8.2.8
Fixed 1
- Fix special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
Security 2
- Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
- Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
From Rocket.Chat
Engine versions
- Node:
22.16.0 - Deno:
1.43.5 - MongoDB:
8.0 - Apps-Engine:
1.60.1
Patch Changes
-
Bump @rocket.chat/meteor version.
-
(#41856 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
-
(#41849 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
-
(#41864 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
-
(#41840 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
-
- @rocket.chat/core-typings@8.2.8
- @rocket.chat/rest-typings@8.2.8