Release 9.0.0 - #41490
Open
rocketchat-github-ci wants to merge 209 commits into
Open
Conversation
…m MediaCallRoomSection (#41043) Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nazareno Bucciarelli <84046180+nazabucciarelli@users.noreply.github.com> Co-authored-by: Julio Araujo <julio.araujo@rocket.chat> Co-authored-by: Nazareno Bucciarelli <bnazareno03@gmail.com>
Hacktron Security Check - SkippedReason: This PR exceeds Hacktron's 200-file review cap and will not be scanned. Split the PR into smaller changes for review coverage.
|
🦋 Changeset detectedLatest commit: 7621bfc The changes in this PR will be included in the next version bump. This PR includes changesets to release 43 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
Contributor
|
Important Review skippedToo many files! This PR contains 2595 files, which is 2295 over the limit of 300. To get a review, narrow the scope: Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (45)
📒 Files selected for processing (2955)
You can disable this status message by setting the |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
19 issues found across 3000 files
Not reviewed (too large): apps/meteor/app/emoji-emojione/client/people-sprites.css (~8,729 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".changeset/persistent-audio-player.md">
<violation number="1" location=".changeset/persistent-audio-player.md:6">
P3: The release note says the Now playing card appears at the top of the sidebar, but the component is mounted after the room list and is documented as pinned to the bottom. Describing it as the bottom sidebar card would keep the generated changelog accurate.</violation>
</file>
<file name="apps/meteor/client/components/Sidebar/Header.tsx">
<violation number="1" location="apps/meteor/client/components/Sidebar/Header.tsx:15">
P2: Sidebar headers now gain an unintended 16px top padding because `paddingBlock` sets both block edges, whereas the previous `pb={16}` set only the bottom edge. Keeping the existing layout requires `paddingBottom={16}` here.</violation>
</file>
<file name=".changeset/quiet-lizards-jump.md">
<violation number="1" location=".changeset/quiet-lizards-jump.md:5">
P3: The release note names an endpoint that does not match the actual API, so users searching for `users.CreateToken` will not find this change. Naming the `createToken` DDP method (or describing the actual exposed route) keeps the release documentation actionable.</violation>
</file>
<file name="apps/meteor/client/components/TextCopy.tsx">
<violation number="1" location="apps/meteor/client/components/TextCopy.tsx:42">
P2: TextCopy now adds 16px of top padding in addition to the existing bottom spacing, which can shift the copied content and increase the component's height. `paddingBlockEnd={16}` preserves the previous `pb={16}` behavior while using the logical property form.</violation>
</file>
<file name=".changeset/license-validate-preview.md">
<violation number="1" location=".changeset/license-validate-preview.md:7">
P3: The release note incorrectly labels V2 licenses as JWTs, which can mislead clients about the token format accepted by `licenses.validate`. Describing the formats as “V2 licenses or V3 JWTs” keeps the migration/API documentation precise.</violation>
</file>
<file name="apps/meteor/client/components/UserStatusMenu.tsx">
<violation number="1" location="apps/meteor/client/components/UserStatusMenu.tsx:40">
P2: The status picker now lets every user manually select Away, reversing the existing behavior that reserved Away for automatic/server-applied presence and only exposed it to switch away from it. Keeping Away conditional on the current status preserves that workflow.</violation>
</file>
<file name="apps/meteor/.docker/Dockerfile.alpine">
<violation number="1" location="apps/meteor/.docker/Dockerfile.alpine:69">
P2: A build without `--target` now silently produces the FIPS image because this is the final stage, changing the Dockerfile's default output from standard Rocket.Chat to a licensed/FIPS-specific runtime. Keeping `release-standard` as the final stage (or otherwise preserving a standard default) would avoid breaking direct builds and consumers that do not pass the compose target.</violation>
</file>
<file name=".changeset/rest-users-setavatar-service.md">
<violation number="1" location=".changeset/rest-users-setavatar-service.md:5">
P3: Consumers of the REST typings cannot discover or type the newly documented `service` multipart field, leaving the public contract out of sync with the endpoint behavior. A dedicated multipart request type (separate from the JSON body schema) would keep the new field typed without implying that JSON `service` is accepted.
