses the race discards its locally generated key and adopts the established one instead of encrypting with a divergent key.

• (#41069) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41168) Fixes LDAP channel sync aborting the entire add/removal pass when a mapped channel could not be resolved, which prevented users from being removed from channels when "Auto Remove Users from Channels" was enabled.

• (#41279) Fixes LDAP sync failing to merge an existing user matched by email, which caused a Username already exists error when the user's username differed from the directory.

• (#41373) Fixes the server crashing during LDAP login or sync when the configured search settings produce an invalid LDAP filter (for example, an empty User Search Field). The operation now fails gracefully with a logged error instead of terminating the process.

• (#41202) Disables more actions on message composer during public channel preview.

• (#41480) Fixes an issue where the "user left" system message could be added to an Omnichannel conversation only after the forwarding process had already finished, causing it to appear out of order in the conversation history

• (#41588) Fixes audio attachments not being seekable using the progress slider

• (#41110) Passes the original message text to the message renderer so blocks without a dedicated renderer (e.g. tables on clients that don't render them yet) can degrade to their raw markup via the parser's fallback source offsets, instead of disappearing.

• (#41074) Fixes an issue where the cursor jumped to the wrong position after inserting a mention at the start or middle of a message.

• (#41304) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.

• (#41089) Enables keyboard activation for Display menu radio buttons and checkboxes

• (#41204) Changes the date columns in the Omnichannel Contact Center to show both the formatted date and the relative time: the Last Chat column in the contacts list, and the Started at and Last Message columns in the chats list

• (#41341) Fixes a server crash when re-enabling the "Enable Push" setting after it was disabled. Push notifications are now fully reconfigured on re-enable, so settings changed while push was disabled are picked up as well.

• (#40768) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user

• (#41206) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

• (#41414) Restores Away as a selectable preset in the quick status menu, custom status modal, and account profile page.

• (#41145) Fixes the SAML Single Logout response so the RelayState matches the exact value received on the logout request, as required by the SAML specification, instead of using Rocket.Chat's own URL

• (#41254) Fixes the setup wizard being forced back into the registration step on the first start after an upgrade when OVERWRITE_SETTING_Show_Setup_Wizard=completed is set, which affected air-gapped workspaces running offline licenses without cloud registration.

• (#41122) Adds keyboard navigation support in Room members list

• (#41112) Returns custom fields on admin rooms detail view

• (#41101) Improved /v1/spotlight search performance: results return faster, and room searches now read from secondary database replicas when available, reducing load on the primary.

• (#41402) Fixes broken pagination on rooms.bannedUsers and on omnichannel department listing endpoints, which ignored the offset parameter and always returned results from the first page. Also reduces payload over-fetching on several endpoints that unintentionally loaded full documents (rooms.hide, private group lookups, direct email replies, omnichannel auto-transfer), and removes the permissive model query typings that allowed these invalid find options to compile unnoticed.

• (#41229) Fixes dates showing one day earlier for users in negative UTC-offset timezones

• (#41200) Fixes an issue where the whole app remounts when VoIP availability changes

• • @rocket.chat/model-typings@2.4.0
  • @rocket.chat/core-typings@8.7.0
  • @rocket.chat/models@2.4.0
  • @rocket.chat/gazzodown@33.0.0
  • @rocket.chat/web-ui-registration@33.0.0
  • @rocket.chat/rest-typings@8.7.0
  • @rocket.chat/passport-x@0.1.0
  • @rocket.chat/i18n@3.3.0
  • @rocket.chat/message-parser@0.32.0
  • @rocket.chat/core-services@0.15.0
  • @rocket.chat/ai-search@0.2.0
  • @rocket.chat/ui-client@33.0.0
  • @rocket.chat/federation-matrix@0.2.0
  • @rocket.chat/apps@0.8.0
  • @rocket.chat/license@1.2.0
  • @rocket.chat/apps-engine@1.65.1
  • @rocket.chat/ui-voip@23.0.0
  • @rocket.chat/ui-composer@4.0.0
  • @rocket.chat/abac@0.3.1
  • @rocket.chat/media-calls@0.5.2
  • @rocket.chat/network-broker@0.2.38
  • @rocket.chat/omni-core-ee@0.0.24
  • @rocket.chat/omnichannel-services@0.3.56
  • @rocket.chat/presence@0.3.1
  • @rocket.chat/cron@0.1.59
  • @rocket.chat/fuselage-ui-kit@33.0.0
  • @rocket.chat/instance-status@0.1.59
  • @rocket.chat/omni-core@0.1.3
  • @rocket.chat/server-fetch@0.2.3
  • @rocket.chat/ui-avatar@29.0.0
  • @rocket.chat/ui-contexts@33.0.0
  • @rocket.chat/ui-video-conf@33.0.0

Engine versions

• Node: 22.16.0
• Deno: 1.43.5
• MongoDB: 8.2
• Apps-Engine: 1.59.1

Patch Changes

• Bump @rocket.chat/meteor version.

• (#41240 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41250 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41298 by @dionisio-bot) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user

• (#41290 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

• • @rocket.chat/core-typings@8.0.8
  • @rocket.chat/model-typings@2.0.8
  • @rocket.chat/models@2.0.8
  • @rocket.chat/abac@0.1.8
  • @rocket.chat/federation-matrix@0.0.17
  • @rocket.chat/license@1.1.15
  • @rocket.chat/media-calls@0.2.8
  • @rocket.chat/omnichannel-services@0.3.52
  • @rocket.chat/pdf-worker@0.3.34
  • @rocket.chat/presence@0.2.55
  • @rocket.chat/api-client@0.2.55
  • @rocket.chat/apps@0.6.8
  • @rocket.chat/core-services@0.12.8
  • @rocket.chat/cron@0.1.55
  • @rocket.chat/fuselage-ui-kit@26.0.8
  • @rocket.chat/gazzodown@26.0.8
  • @rocket.chat/http-router@7.9.22
  • @rocket.chat/message-types@0.1.0
  • @rocket.chat/rest-typings@8.0.8
  • @rocket.chat/ui-avatar@22.0.8
  • @rocket.chat/ui-client@26.0.8
  • @rocket.chat/ui-contexts@26.0.8
  • @rocket.chat/ui-voip@16.0.8
  • @rocket.chat/web-ui-registration@26.0.8
  • @rocket.chat/omni-core-ee@0.0.20
  • @rocket.chat/instance-status@0.1.55
  • @rocket.chat/omni-core@0.0.20
  • @rocket.chat/server-cloud-communication@0.0.2
  • @rocket.chat/network-broker@0.2.34
  • @rocket.chat/ui-theming@0.4.4
  • @rocket.chat/ui-video-conf@26.0.8

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.64.1

Patch Changes

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41234 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41243 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41308 by @dionisio-bot) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.

• (#41292 by @dionisio-bot) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user

• (#41276 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

• • @rocket.chat/core-typings@8.6.1
  • @rocket.chat/model-typings@2.3.2
  • @rocket.chat/models@2.3.2
  • @rocket.chat/apps-engine@1.64.1
  • @rocket.chat/rest-typings@8.6.1

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.63.0

Patch Changes

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#41235 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41244 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41293 by @dionisio-bot) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user

• (#41277 by @dionisio-bot) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

• • @rocket.chat/core-typings@8.5.2
  • @rocket.chat/model-typings@2.3.1
  • @rocket.chat/models@2.3.1
  • @rocket.chat/rest-typings@8.5.2