# Rocket.Chat: what changed from 7 to 8
- Product: Rocket.Chat (https://whatsnew.fyi/product/rocket-chat)
- Vendor: Rocket.Chat
- Range: changelog entries numbered after 7.10.15 up to and including 8.8.0, stable releases only
- Entries below: 12 releases (newest first)
- Resolved: 7 is 7.10.15 and 8 is 8.8.0, the newest stable release of each major we track
- Carrying security changes: 10 · CVEs mentioned: 0 · Mentioning breaking changes: 0 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/rocket-chat/compare/7...8
What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.
Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.
## What changed (54 changes, grouped by kind)
### Added
#### 8.8.0 (2026-09-01)
- Force end-to-end encryption on private rooms setting encrypts every new private room and locks the toggle in create-channel and create-team dialogs
- Users can hide their presence and status message from specific people chosen from the user menu or My Account > Profile
- Rooms managed by Attribute Based Access Control can show classification banners defined as JSON under Administration > Workspace > General > Attribute Based Access Control
- SAML gains an Import IdP metadata action that parses a metadata URL and prefills connection fields
- SAML sign-in through the system browser on mobile and desktop
- Draft message indicator marks rooms and threads holding unsent text in the sidebar, side panel, and Threads list
- Drafts survive room switches and reloads
- Threads panel loads replies a page at a time as you scroll
- Screen sharing for voice calls is generally available
- Users can join internal calls without a working microphone and enable it later from the call widget
- Native Model Context Protocol server ships in alpha with minimal or extended tool sets
- REST endpoints now cover two-factor, audit, custom OAuth, thread-read, message-send, and push-test flows
- `chat.syncMessages` accepts an optional `fromTs` parameter that bounds the sync window
- App action buttons accept role `name` as well as `_id` and support room-scoped roles including owner, moderator, leader, and custom room roles
#### 8.1.8 (2026-08-19)
- Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint (also in 8.3.8; 8.4.6; 8.5.3; 8.7.1)
#### 8.7.0 (2026-08-07)
- Add phishing-resistant MFA support
- Add modern server-side OAuth flow with CSRF protection, state validation, and PKCE via Accounts_OAuth_Use_Modern_Flow setting
- Add unauthenticated endpoints loginCode.redeem, twoFactorChallenges.sendEmailCode, and twoFactorChallenges.verifyChallenge for OAuth sign-in completion and email or TOTP challenges
- Publish FIPS 140-3 compliant Docker images for the monolith and all microservices
- Add Unified AI Search as an opt-in feature preview with semantic message search and grounded AI-generated answers
- Add support for GitHub-style pipe-delimited tables and horizontal rules in messages
- Add persistent audio player that continues playing across room navigation with Now Playing card in sidebar
- Add REST endpoints users.verifyEmail, cloud.connectWorkspace, integrations.clearHistory, and integrations.replayOutgoing
- Add optional service field to users.setAvatar endpoint to preserve original OAuth provider name
### Changed
#### 8.8.0 (2026-09-01)
- Password reset requests from the Forgot password form are now rate limited
- Imports from a public file URL are checked against the SSRF protection allowlist
- Default Apps-Engine runtime changes from Deno to Node.js unless APPS_ENGINE_RUNTIME_BACKEND is set to deno
- Channel, group, session, license, and role endpoints validate request bodies against a schema and return consistent error payloads
#### 8.7.0 (2026-08-07)
- Replace bundled emojione set with native Unicode emojis while maintaining legacy shortnames through compatibility map
- Return 'Away' presence option to user menu's quick status options
- Omnichannel Contact Center date columns now show relative time
- Workspace admins can run Rocket.Chat apps on alternative Node.js runtime backend by setting APPS_ENGINE_RUNTIME_BACKEND to node
- Web client pushes logged-in user's roles to desktop app for version-support warnings
- Upgrade web client rendering baseline to React 19
### Fixed
#### 8.8.0 (2026-09-01)
- Sidebar now scrolls when the room list is taller than the window so rooms below the fold can be reached
#### 8.1.8 (2026-08-19)
- Fix special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview (also in 8.3.8; 8.4.6; 8.2.8; 8.5.3; 8.7.1; 8.6.2)
#### 8.7.1 (2026-08-19)
- Fix an issue where a MultiSelect option checkbox remained checked after the option was deselected
#### 8.7.0 (2026-08-07)
- Harden permission enforcement across users.createToken, channels.convertToTeam, and teams.create to return authorization errors when callers lack required permissions
- Prevent concurrent logins from consuming the same CAS login token
- Prevent users from deleting integrations they do not own
- Fix SAML Single Logout to echo RelayState value as specification requires
- Fix race condition that could leave messages in newly created encrypted rooms permanently undecryptable
#### 8.0.8 (2026-07-11)
- Ensure room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room (also in 8.6.1; 8.5.2)
#### 8.6.1 (2026-07-10)
- Fix wrong FederationLookup type assigned to IUser in apps