(Based on your team's feedback about keeping API typings aligned with runtime endpoints.) [FEEDBACK_USED].</violation>
</file>
<file name=".changeset/flat-poets-cheat.md">
<violation number="1" location=".changeset/flat-poets-cheat.md:14">
P2: Administrators who upgrade will not receive the documented modern OAuth behavior by default because `Accounts_OAuth_Use_Modern_Flow` defaults to `false`, yet this release note describes it as automatic and never tells them to enable the setting. The note should explicitly identify the toggle and its default/rollout behavior.</violation>
</file>
<file name="apps/meteor/client/components/TwoFactorModal/TwoFactorModal.tsx">
<violation number="1" location="apps/meteor/client/components/TwoFactorModal/TwoFactorModal.tsx:24">
P3: The email/challenge prop union is duplicated in the wrapper and `TwoFactorEmailModalProps`, so future changes can make the wrapper accept a shape that the rendered modal does not handle. Extract the shared email props into a common type and compose both component prop types from it.</violation>
</file>
<file name="apps/meteor/app/apps/server/converters/codecs/enums.ts">
<violation number="1" location="apps/meteor/app/apps/server/converters/codecs/enums.ts:26">
P3: These codecs are currently unused by the converters, so this change adds a second source of truth without changing the runtime conversion path. Wiring the converters through these shared codecs and removing the local switch helpers would prevent future enum mappings from diverging.</violation>
</file>
<file name=".changeset/breezy-parts-kiss.md">
<violation number="1" location=".changeset/breezy-parts-kiss.md:12">
P3: The release changelog will contain this OAuth feature twice because `.changeset/flat-poets-cheat.md` already documents the same change. Consolidating the notes and package bump into one changeset would avoid duplicate release documentation.</violation>
<violation number="2" location=".changeset/breezy-parts-kiss.md:19">
P2: This security claim is unconditional even though `Accounts_OAuth_Use_Modern_Flow` defaults to `false`; existing and new installations continue using the legacy flow until an administrator enables it. Qualifying this and the following security bullets with “when enabled” would keep the release notes from overstating the default behavior.</violation>
</file>
<file name="apps/meteor/app/emoji/client/lib.ts">
<violation number="1" location="apps/meteor/app/emoji/client/lib.ts:16">
P2: Initial message renders can show literal shortcodes because this fallback no longer renders anything before `useNativeEmoji` registers the native package in its layout effect. Keeping an initialization-time renderer or registering the native package before message components render would preserve first-render shortcode conversion; otherwise those messages require an unrelated rerender to update.</violation>
</file>
<file name=".changeset/fips-mode-support.md">
<violation number="1" location=".changeset/fips-mode-support.md:4">
P3: The release metadata gives `@rocket.chat/federation-matrix` a minor FIPS feature release even though it has no FIPS implementation or dedicated FIPS image and is not one of the services named in the feature description. Removing this package from the changeset would avoid an unrelated version bump and misleading package changelog entry.</violation>
</file>
<file name=".changeset/rest-batch4-logout-cleanup.md">
<violation number="1" location=".changeset/rest-batch4-logout-cleanup.md:5">
P3: The release note says `logoutCleanUp` is retained only until 9.0.0, even though this 9.0.0 release still registers the method and emits its deprecation warning. Wording that it remains available in 9.0.0 and is planned for removal in a later release would avoid misleading existing DDP clients.</violation>
</file>
<file name=".github/actions/docker-image-size-tracker/action.yml">
<violation number="1" location=".github/actions/docker-image-size-tracker/action.yml:93">
P3: The comment inaccurately says buildx produces OCI images by default; this workflow does not request OCI media types, and registry output defaults to Docker media types. Removing that claim keeps the format-compatibility rationale accurate without changing the fallback behavior.</violation>
</file>
<file name="apps/meteor/app/emoji-native/lib/generateEmojiData.ts">
<violation number="1" location="apps/meteor/app/emoji-native/lib/generateEmojiData.ts:101">
P2: Selecting an alternate shortcode for a tone-capable emoji leaves the picker’s selected skin tone unapplied because `toneList` contains only the primary name. Register every base shortcode in `codes` in `toneList` so aliases follow the same tone-selection path.</violation>
</file>
<file name=".github/workflows/ci-deploy-gh-pages.yml">
<violation number="1" location=".github/workflows/ci-deploy-gh-pages.yml:17">
P2: A compromised dependency or build/action code can use the checkout credentials to push to the repository before deployment because build and install steps share the job's `contents: write` token. Keeping build/install in a read-only job and publishing its artifact from a separate write-scoped deploy job would preserve the Pages push while limiting the elevated token.</violation>
</file>
Note: This PR contains a large number of files. cubic only reviews up to 200 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.
Re-trigger cubic
| @@ -12,9 +12,9 @@ const Header = ({ title, onClose, children, ...props }: HeaderProps) => { | |||
| const { t } = useTranslation(); | |||
|
|
|||
| return ( | |||
| <Box display='flex' flexDirection='column' pb={16} {...props}> | |||
| <Box display='flex' flexDirection='column' paddingBlock={16} {...props}> | |||
Contributor
There was a problem hiding this comment.
