- Implemented configurable SSRF validation with internal IP/DNS rebinding protection, workspace allowlist, and tighter federation email‑domain checks; added 2FA/account‑status enforcement for enterprise DDP login and other security hardeni...
- Extended Apps Engine with multiple file uploads, a new uploads.delete endpoint, file metadata for multi‑file messages, standardized '@' prefix for usernames, and improved OpenAPI handling of multiple methods per path.
- Raised minimum supported MongoDB version to 8.0, introduced a TTL index to auto‑expire statistics after one year, and resolved numerous security and reliability bugs (rate‑limited email verification, blocked messages to archived rooms, c...
8.2.0
Official Rocket.Chat changelog summary with source attribution, release tags, and community reactions.
Track this Rocket.Chat release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Rocket.Chat release note into a weekly digest for the tools you actually use.
Create digestMore Rocket.Chat changelog updates
Bumped @rocket.chat/meteor version.
Added per‑client rate limiting to the unauthenticated `sendForgotPasswordEmail` method, aligning it with the REST `users.forgotPassword` endpoint.
Added per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST endpoint