Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.65.1 Minor Changes (#40351) Adds current field to DeviceManagementSession type and currentLoginToken parameter to aggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session. (#40721) ## Phishing-Resistant Multi-Factor Authentication Introduces a more secure and reliable server-side…
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.65.1-rc.0 Patch Changes Bump @rocket.chat/meteor version. Updated dependencies []: @rocket.chat/core-typings@8.7.0-rc.6 @rocket.chat/rest-typings@8.7.0-rc.6
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.65.1-rc.0 Patch Changes Bump @rocket.chat/meteor version. Updated dependencies []: @rocket.chat/core-typings@8.7.0-rc.5 @rocket.chat/rest-typings@8.7.0-rc.5
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.65.1-rc.0 Patch Changes Bump @rocket.chat/meteor version. (#41588) Fixes audio attachments not being seekable using the progress slider Updated dependencies []: @rocket.chat/core-typings@8.7.0-rc.4 @rocket.chat/rest-typings@8.7.0-rc.4
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.65.1-rc.0 Patch Changes Bump @rocket.chat/meteor version. Updated dependencies []: @rocket.chat/core-typings@8.7.0-rc.3 @rocket.chat/rest-typings@8.7.0-rc.3
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.65.1-rc.0 Patch Changes Bump @rocket.chat/meteor version. Updated dependencies []: @rocket.chat/core-typings@8.7.0-rc.2 @rocket.chat/rest-typings@8.7.0-rc.2
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.65.1-rc.0 Patch Changes Bump @rocket.chat/meteor version. Updated dependencies []: @rocket.chat/core-typings@8.7.0-rc.1 @rocket.chat/rest-typings@8.7.0-rc.1
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.64.1-rc.0 Minor Changes (#40351) Adds current field to DeviceManagementSession type and currentLoginToken parameter to aggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session. (#40721) ## Phishing-Resistant Multi-Factor Authentication Introduces a more secure and reliable server…
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.64.1-rc.0 Major Changes (#40721) ## Phishing-Resistant Multi-Factor Authentication Introduces a more secure and reliable server-side OAuth authentication flow. What’s New Improved OAuth login security OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credent…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.2 Apps-Engine: 1.59.1 Patch Changes Bump @rocket.chat/meteor version. (#41240 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41250 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41298 by @dionisio-bot) Ensures the users.CreateToken endpoint checks fo…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.0 Apps-Engine: 1.60.1 Patch Changes Bump @rocket.chat/meteor version. (#41238 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41247 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41296 by @dionisio-bot) Ensures the users.CreateToken endpoint checks fo…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.0 Apps-Engine: 1.61.1 Patch Changes Bump @rocket.chat/meteor version. (#41237 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41246 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41295 by @dionisio-bot) Ensures the users.CreateToken endpoint checks fo…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 5.0, 6.0, 7.0 Apps-Engine: 1.55.3 Patch Changes Bump @rocket.chat/meteor version. (#41241 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41253 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41291 by @dionisio-bot) Ensures room permission checks are app…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.2 Apps-Engine: 1.59.2 Patch Changes Bump @rocket.chat/meteor version. (#41239 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41248 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41297 by @dionisio-bot) Ensures the users.CreateToken endpoint checks fo…
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.64.1 Patch Changes Bump @rocket.chat/meteor version. Bump @rocket.chat/meteor version. (#41234 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41243 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41308 by @dionisio-bot) Fixes wrong Fed…
Engine versions Node: 22.22.2 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.62.0 Patch Changes Bump @rocket.chat/meteor version. Bump @rocket.chat/meteor version. (#41236 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41245 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41294 by @dionisio-bot) Ensures the use…
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.63.0 Patch Changes Bump @rocket.chat/meteor version. Bump @rocket.chat/meteor version. (#41235 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41244 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#41293 by @dionisio-bot) Ensures the use…
Release 8.6.0 Release Date: July 3, 2026 Support Window: Supported until January 31, 2027 Summary Security and Compliance Security improvements, authentication changes, data protection, and vulnerability fixes. This release adds Virtru as an external attribute store option for attribute-based access control, selectable under Administration > Settings > ABAC, and deactivates users locked out in LDA…
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.64.0-rc.0 Patch Changes Bump @rocket.chat/meteor version. Updated dependencies []: @rocket.chat/core-typings@8.6.0-rc.3 @rocket.chat/rest-typings@8.6.0-rc.3
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.64.0-rc.0 Patch Changes Bump @rocket.chat/meteor version. Updated dependencies []: @rocket.chat/core-typings@8.6.0-rc.2 @rocket.chat/rest-typings@8.6.0-rc.2
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.64.0-rc.0 Patch Changes Bump @rocket.chat/meteor version. (#41057) Fixes incoming integrations inability of reaching internal hosts by adding "ignoreSsrfValidation: true" to it (#41046) Fixes an issue where editing or deleting a message in a federated room caused subsequent messages to stop syncing between servers Note: this pre…
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.64.0-rc.0 Minor Changes (#40826) Shows a confirmation modal when switching attribute store setting (#40274) Adds the backend foundation for a unified presence engine with a priority-based claim system (internal > manual > external), status expiration, and previous state restore. (#40634) Allows using Virtru as the attribute stor…
Engine versions Node: 22.22.3 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.63.0 Patch Changes Bump @rocket.chat/meteor version. Bump @rocket.chat/meteor version. (#40917 by @dionisio-bot) Escapes HTML tags in exported data (#40891 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#40904 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fing…
Engine versions Node: 22.22.2 Deno: 2.3.1 MongoDB: 8.0 Apps-Engine: 1.62.0 Patch Changes Bump @rocket.chat/meteor version. Bump @rocket.chat/meteor version. (#40918 by @dionisio-bot) Escapes HTML tags in exported data (#40892 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#40905 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fing…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.0 Apps-Engine: 1.60.1 Patch Changes Bump @rocket.chat/meteor version. (#40920 by @dionisio-bot) Escapes HTML tags in exported data (#40895 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#40907 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint Updated dependen…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.2 Apps-Engine: 1.59.1 Patch Changes Bump @rocket.chat/meteor version. (#40922 by @dionisio-bot) Escapes HTML tags in exported data (#40897 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#40910 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint Updated dependen…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.0 Apps-Engine: 1.61.1 Patch Changes Bump @rocket.chat/meteor version. (#40919 by @dionisio-bot) Escapes HTML tags in exported data (#40894 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#40906 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint Updated dependen…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 8.2 Apps-Engine: 1.59.2 Patch Changes Bump @rocket.chat/meteor version. (#40921 by @dionisio-bot) Escapes HTML tags in exported data (#40896 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#40908 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint Updated dependen…
Engine versions Node: 22.16.0 Deno: 1.43.5 MongoDB: 5, 6, 7, 8 Apps-Engine: 1.58.1 Patch Changes Bump @rocket.chat/meteor version. (#40923 by @dionisio-bot) Escapes HTML tags in exported data (#40898 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) (#40911 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint Updated d…