P2: Sidebar headers now gain an unintended 16px top padding because paddingBlock sets both block edges, whereas the previous pb={16} set only the bottom edge. Keeping the existing layout requires paddingBottom={16} here.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/client/components/Sidebar/Header.tsx, line 15:
<comment>Sidebar headers now gain an unintended 16px top padding because `paddingBlock` sets both block edges, whereas the previous `pb={16}` set only the bottom edge. Keeping the existing layout requires `paddingBottom={16}` here.</comment>
<file context>
@@ -12,9 +12,9 @@ const Header = ({ title, onClose, children, ...props }: HeaderProps) => {
return (
- <Box display='flex' flexDirection='column' pb={16} {...props}>
+ <Box display='flex' flexDirection='column' paddingBlock={16} {...props}>
{(title || onClose) && (
- <Box display='flex' flexDirection='row' alignItems='center' pi={24} justifyContent='space-between' flexGrow={1}>
</file context>
Suggested change
| <Box display='flex' flexDirection='column' paddingBlock={16} {...props}> | |
| <Box display='flex' flexDirection='column' paddingBottom={16} {...props}> |
| @@ -31,7 +39,7 @@ const TextCopy = ({ text, wrapper = defaultWrapperRenderer, ...props }: TextCopy | |||
| justifyContent='stretch' | |||
| alignItems='flex-start' | |||
| flexGrow={1} | |||
| pb={16} | |||
| paddingBlock={16} | |||
Contributor
There was a problem hiding this comment.
P2: TextCopy now adds 16px of top padding in addition to the existing bottom spacing, which can shift the copied content and increase the component's height. paddingBlockEnd={16} preserves the previous pb={16} behavior while using the logical property form.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/client/components/TextCopy.tsx, line 42:
<comment>TextCopy now adds 16px of top padding in addition to the existing bottom spacing, which can shift the copied content and increase the component's height. `paddingBlockEnd={16}` preserves the previous `pb={16}` behavior while using the logical property form.</comment>
<file context>
@@ -31,7 +39,7 @@ const TextCopy = ({ text, wrapper = defaultWrapperRenderer, ...props }: TextCopy
alignItems='flex-start'
flexGrow={1}
- pb={16}
+ paddingBlock={16}
backgroundColor='surface'
width='full'
</file context>
Suggested change
| paddingBlock={16} | |
| paddingBlockEnd={16} |
| @@ -37,21 +37,16 @@ const UserStatusMenu = ({ | |||
|
|
|||
| const statuses: Array<[value: UserStatusType, label: ReactNode]> = [ | |||
| [UserStatusType.ONLINE, renderOption(UserStatusType.ONLINE, t('Online'))], | |||
| [UserStatusType.AWAY, renderOption(UserStatusType.AWAY, t('Away'))], | |||
Contributor
There was a problem hiding this comment.
P2: The status picker now lets every user manually select Away, reversing the existing behavior that reserved Away for automatic/server-applied presence and only exposed it to switch away from it. Keeping Away conditional on the current status preserves that workflow.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/client/components/UserStatusMenu.tsx, line 40:
<comment>The status picker now lets every user manually select Away, reversing the existing behavior that reserved Away for automatic/server-applied presence and only exposed it to switch away from it. Keeping Away conditional on the current status preserves that workflow.</comment>
<file context>
@@ -37,21 +37,16 @@ const UserStatusMenu = ({
const statuses: Array<[value: UserStatusType, label: ReactNode]> = [
[UserStatusType.ONLINE, renderOption(UserStatusType.ONLINE, t('Online'))],
+ [UserStatusType.AWAY, renderOption(UserStatusType.AWAY, t('Away'))],
[UserStatusType.BUSY, renderOption(UserStatusType.BUSY, t('Busy'))],
];
</file context>
|
|
||
| CMD ["node", "main.js"] | ||
|
|
||
| FROM rocketchat/dhi-node:22.22.3-alpine3.23-fips AS release-fips |
Contributor
There was a problem hiding this comment.
