8.3.8
Added 1
- Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
Fixed 1
- Fix special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
Security 2
- Security hotfix for vulnerability in Rocket.Chat
- Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
From Rocket.Chat
Engine versions
- Node:
22.16.0 - Deno:
1.43.5 - MongoDB:
8.0 - Apps-Engine:
1.61.1
Patch Changes
-
Bump @rocket.chat/meteor version.
-
(#41855 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
-
(#41844 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
-
(#41863 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
-
(#41826 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
-
- @rocket.chat/core-typings@8.3.8
- @rocket.chat/rest-typings@8.3.8