Skip to content

8.6.0

Latest
Latest

Choose a tag to compare

View all tags
@rocketchat-github-ci rocketchat-github-ci released this 03 Jul 17:10
8.6.0
814435a

Release 8.6.0

Release Date: July 3, 2026
Support Window: Supported until January 31, 2027

Summary

Security and Compliance

Security improvements, authentication changes, data protection, and vulnerability fixes.

This release adds Virtru as an external attribute store option for attribute-based access control, selectable under Administration > Settings > ABAC, and deactivates users locked out in LDAP or Active Directory during sync. Sign-in with Apple is hardened with full identity token validation, the Apps Engine package parser is protected against prototype pollution, file deletion and the workspace fingerprint endpoint now require proper authorization, HTML is escaped in message exports and emailed data downloads, and incoming webhook integrations receive a bundled security hotfix, including an SSRF-related fix. Expired sessions now redirect to the login page, unverified users can resend their confirmation email from the login screen, personal access tokens configured to bypass two-factor authentication are accepted correctly, and PDF downloads from encrypted rooms keep their original format and filename.

Messaging and Collaboration

Features and fixes related to messaging, channels, discussions, and communication workflows.

Voice calls can now be popped out into a separate floating window that keeps all call controls while you navigate the workspace, LibreTranslate is available as an auto-translation provider alongside Google, DeepL, and Microsoft, and a new rooms.join API endpoint lets users join any room type, including discussions. Automatic translation now also covers users who joined rooms before setting a language preference, and direct messages with deactivated users become read-only. Fixes improve voice calls accepted from the mobile lock screen, bot assignment after agents reach their simultaneous chat limit, attachment accessibility and descriptions, message search with invalid regular expressions, false "Room not found" errors after reconnection, thread scrolling and reply behavior, jump-to-message after refresh, and overall UI stability across room, team, and account views.

Platform and Extensibility

Developer platform, APIs, integrations, and application framework improvements.

A unified presence sync engine resolves user online status through a priority-based claim system with status expiration and previous-state restore, exposed via the users REST endpoint and Apps Engine user objects. Apps Engine room and user objects now include federation fields, a new endpoint removes custom sounds, and several REST endpoints were extended to mirror their deprecated DDP equivalents, which now log warnings and remain available until 9.0.0. Fixes address a server crash when a Marketplace app is updated twice in quick succession and a federation issue where editing or deleting a message stopped subsequent messages from syncing between servers.

Data, Storage, and Infrastructure

Database, performance, storage, and system-level improvements.

S3-compatible file uploads no longer fail when the region is empty or the bucket URL omits a scheme. Rooms open faster through parallelized and cached message-history loads, navbar search returns results sooner using cached subscriptions, and the Discussions list is virtualized for smoother scrolling and lower memory use on long lists.

Admin, Configuration, and Workspace Management

Administrative controls, configuration settings, and workspace management improvements.

Filipino (Tagalog) joins the available user and workspace language options, the workspace hashed URL now appears on the Manage > Workspace deployment card and in server startup logs, and avatar URL validation error messages preserve the exact URL submitted without additional encoding.

For further details, check out the release notes.

Engine versions

  • Node: 22.22.3
  • Deno: 2.3.1
  • MongoDB: 8.0
  • Apps-Engine: 1.64.0

Minor Changes

  • (#40826) Shows a confirmation modal when switching attribute store setting

  • (#40274) Adds the backend foundation for a unified presence engine with a priority-based claim system (internal > manual > external), status expiration, and previous state restore.

  • (#40634) Allows using Virtru as the attribute store for ABAC decisions.

    Important

    • When using virtru as the store, the internal attribute store is disabled.
    • On switch, existing ABAC attributes from rooms will be removed. Rooms will continue to be private & no users will be removed until you add attributes again.
    • Users are only allowed to see & edit rooms they have access to. Access decision is evaluated on Virtru
    • A user/app with the bypass-abac-store-validation permission can assign any attributes to rooms, even if the user doesn't have them assigned on Virtru.

  • (#40900) Added LibreTranslate as a message auto-translation provider, alongside Google, DeepL and Microsoft. LibreTranslate can be self-hosted, enabling fully on-premise / offline message auto-translation. Configure the instance URL (and optional API key) under Admin → Settings → Message → Auto-Translate → LibreTranslate and select it as the Service Provider.

  • (#40532) Adds custom-sounds.delete API endpoint.

  • (#40711) POST /v1/chat.delete now accepts { fileId, asUser? } as an alternative to { msgId, roomId, asUser? }. When fileId is provided the server resolves the owning message via Messages.getMessageByFileId before running the existing permission and deletion flow.