P2: A build without --target now silently produces the FIPS image because this is the final stage, changing the Dockerfile's default output from standard Rocket.Chat to a licensed/FIPS-specific runtime. Keeping release-standard as the final stage (or otherwise preserving a standard default) would avoid breaking direct builds and consumers that do not pass the compose target.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/.docker/Dockerfile.alpine, line 69:
<comment>A build without `--target` now silently produces the FIPS image because this is the final stage, changing the Dockerfile's default output from standard Rocket.Chat to a licensed/FIPS-specific runtime. Keeping `release-standard` as the final stage (or otherwise preserving a standard default) would avoid breaking direct builds and consumers that do not pass the compose target.</comment>
<file context>
@@ -65,3 +65,29 @@ WORKDIR /app/bundle
CMD ["node", "main.js"]
+
+FROM rocketchat/dhi-node:22.22.3-alpine3.23-fips AS release-fips
+
+LABEL maintainer="buildmaster@rocket.chat"
</file context>
|
|
||
| ## Phishing-Resistant Multi-Factor Authentication | ||
|
|
||
| Introduces a more secure and reliable server-side OAuth authentication flow. |
Contributor
There was a problem hiding this comment.
P2: Administrators who upgrade will not receive the documented modern OAuth behavior by default because Accounts_OAuth_Use_Modern_Flow defaults to false, yet this release note describes it as automatic and never tells them to enable the setting. The note should explicitly identify the toggle and its default/rollout behavior.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .changeset/flat-poets-cheat.md, line 14:
<comment>Administrators who upgrade will not receive the documented modern OAuth behavior by default because `Accounts_OAuth_Use_Modern_Flow` defaults to `false`, yet this release note describes it as automatic and never tells them to enable the setting. The note should explicitly identify the toggle and its default/rollout behavior.</comment>
<file context>
@@ -0,0 +1,28 @@
+
+## Phishing-Resistant Multi-Factor Authentication
+
+Introduces a more secure and reliable server-side OAuth authentication flow.
+
+### What’s New
</file context>
| * Rocket.Chat `IUser['type']` <-> Apps-Engine `UserType`. | ||
| * Mirrors `AppUsersConverter._convertUserTypeToEnum`. | ||
| */ | ||
| export const UserTypeCodec = z.codec(z.string().optional(), z.string(), { |
Contributor
There was a problem hiding this comment.
P3: These codecs are currently unused by the converters, so this change adds a second source of truth without changing the runtime conversion path. Wiring the converters through these shared codecs and removing the local switch helpers would prevent future enum mappings from diverging.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/apps/server/converters/codecs/enums.ts, line 26:
<comment>These codecs are currently unused by the converters, so this change adds a second source of truth without changing the runtime conversion path. Wiring the converters through these shared codecs and removing the local switch helpers would prevent future enum mappings from diverging.</comment>
<file context>
@@ -0,0 +1,124 @@
+ * Rocket.Chat `IUser['type']` <-> Apps-Engine `UserType`.
+ * Mirrors `AppUsersConverter._convertUserTypeToEnum`.
+ */
+export const UserTypeCodec = z.codec(z.string().optional(), z.string(), {
+ decode: (type): string => {
+ switch (type) {
</file context>
| '@rocket.chat/meteor': major | ||
| --- | ||
|
|
||
| ## Phishing-Resistant Multi-Factor Authentication |
Contributor
There was a problem hiding this comment.
P3: The release changelog will contain this OAuth feature twice because .changeset/flat-poets-cheat.md already documents the same change. Consolidating the notes and package bump into one changeset would avoid duplicate release documentation.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .changeset/breezy-parts-kiss.md, line 12:
<comment>The release changelog will contain this OAuth feature twice because `.changeset/flat-poets-cheat.md` already documents the same change. Consolidating the notes and package bump into one changeset would avoid duplicate release documentation.</comment>
<file context>
@@ -0,0 +1,31 @@
+'@rocket.chat/meteor': major
+---
+
+## Phishing-Resistant Multi-Factor Authentication
+
+Introduces a more secure and reliable server-side OAuth authentication flow.
</file context>
| --- | ||
| '@rocket.chat/meteor': minor | ||
| '@rocket.chat/core-typings': minor | ||
| '@rocket.chat/federation-matrix': minor |
Contributor
There was a problem hiding this comment.
P3: The release metadata gives @rocket.chat/federation-matrix a minor FIPS feature release even though it has no FIPS implementation or dedicated FIPS image and is not one of the services named in the feature description. Removing this package from the changeset would avoid an unrelated version bump and misleading package changelog entry.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .changeset/fips-mode-support.md, line 4:
<comment>The release metadata gives `@rocket.chat/federation-matrix` a minor FIPS feature release even though it has no FIPS implementation or dedicated FIPS image and is not one of the services named in the feature description. Removing this package from the changeset would avoid an unrelated version bump and misleading package changelog entry.</comment>
<file context>
@@ -0,0 +1,13 @@
+---
+'@rocket.chat/meteor': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/federation-matrix': minor
+'@rocket.chat/account-service': minor
+'@rocket.chat/authorization-service': minor
</file context>
| '@rocket.chat/meteor': minor | ||
| --- | ||
|
|
||
| Deprecates the `logoutCleanUp` DDP method and stops the client from calling it. The post-logout side effects (`afterLogoutCleanUpCallback` + `Apps.IPostUserLoggedOut`) now run server-side via a new `Accounts.onLogout` handler and from `POST /v1/users.logout`, so both DDP and REST logout paths fire them without a client round-trip. The DDP method keeps its original implementation and registration with a deprecation log pointing at `/v1/users.logout` until 9.0.0. |
Contributor
There was a problem hiding this comment.
