RocketChat · rocketchat-github-ci · May 22, 2026 · May 22, 2026 · May 22, 2026 · May 22, 2026
diff --git a/.changeset/add-tagalog-language.md b/.changeset/add-tagalog-language.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': patch
+'@rocket.chat/i18n': minor
+---
+
+Added Tagalog (`tl`) as a selectable interface language. It appears in the user's **Account → Preferences → Localization → Language** dropdown; interface strings fall back to English until translations are contributed (same approach as other not-yet-translated locales).
diff --git a/.changeset/all-readers-reply.md b/.changeset/all-readers-reply.md
@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/i18n": minor
+---
+
+Shows a confirmation modal when switching attribute store setting
diff --git a/.changeset/bump-patch-1782440081682.md b/.changeset/bump-patch-1782440081682.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1782512866566.md b/.changeset/bump-patch-1782512866566.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bumpy-coats-reply.md b/.changeset/bumpy-coats-reply.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes a memory leakage on the CodeMirror component (used by `code`-typed settings)
diff --git a/.changeset/chubby-garlics-decide.md b/.changeset/chubby-garlics-decide.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/apps': patch
+---
+
+Replaces {} with Object.create(null) to ensure defense-in-depth against prototype pollution
diff --git a/.changeset/crisp-corners-itch.md b/.changeset/crisp-corners-itch.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes S3 file upload failing when the region setting is empty or the endpoint is configured without a URL scheme
diff --git a/.changeset/crisp-taxis-pay.md b/.changeset/crisp-taxis-pay.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes `users.sendConfirmationEmail` rejecting unauthenticated requests, which prevented unverified users from resending their verification email from the login screen
diff --git a/.changeset/cute-humans-follow.md b/.changeset/cute-humans-follow.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/model-typings': patch
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes auto-translate not activating for users who set their language preference after joining rooms
diff --git a/.changeset/ddp-migrate-batch2-callers.md b/.changeset/ddp-migrate-batch2-callers.md
@@ -0,0 +1,12 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrate six client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):
+
+- `loadMissedMessages` → `GET /v1/chat.syncMessages`
+- `joinRoom` → `POST /v1/channels.join` (channel-only; non-`c` rooms now error via REST the same way they used to via DDP)
+- `userSetUtcOffset` → `POST /v1/users.setPreferences` (new `utcOffset` field)
+- `deleteFileMessage` → `POST /v1/chat.delete` (new `fileId` body shape)
+- `spotlight` → `GET /v1/spotlight` (new `usernames` / `type` / `rid` query params)
+- `listCustomSounds` → `GET /v1/custom-sounds.list`
diff --git a/.changeset/ddp-migrate-batch3-callers.md b/.changeset/ddp-migrate-batch3-callers.md
@@ -0,0 +1,10 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrate four client DDP callers to their REST equivalents (the DDP methods stay registered on the server for external SDK/mobile clients, with a deprecation log pointing at the REST route until 9.0.0 removes them):
+
+- `deleteCustomSound` → `POST /v1/custom-sounds.delete`
+- `blockUser` / `unblockUser` → `POST /v1/im.blockUser` (single toggle with `{ roomId, block: boolean }`)
+- `saveSettings` → `POST /v1/settings`
+- `e2e.requestSubscriptionKeys` → `POST /v1/e2e.requestSubscriptionKeys`
diff --git a/.changeset/dull-trams-follow.md b/.changeset/dull-trams-follow.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
diff --git a/.changeset/early-deer-fry.md b/.changeset/early-deer-fry.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue that allowed users to create a DM and send messages to a deactivated account
diff --git a/.changeset/easy-laws-talk.md b/.changeset/easy-laws-talk.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes non-deterministic comparator in team's channel desertion table
diff --git a/.changeset/eight-areas-see.md b/.changeset/eight-areas-see.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/core-services': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where updating an app in quick succession could crash the server.
