merge: Rocket.Chat 8.7.0 into MatterChat - #184
Draft
Chi-Omnis wants to merge 330 commits into
Draft
Conversation
Co-authored-by: Douglas Fabris <devfabris@gmail.com> Co-authored-by: ricardogarim <ricardogarim@users.noreply.github.com>
[no ci]
Co-authored-by: Nazareno Bucciarelli <84046180+nazabucciarelli@users.noreply.github.com> Co-authored-by: Julio Araujo <julio.araujo@rocket.chat> Co-authored-by: Nazareno Bucciarelli <bnazareno03@gmail.com>
…t#40687) Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: Julio Araujo <julio.araujo@rocket.chat>
…hat#41541) Co-authored-by: yash-rajpal <rajpal.yash03@gmail.com>
… `fast-uri`, `sharp`, and `postcss` (RocketChat#41537)
[no ci]
…cketChat#41599) Signed-off-by: Abhinav Kumar <abhinav@avitechlab.com> Co-authored-by: Ricardo Garim <rswarovsky@gmail.com>
…` bump (RocketChat#41628) Co-authored-by: Julio Araujo <julio.araujo@rocket.chat> Co-authored-by: Kevin Aleman <kaleman960@gmail.com>
…cketChat#41588) Signed-off-by: Abhinav Kumar <abhinav@avitechlab.com> Co-authored-by: Ricardo Garim <rswarovsky@gmail.com>
[no ci]
Co-authored-by: Douglas Fabris <devfabris@gmail.com>
[no ci]
[no ci]
[no ci]
Merges upstream 8.6.0 + 8.7.0 (435 commits, 4126 files). Our fork base was upstream develop @ 2026-06-16 (228486f), not 8.6.0 as package.json implied. 427 conflicts: 312 in the stripped EE tree (kept our deletion, plus re-stripped 45 EE files 8.7.0 added), 115 real. Three fork features would have broken silently and were explicitly preserved: - Omnis Boards' server API. 8.7.0 deletes apps/meteor/server/methods/ wholesale (moved to server/meteor-methods/<domain>/, 1185 renames). 27 Boards method files lived there, registered by three fork lines in the deleted index.ts. Files verified byte-identical after relocation; all 8 DDP method names the client calls confirmed registered. - Web Push. Our browser/PWA fan-out lived inside the deleted app/push/server/ push.ts. Native FCM/APN would have kept working, hiding the loss. Re-ported to the equivalent point in the restructured send path, non-blocking semantics kept. - Firm scoping in search. server/lib/spotlight.js collided with 8.7.0's perf rewrite (RocketChat#41101). Took upstream's rewrite, re-applied our multi-tenant scoping; all 12 query paths audited. Conflicts don't surface relocation damage: files that merged cleanly still imported dead paths. A resolver sweep found and fixed 157 unresolvable relative imports across 111 files, concentrated in fork-owned code. Also fixed two classes a plain import scan misses - jest.mock() path strings and a live await import(). Typecheck: the fork was already red (748 errors / 146 files pre-merge). Measured against a baseline worktree built at the pre-merge commit, comparing per-file error counts. This merge introduced 51 errors across 21 files; all fixed. Now at 741 errors with zero files worse than pre-merge. Included: hasOfflineLicense added to the fork's clean-room LicenseService for 8.7.0's air-gapped feature (RocketChat#41148, returns false - the faithful value since our getLicense() returns undefined); Tabs.Item -> TabsItem; Form.* -> named exports; 802 Fuselage shorthand style props renamed across 91 files for 0.78 -> 0.83. Not fixed, deliberately: ~93 endpoint-typing errors on EE-only endpoints (abac/*, audit/*, livechat/units) whose types live in the ee/ tree we strip. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -49,7 +49,7 @@ | |||
| } | |||
|
|
|||
| export function stripTags(str: unknown): string { | |||
| return sanitize(makeString(str)).replace(/<\/?[^>]+>/g, ''); | |||
| return DOMPurify.sanitize(makeString(str)).replace(/<\/?[^>]+>/g, ''); | |||
| oauthRateLimiter = createOAuthRateLimiter(); | ||
| }); | ||
|
|
||
| oAuthRouter.use(oAuthPaths, (req, res, next) => oauthRateLimiter(req, res, next)); |
| `/_oauth/${serviceName}`, | ||
| allowPassportOAuthMiddleware(serviceName, isCustomOAuth), | ||
| passport.authenticate(serviceName, { failureRedirect: '/login', failWithError: true, keepSessionInfo: true }), | ||
| passportOAuthCallback(siteUrl, config.loginStyle ? config.loginStyle : undefined), |
| `/_oauth/${config.provider}`, | ||
| allowPassportOAuthMiddleware(config.provider), | ||
| passport.authenticate(config.provider, { failureRedirect: '/login', failWithError: true, keepSessionInfo: true }), | ||
| passportOAuthCallback(siteUrl), |
Comment on lines
+26
to
+34
| res.send(` | ||
| <script nonce="${nonce}"> | ||
| window.opener.postMessage( | ||
| ${JSON.stringify(payload)}, | ||
| window.location.origin | ||
| ); | ||
| window.close(); | ||
| </script> | ||
| `); |
|
Found 10 test failures on Blacksmith runners: Failures
|
![Fix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/fix-with-codesmith-light.png)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Merges upstream Rocket.Chat 8.7.0 into MatterChat.