P3: The release note says logoutCleanUp is retained only until 9.0.0, even though this 9.0.0 release still registers the method and emits its deprecation warning. Wording that it remains available in 9.0.0 and is planned for removal in a later release would avoid misleading existing DDP clients.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .changeset/rest-batch4-logout-cleanup.md, line 5:
<comment>The release note says `logoutCleanUp` is retained only until 9.0.0, even though this 9.0.0 release still registers the method and emits its deprecation warning. Wording that it remains available in 9.0.0 and is planned for removal in a later release would avoid misleading existing DDP clients.</comment>
<file context>
@@ -0,0 +1,5 @@
+'@rocket.chat/meteor': minor
+---
+
+Deprecates the `logoutCleanUp` DDP method and stops the client from calling it. The post-logout side effects (`afterLogoutCleanUpCallback` + `Apps.IPostUserLoggedOut`) now run server-side via a new `Accounts.onLogout` handler and from `POST /v1/users.logout`, so both DDP and REST logout paths fire them without a client round-trip. The DDP method keeps its original implementation and registration with a deprecation log pointing at `/v1/users.logout` until 9.0.0.
</file context>
Comment on lines
+93
to
+94
| # (Docker schema2 images) or OCIManifest (OCI images, which buildx | ||
| # produces by default). Coalesce so both formats are read. |
Contributor
There was a problem hiding this comment.
P3: The comment inaccurately says buildx produces OCI images by default; this workflow does not request OCI media types, and registry output defaults to Docker media types. Removing that claim keeps the format-compatibility rationale accurate without changing the fallback behavior.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/actions/docker-image-size-tracker/action.yml, line 93:
<comment>The comment inaccurately says buildx produces OCI images by default; this workflow does not request OCI media types, and registry output defaults to Docker media types. Removing that claim keeps the format-compatibility rationale accurate without changing the fallback behavior.</comment>
<file context>
@@ -89,10 +89,11 @@ runs:
- config_size=$(jq -r '.SchemaV2Manifest.config.size // 0' "$manifest_file")
- layers_size=$(jq '[.SchemaV2Manifest.layers[]?.size // 0] | add // 0' "$manifest_file")
+ # docker manifest inspect -v puts the manifest under SchemaV2Manifest
+ # (Docker schema2 images) or OCIManifest (OCI images, which buildx
+ # produces by default). Coalesce so both formats are read.
+ config_size=$(jq -r '(.SchemaV2Manifest // .OCIManifest).config.size // 0' "$manifest_file")
</file context>
Suggested change
| # (Docker schema2 images) or OCIManifest (OCI images, which buildx | |
| # produces by default). Coalesce so both formats are read. | |
| # (Docker schema2 images) or OCIManifest (OCI images). Coalesce | |
| # so both formats are read. |
|
Warning These are security findings reported by the security scanners configured in Layne. Findings may contain false positives - review them and fix what makes sense. Layne found 55 high issues in this PR. View 55 finding(s)
|
Member
|
