RocketChat · rocketchat-github-ci · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026
diff --git a/.changeset/abac-classification-banners.md b/.changeset/abac-classification-banners.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': minor
+---
+
+Adds classification banners to ABAC-managed rooms: admins can describe US-Government-style classification markings (levels, special access programs, releasability, colors) in a new JSON setting, and matching rooms display a colored classification banner above the room header for all members.
diff --git a/.changeset/app-action-button-role-names.md b/.changeset/app-action-button-role-names.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps-engine': minor
+'@rocket.chat/meteor': minor
+---
+
+Accepts a role name in the `when.hasOneRole` and `when.hasAllRoles` filters of an app action button
diff --git a/.changeset/apps-action-button-room-scoped-roles.md b/.changeset/apps-action-button-room-scoped-roles.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixed app action buttons never matching a role scoped to `Subscriptions` — `owner`, `moderator`, `leader`, or a custom one. The room was not being passed as the scope of the role check, so a button filtered by one of those roles stayed hidden even for a user who held it in the room.
diff --git a/.changeset/apps-engine-runtime-default-node.md b/.changeset/apps-engine-runtime-default-node.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps': minor
+'@rocket.chat/meteor': minor
+---
+
+Changes the default apps-engine runtime backend from `deno` to `node`. The previous behavior can be restored by setting the environment variable `APPS_ENGINE_RUNTIME_BACKEND='deno'`
diff --git a/.changeset/bump-patch-1787952176150.md b/.changeset/bump-patch-1787952176150.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1788191925607.md b/.changeset/bump-patch-1788191925607.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/business-hour-finish-minute-inclusive.md b/.changeset/business-hour-finish-minute-inclusive.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixed business hours closing for one minute a day when configured as `00:00`-`23:59`. Work hours are set at minute granularity, but the finish time was treated as exclusive, so consecutive daily windows never met and the service dropped to closed for the whole `23:59` minute — agents could not become available and the Livechat widget rendered the offline form. A work hour now stays open until the end of its finish minute.
diff --git a/.changeset/chatty-socks-hear.md b/.changeset/chatty-socks-hear.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes the composer popups (mentions, slash commands and emojis) staying open after programmatic changes to the composer text, such as canceling the edition of a message that contains a mention.
diff --git a/.changeset/client-safe-errors-not-exceptions.md b/.changeset/client-safe-errors-not-exceptions.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes client-safe errors being reported as exceptions to the channel configured in `Log Exceptions to Channel` when `Log_Level` is set to `2`.
diff --git a/.changeset/cute-pumas-trade.md b/.changeset/cute-pumas-trade.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': minor
+---
+
+Adds support for SAML authentication in the mobile and desktop apps via the system browser.
diff --git a/.changeset/ddp-migrate-batch5-totp-caller.md b/.changeset/ddp-migrate-batch5-totp-caller.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrates the `TwoFactorTOTP` account settings page from the five `2fa:*` DDP methods to the new TOTP REST endpoints. DDP methods stay registered for external SDK/mobile clients with deprecation logs pointing at the new routes until 9.0.0.
diff --git a/.changeset/ddp-migrate-batch6-audit-callers.md b/.changeset/ddp-migrate-batch6-audit-callers.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrated the audit panel (`AuditLogTable`, `useAuditMutation`) from the three `auditGet*` DDP methods to the new `/v1/audit.*` REST endpoints. DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.
diff --git a/.changeset/ddp-migrate-batch7-oauth-caller.md b/.changeset/ddp-migrate-batch7-oauth-caller.md
@@ -0,0 +1,11 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrates the Admin → OAuth services group page from `useMethod` (DDP) to `useEndpoint` (REST):
+
+- `addOAuthService` → existing `POST /v1/settings.addCustomOAuth`
+- `removeOAuthService` → new `POST /v1/settings.removeCustomOAuth`
+- `refreshOAuthService` → new `POST /v1/settings.refreshOAuthServices`
+
+DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.
diff --git a/.changeset/ddp-migrate-readthreads-pushtest.md b/.changeset/ddp-migrate-readthreads-pushtest.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Migrated the last two thread-read call sites (`ThreadChat`, `useThreadMessagesQuery`) from the `readThreads` DDP method to `POST /v1/chat.readThread`, and pointed the admin "send a test push to my user" setting at `POST /v1/push.test` instead of the `push_test` DDP method. Both DDP methods stay registered with deprecation logs pointing at the new routes until 9.0.0.
+
+`POST /v1/push.test` now also returns the `message` translation key and its `params`, matching what the DDP method returned, so the admin setting still reports how many devices the test reached.
diff --git a/.changeset/deprecate-community-saml-ldap.md b/.changeset/deprecate-community-saml-ldap.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Deprecates LDAP and SAML authentication on workspaces without a Premium plan. Both keep working as they are today, but the admin settings now warn that version 9.0.0 will require a license including the `ldap-enterprise` or `saml-enterprise` module, and a warning is logged when an unlicensed workspace authenticates a user through either of them.
diff --git a/.changeset/deps-patch-bump-dependencies.md b/.changeset/deps-patch-bump-dependencies.md
@@ -0,0 +1,12 @@
+---
+'@rocket.chat/meteor': patch
+'rocketchat-services': patch
+'@rocket.chat/ddp-streamer': patch
+'@rocket.chat/pdf-worker': patch
+'@rocket.chat/uikit-playground': patch
+'@rocket.chat/apps': patch
+'@rocket.chat/jest-presets': patch
+'@rocket.chat/release-action': patch
+---
+
+Bumps patch-level dependency updates: `react`, `react-dom` and `react-is` to 19.2.8, `ws` to 8.21.3, `nodemailer` to 9.0.5, `mailparser` to 3.9.15, `google-libphonenumber` to 3.2.46, `twitter-api-v2` to 1.29.1, `ip-range-check` to 0.2.1, `esbuild` to 0.28.2, `@octokit/core` to 7.0.7 and `@octokit/plugin-throttling` to 11.0.5, plus build and test tooling (`@swc/core`, `ts-jest`, `rollup`, `html-webpack-plugin`, `@vitejs/plugin-react`, `@testing-library/user-event`, and the `@types/*` packages). No behavior changes are expected.
diff --git a/.changeset/fifty-turkeys-judge.md b/.changeset/fifty-turkeys-judge.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/eslint-config': minor
+---
+
+Upgrades ESLint to v10 and bumps plugins
diff --git a/.changeset/fix-anonymous-spotlight-callers.md b/.changeset/fix-anonymous-spotlight-callers.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes room search (`spotlight`) failing for anonymous visitors when "Allow Anonymous Read" is enabled
diff --git a/.changeset/force-e2ee-private-rooms.md b/.changeset/force-e2ee-private-rooms.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': minor
+'@rocket.chat/i18n': minor
+---
+
+Adds a workspace setting **Force end-to-end encryption on private rooms** (`E2E_Force_Encryption_For_Private_Rooms`) under **Admin → Settings → End-to-End Encryption**. When enabled, every newly created private room is encrypted by default and users can no longer opt out: the encryption toggle in the create-room modal is locked on for private rooms, and the server rejects any attempt to create a private room with `encrypted: false` (e.g. via `groups.create`) with the error `error-encrypted-private-rooms-enforced`. Public rooms are unaffected. Federated rooms are exempt since federation does not support E2EE. Creating a discussion under an unencrypted private parent room is rejected with a dedicated error instructing the user to make the parent public or enable encryption on it, and the create-discussion dialog now surfaces creation errors as toasts.
diff --git a/.changeset/fruity-views-begin.md b/.changeset/fruity-views-begin.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/rest-typings': patch
+'@rocket.chat/i18n': patch
+'@rocket.chat/meteor': patch
+---
+
+Adds an Import IdP metadata option to SAML settings that fetches the Identity Provider metadata from a URL and prefills the matching setting fields — certificate, entry point and IDP SLO redirect URL, plus identifier format on Enterprise — for the admin to review before saving.
diff --git a/.changeset/funny-wings-sell.md b/.changeset/funny-wings-sell.md
@@ -0,0 +1,10 @@
+---
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/ui-client': minor
+'@rocket.chat/models': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Replaces the "Drafts in sidebar" feature preview with an always-on draft indicator. Thread-composer drafts are also persisted per thread and indicated in the thread list
diff --git a/.changeset/fuzzy-ends-refuse.md b/.changeset/fuzzy-ends-refuse.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
diff --git a/.changeset/gold-jobs-help.md b/.changeset/gold-jobs-help.md
@@ -0,0 +1,6 @@
+---
+"@rocket.chat/core-typings": minor
+"@rocket.chat/media-calls": minor
+---
+
+Adds support for call diversion handling in voice calls
diff --git a/.changeset/hidden-room-history-drain.md b/.changeset/hidden-room-history-drain.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes the message list silently loading the entire room history — and downloading its attachments — in the background when a full-width contextual bar (such as the thread view on small screens) hides it
diff --git a/.changeset/hungry-snakes-help.md b/.changeset/hungry-snakes-help.md
@@ -0,0 +1,7 @@
+---
+"@rocket.chat/i18n": minor
+"@rocket.chat/media-signaling": minor
+"@rocket.chat/ui-voip": minor
+---
+
+Removes voice calling microphone requirement for starting a successful call, allowing users to join as "listen-only".
diff --git a/.changeset/jolly-poets-tan.md b/.changeset/jolly-poets-tan.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes the issue where the message list kept jumping to the latest messages instead of restoring the previous position when switching channels.
diff --git a/.changeset/kind-peas-greet.md b/.changeset/kind-peas-greet.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes thread replies keeping the "sent" single checkmark after everyone had read the thread, only switching to the "viewed" double checkmark once a new message was sent in that thread.
diff --git a/.changeset/lazy-ends-drive.md b/.changeset/lazy-ends-drive.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes `canAccessRoom` throwing when the user's `_id` is undefined
diff --git a/.changeset/lovely-bats-buy.md b/.changeset/lovely-bats-buy.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
diff --git a/.changeset/native-mcp-server.md b/.changeset/native-mcp-server.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+'@rocket.chat/rest-typings': minor
+---
+
+Adds an AI add-on-gated native Model Context Protocol endpoint and its administration controls in AI Center
diff --git a/.changeset/odd-steaks-pull.md b/.changeset/odd-steaks-pull.md
@@ -0,0 +1,11 @@
+---
+'@rocket.chat/core-services': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+'@rocket.chat/model-typings': minor
+'@rocket.chat/models': minor
+'@rocket.chat/rest-typings': minor
+---
+
+Adds status visibility, letting users hide their presence and status message from specific people they choose. Blocked people see that user as offline, indistinguishable from genuinely offline, and the block can be lifted at any time — changes apply live, without a reload.
diff --git a/.changeset/pink-dolls-flash.md b/.changeset/pink-dolls-flash.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
diff --git a/.changeset/plenty-lines-double.md b/.changeset/plenty-lines-double.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes a reload loop when opening a link to an older message (`?msg=`): the room would flash the linked message and then keep loading until it hit the server rate limit (429) instead of settling. The room now opens positioned on the linked message, and when the linked message cannot be loaded the room settles on the most recent messages instead of retrying.
diff --git a/.changeset/pre.json b/.changeset/pre.json
@@ -0,0 +1,138 @@
+{
+  "mode": "pre",
+  "tag": "rc",
+  "initialVersions": {
+    "@rocket.chat/meteor": "8.8.0-develop",
+    "rocketchat-services": "2.0.50",
+    "@rocket.chat/uikit-playground": "0.7.15",
+    "@rocket.chat/account-service": "0.5.0",
+    "@rocket.chat/authorization-service": "0.7.0",
+    "@rocket.chat/ddp-streamer": "0.4.0",
+    "@rocket.chat/omnichannel-transcript": "0.5.0",
+    "@rocket.chat/presence-service": "0.6.0",
+    "@rocket.chat/queue-worker": "0.5.0",
+    "@rocket.chat/abac": "0.3.1",
+    "@rocket.chat/federation-matrix": "0.2.0",
+    "@rocket.chat/license": "1.2.0",
+    "@rocket.chat/media-calls": "0.5.2",
+    "@rocket.chat/network-broker": "0.2.38",
+    "@rocket.chat/omni-core-ee": "0.0.24",
+    "@rocket.chat/omnichannel-services": "0.3.56",
+    "@rocket.chat/pdf-worker": "0.3.35",
+    "@rocket.chat/presence": "0.3.1",
+    "@rocket.chat/account-utils": "0.0.3",
+    "@rocket.chat/agenda": "0.1.1",
+    "@rocket.chat/ai-search": "0.2.0",
+    "@rocket.chat/api-client": "0.2.56",
+    "@rocket.chat/apps": "0.8.0",
+    "@rocket.chat/apps-engine": "1.66.0-develop",
+    "@rocket.chat/base64": "1.0.14",
+    "@rocket.chat/cas-validate": "0.0.4",
+    "@rocket.chat/core-services": "0.15.0",
+    "@rocket.chat/core-typings": "8.8.0-develop",
+    "@rocket.chat/cron": "0.1.59",
+    "@rocket.chat/ddp-client": "1.1.1",
+    "@rocket.chat/desktop-api": "1.3.0",
+    "@rocket.chat/emitter": "0.33.0",
+    "@rocket.chat/eslint-config": "0.8.0",
+    "@rocket.chat/favicon": "0.0.5",
+    "@rocket.chat/fuselage-ui-kit": "33.0.0",
+    "@rocket.chat/gazzodown": "33.0.0",
+    "@rocket.chat/http-router": "7.9.23",
+    "@rocket.chat/i18n": "3.3.0",
+    "@rocket.chat/instance-status": "0.1.59",
+    "@rocket.chat/jest-presets": "0.0.2",
+    "@rocket.chat/jwt": "0.2.1",
+    "@rocket.chat/livechat": "2.1.6",
+    "@rocket.chat/logger": "1.0.1",
+    "@rocket.chat/media-signaling": "1.1.0",
+    "@rocket.chat/memo": "0.31.25",
+    "@rocket.chat/message-parser": "0.32.0",
+    "@rocket.chat/message-types": "0.1.1",
+    "@rocket.chat/mock-providers": "0.4.19",
+    "@rocket.chat/model-typings": "2.4.0",
+    "@rocket.chat/models": "2.4.0",
+    "@rocket.chat/mongo-adapter": "0.0.3",
+    "@rocket.chat/mp3-encoder": "0.31.26",
+    "@rocket.chat/poplib": "0.0.3",
+    "@rocket.chat/omni-core": "0.1.3",
+    "@rocket.chat/passport-x": "0.1.0",
+    "@rocket.chat/password-policies": "0.1.1",
+    "@rocket.chat/patch-injection": "0.0.2",
+    "@rocket.chat/peggy-loader": "0.31.28",
+    "@rocket.chat/random": "1.2.3",
+    "@rocket.chat/release-action": "2.2.4",
+    "@rocket.chat/release-changelog": "0.1.1",
+    "@rocket.chat/rest-typings": "8.8.0-develop",
+    "@rocket.chat/server-cloud-communication": "0.0.3",
+    "@rocket.chat/server-fetch": "0.2.3",
+    "@rocket.chat/sha256": "1.0.13",
+    "@rocket.chat/storybook-config": "0.0.3",
+    "@rocket.chat/tools": "0.3.0",
+    "@rocket.chat/tracing": "0.0.2",
+    "@rocket.chat/tsconfig": "0.0.0",
+    "@rocket.chat/ui-avatar": "29.0.0",
+    "@rocket.chat/ui-client": "33.0.0",
+    "@rocket.chat/ui-composer": "4.0.0",
+    "@rocket.chat/ui-contexts": "33.0.0",
+    "@rocket.chat/ui-kit": "1.1.0",
+    "@rocket.chat/ui-video-conf": "33.0.0",
+    "@rocket.chat/ui-voip": "23.0.0",
+    "@rocket.chat/web-ui-registration": "33.0.0"
+  },
+  "changesets": [
+    "abac-classification-banners",
+    "app-action-button-role-names",
+    "apps-action-button-room-scoped-roles",
+    "apps-engine-runtime-default-node",
+    "bump-patch-1787952176150",
+    "bump-patch-1788191925607",
+    "business-hour-finish-minute-inclusive",
+    "chatty-socks-hear",
+    "client-safe-errors-not-exceptions",
+    "cute-pumas-trade",
+    "ddp-migrate-batch5-totp-caller",
+    "ddp-migrate-batch6-audit-callers",
+    "ddp-migrate-batch7-oauth-caller",
+    "ddp-migrate-readthreads-pushtest",
+    "deprecate-community-saml-ldap",
+    "deps-patch-bump-dependencies",
+    "fifty-turkeys-judge",
+    "fix-anonymous-spotlight-callers",
+    "force-e2ee-private-rooms",
+    "fruity-views-begin",
+    "funny-wings-sell",
+    "fuzzy-ends-refuse",
+    "gold-jobs-help",
+    "hidden-room-history-drain",
+    "hungry-snakes-help",
+    "jolly-poets-tan",
+    "kind-peas-greet",
+    "lazy-ends-drive",
+    "lovely-bats-buy",
+    "native-mcp-server",
+    "odd-steaks-pull",
+    "pink-dolls-flash",
+    "plenty-lines-double",
+    "proud-garlics-open",
+    "real-zoos-cover",
+    "rest-audit-endpoints",
+    "rest-chat-read-thread",
+    "rest-logout-session-cleanup",
+    "rest-settings-oauth-admin",
+    "rest-users-totp",
+    "shy-actors-jump",
+    "sidebar-scroll-min-height",
+    "some-banks-spend",
+    "sour-pugs-bow",
+    "sparkly-regions-drive",
+    "sync-messages-from-ts",
+    "tags-save-updatedat",
+    "tangy-cobras-beg",
+    "thick-kings-type",
+    "voice-call-rules",
+    "wet-turtles-fix",
+    "wicked-moons-reconnect",
+    "wide-laws-teach"
+  ]
+}
diff --git a/.changeset/proud-garlics-open.md b/.changeset/proud-garlics-open.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes "Jump to message" not navigating to the message's room when the message belongs to a room other than the currently opened one (e.g. global search results).
diff --git a/.changeset/real-zoos-cover.md b/.changeset/real-zoos-cover.md
@@ -0,0 +1,11 @@
+---
+'@rocket.chat/federation-matrix': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes federation endpoints rejecting valid requests, which broke:
+
+- room history backfill
+- image thumbnails
+- room message pagination
+- accepting an invite from another homeserver