Our fork base was upstream
develop@ 2026-06-16 (228486f07c) — post-8.5.0, mid-8.6.0-dev — despitepackage.jsonsaying8.6.0-develop. So this pulls 8.6.0 and 8.7.0 together: 435 upstream commits, 4,126 files.Draft until tested. Nothing here has been run against a live server.
Why it's a big diff
8.7.0 contains a large structural refactor, and this fork strips the entire EE tree, so the two collide:
apps/meteor/server/methods/**andapp/*/server/methods/**→apps/meteor/server/meteor-methods/<domain>/**(1,185 renames). The old directory is deleted outright.apps/meteor/app/push/server/**→server/lib/notifications/push/**+server/services/push/**.apps/meteor/app/**moved intoapps/meteor/server/**.427 merge conflicts: 312 in the EE tree (all resolved as "keep our deletion"), 115 real.
The three things that would have broken silently
server/methods/tree, registered by three fork lines in the deletedserver/methods/index.ts. Taking upstream's deletion would have killed the kanban half of the product withMethod 'boards/cardCreate' not found. Files verified byte-identical after relocation; all 8 DDP method names the client calls confirmed registered.app/push/server/push.ts. Native FCM/APN would have kept working, so its loss would have been invisible. Re-ported to the equivalent point in 8.7.0's restructured send path, non-blocking semantics intact.server/lib/spotlight.jscollided with 8.7.0's perf rewrite (chore(spotlight): parallelize searches and slim connected-users pipeline RocketChat/Rocket.Chat#41101). Took upstream's rewrite as the base and re-applied our scoping; all 12 query paths audited, both unbounded ones confirmed still scoped.The trap conflicts don't surface
8.7.0's relocations meant files that merged cleanly still imported dead paths — so no conflict-driven review covered them. A resolver sweep found 157 unresolvable relative imports across 111 files, concentrated in fork-owned code (boards, firms, chi, connectors, omnisai-oauth). All repaired.
git statuslooked clean the whole time while the server could not have booted.Two classes a plain import scan misses were also found and fixed:
jest.mock()path strings, andawait import()in a live code path (server/lib/agents/ask-handler.ts).Typecheck
The fork was already red before this merge — typecheck is wired into CI (
ci-code-check.yml:92) but has not been passing.Zero files are worse than pre-merge.
Measured by building a full baseline worktree at the pre-merge commit (its own React 18 / Fuselage 0.78 install + package build + same
tsc) and comparing per-file error counts, which is immune to 8.7.0's file relocations and to message-text churn.The merge introduced 51 errors across 21 files; all were fixed:
hasOfflineLicense(15) — 8.7.0's air-gapped-license feature (feat: no egress for offline licenses RocketChat/Rocket.Chat#41148) expects aLicenseServicemethod our stripped-EE license package lacks. Implemented asreturn false, which is the faithful answer: upstream computesgetLicense()?.information.offline ?? falseand ourgetLicense()returnsundefined. All 15 call sites checked — returningtruewould have silently disabled cloud sync, push delivery and the usage report.Tabs.Item→TabsItem(12),Form.*→ named exports (20),ActionButton→IconButton(1),SearchInput addon(2), spec typing (1).Separately, 802 Fuselage shorthand style props were renamed across 91 files (
mbe→marginBlockEndetc.) for the 0.78 → 0.83 bump, matching upstream's own codemod.Not fixed, deliberately: ~93 endpoint-typing errors, all on EE-only endpoints (
abac/*,audit/*,livechat/units,engagement-dashboard/*) in EE test files and admin views whose types live in theee/tree we strip. Dead code in this fork.Dependencies
yarn.lockregenerated. React 18 → 19, Fuselage 0.78 → 0.83, plus upstream's bumps. Fork-only deps re-resolved (@dnd-kit/*,@omnisaiorg/litbox-file-browser,web-push); 30 staleee/workspace entries dropped.@rocket.chat/logostays pinned to the patched 0.32.5 — the rebrand patch is version-keyed and cannot apply to upstream's 0.33.1.What to test
@dnd-kitis pinned at React-18-peer versions and now runs under React 19; drag-and-drop is the most likely real breakage.omnisaihandler).Firms_SelfServe_Enabled+Firms_Scoped_Directory.Pre-existing issues found along the way (not caused by this merge, not fixed here)
server/api/v1/sms.tsroutes never register — the handler sits inside the options object, so nothing binds. Also unregistered inapi/index.ts.boards.exportthrows on every call (this.setHeaderdoes not exist) and always returns a 400.boards-invite-guests.tsanddocs.tsare unregistered; the Docs panel and SMS browser 404 today.ToggleGroup/ToggleGroupOption/RadioGroupappear in no Fuselage version — those screens never rendered.🤖 Generated with Claude Code