diff --git a/.changeset/eight-dingos-press.md b/.changeset/eight-dingos-press.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes incoming integrations inability of reaching internal hosts by adding "ignoreSsrfValidation: true" to it
diff --git a/.changeset/eighty-onions-deny.md b/.changeset/eighty-onions-deny.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes error handling when using invalid regular expressions on message search
diff --git a/.changeset/famous-birds-join.md b/.changeset/famous-birds-join.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes the message list shifting when typing in the fully expanded message composer
diff --git a/.changeset/fast-apes-know.md b/.changeset/fast-apes-know.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Escapes HTML tags in exported data
diff --git a/.changeset/few-lies-drum.md b/.changeset/few-lies-drum.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue with embedded layout where users were able to receive VideoConf calls, causing the application to crash
diff --git a/.changeset/fix-join-room-subscription-refresh.md b/.changeset/fix-join-room-subscription-refresh.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixed the "not subscribed" room screen not updating after joining a room. The join mutation invalidated a stale React Query key that no longer matched the open-room query, so the UI kept showing the join prompt until a manual page refresh. It now invalidates the correct `rooms` reference key, so the room opens immediately after joining.
diff --git a/.changeset/fluffy-poets-check.md b/.changeset/fluffy-poets-check.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/media-signaling': minor
+---
+
+Fixes a soft lock issue where the call negotiation doesn't proceed if the call is accepted while still being initialized
diff --git a/.changeset/full-results-share.md b/.changeset/full-results-share.md
@@ -0,0 +1,11 @@
+---
+'@rocket.chat/presence-service': minor
+'@rocket.chat/core-services': patch
+'@rocket.chat/model-typings': patch
+'@rocket.chat/core-typings': patch
+'@rocket.chat/presence': minor
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': minor
+---
+
+Adds the backend foundation for a unified presence engine with a priority-based claim system (internal > manual > external), status expiration, and previous state restore.
diff --git a/.changeset/heavy-balloons-cut.md b/.changeset/heavy-balloons-cut.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue that caused the UI to attempt to mark an unserved livechat room as read
diff --git a/.changeset/itchy-years-learn.md b/.changeset/itchy-years-learn.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where an app's bot user presence was incorrectly shown as Offline after updating it.
diff --git a/.changeset/khaki-gifts-follow.md b/.changeset/khaki-gifts-follow.md
@@ -0,0 +1,13 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/abac": minor
+---
+
+Allows using Virtru as the attribute store for ABAC decisions.
+
+### Important
+
+- When using virtru as the store, the internal attribute store is disabled.
+- On switch, existing ABAC attributes from rooms will be removed. Rooms will continue to be private & no users will be removed until you add attributes again.
+- Users are only allowed to see & edit rooms they have access to. Access decision is evaluated on Virtru
+- A user/app with the `bypass-abac-store-validation` permission can assign any attributes to rooms, even if the user doesn't have them assigned on Virtru.
diff --git a/.changeset/libretranslate-autotranslate-provider.md b/.changeset/libretranslate-autotranslate-provider.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': minor
+'@rocket.chat/i18n': patch
+---
+
+Added LibreTranslate as a message auto-translation provider, alongside Google, DeepL and Microsoft. LibreTranslate can be self-hosted, enabling fully on-premise / offline message auto-translation. Configure the instance URL (and optional API key) under **Admin → Settings → Message → Auto-Translate → LibreTranslate** and select it as the Service Provider.
diff --git a/.changeset/loose-knives-retire.md b/.changeset/loose-knives-retire.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes the behavior when the login token expires to redirect the user to the login page
diff --git a/.changeset/metal-regions-yell.md b/.changeset/metal-regions-yell.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where temporary AD/LDAP lockouts would deactivate users on rocket.chat.
diff --git a/.changeset/neat-planets-hope.md b/.changeset/neat-planets-hope.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds custom-sounds.delete API endpoint.
diff --git a/.changeset/nice-baboons-flash.md b/.changeset/nice-baboons-flash.md
@@ -0,0 +1,8 @@
+---
+'@rocket.chat/federation-matrix': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where editing or deleting a message in a federated room caused subsequent messages to stop syncing between servers
+
+Note: this prevents the issue from happening, but does not restore rooms that are already affected. Recovering those requires a separate, one-time repair.