- Ensure the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user (also in 8.5.2)
### Deprecated
#### 8.8.0 (2026-09-01)
- The `conditions` entry of the `selector` parameter on Omnichannel autocomplete lookups is deprecated and logs a warning
### Security
#### 8.1.8 (2026-08-19)
- Security hotfix (also in 8.4.6; 8.5.3; 8.7.1)
#### 8.3.8 (2026-08-19)
- Security hotfix for vulnerability in Rocket.Chat
- Replace http with serverFetch in downloadPublicImportFile to add SSRF protection (also in 8.4.6; 8.2.8; 8.7.1; 8.6.2)
#### 8.2.8 (2026-08-19)
- Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint (also in 8.6.2)
#### 8.5.3 (2026-08-19)
- Add SSRF protection by replacing http with serverFetch in downloadPublicImportFile
#### 8.0.8 (2026-07-11)
- Apply security hotfix for vulnerability management
- Ensure the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user
#### 8.6.1 (2026-07-10)
- Apply security hotfix (also in 8.5.2)
## Release notes
### 8.8.0
- Date: 2026-09-01
- Version: 8.8.0
- Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.8.0
- Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.8.0
- **added** — Force end-to-end encryption on private rooms setting encrypts every new private room and locks the toggle in create-channel and create-team dialogs
- **added** — Users can hide their presence and status message from specific people chosen from the user menu or My Account > Profile
- **added** — Rooms managed by Attribute Based Access Control can show classification banners defined as JSON under Administration > Workspace > General > Attribute Based Access Control
- **added** — SAML gains an Import IdP metadata action that parses a metadata URL and prefills connection fields
- **added** — SAML sign-in through the system browser on mobile and desktop
- **added** — Draft message indicator marks rooms and threads holding unsent text in the sidebar, side panel, and Threads list
- **added** — Drafts survive room switches and reloads
- **added** — Threads panel loads replies a page at a time as you scroll
- **added** — Screen sharing for voice calls is generally available
- **added** — Users can join internal calls without a working microphone and enable it later from the call widget
- **added** — Native Model Context Protocol server ships in alpha with minimal or extended tool sets
- **added** — REST endpoints now cover two-factor, audit, custom OAuth, thread-read, message-send, and push-test flows
- **added** — `chat.syncMessages` accepts an optional `fromTs` parameter that bounds the sync window
- **added** — App action buttons accept role `name` as well as `_id` and support room-scoped roles including owner, moderator, leader, and custom room roles
- **changed** — Password reset requests from the Forgot password form are now rate limited
- **changed** — Imports from a public file URL are checked against the SSRF protection allowlist
- **changed** — Default Apps-Engine runtime changes from Deno to Node.js unless APPS_ENGINE_RUNTIME_BACKEND is set to deno
- **changed** — Channel, group, session, license, and role endpoints validate request bodies against a schema and return consistent error payloads
- **deprecated** — The `conditions` entry of the `selector` parameter on Omnichannel autocomplete lookups is deprecated and logs a warning
- **fixed** — Sidebar now scrolls when the room list is taller than the window so rooms below the fold can be reached
#### Release 8.8.0
**Release Date**: September 3, 2026
**Support Window**: Supported until March 31, 2027
##### Summary
###### Security and Compliance
_Security improvements, authentication changes, data protection, and vulnerability fixes._
A new **Force end-to-end encryption on private rooms** setting under **Administration** > **Workspace** > **End-to-end encryption** encrypts every new private room and locks the toggle on in the create-channel and create-team dialogs. Public rooms are unaffected and federated rooms are exempt. Users can now hide their presence and status message from specific people, chosen from the user menu or **My Account** > **Profile**. Anyone on that list sees them as offline, and hidden status is excluded from lookups and search. Rooms managed by Attribute Based Access Control can show classification banners, defined as JSON under **Administration** > **Workspace** > **General** > **Attribute Based Access Control**. SAML gains an **Import IdP metadata** action under **Administration** > **Workspace** > **SAML** that parses a metadata URL and prefills the connection fields, plus sign-in through the system browser on mobile and desktop. LDAP and SAML still work in 8.8.0 without a Premium plan, but from 9.0.0 they require a license with the `ldap-enterprise` or `saml-enterprise` module. Password reset requests from the **Forgot password** form are now rate limited, and imports from a public file URL are checked against the **SSRF protection** allowlist. Fixes cover `POST /v1/logout` leaving sessions active in **My Account** > **Device Management**, room access checks erroring for callers without a resolved identity, and unescaped visitor names in the Omnichannel queue preview. An undisclosed security hotfix for thread message retrieval and real-time notification subscriptions applies on upgrade.