/layne exception-approve LAYNE-444e666a3d283215 LAYNE-fc2d8685a58d12d2 LAYNE-40ff54ded49388a9 LAYNE-a03618bb043d0e60 LAYNE-dfa1044ca4ac93d5 LAYNE-c84a1219c89a6a64 LAYNE-a24dde934c022920 LAYNE-740fe4661e9634ba LAYNE-e2e5abcf124ff915 LAYNE-f3a64acc0efe0d91 LAYNE-fe41fedccfb015a4 LAYNE-3e3b9c3235001f53 LAYNE-f737280aba6ebe45 LAYNE-4140dbe675a2f1a4 LAYNE-13eea44db3398875 LAYNE-b63865b6b5ce7c50 LAYNE-c484ac3ad4cf7514 LAYNE-5a13936919dad058 LAYNE-84d7364adeee3d85 LAYNE-14e367de73edcde8 LAYNE-45ef8cbc41cf0f65 LAYNE-22ffed8aad3ff424 LAYNE-a363aed39ea1fe50 LAYNE-7e20d9442a92740e LAYNE-de17d056e706b841 LAYNE-49a3fa7533badf61 LAYNE-2194889a8f6bfdab LAYNE-58bb578d6497aee1 LAYNE-7c448084f867baef LAYNE-257efa562f27dfb6 LAYNE-b84b55f3df673449 LAYNE-c1c4401016d00b3b LAYNE-d5a4427cd246fc91 LAYNE-c114d92fccc1721e LAYNE-3d7af531e2a486a5 LAYNE-9c7ba427b03c9d2f LAYNE-4d598ee1db533da0 LAYNE-5c760bf9cf0de4d2 LAYNE-debbb9781ec393a3 LAYNE-07ff5e7849435682 LAYNE-8831529b741184d5 LAYNE-80c29a759dc0ee6f LAYNE-9e09b2b054fe7c36 LAYNE-b9d2d7a44470ef8d LAYNE-4d5b6e6b5881af9f LAYNE-ad1ecf91305f592b LAYNE-63078a757671eeae LAYNE-a6429ee3b1213c27 LAYNE-9d1345e5bb20ccbd LAYNE-c1376c993f2f8f95 LAYNE-4b8784e52878e3e4 LAYNE-944e1730c7bf21dc LAYNE-233b583b79a28c1c LAYNE-3fd08e4cf86d1629 LAYNE-916cd0d36de29205 reason: false positives |
|
✅ Exception recorded for LAYNE-444e666a3d283215, LAYNE-fc2d8685a58d12d2, LAYNE-40ff54ded49388a9, LAYNE-a03618bb043d0e60, LAYNE-dfa1044ca4ac93d5, LAYNE-c84a1219c89a6a64, LAYNE-a24dde934c022920, LAYNE-740fe4661e9634ba, LAYNE-e2e5abcf124ff915, LAYNE-f3a64acc0efe0d91, LAYNE-fe41fedccfb015a4, LAYNE-3e3b9c3235001f53, LAYNE-f737280aba6ebe45, LAYNE-4140dbe675a2f1a4, LAYNE-13eea44db3398875, LAYNE-b63865b6b5ce7c50, LAYNE-c484ac3ad4cf7514, LAYNE-5a13936919dad058, LAYNE-84d7364adeee3d85, LAYNE-14e367de73edcde8, LAYNE-45ef8cbc41cf0f65, LAYNE-22ffed8aad3ff424, LAYNE-a363aed39ea1fe50, LAYNE-7e20d9442a92740e, LAYNE-de17d056e706b841, LAYNE-49a3fa7533badf61, LAYNE-2194889a8f6bfdab, LAYNE-58bb578d6497aee1, LAYNE-7c448084f867baef, LAYNE-257efa562f27dfb6, LAYNE-b84b55f3df673449, LAYNE-c1c4401016d00b3b, LAYNE-d5a4427cd246fc91, LAYNE-c114d92fccc1721e, LAYNE-3d7af531e2a486a5, LAYNE-9c7ba427b03c9d2f, LAYNE-4d598ee1db533da0, LAYNE-5c760bf9cf0de4d2, LAYNE-debbb9781ec393a3, LAYNE-07ff5e7849435682, LAYNE-8831529b741184d5, LAYNE-80c29a759dc0ee6f, LAYNE-9e09b2b054fe7c36, LAYNE-b9d2d7a44470ef8d, LAYNE-4d5b6e6b5881af9f, LAYNE-ad1ecf91305f592b, LAYNE-63078a757671eeae, LAYNE-a6429ee3b1213c27, LAYNE-9d1345e5bb20ccbd, LAYNE-c1376c993f2f8f95, LAYNE-4b8784e52878e3e4, LAYNE-944e1730c7bf21dc, LAYNE-233b583b79a28c1c, LAYNE-3fd08e4cf86d1629, LAYNE-916cd0d36de29205 by @julio-rocketchat: "false positives". Re-running scan... |
Co-authored-by: Julio Araujo <julio.araujo@rocket.chat> Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You can see below a preview of the release change log:
9.0.0
Engine versions
22.22.32.3.18.01.64.1-rc.0Major Changes
(#40721) ## Phishing-Resistant Multi-Factor Authentication
Introduces a more secure and reliable server-side OAuth authentication flow.
What’s New
OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
Enable this new setting
Accounts_OAuth_Use_Modern_Flowto use all of the above mentioned features.Minor Changes
(#40351) Adds
currentfield toDeviceManagementSessiontype andcurrentLoginTokenparameter toaggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.(#40890) Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.
