# Rocket.Chat changelog > An open-source team communication platform. - Vendor: Rocket.Chat - Category: Communication - Official site: https://www.rocket.chat - Tracked by: What's New (https://whatsnew.fyi/product/rocket-chat) - Harvested from: GitHub (RocketChat/Rocket.Chat) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### 8.7.0-rc.6 - Date: 2026-08-06 - Version: 8.7.0-rc.6 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.6 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.0-rc.6 - Labels: Pre-release ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.65.1-rc.0` ###### Patch Changes * Bump @rocket.chat/meteor version. *
Updated dependencies []: * @rocket.chat/core-typings@8.7.0-rc.6 * @rocket.chat/rest-typings@8.7.0-rc.6
### 8.7.0-rc.5 - Date: 2026-08-04 - Version: 8.7.0-rc.5 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.5 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.0-rc.5 - Labels: Pre-release - **changed** — Update @rocket.chat/meteor version - **changed** — Update @rocket.chat/core-typings to 8.7.0-rc.5 - **changed** — Update @rocket.chat/rest-typings to 8.7.0-rc.5 ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.65.1-rc.0` ###### Patch Changes * Bump @rocket.chat/meteor version. *
Updated dependencies []: * @rocket.chat/core-typings@8.7.0-rc.5 * @rocket.chat/rest-typings@8.7.0-rc.5
### 8.7.0-rc.4 - Date: 2026-08-03 - Version: 8.7.0-rc.4 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.4 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.0-rc.4 - Labels: Pre-release - **fixed** — Fix audio attachments not being seekable using the progress slider ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.65.1-rc.0` ###### Patch Changes * Bump @rocket.chat/meteor version. * ([#41588](https://github.com/RocketChat/Rocket.Chat/pull/41588)) Fixes audio attachments not being seekable using the progress slider *
Updated dependencies []: * @rocket.chat/core-typings@8.7.0-rc.4 * @rocket.chat/rest-typings@8.7.0-rc.4
### 8.7.0-rc.3 - Date: 2026-07-31 - Version: 8.7.0-rc.3 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.3 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.0-rc.3 - Labels: Pre-release ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.65.1-rc.0` ###### Patch Changes * Bump @rocket.chat/meteor version. *
Updated dependencies []: * @rocket.chat/core-typings@8.7.0-rc.3 * @rocket.chat/rest-typings@8.7.0-rc.3
### 8.7.0-rc.2 - Date: 2026-07-23 - Version: 8.7.0-rc.2 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.2 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.0-rc.2 - Labels: Pre-release ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.65.1-rc.0` ###### Patch Changes * Bump @rocket.chat/meteor version. *
Updated dependencies []: * @rocket.chat/core-typings@8.7.0-rc.2 * @rocket.chat/rest-typings@8.7.0-rc.2
### 8.7.0-rc.1 - Date: 2026-07-23 - Version: 8.7.0-rc.1 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.1 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.0-rc.1 - Labels: Pre-release ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.65.1-rc.0` ###### Patch Changes * Bump @rocket.chat/meteor version. *
Updated dependencies []: * @rocket.chat/core-typings@8.7.0-rc.1 * @rocket.chat/rest-typings@8.7.0-rc.1
### 8.7.0-rc.0 - Date: 2026-07-21 - Version: 8.7.0-rc.0 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.0 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.7.0-rc.0 - Labels: Pre-release - **added** — Add `current` field to `DeviceManagementSession` type and `currentLoginToken` parameter to `aggregateSessionsByUserId` to identify and flag the caller's active session - **added** — Introduce server-side OAuth authentication flow with CSRF, state validation, and PKCE protection - **added** — Add two-step verification with OAuth logins for users with email or TOTP two-factor authentication - **added** — Add smoother and more secure deep-link OAuth login flow for mobile and desktop apps - **added** — Add `Accounts_OAuth_Use_Modern_Flow` setting to enable the new OAuth flow - **added** — Add AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration - **added** — Add support for running Rocket.Chat in FIPS mode with dedicated FIPS Docker images - **added** — Add alternative runtime runner for apps via environment variable `APPS_ENGINE_RUNTIME_BACKEND='node'` - **added** — Add inline JSON validation feedback to admin settings with `code: application/json` - **added** — Add `licenses.validate` REST endpoint to validate a license without applying it - **added** — Add persistent audio player that continues playing audio attachments across room navigation - **added** — Add `POST /v1/cloud.connectWorkspace` endpoint replacing the deprecated `cloud:connectWorkspace` DDP method - **added** — Add `POST /v1/integrations.clearHistory` and `POST /v1/integrations.replayOutgoing` endpoints replacing deprecated DDP methods - **added** — Add `POST /v1/permissions.addRole` and `POST /v1/permissions.removeRole` endpoints replacing deprecated DDP methods - **changed** — Replace proprietary emojis with native unicode emojis and increase available emoji set - **changed** — Move post-logout side effects to run server-side via `Accounts.onLogout` handler and from `POST /v1/users.logout` - **deprecated** — Deprecate `logoutCleanUp` DDP method in favor of `POST /v1/users.logout` - **deprecated** — Deprecate `cloud:connectWorkspace` DDP method in favor of `POST /v1/cloud.connectWorkspace` - **deprecated** — Deprecate `clearIntegrationHistory` and `replayOutgoingIntegration` DDP methods in favor of REST endpoints - **deprecated** — Deprecate `authorization:addPermissionToRole` and `authorization:removeRoleFromPermission` DDP methods in favor of REST endpoints - **added** — Add support for the `offline` license flag to suppress outbound connections to Rocket.Chat Cloud services and Push Gateway ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.64.1-rc.0` ###### Minor Changes * ([#40351](https://github.com/RocketChat/Rocket.Chat/pull/40351)) Adds `current` field to `DeviceManagementSession` type and `currentLoginToken` parameter to `aggregateSessionsByUserId`, allowing the sessions endpoint to identify and flag the caller's active session. * ([#40721](https://github.com/RocketChat/Rocket.Chat/pull/40721)) ## Phishing-Resistant Multi-Factor Authentication Introduces a more secure and reliable server-side OAuth authentication flow. ### What’s New * **Improved OAuth login security** OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception. * **Built-in CSRF, state validation, and PKCE protection** OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support. * **Improved two-step verification with OAuth logins** Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others. * **Improved mobile & desktop app login** Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow. * **A new setting to enable/disable new OAuth Flow** Enable this new setting `Accounts_OAuth_Use_Modern_Flow` to use all of the above mentioned features. * ([#40890](https://github.com/RocketChat/Rocket.Chat/pull/40890)) Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration. * ([#39324](https://github.com/RocketChat/Rocket.Chat/pull/39324)) Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new `fips` module, and FIPS status is now reported in server logs and statistics. * ([#41019](https://github.com/RocketChat/Rocket.Chat/pull/41019)) Adds an alternative runtime runner for apps. It can be enabled via environment variable `APPS_ENGINE_RUNTIME_BACKEND='node'` * ([#41142](https://github.com/RocketChat/Rocket.Chat/pull/41142)) Adds inline JSON validation feedback to admin settings that hold JSON (`code: application/json`), showing an error in the editor and blocking save while the value is malformed * ([#40916](https://github.com/RocketChat/Rocket.Chat/pull/40916)) Adds a new `licenses.validate` REST endpoint that validates a Rocket.Chat license (V2 or V3 JWT) against the current workspace without applying it, so a license can be previewed before it is applied from the UI. A valid license responds with success; an invalid one responds with the validation behaviors that rejected it. * ([#39411](https://github.com/RocketChat/Rocket.Chat/pull/39411)) Replaces proprietary emojis with native (unicode) emojis and increases available emoji set * ([#41148](https://github.com/RocketChat/Rocket.Chat/pull/41148)) Adds support for the `offline` license flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance. * ([#41120](https://github.com/RocketChat/Rocket.Chat/pull/41120)) Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating co _[Truncated at 4000 characters — full notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.7.0-rc.0]_ ### 8.0.8 - Date: 2026-07-11 - Version: 8.0.8 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.0.8 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.0.8 - **security** — Apply security hotfix for vulnerability management - **security** — Apply security hotfix for vulnerability management - **security** — Ensure the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user - **fixed** — Ensure room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room ###### Engine versions - Node: `22.16.0` - Deno: `1.43.5` - MongoDB: `8.2` - Apps-Engine: `1.59.1` ###### Patch Changes * Bump @rocket.chat/meteor version. * ([#41240](https://github.com/RocketChat/Rocket.Chat/pull/41240) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) * ([#41250](https://github.com/RocketChat/Rocket.Chat/pull/41250) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) * ([#41298](https://github.com/RocketChat/Rocket.Chat/pull/41298) by [@dionisio-bot](https://github.com/dionisio-bot)) Ensures the `users.CreateToken` endpoint checks for the `user-generate-access-token` permission when generating a login token for another user * ([#41290](https://github.com/RocketChat/Rocket.Chat/pull/41290) by [@dionisio-bot](https://github.com/dionisio-bot)) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room *
Updated dependencies [1a604e2cc2f20b6ade88d6bf373252fad1f32e3c]: * @rocket.chat/core-typings@8.0.8 * @rocket.chat/model-typings@2.0.8 * @rocket.chat/models@2.0.8 * @rocket.chat/abac@0.1.8 * @rocket.chat/federation-matrix@0.0.17 * @rocket.chat/license@1.1.15 * @rocket.chat/media-calls@0.2.8 * @rocket.chat/omnichannel-services@0.3.52 * @rocket.chat/pdf-worker@0.3.34 * @rocket.chat/presence@0.2.55 * @rocket.chat/api-client@0.2.55 * @rocket.chat/apps@0.6.8 * @rocket.chat/core-services@0.12.8 * @rocket.chat/cron@0.1.55 * @rocket.chat/fuselage-ui-kit@26.0.8 * @rocket.chat/gazzodown@26.0.8 * @rocket.chat/http-router@7.9.22 * @rocket.chat/message-types@0.1.0 * @rocket.chat/rest-typings@8.0.8 * @rocket.chat/ui-avatar@22.0.8 * @rocket.chat/ui-client@26.0.8 * @rocket.chat/ui-contexts@26.0.8 * @rocket.chat/ui-voip@16.0.8 * @rocket.chat/web-ui-registration@26.0.8 * @rocket.chat/omni-core-ee@0.0.20 * @rocket.chat/instance-status@0.1.55 * @rocket.chat/omni-core@0.0.20 * @rocket.chat/server-cloud-communication@0.0.2 * @rocket.chat/network-broker@0.2.34 * @rocket.chat/ui-theming@0.4.4 * @rocket.chat/ui-video-conf@26.0.8
### 8.6.1 - Date: 2026-07-10 - Version: 8.6.1 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.6.1 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.6.1 - **security** — Apply security hotfix - **security** — Apply security hotfix - **fixed** — Fix wrong FederationLookup type assigned to IUser in apps - **fixed** — Ensure the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user - **fixed** — Ensure room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.64.1` ###### Patch Changes * Bump @rocket.chat/meteor version. * Bump @rocket.chat/meteor version. * ([#41234](https://github.com/RocketChat/Rocket.Chat/pull/41234) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) * ([#41243](https://github.com/RocketChat/Rocket.Chat/pull/41243) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) * ([#41308](https://github.com/RocketChat/Rocket.Chat/pull/41308) by [@dionisio-bot](https://github.com/dionisio-bot)) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it. * ([#41292](https://github.com/RocketChat/Rocket.Chat/pull/41292) by [@dionisio-bot](https://github.com/dionisio-bot)) Ensures the `users.CreateToken` endpoint checks for the `user-generate-access-token` permission when generating a login token for another user * ([#41276](https://github.com/RocketChat/Rocket.Chat/pull/41276) by [@dionisio-bot](https://github.com/dionisio-bot)) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room *
Updated dependencies [89ab75ca9121feb289a0f5744a526361364b8867, c86d933c267e375b0b32585450cf513b6483c245]: * @rocket.chat/core-typings@8.6.1 * @rocket.chat/model-typings@2.3.2 * @rocket.chat/models@2.3.2 * @rocket.chat/apps-engine@1.64.1 * @rocket.chat/rest-typings@8.6.1
### 8.5.2 - Date: 2026-07-10 - Version: 8.5.2 - Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.5.2 - Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.5.2 - **security** — Apply security hotfix - **security** — Apply security hotfix - **fixed** — Ensure the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user - **fixed** — Ensure room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room ###### Engine versions - Node: `22.22.3` - Deno: `2.3.1` - MongoDB: `8.0` - Apps-Engine: `1.63.0` ###### Patch Changes * Bump @rocket.chat/meteor version. * Bump @rocket.chat/meteor version. * ([#41235](https://github.com/RocketChat/Rocket.Chat/pull/41235) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) * ([#41244](https://github.com/RocketChat/Rocket.Chat/pull/41244) by [@dionisio-bot](https://github.com/dionisio-bot)) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) * ([#41293](https://github.com/RocketChat/Rocket.Chat/pull/41293) by [@dionisio-bot](https://github.com/dionisio-bot)) Ensures the `users.CreateToken` endpoint checks for the `user-generate-access-token` permission when generating a login token for another user * ([#41277](https://github.com/RocketChat/Rocket.Chat/pull/41277) by [@dionisio-bot](https://github.com/dionisio-bot)) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room *
Updated dependencies [ac29d8a5fa4c032aa0dd9772eddaa060afd3e35e]: * @rocket.chat/core-typings@8.5.2 * @rocket.chat/model-typings@2.3.1 * @rocket.chat/models@2.3.1 * @rocket.chat/rest-typings@8.5.2