Rocket.Chat 8.3.8
Patch release with security fixes including per-client rate limiting for forgot password endpoint, SSRF protection in file downloads, and fixes for special character escaping in Omnichannel visitor names.
Engine versions
- Node:
22.16.0 - Deno:
1.43.5 - MongoDB:
8.0 - Apps-Engine:
1.61.1
Patch Changes
-
Bump @rocket.chat/meteor version.
-
(#41855 by @dionisio-bot) Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint
-
(#41844 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
-
(#41863 by @dionisio-bot) Replace http with serverFetch in downloadPublicImportFile to add SSRF protection
-
(#41826 by @dionisio-bot) Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview
-
Updated dependencies []:
- @rocket.chat/core-typings@8.3.8
- @rocket.chat/rest-typings@8.3.8
Source: original entry ↗