  • (#40724) Added POST /v1/e2e.requestSubscriptionKeys (replaces the deprecated e2e.requestSubscriptionKeys DDP method). Auth-gated, no body. Broadcasts notify.e2e.keyRequest for every encrypted room the caller is subscribed to without an E2E key, matching the DDP method's behavior. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.

  • (#40724) Added POST /v1/im.blockUser (replaces the deprecated blockUser / unblockUser DDP methods). Body is { roomId, block: boolean } — block: true blocks the other DM participant, block: false unblocks. Auth-gated and per-room via the RoomMemberActions.BLOCK directive (DM-only). Both legacy DDP methods remain registered until 9.0.0 with deprecation logs pointing at the new route.

  • (#40724) Added POST /v1/settings for batched admin setting updates (replaces the deprecated saveSettings DDP method). Body is { settings: { _id, value }[] }. The endpoint requires authentication, enforces 2FA (twoFactorRequired: true), and runs the same per-setting permission chain (edit-privileged-setting OR manage-selected-settings + per-id permission) and audit/notify side effects the DDP method already performed. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.

  • (#40711) GET /v1/spotlight now mirrors the DDP spotlight method:

    • accepts optional usernames (comma-separated string), type (JSON-encoded { users?, mentions?, rooms?, includeFederatedRooms? }) and rid query params;
    • response items expose nickname / outside (users) and uids / usernames / fname (rooms);
    • status on each user is now optional — outside/federated users were already being returned without one and the previous required-field schema rejected them as Response validation failed;
    • the endpoint is no longer auth-gated, allowing anonymous-read flows (e.g. Accounts_AllowAnonymousRead) to keep finding public channels through the navbar search.

  • (#40711) POST /v1/users.setPreferences now accepts an optional data.utcOffset (number) field. The value is stored at the user-document root via Users.setUtcOffset (not under settings.preferences), matching what the legacy userSetUtcOffset DDP method did.

  • (#40996) Added a new rooms.join REST endpoint that lets a user join any room type, replicating the behavior of the deprecated joinRoom DDP method. Unlike channels.join, it resolves all room types through the shared Room.join service (access checks, join codes, federation and omnichannel rules). The client now uses rooms.join instead of channels.join.

  • (#40791) Exposes the isFederated and federation fields for room and user objects in apps

  • (#40202) Introduces popout functionality for voice calls

Patch Changes

  • (#40988) Added Tagalog (tl) as a selectable interface language. It appears in the user's Account → Preferences → Localization → Language dropdown; interface strings fall back to English until translations are contributed (same approach as other not-yet-translated locales).

  • Bump @rocket.chat/meteor version.

  • Bump @rocket.chat/meteor version.

  • Bump @rocket.chat/meteor version.

  • Bump @rocket.chat/meteor version.

  • (#40902) Fixes a memory leakage on the CodeMirror component (used by code-typed settings)

  • (#40759) Fixes S3 file upload failing when the region setting is empty or the endpoint is configured without a URL scheme

  • (#40702) Fixes users.sendConfirmationEmail rejecting unauthenticated requests, which prevented unverified users from resending their verification email from the login screen

  • (#40992) Fixes auto-translate not activating for users who set their language preference after joining rooms

  • (#40711) Migrate six client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):

    • loadMissedMessages → GET /v1/chat.syncMessages
    • joinRoom → POST /v1/channels.join (channel-only; non-c rooms now error via REST the same way they used to via DDP)
    • userSetUtcOffset → POST /v1/users.setPreferences (new utcOffset field)
    • deleteFileMessage → POST /v1/chat.delete (new fileId body shape)
    • spotlight → GET /v1/spotlight (new usernames / type / rid query params)
    • listCustomSounds → GET /v1/custom-sounds.list

  • (#40724) Migrate four client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):

    • deleteCustomSound → POST /v1/custom-sounds.delete
    • blockUser / unblockUser → POST /v1/im.blockUser (single toggle with { roomId, block: boolean })
    • saveSettings → POST /v1/settings
    • e2e.requestSubscriptionKeys → POST /v1/e2e.requestSubscriptionKeys

  • (#41017) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

  • (#40767) Fixes an issue that allowed users to create a DM and send messages to a deactivated account

  • (#40857) Fixes non-deterministic comparator in team's channel desertion table

  • (#41009) Fixes an issue where updating an app in quick succession could crash the server.

  • (#41057) Fixes incoming integrations inability of reaching internal hosts by adding "ignoreSsrfValidation: true" to it

  • (#40788) Fixes error handling when using invalid regular expressions on message search

  • (#41007) Fixes the message list shifting when typing in the fully expanded message composer

  • (#40802) Escapes HTML tags in exported data

  • (#40982) Fixes an issue with embedded layout where users were able to receive VideoConf calls, causing the application to crash

  • (#40996) Fixed the "not subscribed" room screen not updating after joining a room. The join mutation invalidated a stale React Query key that no longer matched the open-room query, so the UI kept showing the join prompt until a manual page refresh. It now invalidates the correct rooms reference key, so the room opens immediately after joining.

