- Tightened security across authentication and data handling: OAuth tokens revoked on user deactivation, visitor tokens removed from livechat info, image URLs sanitized, and stricter validation for SAML, OAuth scopes, and file uploads.
- Introduced several new features: a Drafts sidebar group, optional room‑scoped search index via USE_ROOM_SEARCH_INDEX, REST endpoints for custom sound creation/update with strict validation, expanded ABAC admin UI and permissions, freeSwi...
- Breaking/deprecation updates: older custom sound Meteor methods are deprecated, autotranslate.translateMessage now requires room access, and visitors.info no longer includes a token, requiring integration adjustments.
8.5.0
Official Rocket.Chat changelog summary with source attribution, release tags, and community reactions.
Track this Rocket.Chat release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Rocket.Chat release note into a weekly digest for the tools you actually use.
Create digestMore Rocket.Chat changelog updates
Bumped @rocket.chat/meteor version.
Added per‑client rate limiting to the unauthenticated `sendForgotPasswordEmail` method, aligning it with the REST `users.forgotPassword` endpoint.
Added per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST endpoint