###### Messaging and Collaboration
_Features and fixes related to messaging, channels, discussions, and communication workflows._
The draft message indicator is now on for everyone, so rooms and threads holding unsent text are marked in the sidebar, side panel, and Threads list. Drafts survive room switches and reloads, and **Drafts in sidebar** is gone from **My Account** > **Feature Preview**. The Threads panel now loads replies a page at a time as you scroll, so long threads open quickly. Screen sharing for voice calls is generally available. Users can join internal calls without a working microphone, enable it later from the call widget, and see share, hold, and transfer controls only when the call supports them. Diverted SIP calls are recorded as transfers, and caller names from the SIP integration are preserved. Federated conversations between servers work again, including first contact, older history, thumbnails, paging, and invitations. Other fixes: read receipts on thread replies, discussion reply counts that ignore hidden system messages, restored reading position when you return to a room, **Jump to message** across rooms, deep links (`?msg=`), suggestion popups that stayed open, line breaks lost in very long messages, real names in reaction lists, idle users flipping back to Online, room search for anonymous visitors, editing Omnichannel tags, business hours set to 00:00 to 23:59 closing early, and excessive history loading in contextual bars. The `conditions` entry of the `selector` parameter on Omnichannel autocomplete lookups is deprecated and now logs a warning.
###### Platform and Extensibility
_Developer platform, APIs, integrations, and application framework improvements._
A native Model Context Protocol (MCP) server ships in alpha. Admins turn the endpoint on in the AI Center administration area and choose the minimal or extended tool set. Both controls are off by default, and access requires a license with the AI add-on plus the new `access-mcp` permission. REST endpoints now cover the two-factor, audit, custom OAuth, thread-read, message-send, and push-test flow
_[Truncated at 4000 characters — full notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.8.0]_
### 8.1.8
- Date: 2026-08-19
- Version: 8.1.8
- Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.1.8
- Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.1.8
- **added** — Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
- **security** — Security hotfix
- **fixed** — Fix special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
###### Engine versions
- Node: `22.16.0`
- Deno: `1.43.5`
- MongoDB: `8.2`
- Apps-Engine: `1.59.2`
###### Patch Changes
* Bump @rocket.chat/meteor version.
* ([#41857](https://github.com/RocketChat/Rocket.Chat/pull/41857) by [@dionisio-bot](https://github.com/dionisio-bot)) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
* ([#41850](https://github.com/RocketChat/Rocket.Chat/pull/41850) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
* ([#41841](https://github.com/RocketChat/Rocket.Chat/pull/41841) by [@dionisio-bot](https://github.com/dionisio-bot)) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
* Updated dependencies []:
* @rocket.chat/core-typings@8.1.8
* @rocket.chat/rest-typings@8.1.8
* @rocket.chat/abac@0.1.10
* @rocket.chat/federation-matrix@0.0.19
* @rocket.chat/license@1.1.17
* @rocket.chat/media-calls@0.2.10
* @rocket.chat/omnichannel-services@0.3.54
* @rocket.chat/pdf-worker@0.3.36
* @rocket.chat/presence@0.2.57
* @rocket.chat/api-client@0.2.57
* @rocket.chat/apps@0.6.10
* @rocket.chat/core-services@0.12.10
* @rocket.chat/cron@0.1.57
* @rocket.chat/fuselage-ui-kit@27.0.8
* @rocket.chat/gazzodown@27.0.8
* @rocket.chat/http-router@7.9.24
* @rocket.chat/message-types@0.1.0
* @rocket.chat/model-typings@2.0.10
* @rocket.chat/ui-avatar@23.0.8
* @rocket.chat/ui-client@27.0.8
* @rocket.chat/ui-contexts@27.0.8
* @rocket.chat/ui-voip@17.0.8
* @rocket.chat/web-ui-registration@27.0.8
* @rocket.chat/models@2.0.10
* @rocket.chat/server-cloud-communication@0.0.2
* @rocket.chat/network-broker@0.2.36
* @rocket.chat/omni-core-ee@0.0.22
* @rocket.chat/ui-theming@0.4.4
* @rocket.chat/ui-video-conf@27.0.8
* @rocket.chat/instance-status@0.1.57
* @rocket.chat/omni-core@0.0.22
Updated dependencies []:
* @rocket.chat/core-typings@8.3.8
* @rocket.chat/rest-typings@8.3.8
Updated dependencies []:
* @rocket.chat/core-typings@8.4.6
* @rocket.chat/rest-typings@8.4.6
Updated dependencies []:
* @rocket.chat/core-typings@8.2.8
* @rocket.chat/rest-typings@8.2.8
Updated dependencies []:
* @rocket.chat/core-typings@8.5.3
* @rocket.chat/rest-typings@8.5.3
Updated dependencies []:
* @rocket.chat/core-typings@8.7.1
* @rocket.chat/rest-typings@8.7.1
Updated dependencies []:
* @rocket.chat/core-typings@8.6.2
* @rocket.chat/rest-typings@8.6.2
Updated dependencies [1a604e2cc2f20b6ade88d6bf373252fad1f32e3c]:
* @rocket.chat/core-typings@8.0.8
* @rocket.chat/model-typings@2.0.8
* @rocket.chat/models@2.0.8
* @rocket.chat/abac@0.1.8
* @rocket.chat/federation-matrix@0.0.17
* @rocket.chat/license@1.1.15
* @rocket.chat/media-calls@0.2.8
* @rocket.chat/omnichannel-services@0.3.52
* @rocket.chat/pdf-worker@0.3.34
* @rocket.chat/presence@0.2.55
* @rocket.chat/api-client@0.2.55
* @rocket.chat/apps@0.6.8
* @rocket.chat/core-services@0.12.8
* @rocket.chat/cron@0.1.55
* @rocket.chat/fuselage-ui-kit@26.0.8
* @rocket.chat/gazzodown@26.0.8
* @rocket.chat/http-router@7.9.22
* @rocket.chat/message-types@0.1.0
* @rocket.chat/rest-typings@8.0.8
* @rocket.chat/ui-avatar@22.0.8
* @rocket.chat/ui-client@26.0.8
* @rocket.chat/ui-contexts@26.0.8
* @rocket.chat/ui-voip@16.0.8
* @rocket.chat/web-ui-registration@26.0.8
* @rocket.chat/omni-core-ee@0.0.20
* @rocket.chat/instance-status@0.1.55
* @rocket.chat/omni-core@0.0.20
* @rocket.chat/server-cloud-communication@0.0.2
* @rocket.chat/network-broker@0.2.34
* @rocket.chat/ui-theming@0.4.4
* @rocket.chat/ui-video-conf@26.0.8
Updated dependencies [89ab75ca9121feb289a0f5744a526361364b8867, c86d933c267e375b0b32585450cf513b6483c245]:
* @rocket.chat/core-typings@8.6.1
* @rocket.chat/model-typings@2.3.2
* @rocket.chat/models@2.3.2
* @rocket.chat/apps-engine@1.64.1
* @rocket.chat/rest-typings@8.6.1
Updated dependencies [ac29d8a5fa4c032aa0dd9772eddaa060afd3e35e]:
* @rocket.chat/core-typings@8.5.2
* @rocket.chat/model-typings@2.3.1
* @rocket.chat/models@2.3.1
* @rocket.chat/rest-typings@8.5.2