(#39324) Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new
fipsmodule, and FIPS status is now reported in server logs and statistics.(#40721) ## Phishing-Resistant Multi-Factor Authentication
Introduces a more secure and reliable server-side OAuth authentication flow.
What’s New
OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
(#41019) Adds an alternative runtime runner for apps. It can be enabled via environment variable
APPS_ENGINE_RUNTIME_BACKEND='node'(#41142) Adds inline JSON validation feedback to admin settings that hold JSON (
code: application/json), showing an error in the editor and blocking save while the value is malformed(#40916) Adds a new
licenses.validateREST endpoint that validates a Rocket.Chat license (V2 or V3 JWT) against the current workspace without applying it, so a license can be previewed before it is applied from the UI. A valid license responds with success; an invalid one responds with the validation behaviors that rejected it.(#39411) Replaces proprietary emojis with native (unicode) emojis and increases available emoji set
(#41148) Adds support for the
offlinelicense flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance.(#41120) Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.
(#40728) Deprecates the
logoutCleanUpDDP method and stops the client from calling it. The post-logout side effects (afterLogoutCleanUpCallback+Apps.IPostUserLoggedOut) now run server-side via a newAccounts.onLogouthandler and fromPOST /v1/users.logout, so both DDP and REST logout paths fire them without a client round-trip. The DDP method keeps its original implementation and registration with a deprecation log pointing at/v1/users.logoutuntil 9.0.0.(#40728) Added
POST /v1/cloud.connectWorkspace(replaces the deprecatedcloud:connectWorkspaceDDP method). Body is{ token }; auth-gated withmanage-cloudpermission. The legacy DDP method remains registered with a deprecation log pointing at the new route.(#40728) Added
POST /v1/integrations.clearHistoryandPOST /v1/integrations.replayOutgoing(replace the deprecatedclearIntegrationHistoryandreplayOutgoingIntegrationDDP methods). Bodies{ integrationId }and{ integrationId, historyId }respectively. Permissions (manage-outgoing-integrationsormanage-own-outgoing-integrations) are enforced the same way the DDP methods did. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.(#40728) Added
POST /v1/permissions.addRoleandPOST /v1/permissions.removeRole(replace the deprecatedauthorization:addPermissionToRoleandauthorization:removeRoleFromPermissionDDP methods). Body is{ permissionId, role }on both. The same per-user permission checks (access-permissions,access-setting-permissions) the DDP methods enforced are reused. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.(#40728) Extended
POST /v1/users.setAvatarto accept an optionalservicemultipart field. When provided, the value is stored as the user'savatarOrigin, matching what the deprecatedsetAvatarFromServiceDDP method did. The legacy DDP method remains registered with a deprecation log pointing at the new route.(#40728) Added
POST /v1/users.verifyEmail(replaces the two-call DDP flow ofverifyEmail+afterVerifyEmail). Body is{ token }; the server resolves the user, marks the email verified, and runs the anonymous→user role swap in a single request. The deprecatedafterVerifyEmailDDP method keeps its registration with a deprecation log pointing at the new route.(#40916) Adds a manage license flow to the subscription admin page, allowing license verification before applying it and an option to remove the license. Note: From this point license management should be made in subscription page instead of the Enterprise settings page.
Patch Changes
(#41174) Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself
(#41152) Fixes own account showing twice in navbar room search when searching by username
(#41285) Fixes the Slack importer storing shared files as raw URLs in the message body. Imported file messages now stay hidden until "Download Pending Files" button fetches them, then display as native attachments with image previews. Failed downloads (e.g. invalidated export links) are no longer silently saved as the file's content — they are counted as errors and can be retried.
(#41056) Added a
setUserRolesbridge method to the desktop API and pushed the logged-in user's roles to the desktop app. This lets the desktop client restrict supportedVersions messages (such as version-expiration warnings) to specific roles like admins, instead of showing them to every user. The push is reactive to role changes; desktop builds without the bridge method fall back to their own role lookup.(#41207) Fixes engagement dashboard loading unnecessary data into memory on startup
(#41173) Fixes the password policy allowing a maximum length lower than the minimum length to be saved — a combination that made it impossible to set any valid password. The server now rejects such configurations when password policy settings are saved and shows an error explaining the constraint.
(#41233) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41195) fix: Buttons from emoji picker misbehaving on clicks
An infinite render loop was preventing proper behavior when clicking on the emoji picker buttons. It was fixed by removing the unnecessary state update that was causing the loop and replacing multiple fires of the same mouseover event (when a mouseenter event was the right one to use). There is a chance this pre-existing bug was hidden by React 18's event delegation.