diff --git a/.changeset/old-cities-enjoy.md b/.changeset/old-cities-enjoy.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+fixes issue that caused threads to sometimes not scroll when sending messages
diff --git a/.changeset/pre.json b/.changeset/pre.json
@@ -0,0 +1,135 @@
+{
+  "mode": "pre",
+  "tag": "rc",
+  "initialVersions": {
+    "@rocket.chat/meteor": "8.6.0-develop",
+    "rocketchat-services": "2.0.48",
+    "@rocket.chat/uikit-playground": "0.7.13",
+    "@rocket.chat/account-service": "0.4.57",
+    "@rocket.chat/authorization-service": "0.6.1",
+    "@rocket.chat/ddp-streamer": "0.3.57",
+    "@rocket.chat/omnichannel-transcript": "0.4.57",
+    "@rocket.chat/presence-service": "0.4.57",
+    "@rocket.chat/queue-worker": "0.4.57",
+    "@rocket.chat/abac": "0.2.1",
+    "@rocket.chat/federation-matrix": "0.1.4",
+    "@rocket.chat/license": "1.1.16",
+    "@rocket.chat/media-calls": "0.5.0",
+    "@rocket.chat/network-broker": "0.2.36",
+    "@rocket.chat/omni-core-ee": "0.0.22",
+    "@rocket.chat/omnichannel-services": "0.3.54",
+    "@rocket.chat/pdf-worker": "0.3.35",
+    "@rocket.chat/presence": "0.2.57",
+    "@rocket.chat/account-utils": "0.0.3",
+    "@rocket.chat/agenda": "0.1.1",
+    "@rocket.chat/api-client": "0.2.56",
+    "@rocket.chat/apps": "0.7.0",
+    "@rocket.chat/apps-engine": "1.63.0",
+    "@rocket.chat/base64": "1.0.14",
+    "@rocket.chat/cas-validate": "0.0.4",
+    "@rocket.chat/core-services": "0.14.1",
+    "@rocket.chat/core-typings": "8.6.0-develop",
+    "@rocket.chat/cron": "0.1.57",
+    "@rocket.chat/ddp-client": "1.1.0",
+    "@rocket.chat/desktop-api": "1.2.0",
+    "@rocket.chat/eslint-config": "0.8.0",
+    "@rocket.chat/favicon": "0.0.5",
+    "@rocket.chat/fuselage-ui-kit": "31.0.0",
+    "@rocket.chat/gazzodown": "31.0.0",
+    "@rocket.chat/http-router": "7.9.23",
+    "@rocket.chat/i18n": "3.1.0",
+    "@rocket.chat/instance-status": "0.1.57",
+    "@rocket.chat/jest-presets": "0.0.2",
+    "@rocket.chat/jwt": "0.2.1",
+    "@rocket.chat/livechat": "2.1.4",
+    "@rocket.chat/log-format": "0.0.3",
+    "@rocket.chat/logger": "1.0.1",
+    "@rocket.chat/media-signaling": "1.0.0",
+    "@rocket.chat/message-parser": "0.31.36",
+    "@rocket.chat/message-types": "0.1.1",
+    "@rocket.chat/mock-providers": "0.4.17",
+    "@rocket.chat/model-typings": "2.3.0",
+    "@rocket.chat/models": "2.3.0",
+    "@rocket.chat/mongo-adapter": "0.0.3",
+    "@rocket.chat/poplib": "0.0.3",
+    "@rocket.chat/omni-core": "0.1.1",
+    "@rocket.chat/password-policies": "0.1.1",
+    "@rocket.chat/patch-injection": "0.0.2",
+    "@rocket.chat/peggy-loader": "0.31.28",
+    "@rocket.chat/random": "1.2.3",
+    "@rocket.chat/release-action": "2.2.4",
+    "@rocket.chat/release-changelog": "0.1.1",
+    "@rocket.chat/rest-typings": "8.6.0-develop",
+    "@rocket.chat/server-cloud-communication": "0.0.3",
+    "@rocket.chat/server-fetch": "0.2.1",
+    "@rocket.chat/sha256": "1.0.13",
+    "@rocket.chat/storybook-config": "0.0.3",
+    "@rocket.chat/tools": "0.3.0",
+    "@rocket.chat/tracing": "0.0.2",
+    "@rocket.chat/tsconfig": "0.0.0",
+    "@rocket.chat/ui-avatar": "27.0.0",
+    "@rocket.chat/ui-client": "31.0.0",
+    "@rocket.chat/ui-composer": "2.0.0",
+    "@rocket.chat/ui-contexts": "31.0.0",
+    "@rocket.chat/ui-kit": "1.1.0",
+    "@rocket.chat/ui-video-conf": "31.0.0",
+    "@rocket.chat/ui-voip": "21.0.0",
+    "@rocket.chat/web-ui-registration": "31.0.0"
+  },
+  "changesets": [
+    "add-tagalog-language",
+    "all-readers-reply",
+    "bump-patch-1782440081682",
+    "bump-patch-1782512866566",
+    "bumpy-coats-reply",
+    "chubby-garlics-decide",
