Rocket.Chat 8.2.8
Patch release with security improvements including rate limiting on the unauthenticated sendForgotPasswordEmail method, SSRF protection in file downloads, and fixes for special character escaping in Omnichannel. Also updates Node, Deno, MongoDB, and Apps-Engine engine versions.
Engine versions
- Node:
22.16.0 - Deno:
1.43.5 - MongoDB:
8.0 - Apps-Engine:
1.60.1
Patch Changes
-
Bump @rocket.chat/meteor version.
-
(#41856 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
-
(#41849 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
-
(#41864 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
-
(#41840 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
-
Updated dependencies []:
- @rocket.chat/core-typings@8.2.8
- @rocket.chat/rest-typings@8.2.8
Source: original entry ↗