(#41158) Fixes agents' business-hour availability not being updated when they are removed from a department linked to a business hour while multiple business hours are enabled. The recomputation step always failed, leaving removed agents available (or unavailable) according to a business hour that no longer applied to them — and, on deployments running with
EXIT_UNHANDLEDPROMISEREJECTION(or in development/test mode), the unhandled rejection crashed the server process.(#41164) Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.
Also fixes agents keeping a business hour's availability after their department was removed from it: saving a business hour with a smaller department list unlinked the departments but never cleared the business hour from the removed departments' agents.
(#41472) Fixes the license provided via the
ROCKETCHAT_LICENSEenvironment variable not being applied when it is newer than the one persisted in the workspace.(#40351) Fixes error message being shown when logging out current device via Device Management despite successful logout.
(#41169) Fixes a race condition that left messages permanently undecryptable ("incorrect encryption key") in rooms created with encryption enabled. When several members opened such a room at the same time, each client could independently generate and distribute a different group key. Establishing the room key is now atomic (first-write-wins) on the server, and a client that loses the race discards its locally generated key and adopts the established one instead of encrypting with a divergent key.
(#41069) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#41168) Fixes LDAP channel sync aborting the entire add/removal pass when a mapped channel could not be resolved, which prevented users from being removed from channels when "Auto Remove Users from Channels" was enabled.
(#41279) Fixes LDAP sync failing to merge an existing user matched by email, which caused a
Username already existserror when the user's username differed from the directory.(#41373) Fixes the server crashing during LDAP login or sync when the configured search settings produce an invalid LDAP filter (for example, an empty User Search Field). The operation now fails gracefully with a logged error instead of terminating the process.
(#41202) Disables more actions on message composer during public channel preview.
(#41480) Fixes an issue where the "user left" system message could be added to an Omnichannel conversation only after the forwarding process had already finished, causing it to appear out of order in the conversation history
(#41110) Passes the original message text to the message renderer so blocks without a dedicated renderer (e.g. tables on clients that don't render them yet) can degrade to their raw markup via the parser's
fallbacksource offsets, instead of disappearing.(#41074) Fixes an issue where the cursor jumped to the wrong position after inserting a mention at the start or middle of a message.
(#41304) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.
(#41089) Enables keyboard activation for Display menu radio buttons and checkboxes
(#41204) Changes the date columns in the Omnichannel Contact Center to show both the formatted date and the relative time: the Last Chat column in the contacts list, and the Started at and Last Message columns in the chats list
(#41341) Fixes a server crash when re-enabling the "Enable Push" setting after it was disabled. Push notifications are now fully reconfigured on re-enable, so settings changed while push was disabled are picked up as well.
(#40768) Ensures the
users.CreateTokenendpoint checks for theuser-generate-access-tokenpermission when generating a login token for another user(#41206) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room
(#41414) Restores Away as a selectable preset in the quick status menu, custom status modal, and account profile page.
(#41145) Fixes the SAML Single Logout response so the
RelayStatematches the exact value received on the logout request, as required by the SAML specification, instead of using Rocket.Chat's own URL(#41254) Fixes the setup wizard being forced back into the registration step on the first start after an upgrade when
OVERWRITE_SETTING_Show_Setup_Wizard=completedis set, which affected air-gapped workspaces running offline licenses without cloud registration.(#41122) Adds keyboard navigation support in Room members list
(#41112) Returns
custom fieldson admin rooms detail view(#41101) Improved
/v1/spotlightsearch performance: results return faster, and room searches now read from secondary database replicas when available, reducing load on the primary.(#41402) Fixes broken pagination on
rooms.bannedUsersand on omnichannel department listing endpoints, which ignored theoffsetparameter and always returned results from the first page. Also reduces payload over-fetching on several endpoints that unintentionally loaded full documents (rooms.hide, private group lookups, direct email replies, omnichannel auto-transfer), and removes the permissive model query typings that allowed these invalid find options to compile unnoticed.(#41229) Fixes dates showing one day earlier for users in negative UTC-offset timezones
(#41200) Fixes an issue where the whole app remounts when VoIP availability changes
Updated dependencies [c7aff48, 5f92f9a, 70c0ff0, 13b4a7b, eec6083, 4b34bd6, adc1570, 1bf84cb, 4b57346, 8d8cd01, 297df1a, 6ebabce, 13b4a7b, ffe1b64, 784c287, 3cd7db6, 115dfe8, 719e3db, b2b5edf, 74d6cac, 4186deb, 4117a1d, 376c9d8, 73c3aec, 73c3aec, 73c3aec, 73c3aec, 615ae2b, b2b5edf, 1cc7bbd, 6041285, e5da5d0, 2ec4d29, 70c0ff0, 1637a8b]: