Release 8.6.0#41029
Open
rocketchat-github-ci wants to merge 154 commits into
Open
Conversation
…ersion-durability (#40646)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: KevLehman <11577696+KevLehman@users.noreply.github.com> Co-authored-by: Kevin Aleman <kaleman960@gmail.com>
Co-authored-by: Tasso Evangelista <tasso.evangelista@rocket.chat>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
…or batch processing (#40701) Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
⏭️ Hacktron Security Check — SkippedReason: This PR exceeds Hacktron's 200-file review cap and will not be scanned. Split the PR into smaller changes for review coverage.
|
🦋 Changeset detectedLatest commit: 8a7f181 The changes in this PR will be included in the next version bump. This PR includes no changesetsWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
Contributor
|
Important Review skippedToo many files! This PR contains 2046 files, which is 1896 over the limit of 150. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (26)
📒 Files selected for processing (2046)
You can disable this status message by setting the Use the checkbox below for a quick retry:
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #41029 +/- ##
==========================================
+ Coverage 69.95% 70.15% +0.20%
==========================================
Files 3328 3371 +43
Lines 126813 130417 +3604
Branches 22143 22561 +418
==========================================
+ Hits 88706 91489 +2783
- Misses 34805 35611 +806
- Partials 3302 3317 +15
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Caution These are security findings reported by the security scanners configured in Layne. Findings may contain false positives - review them and fix what makes sense. If you believe a finding is not valid, contact the security team. Layne found 7 high issues in this PR. View 7 finding(s)
|
…ps.invite and channels.invite (#41059)
…a color setting (#41067)
Signed-off-by: Abhinav Kumar <abhinav@avitechlab.com> Co-authored-by: Abhinav Kumar <abhinav@avitechlab.com> Co-authored-by: Nazareno Bucciarelli <bnazareno03@gmail.com>
…ignoreSsrfValidation (#41057)
[no ci]
Co-authored-by: Douglas Fabris <devfabris@gmail.com> Co-authored-by: ricardogarim <ricardogarim@users.noreply.github.com>
[no ci]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You can see below a preview of the release change log:
8.6.0
Engine versions
22.22.32.3.18.01.64.0-rc.0Minor Changes
(#40826) Shows a confirmation modal when switching attribute store setting
(#40274) Adds the backend foundation for a unified presence engine with a priority-based claim system (internal > manual > external), status expiration, and previous state restore.
(#40634) Allows using Virtru as the attribute store for ABAC decisions.
Important
bypass-abac-store-validationpermission can assign any attributes to rooms, even if the user doesn't have them assigned on Virtru.(#40900) Added LibreTranslate as a message auto-translation provider, alongside Google, DeepL and Microsoft. LibreTranslate can be self-hosted, enabling fully on-premise / offline message auto-translation. Configure the instance URL (and optional API key) under Admin → Settings → Message → Auto-Translate → LibreTranslate and select it as the Service Provider.
(#40532) Adds custom-sounds.delete API endpoint.
(#40711)
POST /v1/chat.deletenow accepts{ fileId, asUser? }as an alternative to{ msgId, roomId, asUser? }. WhenfileIdis provided the server resolves the owning message viaMessages.getMessageByFileIdbefore running the existing permission and deletion flow.(#40724) Added
POST /v1/e2e.requestSubscriptionKeys(replaces the deprecatede2e.requestSubscriptionKeysDDP method). Auth-gated, no body. Broadcastsnotify.e2e.keyRequestfor every encrypted room the caller is subscribed to without an E2E key, matching the DDP method's behavior. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.(#40724) Added
POST /v1/im.blockUser(replaces the deprecatedblockUser/unblockUserDDP methods). Body is{ roomId, block: boolean }—block: trueblocks the other DM participant,block: falseunblocks. Auth-gated and per-room via theRoomMemberActions.BLOCKdirective (DM-only). Both legacy DDP methods remain registered until 9.0.0 with deprecation logs pointing at the new route.(#40724) Added
POST /v1/settingsfor batched admin setting updates (replaces the deprecatedsaveSettingsDDP method). Body is{ settings: { _id, value }[] }. The endpoint requires authentication, enforces 2FA (twoFactorRequired: true), and runs the same per-setting permission chain (edit-privileged-settingORmanage-selected-settings+ per-id permission) and audit/notify side effects the DDP method already performed. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.(#40711)
GET /v1/spotlightnow mirrors the DDPspotlightmethod:usernames(comma-separated string),type(JSON-encoded{ users?, mentions?, rooms?, includeFederatedRooms? }) andridquery params;nickname/outside(users) anduids/usernames/fname(rooms);statuson each user is now optional — outside/federated users were already being returned without one and the previous required-field schema rejected them asResponse validation failed;Accounts_AllowAnonymousRead) to keep finding public channels through the navbar search.(#40711)
POST /v1/users.setPreferencesnow accepts an optionaldata.utcOffset(number) field. The value is stored at the user-document root viaUsers.setUtcOffset(not undersettings.preferences), matching what the legacyuserSetUtcOffsetDDP method did.(#40996) Added a new