+    "crisp-corners-itch",
+    "crisp-taxis-pay",
+    "cute-humans-follow",
+    "ddp-migrate-batch2-callers",
+    "ddp-migrate-batch3-callers",
+    "dull-trams-follow",
+    "early-deer-fry",
+    "easy-laws-talk",
+    "eight-areas-see",
+    "eight-dingos-press",
+    "eighty-onions-deny",
+    "famous-birds-join",
+    "fast-apes-know",
+    "few-lies-drum",
+    "fix-join-room-subscription-refresh",
+    "fluffy-poets-check",
+    "full-results-share",
+    "heavy-balloons-cut",
+    "itchy-years-learn",
+    "khaki-gifts-follow",
+    "libretranslate-autotranslate-provider",
+    "loose-knives-retire",
+    "metal-regions-yell",
+    "neat-planets-hope",
+    "nice-baboons-flash",
+    "old-cities-enjoy",
+    "pretty-rocks-retire",
+    "rest-chat-delete-by-fileid",
+    "rest-e2e-request-subscription-keys",
+    "rest-im-block-user",
+    "rest-settings-post",
+    "rest-spotlight-params-and-anonymous",
+    "rest-users-setpreferences-utcoffset",
+    "rich-bananas-shine",
+    "rooms-join-endpoint",
+    "salty-suits-strive",
+    "short-mice-cover",
+    "silent-coats-open",
+    "slick-hats-arrive",
+    "sup-1064-pat-bypass-two-factor",
+    "swift-rooms-load",
+    "tasty-deserts-doubt",
+    "thick-fans-leave",
+    "tricky-comics-wink",
+    "true-cooks-lick",
+    "upset-rats-work",
+    "wise-regions-sip",
+    "wise-years-shout"
+  ]
+}
diff --git a/.changeset/pretty-rocks-retire.md b/.changeset/pretty-rocks-retire.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue on ABAC audit page that sent local timestamps instead of UTC ones as filters to fetch audit logs
diff --git a/.changeset/rest-chat-delete-by-fileid.md b/.changeset/rest-chat-delete-by-fileid.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+`POST /v1/chat.delete` now accepts `{ fileId, asUser? }` as an alternative to `{ msgId, roomId, asUser? }`. When `fileId` is provided the server resolves the owning message via `Messages.getMessageByFileId` before running the existing permission and deletion flow.
diff --git a/.changeset/rest-e2e-request-subscription-keys.md b/.changeset/rest-e2e-request-subscription-keys.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Added `POST /v1/e2e.requestSubscriptionKeys` (replaces the deprecated `e2e.requestSubscriptionKeys` DDP method). Auth-gated, no body. Broadcasts `notify.e2e.keyRequest` for every encrypted room the caller is subscribed to without an E2E key, matching the DDP method's behavior. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.
diff --git a/.changeset/rest-im-block-user.md b/.changeset/rest-im-block-user.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Added `POST /v1/im.blockUser` (replaces the deprecated `blockUser` / `unblockUser` DDP methods). Body is `{ roomId, block: boolean }` — `block: true` blocks the other DM participant, `block: false` unblocks. Auth-gated and per-room via the `RoomMemberActions.BLOCK` directive (DM-only). Both legacy DDP methods remain registered until 9.0.0 with deprecation logs pointing at the new route.
diff --git a/.changeset/rest-settings-post.md b/.changeset/rest-settings-post.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Added `POST /v1/settings` for batched admin setting updates (replaces the deprecated `saveSettings` DDP method). Body is `{ settings: { _id, value }[] }`. The endpoint requires authentication, enforces 2FA (`twoFactorRequired: true`), and runs the same per-setting permission chain (`edit-privileged-setting` OR `manage-selected-settings` + per-id permission) and audit/notify side effects the DDP method already performed. The legacy DDP method remains registered until 9.0.0 with a deprecation log pointing at the new route.