Rocket.Chat

Updated
Prev Next

Release 9.0.0-rc.0

Release Date: October 27, 2026

Support Window: Supported until April 30, 2027

9.0.0 is a major release with breaking changes, including removed integrations, settings, Meteor methods, and REST API parameters, changed REST API status codes, and a new license requirement for LDAP and SAML login. The bullets below state the action required where one applies. Review the deprecated and phasing out features and the guidelines for updating Rocket.Chat before you upgrade.

Security and Compliance

Security improvements, authentication changes, data protection, and vulnerability fixes.

  • Added OAuth sign-in for MCP clients. MCP clients can now connect to the workspace MCP endpoint with access tokens from the workspace OAuth 2.0 server, in addition to personal access tokens. The OAuth 2.0 server now verifies PKCE challenges, publishes its authorization server metadata at /.well-known/oauth-authorization-server, and supports dynamic client registration behind the new Allow dynamic client registration setting in the MCP settings. The setting is off by default and requires the Rocket.Chat AI add-on with MCP enabled. (#43149, #43150, #43151, #43152, #43148)

  • Added private TURN servers for voice calls. The new TURN servers setting under Manage > Workspace > Settings > Team voice calls (VoIP) > WebRTC settings hands TURN servers and their credentials only to users on a call, instead of exposing them through the public ICE servers setting. Each server can use fixed credentials or a shared secret, in which case the workspace issues time-limited credentials for every call. (#42744)

  • Removed the built-in Drupal, Facebook, GitHub Enterprise, LinkedIn, Meteor, Twitter, WordPress, and Dolphin OAuth login providers; Apple, GitHub, GitLab, Google, Nextcloud, and custom OAuth remain. OAuth logins now always use the server-side flow with PKCE and state validation, and the OAuth proxy settings are removed. Workspaces that rely on a removed provider can recreate it as a custom OAuth service where the provider supports standard OAuth 2.0, and affected users keep their accounts but must sign in another way. (#41992, #42369)

  • Removed the Atlassian Crowd integration, including the Atlassian Crowd settings section and the background user sync; the settings and scheduled sync jobs are deleted on upgrade. Users provisioned through Crowd keep their accounts but must sign in another way, for example through LDAP or a local password set with Forgot password. (#41986)

  • Removed the Allow anonymous write setting, the Or talk as anonymous composer action, and the anonymous role; Allow anonymous read remains. On upgrade, users who hold the anonymous role are deactivated and logged out. (#41828)

  • Removed the deprecated query and fields REST API parameters and the ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS environment variable that re-enabled them; endpoints that validate their query string now reject them with 400 error-invalid-params. As replacements, users.list accepts username, customFields[key], and includeCustomFields filters, and users with the view-room-administration permission can read rooms they are not members of through rooms.info. (#41948, #42078, #42171, #42172)

  • Removed the legacy /ufs path for downloading uploaded files. Files are served only through the current file upload URLs, so integrations or bookmarks that still use /ufs links stop working. (#41054)

  • Included a security hotfix for DM creation and Omnichannel transcripts. Creating a DM between other users with the excludeSelf option of im.create now requires the new Create direct messages for other users permission (create-d-other-users), and Omnichannel transcripts only attach files that belong to the conversation. Details are published in the security fixes and updates document. (#42906)

  • Fixed the external service call of Livechat triggers skipping Server-Side Request Forgery (SSRF) validation. If a trigger calls an internal host, add the host to SSRF allowlist under Manage > Workspace > Settings > General > SSRF protection. (#42201)

  • Added a channel membership check to discussion creation in public channels. Users who are not members of the channel now receive error-user-not-in-room from rooms.createDiscussion and from the create discussion action; apps are exempt. (#43038)

  • Fixed roles with the Rooms scope, such as owner, moderator, leader, or custom roles, not granting their permissions in the web client when assigned to a user globally under Manage > Workspace > Users. Changing team member roles through the teams endpoints now checks the set-owner, set-moderator, and set-leader permissions and returns 403 otherwise. (#42664, #42947)