  • (#40719 by @copilot-swe-agent) Fixes an issue that caused the UI to attempt to mark an unserved livechat room as read

  • (#41009) Fixes an issue where an app's bot user presence was incorrectly shown as Offline after updating it.

  • (#40849) Fixes the behavior when the login token expires to redirect the user to the login page

  • (#40842) Fixes an issue where temporary AD/LDAP lockouts would deactivate users on rocket.chat.

  • (#41046) Fixes an issue where editing or deleting a message in a federated room caused subsequent messages to stop syncing between servers

    Note: this prevents the issue from happening, but does not restore rooms that are already affected. Recovering those requires a separate, one-time repair.

  • (#40956) fixes issue that caused threads to sometimes not scroll when sending messages

  • (#40684) Fixes an issue on ABAC audit page that sent local timestamps instead of UTC ones as filters to fetch audit logs

  • (#40889) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

  • (#40706) Fixes missing permission check on the POST /api/v1/fingerprint endpoint

  • (#40991) Fixes rooms failing to open on transient network errors, and prevents a "Room Not Found" flash when opening a room with a local subscription

  • (#40635 by @copilot-swe-agent) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited

  • (#40839) Fixes an issue where description was incorrectly being used as alternative text for image attachments

  • (#41065) Fixes REST API endpoints that require two-factor authentication (such as users.update) rejecting requests authenticated with a Personal Access Token created with "Ignore Two Factor Authentication", returning totp-required even though the token was meant to bypass the check. The two-factor authorization check now resolves the login token from the REST connection, so bypassTwoFactor tokens are honored again.

  • (#40954) Speeds up room opening by removing redundant work in the message history load. On the client, the prefetched first history batch no longer blocks on the message-list DOM before rendering, and the history pager no longer fires an extra loadHistory round trip just to reach a full page of visible messages when the latest page contains thread replies. On the server, loadHistory reuses the already-fetched room document instead of querying it twice, and runs message normalization and the unread (first-unread + count) queries concurrently instead of sequentially.

  • (#39273 by @metaloozee) Fixes an issue where ui crashes when message attachment fields contains non-string value field

  • (#40955) Fixes an issue where the channel selection modal would not load when removing a member from a team.

  • (#40864) Fixes an issue on canAccessRoom where abacAttributes were not fetched in some endpoint calls

  • Updated dependencies [6ae500a, 4319d3e, 24dc6ec, 73e12e1, a7279ce, ebc9c17, 7380c44, a7279ce, 3c47215, 25722db, f4f3612, 308e1c5, 9a36221, f57901d, f57901d, f57901d, 9a36221, 9a36221, fa685d0, 6bd9182, 6fa5378, f63b965, 5d5edd8, 9ab1cf6, ff75174, 9861932]:
    • @rocket.chat/i18n@3.2.0
    • @rocket.chat/apps@0.7.1
    • @rocket.chat/model-typings@2.3.1
    • @rocket.chat/models@2.3.1
    • @rocket.chat/core-services@0.14.2
    • @rocket.chat/media-signaling@1.1.0
    • @rocket.chat/core-typings@8.6.0
    • @rocket.chat/presence@0.3.0
    • @rocket.chat/abac@0.3.0
    • @rocket.chat/rest-typings@8.6.0
    • @rocket.chat/federation-matrix@0.1.6
    • @rocket.chat/apps-engine@1.64.0
    • @rocket.chat/ui-voip@22.0.0
    • @rocket.chat/media-calls@0.5.1
    • @rocket.chat/network-broker@0.2.37
    • @rocket.chat/omni-core-ee@0.0.23
    • @rocket.chat/omnichannel-services@0.3.55
    • @rocket.chat/cron@0.1.58
    • @rocket.chat/ddp-client@1.1.1
    • @rocket.chat/fuselage-ui-kit@32.0.0
    • @rocket.chat/gazzodown@32.0.0
    • @rocket.chat/instance-status@0.1.58
    • @rocket.chat/omni-core@0.1.2
    • @rocket.chat/server-fetch@0.2.2
    • @rocket.chat/ui-avatar@28.0.0
    • @rocket.chat/ui-client@32.0.0
    • @rocket.chat/ui-composer@3.0.0
    • @rocket.chat/ui-contexts@32.0.0
    • @rocket.chat/ui-video-conf@32.0.0
    • @rocket.chat/web-ui-registration@32.0.0
Assets 2
Loading