Coop 1.2.0

Important

This release addresses the eMudhra intermediate CA certificates compromise: all deployments should upgrade. For security announcements, we encourage adopters to subscribe to the security-announce@roost.tools mailing list.

Eight intermediate CA certificates issued under eMudhra's emSign ECC Root CA - G3 have compromised private keys, and the CA has revoked them. This release updates Node.js to 24.22.1, which removes the compromised certificates from its bundled trust store. See the Node.js advisory for details.

The risk is believed to be low but real: an attacker would need one of the compromised keys and a position on the network path of Coop's outbound TLS calls, such as those to third-party APIs. We recommend all deployments upgrade, or rebuild their images on node:24.22.1 or later.

Beyond the security update, this release focuses on three areas: giving admins more control over review queues, per-organization hash-exchange credentials for multi-org deployments, and fixes to rules, hashing, and integrations that were silently misbehaving.

Upgrade notes

• Coop now requires HMA 1.2.0 or later.
• @roostorg/coop-types is now at v3.0.0.
• The package manager has switched from npm to pnpm, so use pnpm install when building from source.
• The updateExchangeCredentials GraphQL mutation and ExchangeApiInfo.has_auth are deprecated in favor of per-bank credentials.

Review queues

Admins can now grant access to a review queue by role, instead of adding reviewers one at a time, which makes onboarding many reviewers at once much easier. Thanks to @julietshen and @taobojlen (#1060).

Queues can also have a per-queue job sort order: keep the default first-in-first-out, or put the most-reported items first. Thanks to @calebmcquaid (#718).

The Appeals tab now shows an indicator when appeals are pending, thanks to @madheesunp (#1329). The Actions dashboard has an eligible item types column and filter, thanks to @taobojlen (#1369).

Multi-org hash exchanges

Hash-exchange credentials are now stored per hash bank rather than shared across an instance, so organizations on a multi-org deployment no longer share or overwrite each other's NCMEC, StopNCII, or ThreatExchange credentials. This replaces the stopgap in 1.1.1, so credentials can be edited from the bank UI in Coop again, and it requires HMA 1.2.0. Renaming a hash bank also no longer discards its hashed content. Thanks to @juanmrad (#1360).

Fixes

• Image hashing now applies to every Image field on an item or report, not just an array field named images (#1390, @reitblatt).
• Rule conditions on multi-value inputs (e.g. Any image, Relevant Policy) now check every value instead of only the first, so a rule no longer depends on the order of values (#1389, @reitblatt).
• Zentropi Labeler signal calls were failing on every request after a change to Zentropi's API. Coop now sends the labeler ID, and configurations that only have a version ID keep working (#1335 by @reitblatt, #1388 by @Joseph-Mutua).
• NCMEC review escalations no longer appear to succeed when the item can't resolve to a user (#1331, @Joseph-Mutua).
• Recent Decisions no longer gets stuck in an infinite loop when opening a decision (#1422, @jess-upscrolled).

For integrators

@roostorg/coop-types v3.0.0 adds org-specific signal catalogs, provider policies, and evaluation context types, so integrations can expose signals and policies specific to an organization. Thanks to @juanmrad (#1384).

New Contributors

• @sahilx13 made their first contribution in #1420

Full Changelog: 1.1.1...1.2.0