  • Limited Two-Factor Authentication (2FA) email codes to one per user per minute, and the login screen now explains the limit. A password login that needs an email code returns a challengeId that clients use to resend the code. (#42735)

  • Enforced the permissions that app slash commands declare, so commands are hidden from and refused for users without them. The commands.run and commands.preview endpoints now respond with 403 Forbidden instead of 400 when a command refuses the action, so integrations that check for 400 must be updated. Running /invite on a banned or unknown user now shows a translated message, or the app's reason when an app blocks the join. (#42651, #42741, #43011)

  • Rewrote the description of the Force end-to-end encryption on private rooms setting under Manage > Workspace > Settings > End-to-end encryption to explain its effect more clearly. The setting's behavior is unchanged. (#42517)

  • ABAC enhancements. Added workspace-wide Attribute-Based Access Control (ABAC) enforcement. Admins can turn on Enforce ABAC across all workspace rooms under Manage > Workspace > Settings > General > Attribute-based access control and choose the attributes every room must carry in Attributes required in all ABAC rooms. While enforcement is on, rooms without the required attributes are locked: nobody can post in them or be added to them, a callout replaces the composer, and discussions are turned off until enforcement ends. Direct Messages (DMs), Omnichannel conversations, and federated rooms are never locked. Default and team default rooms can now carry ABAC attributes, and new users and team joins are added only to the attributed rooms they qualify for. (#42850, #42366, #42244, #42275, #42308, #42323, #42672)

  • Added ABAC-managed channels and teams. Create channel and Create team now offer an ABAC managed option that walks users through choosing attributes and previews which members will be added before the private room or team is created. It requires the new Create ABAC-managed rooms permission (create-abac-managed-room), granted to users by default, and users can assign only attribute values they hold, or, with Virtru, values Virtru entitles them to. Members who do not qualify are skipped and reported. (#42522, #42523, #42524)

  • Added room attribute editing with a membership impact preview. Users with the new Edit room ABAC attributes permission get an Attribute-based access control panel in private channels and teams to view and change the room's attributes, and a room locked by enforcement offers them Manage attributes in place of the composer. Before changes are saved, this panel and room editing under Manage > Workspace > ABAC > Rooms preview which members lose or keep access. (#42652, #42653, #42654)

  • Extended classification banners to every room and aligned ABAC with room operations and apps. The banner configuration accepts an optional list of banners for rooms that are not ABAC managed, such as DMs, discussions, and federated rooms, and rooms.info now returns only the banner that applies instead of exposing the configuration publicly. Converting a room to a team, a team to a channel, or moving a room into a team removes its ABAC attributes after a warning and records the change in the audit log, /invite-all-to and /invite-all-from skip and list members the room does not allow, and apps with the new abac.write permission can create attributed private rooms. (#42701, #42702, #42713, #42719, #42924, #42739, #42677)

  • Fixed ABAC audit log entries showing an empty room name when a user is removed by the Virtru sync or by attribute re-evaluation, or when the last attribute of a room is removed. (#42556, #42565)

  • Premium plan sign-in requirements. Moved LDAP and SAML login to Premium plans. LDAP and SAML login now require a license with the ldap-enterprise or saml-enterprise module, and the LDAP and SAML settings are locked without it. Workspaces without the module lose LDAP and SAML login when they upgrade to 9.0.0, so keep a Premium license, or make sure an admin account can sign in another way, before upgrading. (#41643)

  • Moved custom OAuth to Premium plans. Custom OAuth services under Manage > Workspace > Settings > OAuth now require the oauth-enterprise license module. Without it, every custom OAuth service is disabled, custom OAuth logins are refused, and adding a custom OAuth service returns an error. Built-in providers such as GitHub, GitLab, and Google are not affected. (#42477)

  • Fixed a NoSQL injection in the Omnichannel department and visitor autocomplete endpoints, which now ignore the conditions part of the selector parameter and use only the search term and exceptions. (#41898)

  • Fixed chat.sendMessage accepting message fields that only the server may set and malformed message blocks that could make a room unreadable. chat.sendMessage and chat.postMessage also drop Markdown trees placed inside attachments. (#42975)

  • Fixed UiKit image URLs being usable to inject CSS, and UiKit buttons in messages sending interactions to an endpoint other than the app interaction endpoint when the block has no valid app ID. (#42640, #43036)

  • Fixed message edits and deletions received from federated rooms being applied without checking them against the Matrix rules, and Matrix federation answering every /.well-known path, which hid other discovery documents the workspace serves there. New federated rooms now use room version 11. (#42927, #43147)

  • Updated third-party dependencies flagged by security advisories, including axios, undici, compression, launch-editor, markdown-it, proxy-addr, joi, and cookie. Image dimension detection now uses sharp instead of image-size. (#43033, #43052, #43063, #42475, #42597, #42637, #42599, #42077, #42728)

Messaging and Collaboration

Features and fixes related to messaging, channels, discussions, and communication workflows.

  • Added native LiveKit video conference calls. Admins can enable LiveKit as a built-in video conference provider under Manage > Workspace > Settings > Conference call > LiveKit with a server URL, API key, API secret, and access token lifetime. It is off by default, is offered only while the conference window is enabled, and requires the video-conference-native license add-on. Calls add mute reminders, video quality options, spotlight and sidebar layouts, a Connection info panel, reactions, and a raised-hands queue, and the video call button is disabled with Join this room to start a call while a room is only being previewed. (#42437, #42439, #42443, #42663, #42666, #42644, #42645, #42691, #42643, #42696, #42697, #42692, #42642, #42557, #43071)

  • Added a native XMPP server for federation. Rocket.Chat can now federate directly with other XMPP servers: users can message any XMPP address, exchange presence, and join remote rooms, and remote XMPP users can join dedicated XMPP rooms. The server runs as a separate microservice and is configured under Manage > Workspace > Settings > Federation > XMPP Server (Native). (#42501)

  • Added admin control over user status. Manage > Workspace > Status and presence now has Settings, Custom status, and User status tabs, where admins can turn a user's status off or hide it from chosen people, also while editing a user. A Show status setting turns status off for the whole workspace, and all of this is behind the Manage user status setting, which is off by default. A user whose status is turned off always appears offline and cannot change it. (#42050, #42066)

  • Redesigned the user card and the user information panel. Hovering a message author's name or avatar, or a mention, opens the redesigned user card, and clicking opens the user information panel, now called Full profile. Roles are grouped by workspace and room scope and shown in the message header as one tag per scope, such as Admin +2, and the user actions menu is grouped by purpose. Video calls can be started from the user card without an existing DM, and a user's own card no longer offers Mute, Remove from room, or Ban. (#42628, #42510, #42646, #42509, #42535, #42499, #42503, #42505, #42506, #42500, #42507, #42508, #42518, #42519, #42598, #42627, #42662, #43197, #42970, #43194)

  • Added AI search filters and error messages. Users with the AI search feature preview can narrow results with Room, From, Before, and After filters. When AI search fails, the top bar search and the results view now say that AI search is unavailable or not configured, and tell admins whether the pipeline rejected the credentials, could not be found, or did not respond, with a link to AI center. (#42720, #42320, #42733, #42742, #42707)

  • Added the emojis from Emoji 17.0 to the emoji picker, shortcodes, PDF chat transcripts, and federated reactions. (#42363)

  • Added bulleted and numbered list buttons to the message composer. With the live message preview composer, code blocks added from the formatting toolbar, multi-line quotes, spoiler blocks, and editing a message without an extra new line now work as expected. (#42438, #42282, #42283, #42330, #42495, #42303, #42351, #42353, #42368)

  • Added a bubble to the sidebar room list that reads Unread mentions or More unreads when an unread conversation is scrolled out of view; clicking it scrolls to the nearest mention or unread room. The draft indicator tooltip now reads Draft or Thread draft, and the Create icon of the Sidebar Rail is updated. (#42572, #42641, #42967, #42731, #42828)

  • Changed English interface labels, including many setting names under Manage > Workspace > Settings, to sentence case, for example Allow anonymous read instead of Allow Anonymous Read. (#42040)

  • Removed the leftover Drafts group from the sidebar on workspaces upgraded from 8.5 to 8.7. An upgrade migration removes it from Sidebar sections order in Default User Preferences and from each user's sidebar categories. (#42496)

  • Fixed several room and message list issues. The new messages button keeps working after the first use, copied text no longer includes the quick-reaction emojis of the message toolbar, room history no longer gets stuck after importing messages with invalid timestamps, presence indicators keep updating after a reconnection, DMs show the user status instead of @ in search and the sidebar, and the composer no longer stays a loading skeleton when an embedded DM is opened by username. (#42359, #42504, #42596, #42751, #42962, #42358, #42462)

  • Fixed the Directory crashing with an invalid time value when a room's last message has no timestamp. (#40584)

  • Fixed audio and video attachments served through the Amazon S3 or Google Cloud Storage proxy not showing their duration and progress or allowing seeking, images dragged from a message into the composer being added twice, and aborted uploads leaving a temporary file on the server. (#42232, #42429, #42571)

  • Message rendering and preferences. Added nested lists and code blocks fenced by four or more backticks to messages, so a code block can contain a triple-backtick fence, and mentions and link previews work inside nested list items. Link tooltips no longer show stray slashes, and custom emoji in the sidebar preview no longer fall back to a native emoji with the same name. (#42686, #43059, #42722, #42846)

  • Fixed saving the Don't ask me again list in My Account > Preferences, which stored broken entries after an item was removed. (#42616, #42427, #42473, #42610)

  • Keyboard and accessibility. Updated the sidebar, side panel, navbar search results, composer suggestion popups, and the Members, Files, Canned Responses, and ongoing calls lists to share one row design. Room search keeps a single highlighted row and Enter opens the row under the pointer, and these lists, along with Outlook events, are a single tab stop navigated with the arrow keys. (#42819, #42818, #42820, #42832, #42829, #42831, #42840, #42901, #42903, #43017, #43196, #42563)

  • Improved keyboard navigation and screen reader support. The threads, discussions, pinned, starred, and mentions lists and both sidebars are now a single tab stop where the arrow keys move between rows, Tab walks the focused row's controls, and Escape returns to the row, and Tab in a message list now reaches the composer. Selects are announced by their visible label, and popups and the reaction emoji picker stay attached to their anchor while scrolling. (#42842, #43061, #43162, #43087, #42554, #42286, #42632, #43156, #43103)

  • Voice calls. Added the Share screen in voice calls permission (allow-screen-share-voice-calls) under Manage > Workspace > Permissions, granted to the admin and user roles by default, to control who can share their screen in a voice call. Users without it can still see screens that other participants share. (#41946)

  • Fixed several voice call issues. The voice call icon in a DM is offered only when the other user has a phone extension while internal calls are routed through SIP, a transferred incoming call shows Connecting, external calls play the ringing sound only after the server has placed the call, and a DM no longer shows calls from another session of the same user. (#40862, #41224, #41282, #41892, #42673)

  • Fixed room history not loading and voice calls crashing the web client on workspaces opened over plain HTTP instead of HTTPS. (#41708, #42660)

  • Omnichannel and Livechat. Changed the default of the Omnichannel enabled setting (Livechat_enabled) to off, so new workspaces must turn on Omnichannel under Manage > Workspace > Settings > Omnichannel. Existing workspaces keep their current value on upgrade. (#42469)

  • Removed the deprecated DELETE /v1/canned-responses endpoint that took the ID in the request body. Integrations must use DELETE /v1/canned-responses/:_id; canned responses in Omnichannel are unchanged. (#41977)

  • Fixed Livechat transcript PDFs being uploaded empty or truncated to one of the two rooms they are sent to, and the Source filter of a contact's history in Contact Center being ignored on licensed workspaces. (#42337, #43042)

Platform and Extensibility

Developer platform, APIs, integrations, and application framework improvements.

