- Enhanced OAuth security with a fully server‑side flow, built‑in CSRF/state/PKCE protection, mandatory 2FA for provider logins and a toggleable modern flow setting.
- Added major features such as AI Search with semantic results, FIPS‑compliant mode, offline‑license flag, persistent audio player, alternative apps runtime, inline JSON validation, native Unicode emojis, and numerous new REST endpoints re...
- Fixed many race conditions and stability issues (login token races, Slack importer file handling, password‑policy limits, business‑hour and encryption key races), and deprecated the logoutCleanUp DDP method in favor of server‑side handling.
8.7.0
Official Rocket.Chat changelog summary with source attribution, release tags, and community reactions.
Track this Rocket.Chat release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Rocket.Chat release note into a weekly digest for the tools you actually use.
Create digestMore Rocket.Chat changelog updates
Bumped @rocket.chat/meteor version.
Added per‑client rate limiting to the unauthenticated `sendForgotPasswordEmail` method, aligning it with the REST `users.forgotPassword` endpoint.
Added per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST endpoint