- Added Virtru as an external attribute store for ABAC, introduced a unified presence sync engine, and a new rooms.join API to join any room type
- Strengthened security with full Apple sign‑in token validation, prototype‑pollution protection, SSRF fix, stricter auth on file deletion and workspace fingerprint, plus HTML escaping in exports
- Migrated many DDP methods to REST endpoints (with deprecation logs) and fixed issues such as S3 upload failures, memory leaks, auto‑translate activation, and UI stability
8.6.0
Official Rocket.Chat changelog summary with source attribution, release tags, and community reactions.
Track this Rocket.Chat release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Rocket.Chat release note into a weekly digest for the tools you actually use.
Create digestMore Rocket.Chat changelog updates
Bumped @rocket.chat/meteor version.
Added per‑client rate limiting to the unauthenticated `sendForgotPasswordEmail` method, aligning it with the REST `users.forgotPassword` endpoint.
Added per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST endpoint