# Rocket.Chat 8.8.0-rc.0

- Product: Rocket.Chat (https://whatsnew.fyi/product/rocket-chat)
- Vendor: Rocket.Chat
- Date: 2026-08-20
- Version: 8.8.0-rc.0
- Original notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.8.0-rc.0
- Permalink: https://whatsnew.fyi/product/rocket-chat/releases/8.8.0-rc.0
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add classification banners to ABAC-managed rooms with customizable US-Government-style classification markings, levels, special access programs, releasability, and colors
- **changed** — Accept role names in the when.hasOneRole and when.hasAllRoles filters of an app action button
- **changed** — Change the default apps-engine runtime backend from deno to node, restorable via APPS_ENGINE_RUNTIME_BACKEND='deno' environment variable
- **added** — Add support for SAML authentication in mobile and desktop apps via the system browser
- **deprecated** — Deprecate LDAP and SAML authentication on workspaces without a Premium plan, requiring ldap-enterprise or saml-enterprise module in version 9.0.0
- **added** — Add workspace setting Force end-to-end encryption on private rooms to enforce encryption for newly created private rooms with locked toggle and server-side validation
- **changed** — Replace the Drafts in sidebar feature preview with an always-on draft indicator and persist thread-composer drafts per thread
- **added** — Add AI add-on-gated native Model Context Protocol endpoint and administration controls in AI Center
- **added** — Add status visibility feature allowing users to hide their presence and status message from specific people
- **added** — Add three new REST endpoints under /v1/audit.* for audit flows: GET /v1/audit.auditions, POST /v1/audit.messages, and POST /v1/audit.omnichannelMessages (EE-only, requires auditing license)
- **added** — Add POST /v1/chat.readThread endpoint to mark a single thread as read for the caller
- **added** — Add POST /v1/settings.removeCustomOAuth and POST /v1/settings.refreshOAuthServices REST endpoints for Custom OAuth administration
- **added** — Add five new REST endpoints covering TOTP 2FA flows: POST /v1/users.enableTotp and POST /v1/users.disableTotp

###### Engine versions

- Node: `22.22.3`
- Deno: `2.3.1`
- MongoDB: `8.0`
- Apps-Engine: `1.66.0-rc.0`

###### Minor Changes

*   ([#41307](https://github.com/RocketChat/Rocket.Chat/pull/41307)) Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.

*   ([#41765](https://github.com/RocketChat/Rocket.Chat/pull/41765)) Accepts a role name in the `when.hasOneRole` and `when.hasAllRoles` filters of an app action button

*   ([#41474](https://github.com/RocketChat/Rocket.Chat/pull/41474)) Changes the default apps-engine runtime backend from `deno` to `node`. The previous behavior can be restored by setting the environment variable `APPS_ENGINE_RUNTIME_BACKEND='deno'`

*   ([#41788](https://github.com/RocketChat/Rocket.Chat/pull/41788)) Adds support for SAML authentication in the mobile and desktop apps via the system browser.

*   ([#41642](https://github.com/RocketChat/Rocket.Chat/pull/41642)) Deprecates LDAP and SAML authentication on workspaces without a Premium plan. Both keep working as they are today, but the admin settings now warn that version 9.0.0 will require a license including the `ldap-enterprise` or `saml-enterprise` module, and a warning is logged when an unlicensed workspace authenticates a user through either of them.

*   ([#41095](https://github.com/RocketChat/Rocket.Chat/pull/41095)) Adds a workspace setting **Force end-to-end encryption on private rooms** (`E2E_Force_Encryption_For_Private_Rooms`) under **Admin → Settings → End-to-End Encryption**. When enabled, every newly created private room is encrypted by default and users can no longer opt out: the encryption toggle in the create-room modal is locked on for private rooms, and the server rejects any attempt to create a private room with `encrypted: false` (e.g. via `groups.create`) with the error `error-encrypted-private-rooms-enforced`. Public rooms are unaffected. Federated rooms are exempt since federation does not support E2EE. Creating a discussion under an unencrypted private parent room is rejected with a dedicated error instructing the user to make the parent public or enable encryption on it, and the create-discussion dialog now surfaces creation errors as toasts.

*   ([#41355](https://github.com/RocketChat/Rocket.Chat/pull/41355)) Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list

*   ([#41082](https://github.com/RocketChat/Rocket.Chat/pull/41082)) Adds an AI add-on-gated native Model Context Protocol endpoint and its administration controls in AI Center

*   ([#41747](https://github.com/RocketChat/Rocket.Chat/pull/41747)) Adds status visibility, letting users hide their presence and status message from specific people they choose. Blocked people see that user as offline, indistinguishable from genuinely offline, and the block can be lifted at any time — changes apply live, without a reload.

*   ([#40736](https://github.com/RocketChat/Rocket.Chat/pull/40736)) Added three new REST endpoints under `/v1/audit.*` (EE-only, requires the `auditing` license) covering the audit flows that previously only existed as DDP methods:

    *   `GET /v1/audit.auditions?startDate=&endDate=` → `{ auditions: IAuditLog[] }` (replaces `auditGetAuditions`, `can-audit-log`)
    *   `POST /v1/audit.messages` body `{ rid?, startDate, endDate, users, msg, type, visitor?, agent? }` → `{ messages: IMessage[] }` (replaces `auditGetMessages`, `can-audit`)
    *   `POST /v1/audit.omnichannelMessages` body `{ startDate, endDate, users, msg, type, visitor?, agent? }` → `{ messages: IMessage[] }` (replaces `auditGetOmnichannelMessages`, `can-audit`)

    Each endpoint is rate-limited at 10 requests / 60s (matching the DDP `

_[Truncated at 4000 characters — full notes: https://github.com/RocketChat/Rocket.Chat/releases/tag/8.8.0-rc.0]_