rooms.joinREST endpoint that lets a user join any room type, replicating the behavior of the deprecatedjoinRoomDDP method. Unlikechannels.join, it resolves all room types through the sharedRoom.joinservice (access checks, join codes, federation and omnichannel rules). The client now usesrooms.joininstead ofchannels.join.(#40791) Exposes the
isFederatedandfederationfields for room and user objects in apps(#40202) Introduces popout functionality for voice calls
Patch Changes
(#40988) Added Tagalog (
tl) as a selectable interface language. It appears in the user's Account → Preferences → Localization → Language dropdown; interface strings fall back to English until translations are contributed (same approach as other not-yet-translated locales).(#40902) Fixes a memory leakage on the CodeMirror component (used by
code-typed settings)(#40759) Fixes S3 file upload failing when the region setting is empty or the endpoint is configured without a URL scheme
(#40702) Fixes
users.sendConfirmationEmailrejecting unauthenticated requests, which prevented unverified users from resending their verification email from the login screen(#40992) Fixes auto-translate not activating for users who set their language preference after joining rooms
(#40711) Migrate six client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):
loadMissedMessages→GET /v1/chat.syncMessagesjoinRoom→POST /v1/channels.join(channel-only; non-crooms now error via REST the same way they used to via DDP)userSetUtcOffset→POST /v1/users.setPreferences(newutcOffsetfield)deleteFileMessage→POST /v1/chat.delete(newfileIdbody shape)spotlight→GET /v1/spotlight(newusernames/type/ridquery params)listCustomSounds→GET /v1/custom-sounds.list(#40724) Migrate four client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):
deleteCustomSound→POST /v1/custom-sounds.deleteblockUser/unblockUser→POST /v1/im.blockUser(single toggle with{ roomId, block: boolean })saveSettings→POST /v1/settingse2e.requestSubscriptionKeys→POST /v1/e2e.requestSubscriptionKeys(#41017) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40767) Fixes an issue that allowed users to create a DM and send messages to a deactivated account
(#40857) Fixes non-deterministic comparator in team's channel desertion table
(#41009) Fixes an issue where updating an app in quick succession could crash the server.
(#40788) Fixes error handling when using invalid regular expressions on message search
(#41007) Fixes the message list shifting when typing in the fully expanded message composer
(#40802) Escapes HTML tags in exported data
(#40982) Fixes an issue with embedded layout where users were able to receive VideoConf calls, causing the application to crash
(#40996) Fixed the "not subscribed" room screen not updating after joining a room. The join mutation invalidated a stale React Query key that no longer matched the open-room query, so the UI kept showing the join prompt until a manual page refresh. It now invalidates the correct
roomsreference key, so the room opens immediately after joining.(#40719 by @copilot-swe-agent) Fixes an issue that caused the UI to attempt to mark an unserved livechat room as read
(#41009) Fixes an issue where an app's bot user presence was incorrectly shown as Offline after updating it.
(#40849) Fixes the behavior when the login token expires to redirect the user to the login page
(#40842) Fixes an issue where temporary AD/LDAP lockouts would deactivate users on rocket.chat.
(#40956) fixes issue that caused threads to sometimes not scroll when sending messages
(#40684) Fixes an issue on ABAC audit page that sent local timestamps instead of UTC ones as filters to fetch audit logs
(#40889) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40706) Fixes missing permission check on the
POST /api/v1/fingerprintendpoint(#40991) Fixes rooms failing to open on transient network errors, and prevents a "Room Not Found" flash when opening a room with a local subscription
(#40635 by @copilot-swe-agent) Fixes the Chat Limits locking mechanism to allow bot agents to skip the lock as they aren't limited
(#40839) Fixes an issue where
descriptionwas incorrectly being used as alternative text for image attachments(#40954) Speeds up room opening by removing redundant work in the message history load. On the client, the prefetched first history batch no longer blocks on the message-list DOM before rendering, and the history pager no longer fires an extra
loadHistoryround trip just to reach a full page of visible messages when the latest page contains thread replies. On the server,loadHistoryreuses the already-fetched room document instead of querying it twice, and runs message normalization and the unread (first-unread + count) queries concurrently instead of sequentially.(#39273 by @metaloozee) Fixes an issue where ui crashes when message attachment fields contains non-string
valuefield(#40955) Fixes an issue where the channel selection modal would not load when removing a member from a team.
(#40864) Fixes an issue on
canAccessRoomwhereabacAttributeswere not fetched in some endpoint callsUpdated dependencies [6ae500a, 4319d3e, 24dc6ec, 73e12e1, a7279ce, ebc9c17, 7380c44, a7279ce, 3c47215, 25722db, f4f3612, 9a36221, f57901d, f57901d, f57901d, 9a36221, 9a36221, fa685d0, 6bd9182, f63b965, 9ab1cf6, ff75174]: