RocketChat · ggazzo · Jun 10, 2026 · Apr 22, 2026 · Apr 22, 2026 · Apr 22, 2026
diff --git a/.changeset/angry-baboons-trade.md b/.changeset/angry-baboons-trade.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/ui-kit': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue that prevented BlockAction interactions from having room information when triggered in a ContextualBar surface
diff --git a/.changeset/beige-parrots-lead.md b/.changeset/beige-parrots-lead.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': minor
+---
+
+Swap usage of internal @rocket.chat/apps-engine internal APIs to @rocket.chat/apps package
diff --git a/.changeset/big-corners-tie.md b/.changeset/big-corners-tie.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/model-typings': patch
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': patch
+---
+
+Ensures OAuth tokens are cleaned up after user deactivation
diff --git a/.changeset/brave-fans-tie.md b/.changeset/brave-fans-tie.md
@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/i18n": minor
+---
+
+Adds 4 new permissions (assigned to admins by default) to control the visibility of each tab inside the ABAC Administration panel
diff --git a/.changeset/brown-files-work.md b/.changeset/brown-files-work.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/apps-engine': minor
+---
+
+Remove files that weren't accessible to apps at development time
diff --git a/.changeset/bump-patch-1779457640608.md b/.changeset/bump-patch-1779457640608.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1780029980454.md b/.changeset/bump-patch-1780029980454.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1780545712119.md b/.changeset/bump-patch-1780545712119.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1780685193955.md b/.changeset/bump-patch-1780685193955.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1781098424278.md b/.changeset/bump-patch-1781098424278.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/bump-patch-1781123233262.md b/.changeset/bump-patch-1781123233262.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.
diff --git a/.changeset/calm-seas-run.md b/.changeset/calm-seas-run.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue that allowed a room converted from private to public (while abac is disabled) to retain its abac attributes (if any)
diff --git a/.changeset/clever-zebras-melt.md b/.changeset/clever-zebras-melt.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where thread content would disappear after clicking "Jump to recent messages".
diff --git a/.changeset/ddp-client-idempotent-reconnect.md b/.changeset/ddp-client-idempotent-reconnect.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/ddp-client": patch
+---
+
+Make `Connection.connect()` and `Connection.reconnect()` idempotent. Previously they rejected with `Error('Connection in progress')` when called while a connection was already in flight or established. Because the internal retry timer (`ws.onclose` → `setTimeout(() => void this.reconnect(), …)`) fires with no `.catch`, that rejection surfaced as an unhandled rejection at the page level whenever an external caller (e.g. an SDK consumer's bootstrap path) won the race against the timer. While `status === 'connecting'`, both methods now return the in-flight handshake promise so a later `failed` payload still propagates to every caller instead of being masked by a synthesized success; while `status === 'connected'` they resolve with `true`. The timer also no-ops when the connection has already been re-established, and a stale `ws.onclose` from a replaced socket no longer clobbers the new socket's status or schedules a redundant retry.
diff --git a/.changeset/ddp-client-reset-retry-count.md b/.changeset/ddp-client-reset-retry-count.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/ddp-client": patch
+---
+
+Reset `Connection.retryCount` to zero on a successful (re)connection. The counter was only ever incremented (in `ws.onclose`), never zeroed, so the retry budget was monotonically consumed across the connection's lifetime. With the default budget of `1`, any chain of two close events — for example the SDK reconnecting after a server force-logout, then the client running a follow-up `Meteor.logout()` whose server handler closes the WS again — drained the budget; the second close handler bailed at `retryCount >= retryOptions.retryCount` and the SDK stayed permanently disconnected. Method frames already in the dispatcher queue (e.g. a fresh `login` retry from the consumer) stayed queued forever.
diff --git a/.changeset/ddp-dispatcher-non-method-frames.md b/.changeset/ddp-dispatcher-non-method-frames.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/ddp-client": patch
+---
+
+Fix `DDPDispatcher` dropping non-method frames (connect, sub, unsub, ping, pong) when a `wait` block is at the head of the queue. Previously every payload flowed through the same wait-serialization path: a `connect` frame dispatched after a `wait: true` method (e.g. `login`) would be queued in a new non-wait block but never actually sent, wedging the DDP handshake — the socket stayed open, the server never replied `connected`, and any caller awaiting the connection hung. Non-method payloads now bypass the queue and emit immediately; wait-method serialization between methods is unchanged.
diff --git a/.changeset/dry-squids-wonder.md b/.changeset/dry-squids-wonder.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes the missing edited indicator for the main parent message in the thread panel to ensure visual consistency with the main channel view.
diff --git a/.changeset/edit-room-info-multiselect-aria-label.md b/.changeset/edit-room-info-multiselect-aria-label.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Adds an accessible label to the system-messages multi-select in the channel edit panel so screen readers announce its purpose.
diff --git a/.changeset/eight-clouds-count.md b/.changeset/eight-clouds-count.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes intermittent "Channel Not Joined" screen when opening rooms in embedded mode.
diff --git a/.changeset/fix-presence-comma-ids.md b/.changeset/fix-presence-comma-ids.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': patch
+'@rocket.chat/rest-typings': patch
+---
+
+Fixes the `users.presence` endpoint returning an empty array when called with multiple comma-separated IDs, caused by `ajvQuery` coercing the string into a single-element array after the OpenAPI migration
diff --git a/.changeset/flat-islands-nail.md b/.changeset/flat-islands-nail.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/ui-voip": patch
+---
+
+Fixes an issue where intentionally cancelling a screen share request would show an error toast by identifying error types and counting consecutive failures.
diff --git a/.changeset/good-rules-lie.md b/.changeset/good-rules-lie.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/model-typings': patch
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': patch
+---
+
+Ensures that deactivated users have their login tokens cleaned up in users.deactivateidle
diff --git a/.changeset/hot-impalas-vanish.md b/.changeset/hot-impalas-vanish.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": minor
+---
+
+Hides the room announcement, topic and description from the Administration > Rooms panel for ABAC managed rooms. In the channel sidebar Edit Channel form those fields stay visible to room members but are disabled, and the API rejects edits to them.
diff --git a/.changeset/hot-spoons-heal.md b/.changeset/hot-spoons-heal.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Disables SAML login when it is set to validate signatures without the proper configuration for it
diff --git a/.changeset/little-cars-love.md b/.changeset/little-cars-love.md
@@ -0,0 +1,6 @@
+---
+"@rocket.chat/i18n": minor
+"@rocket.chat/ui-voip": minor
+---
+
+Adds "Open in room" button to shared screen card on voice call widget
diff --git a/.changeset/lovely-laws-wait.md b/.changeset/lovely-laws-wait.md
@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Allows users to search for attribute values when assigning them to rooms
diff --git a/.changeset/major-coats-smash.md b/.changeset/major-coats-smash.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes test button not playing default sound in Notifications Preferences
diff --git a/.changeset/mighty-icons-kiss.md b/.changeset/mighty-icons-kiss.md
@@ -0,0 +1,9 @@
+---
+'@rocket.chat/model-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/models': minor
+'@rocket.chat/meteor': minor
+'@rocket.chat/i18n': minor
+---
+
+Adds new API endpoints `custom-sounds.create` and `custom-sounds.update` to manage custom sounds with strict file validation for size and specific MIME types to ensure system compatibility.
diff --git a/.changeset/neat-trams-juggle.md b/.changeset/neat-trams-juggle.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Ensures the Meteor method for translateMessage validates access and types
diff --git a/.changeset/ninety-lilies-kick.md b/.changeset/ninety-lilies-kick.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/gazzodown': patch
+'@rocket.chat/i18n': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes Insert Timestamp relative time preview not updating on input changes and losing the user's locale after the first refresh tick.
diff --git a/.changeset/orange-bottles-glow.md b/.changeset/orange-bottles-glow.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/i18n': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes signed URL generation for S3 and Google Cloud Storage when the expiry setting is below 5 seconds, which previously caused expired or invalid preview URLs. Adds a dedicated URL expiry setting for Google Cloud Storage since it was incorrectly reusing the AWS S3 setting.
diff --git a/.changeset/perky-tires-invite.md b/.changeset/perky-tires-invite.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Ensures the visitor token is not present in the visitors.info response
diff --git a/.changeset/pink-moons-cheer.md b/.changeset/pink-moons-cheer.md
@@ -0,0 +1,7 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/apps-engine": minor
+"@rocket.chat/apps": minor
+---
+
+Allows apps with the right permission to read room's ABAC attributes.
diff --git a/.changeset/pre.json b/.changeset/pre.json
@@ -0,0 +1,131 @@
+{
+  "mode": "pre",
+  "tag": "rc",
+  "initialVersions": {
+    "@rocket.chat/meteor": "8.5.0-develop",
+    "rocketchat-services": "2.0.47",
+    "@rocket.chat/uikit-playground": "0.7.12",
+    "@rocket.chat/account-service": "0.4.56",
+    "@rocket.chat/authorization-service": "0.6.0",
+    "@rocket.chat/ddp-streamer": "0.3.56",
+    "@rocket.chat/omnichannel-transcript": "0.4.56",
+    "@rocket.chat/presence-service": "0.4.56",
+    "@rocket.chat/queue-worker": "0.4.56",
+    "@rocket.chat/abac": "0.2.0",
+    "@rocket.chat/federation-matrix": "0.1.3",
+    "@rocket.chat/license": "1.1.16",
+    "@rocket.chat/media-calls": "0.4.0",
+    "@rocket.chat/network-broker": "0.2.35",
+    "@rocket.chat/omni-core-ee": "0.0.21",
+    "@rocket.chat/omnichannel-services": "0.3.53",
+    "@rocket.chat/pdf-worker": "0.3.35",
+    "@rocket.chat/presence": "0.2.56",
+    "@rocket.chat/account-utils": "0.0.3",
+    "@rocket.chat/agenda": "0.1.1",
+    "@rocket.chat/api-client": "0.2.56",
+    "@rocket.chat/apps": "0.6.9",
+    "@rocket.chat/apps-engine": "1.62.0",
+    "@rocket.chat/base64": "1.0.14",
+    "@rocket.chat/cas-validate": "0.0.4",
+    "@rocket.chat/core-services": "0.14.0",
+    "@rocket.chat/core-typings": "8.5.0-develop",
+    "@rocket.chat/cron": "0.1.56",
+    "@rocket.chat/ddp-client": "1.0.9",
+    "@rocket.chat/desktop-api": "1.1.1",
+    "@rocket.chat/eslint-config": "0.8.0",
+    "@rocket.chat/favicon": "0.0.5",
+    "@rocket.chat/fuselage-ui-kit": "30.0.0",
+    "@rocket.chat/gazzodown": "30.0.0",
+    "@rocket.chat/http-router": "7.9.23",
+    "@rocket.chat/i18n": "3.0.0",
+    "@rocket.chat/instance-status": "0.1.56",
+    "@rocket.chat/jest-presets": "0.0.2",
+    "@rocket.chat/jwt": "0.2.1",
+    "@rocket.chat/livechat": "2.1.3",
+    "@rocket.chat/log-format": "0.0.3",
+    "@rocket.chat/logger": "1.0.1",
+    "@rocket.chat/media-signaling": "1.0.0",
+    "@rocket.chat/message-parser": "0.31.36",
+    "@rocket.chat/message-types": "0.1.1",
+    "@rocket.chat/mock-providers": "0.4.16",
+    "@rocket.chat/model-typings": "2.2.0",
+    "@rocket.chat/models": "2.2.0",
+    "@rocket.chat/mongo-adapter": "0.0.3",
+    "@rocket.chat/poplib": "0.0.3",
+    "@rocket.chat/omni-core": "0.1.0",
+    "@rocket.chat/password-policies": "0.1.1",
+    "@rocket.chat/patch-injection": "0.0.2",
+    "@rocket.chat/peggy-loader": "0.31.28",
+    "@rocket.chat/random": "1.2.3",
+    "@rocket.chat/release-action": "2.2.4",
+    "@rocket.chat/release-changelog": "0.1.1",
+    "@rocket.chat/rest-typings": "8.5.0-develop",
+    "@rocket.chat/server-cloud-communication": "0.0.3",
+    "@rocket.chat/server-fetch": "0.2.0",
+    "@rocket.chat/sha256": "1.0.13",
+    "@rocket.chat/storybook-config": "0.0.3",
+    "@rocket.chat/tools": "0.3.0",
+    "@rocket.chat/tracing": "0.0.2",
+    "@rocket.chat/tsconfig": "0.0.0",
+    "@rocket.chat/ui-avatar": "26.0.0",
+    "@rocket.chat/ui-client": "30.0.0",
+    "@rocket.chat/ui-composer": "1.0.0",
+    "@rocket.chat/ui-contexts": "30.0.0",
+    "@rocket.chat/ui-kit": "1.0.0",
+    "@rocket.chat/ui-video-conf": "30.0.0",
+    "@rocket.chat/ui-voip": "20.0.0",
+    "@rocket.chat/web-ui-registration": "30.0.0"
+  },
+  "changesets": [
+    "angry-baboons-trade",
+    "beige-parrots-lead",
+    "big-corners-tie",
+    "brave-fans-tie",
+    "brown-files-work",
+    "bump-patch-1779457640608",
+    "bump-patch-1780029980454",
+    "bump-patch-1780545712119",
+    "bump-patch-1780685193955",
+    "bump-patch-1781098424278",
+    "bump-patch-1781123233262",
+    "calm-seas-run",
+    "clever-zebras-melt",
+    "ddp-client-idempotent-reconnect",
+    "ddp-client-reset-retry-count",
+    "ddp-dispatcher-non-method-frames",
+    "dry-squids-wonder",
+    "edit-room-info-multiselect-aria-label",
+    "eight-clouds-count",
+    "fix-presence-comma-ids",
+    "flat-islands-nail",
+    "good-rules-lie",
+    "hot-impalas-vanish",
+    "hot-spoons-heal",
+    "little-cars-love",
+    "lovely-laws-wait",
+    "major-coats-smash",
+    "mighty-icons-kiss",
+    "neat-trams-juggle",
+    "ninety-lilies-kick",
+    "orange-bottles-glow",
+    "perky-tires-invite",
+    "pink-moons-cheer",
+    "public-ravens-like",
+    "red-maps-wink",
+    "rich-doodles-grow",
+    "room-search-index",
+    "sanitize-image-element-url",
+    "sdk-account-event-handlers",
+    "shaggy-kiwis-burn",
+    "sharp-planets-throw",
+    "silent-coats-open",
+    "spicy-phones-breathe",
+    "stale-needles-care",
+    "ten-lizards-divide",
+    "tidy-donuts-check",
+    "tricky-kiwis-sit",
+    "use-format-date-fallback",
+    "use-rc-sdk-transport-setting",
+    "witty-ravens-end"
+  ]
+}
diff --git a/.changeset/public-ravens-like.md b/.changeset/public-ravens-like.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps-engine': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds the capability for fetching a user by their sip extension to the apps
diff --git a/.changeset/red-maps-wink.md b/.changeset/red-maps-wink.md
@@ -0,0 +1,8 @@
+---
+'@rocket.chat/ui-client': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds a new "Drafts" group to the sidebar, providing quick access to all rooms with unfinished messages.
+> This feature is available under the `Drafts in sidebar` feature preview and needs to be enabled in settings to be tested.
diff --git a/.changeset/rich-doodles-grow.md b/.changeset/rich-doodles-grow.md
@@ -0,0 +1,9 @@
+---
+'@rocket.chat/model-typings': patch
+'@rocket.chat/core-typings': patch
+'@rocket.chat/models': patch
+'@rocket.chat/i18n': patch
+'@rocket.chat/meteor': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
diff --git a/.changeset/room-search-index.md b/.changeset/room-search-index.md
@@ -0,0 +1,8 @@
+---
+'@rocket.chat/meteor': minor
+'@rocket.chat/models': minor
+---
+
+Adds the `USE_ROOM_SEARCH_INDEX` environment variable. When set to `true`, the messages collection's text index is created as `{ rid: 1, msg: 'text' }` instead of the default `{ msg: 'text' }`. The compound shape lets per-room `$text` searches use `rid` as a prefix, dramatically reducing the portion of the index scanned on workspaces where global search is disabled.
+
+The index is reconciled on every startup: if the existing text index already matches the desired shape, nothing happens; otherwise the stale text index is dropped and the desired one is recreated. Unsetting the variable on a later boot reverts to the default shape.
diff --git a/.changeset/sanitize-image-element-url.md b/.changeset/sanitize-image-element-url.md
@@ -0,0 +1,6 @@
+---
+'@rocket.chat/gazzodown': patch
+'@rocket.chat/meteor': patch
+---
+
+Sanitizes image URLs in rendered messages to block `javascript:`, `data:`, and `vbscript:` schemes — matching the protection already applied to markdown links. Defense-in-depth against XSS via crafted markdown like `![label](javascript:...)`.
diff --git a/.changeset/sdk-account-event-handlers.md b/.changeset/sdk-account-event-handlers.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/ddp-client': minor
+---
+
+Add lifecycle event handlers to `Account`: `onLogin`, `onLogout`, `onEmailVerificationLink`, and `onPageLoadLogin`. `onLogin` / `onLogout` fire on `uid` transitions (the setter now emits only when the value changes, so a single login or logout produces exactly one callback). `onEmailVerificationLink` and `onPageLoadLogin` are convenience wrappers around new `Emitter` events of the same names — fire them externally with `account.emit('emailVerificationLink', token)` / `account.emit('pageLoadLogin', loginAttempt)`. The bridge from Meteor's accounts-base lives in the consumer (`apps/meteor/client`) so the package stays Meteor-independent. All four handlers return an unsubscribe function.