  • Added new UiKit blocks and elements. Apps can now use the header, markdown, table, video, and context_actions blocks, feedback buttons, a date-time picker, number, email, and URL inputs, conversation selects with initial selections, and the focus_on_load and accessibility_label options. Modals now close on a modal.close response, unsafe button URLs are ignored, callouts render in banners and messages, and input and icon button labels are announced to screen readers. (#42562, #42854, #42550, #42553, #42558, #42560, #42564, #42567, #42853)

  • Made the Rocket.Chat JavaScript DDP SDK the official SDK for realtime clients. It reconnects with increasing delays by default, logs in again and restores subscriptions after a reconnection, and fails calls lost with the connection instead of leaving them pending, and new connection options control whether lost calls are resent and whether a refused session logs the account out. (#42953, #43083, #43085, #43089)

  • Aligned spacing across the web client with the design system scale, which shifts many screens by 1 to 4 pixels, and spacing now stays in pixels when users change the font size in My Account > Accessibility and Appearance. Fuselage design system components no longer accept layout styling options from their callers, which affects external projects built on the Fuselage package. (#42974, #43100, #43195, #43021, #43037, #43047, #43146, #43157, #43158, #43188)

  • Breaking API changes. Changed REST API status codes to match their meaning. Requests without a session now receive 401 with error-unauthenticated, and requests from users without permission receive 403, with error-not-authorized moving from 400 to 403. 401 responses no longer include the legacy status and message fields, validation failures always report error-invalid-params, and chat.sendMessage rejects fields it does not support. Integrations that check these status codes or fields must be updated. (#43138)

  • Removed deprecated Meteor (DDP) methods. 157 realtime methods that the web client no longer uses are removed, together with the methods for sending a file message and for adding, updating, and deleting custom sounds. Integrations and SDK clients that still call them receive a method-not-found error and must switch to the matching REST endpoint listed in the GitHub release notes. (#40656, #40288, #40883, #40476, #42684)

  • REST API updates. Added userIds and usernames arrays to channels.invite, so several users can be invited in one request, as with groups.invite. A request must identify users either by ID or by username, not both. (#43005)

  • Improved REST API contract accuracy. The count and offset pagination parameters must be non-negative integers, responses hold at most the number of items set by API_Upper_Count_Limit, endpoint types now match the implementation (for example, chat.getDeletedMessages returns only IDs), and the generated OpenAPI document is served as version 3.1 with per-parameter descriptions. (#42863, #41638, #42181, #42874)

  • Changed the POST /v1/push.token response to return flat tokenValue and tokenType fields instead of a nested token object, and VoIP push tokens are now stored separately from device tokens. Mobile or custom clients that read the nested token must be updated. (#41382, #42071)

  • Fixed im.create and dm.create creating a DM without members when a requested username does not exist; they now fail with error-invalid-user. (#42278)

Data, Storage, and Infrastructure

Database, performance, storage, and system-level improvements.

  • Updated the official Docker images to Node.js 24.22.1 and moved the Debian-based image from bullseye to bookworm, fixing a Brotli decoder vulnerability (CVE-2026-111497). The supported Node.js range for manual installations is unchanged. Self-hosted operators on the official Docker images get the new runtime by pulling the latest tag, with no compose or environment changes. (#43031)

  • Dropped unused MongoDB indexes on the visitors, sessions, subscriptions, read receipts, moderation reports, and statistics collections during the upgrade to 9.0.0. Nothing changes in the interface, and large workspaces may notice the index changes during the first startup. (#41974, #38572)

  • Changed the default of the MESSAGE_MAX_PARSE_LENGTH environment variable to 10,000 characters, so longer messages render as plain text instead of formatted Markdown. Workspaces with the default Message_MaxAllowedSize of 5,000 characters are not affected; set the variable higher, or to 0, to restore unlimited parsing. (#42573)

  • Fixed the retention policy failing on rooms with a large message backlog: messages are now pruned in batches, a failing room no longer stops the run, and read receipts of pruned messages are removed. The retention warning in rooms now shows the message age when the TTL settings come from environment variables; if the variable was removed before upgrading, save the setting once. (#42410, #41968)

  • Fixed realtime updates in microservices deployments. Updates from the main process, such as canned response changes, import progress, and typing indicators, now reach clients and federated rooms, and the DDP Streamer service no longer leaks memory on long-lived connections and keeps accepting websocket connections when client versions fail to load at startup. (#42415, #42032, #42174, #42336)

  • Fixed outbound requests, such as SAML metadata fetches and public import file downloads, keeping connections open after an error response or redirect. (#42709)

Admin, Configuration, and Workspace Management

Administrative controls, configuration settings, and workspace management improvements.

  • Added multiple phone numbers per user. Users can now have several phone numbers, each with an optional label, edited in the user profile and under Manage > Workspace > Users. The phone field on user records is replaced by a phones list and existing numbers are migrated on upgrade, so integrations that read or write phone must use phones. (#40697, #43161)

  • Removed Meteor from the web client. Custom scripts under Manage > Workspace > Settings > Layout > Custom Scripts that use the Meteor client API stop working and must read the user ID and token from local storage and call the REST API instead. The Use Rocket.Chat SDK setting is removed, logging out one device in Device management no longer logs out the other sessions, and a transient error during session resume no longer logs the user out. Rocket.Chat Desktop now receives server information, the unread badge, presence, and login state from the web client through a versioned connection. (#42979, #43064, #42331, #42362, #42380, #42968, #43018, #42916, #42920, #42921, #43006)

  • Renamed the user freeSwitchExtension attribute to sipExtension, since the VoIP extension works with any SIP router. Existing users are migrated on upgrade, and REST integrations must use the new name in users.create, users.update, users.info, and returned user objects. (#42568)

  • Changed incoming and outgoing webhook scripts under Manage > Workspace > Integrations to run as written instead of being transpiled with Babel. Class method bodies now run in strict mode, so scripts that rely on implicit globals, this in nested functions, arguments.callee, octal literals, or duplicate parameter names must be updated. (#40142)

  • Removed the WebDAV integration, including the Webdav Integration settings, the WebDAV file upload storage option, user WebDAV accounts, the WebDAV file picker in the composer, and the WebDAV REST endpoints. The settings are cleared on upgrade. (#40856)

  • Removed the unsupported Rocket.Chat Federation and Matrix Bridge sections under Manage > Workspace > Settings > Federation, including the Check configuration action; their settings are deleted on upgrade. Native Federation is the supported option. (#41908, #41940)

  • Removed the built-in Gravatar integration. New users get an uploaded or OAuth-provided avatar, or otherwise the initials avatar, existing avatars are kept, and workspaces that want Gravatar can install the Gravatar app from the Rocket.Chat Marketplace. (#42011, #43200)

  • Removed the legacy GCM push settings under Manage > Workspace > Settings > Push because Google shut down the provider. Android push notifications keep working through the push gateway or the FCM credentials. (#41899)

  • Removed the FileUpload S3 SignatureVersion setting under Manage > Workspace > Settings > File Upload > Amazon S3. It is deleted on upgrade, and uploads to Amazon S3 keep working. (#41809)

  • Removed the Disable Statistics Generator and Disable Workspace Sync settings under Manage > Workspace > Settings > Troubleshoot. They are deleted on upgrade. (#41896)

  • Fixed LDAP Test Connection and Test LDAP Search under Manage > Workspace > Settings > LDAP hiding bind failures and unreachable servers; both now show the server's error, and the search test distinguishes no user found from more than one. Sync Now reports when nothing is enabled to sync or why the sync failed, and background sync skips users it cannot map instead of stopping. (#42529, #42590, #42618, #42668)

  • Fixed the email field in the Invite members panel under Manage > Workspace > Users not filling the panel width. (#43198)

For more detailed information, check our GitHub release notes.

Rocket.Chat versions receive support for six months after release. End-of-life for any version is the last day of the month when support ends.