BigBlueButton 2.6.2 → 3.0.39
72 releases · 11 breaking changes · 88 security fixes · 39 advisories fixed
88security11breaking1deprecated171feature719fix
Vulnerabilities fixed by this upgrade
- 5.4 GHSA-5p2g-ff34-ghm3 Breakout room access is not revoked after a participant is removed
- 3.1 GHSA-x795-r9c3-rh9q Whiteboard annotation authorship could be forged by a participant with whiteboard access
- 7.3 GHSA-h6m5-4xgx-pvpp Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player
- 4.3 GHSA-52cv-pvw8-89c6 Hidden user list can be bypassed through voice and reaction data
- 5.0 GHSA-rr62-cx93-4fwh Unescaped poll text in presentation export enables SVG injection and server-side request forgery
- 4.3 GHSA-j5gq-h48h-23r4 Live meeting streams remain accessible to a removed participant
- 4.3 GHSA-gjvc-jq4g-58xp BlockNote shared notes accessible to non-members of a meeting
- 9.0 GHSA-f6gw-hpfv-5gxg Command Injection through "destination_number"
- 7.0 GHSA-49qg-pcv3-r2g6 Unauthenticated access to a meeting's audio conference
- 5.4 GHSA-j43j-jmqf-2fg6 Missing server-side enforcement of the maximum number of custom poll options
- 7.6 GHSA-8p8h-cw52-x467 GetJoinUrl Parameter Injection and Checksum Pollution
- 4.3 GHSA-mvx6-hg8v-3x4j Cross Meeting Page IDOR
- 4.3 GHSA-9v52-vhvw-4w5c Cross-Meeting Presentation Injection Due to an Unbound Upload Token
- 7.1 GHSA-g92v-3w29-55rh Cross-meeting audio access via unvalidated voice bridge
- 9.6 GHSA-v28f-mvg5-mv7m Arbitrary local file read via crafted SVG presentation upload
- 9.8 GHSA-q8vx-4cgc-7w4w Improper Authentication through /api/join via POST parameter "auth"
- 9.9 GHSA-h2rp-mcch-vgh9 Stored XSS in annotation through /graphql via GraphQL Mutation "url"
- 10.0 GHSA-4g74-4wqf-fr8c Path Traversal through etherpad-lite
- 5.4 CVE-2026-55491 Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
- 4.9 CVE-2026-55489 IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
- 7.1 CVE-2026-46355 Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
- 8.5 CVE-2026-46682 Blind SQL Injection AUTH (Moderator)
- 8.1 CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl
- 6.8 CVE-2026-46404 Presentation URL Security Hardening
- 8.1 CVE-2026-46351 Insecure Randomness allows to guess user's conference session token and impersonate them
- 8.9 CVE-2026-27737 Stored XSS in bbb-playback replay
- 6.5 CVE-2026-41127 Missing authorization allows viewer to inject/overwrite captions
- 4.3 CVE-2026-41126 Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL"
- 6.1 CVE-2026-27736 Open Redirect vulnerability in ApiController
- 2.0 CVE-2026-27467 Audio from participants to the server initially unmuted
- 7.2 CVE-2026-27466 Exposed ClamAV port allowing denial of service
- 7.1 CVE-2025-55200 Stored XSS via name of user at Shared Notes
- 7.5 CVE-2025-61601 DoS via PollSubmitVote GraphQL mutation leads to BigBlueButton server crash
- 7.5 CVE-2025-61602 Reacting to messages can make the chat unusable.
- 3.7 CVE-2024-39302 Some bbb-record-core files installed with wrong file permission
- 4.6 CVE-2024-38518 API Additional Parameters Considered
- 6.3 CVE-2023-43797 Stored XSS at Guest Lobby
- 5.6 CVE-2023-43798 Blind SSRF When Uploading Presentation (mitigation bypass)
- 4.8 CVE-2023-33176 Blind SSRF When Uploading Presentation
Breaking changes
- breaking Ref(html5): Remove non-used settings in 3.0.25
- breaking indirectly: * fix(tldraw): remove unnecessary extra zoom call + in 3.0.19
- breaking fix (gql-server): Remove length-constrained user columns (for values provided via API or config) in 3.0.16
- breaking Refactor (html5): Remove Subscriptions and Add Conditional Execution for Performance Optimization in 3.0.14
- breaking refactor (gql-server): Remove unused indexes from the bbb_graphql database in 3.0.12
- breaking fix (gql-server): Remove unused voiceConf fields from Graphql and fix UserVoice race condition in 3.0.8
- breaking cleanup (gql-server): Removes graphql Type meeting_metadata in 3.0.8
- breaking Recording: Remove 'duration' lines from ffmpeg playlist in 3.0.8
- breaking refactor (bbb-html5): Remove unused fields from breakoutRoom subscriptions in 3.0.7
- breaking SMALL FIX : Remove duplicate jobId in logger in 3.0.5
- breaking remove: Clean up after user feedback form removal in 3.0.5
Security changes
- security Command Injection through "destination_number" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-f6gw-hpfv-5gxg in 3.0.38
- security Unauthenticated access to a meeting's audio conference https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-49qg-pcv3-r2g6 in 3.0.38
- security BlockNote shared notes accessible to non-members of a meeting https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gjvc-jq4g-58xp in 3.0.38
- security Live meeting streams remain accessible to a removed participant https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5gq-h48h-23r4 in 3.0.38
- security Unescaped poll text in presentation export enables SVG injection and server-side request forgery https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rr62-cx93-4fwh in 3.0.38
- security Hidden user list can be bypassed through voice and reaction data https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-52cv-pvw8-89c6 in 3.0.38
- security Breakout room access is not revoked after a participant is removed https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5p2g-ff34-ghm3 in 3.0.38
- security Whiteboard annotation authorship could be forged by a participant with whiteboard access https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x795-r9c3-rh9q in 3.0.38
- security Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h6m5-4xgx-pvpp in 3.0.38
- security Fixes GHSA-mvx6-hg8v-3x4j: Cross Meeting Page IDOR in 3.0.37
- security Cross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh in 3.0.37
- security Cross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c in 3.0.37
- security GetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467 in 3.0.37
- security Improper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p in 3.0.37
- security fix(sec): harden static asset path resolution by @prlanzarin https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c in 3.0.35
- security fix: Block embeddable shape types in whiteboard annotations by @Tainan404 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h2rp-mcch-vgh9 in 3.0.29
- security fix(bbb-web): Reject GET-Only Endpoint Requests With Request Bodies by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q8vx-4cgc-7w4w in 3.0.29
- security fix(playback): prevent stored XSS in recording playback by @germanocaumo https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9 in 3.0.29
- security fix(akka-apps): Verify Meeting ID on Presentation Delete Message by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g in 3.0.29
- security Missing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33 in 3.0.24
- security Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8 in 3.0.24
- security fix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will… in 3.0.23
- security fix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026 in 3.0.23
- security Fix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026 in 3.0.22
- security [3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026 in 3.0.22
- security fix(bbb-web): Prevent Checksum Bypass With PresentationUploadExternalUrl contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff will be made public not earlier than Feb 10, 2026 in 3.0.21
- security fix(bbb-web): Use Secure PRNG for ID and Token Generation contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h will be made public not earlier than Feb 10, 2026 in 3.0.21
- security fix(audio): ensure MediaStreamTrack is disabled on first join + mute contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8 will be made public not earlier than Feb 10, 2026 in 3.0.20
- security fix(bbb-web): Ignore ErrorRedirectUrl on Checksum Validation Failure contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx will be made public not earlier than Feb 10, 2026 in 3.0.20
- security [Snyk] Security upgrade lodash from 4.17.21 to 4.17.23 in 3.0.20
- security build: bbb-playback to 5.4.3 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv will be made public not earlier than Feb 2, 2026 in 3.0.19
- security Fixes GHSA-v28f-mvg5-mv7m: Arbitrary local file read via crafted SVG presentation upload in 3.0.16
- security [Snyk] Security upgrade axios from 1.8.3 to 1.12.0 in 3.0.15
- security refactor: remove emoji id from chat reactions contains a security fix. https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5m8m-h7fj-8wx6 will be made public circa Sept 1, 2025 in 3.0.13
- security fix (gql-actions): Add validation for mutation pollSubmitUserVote contains a security fix. https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5 will be made public circa Sept 1, 2025 in 3.0.13
- security [Snyk] Security upgrade form-data from 4.0.2 to 4.0.4 in 3.0.13
- security build: Bump bbb-pads to 1.5.4 contains a security fix. https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2 will be made public cicra Sept 1, 2025 in 3.0.13
- security Update SECURITY.md in 3.0.9
- security (html5) [Snyk] Security upgrade axios from 1.7.8 to 1.8.2 in 3.0.2
- security (gql actions) [Snyk] Security upgrade axios from 1.7.8 to 1.8.2 in 3.0.2
- security [Snyk] Security upgrade axios from 1.7.8 to 1.8.2 in 3.0.2
- security [Snyk] Security upgrade rubocop from 1.34.1 to 1.66.0 in 3.0.2
- security [Snyk] Security upgrade meteor-node-stubs from 1.2.10 to 1.2.12 in 2.7.16
- security [Snyk] Security upgrade axios from 1.7.7 to 1.7.8 in 2.7.16
- security export-ann: [Snyk] Security upgrade axios from 1.7.4 to 1.7.8 in 2.7.16
- security [Snyk] Security upgrade axios from 1.6.4 to 1.7.4 (test) in 2.7.13
- security [Snyk] Security upgrade axios from 1.6.4 to 1.7.4 in 2.7.13
- security [Snyk] Security upgrade @docusaurus/preset-classic from 3.0.1 to 3.5.0 in 2.7.13
- security [Snyk] Security upgrade axios from 1.6.4 to 1.7.4 (export-ann) in 2.7.13
- security [Snyk] Security upgrade rubocop from 1.31.2 to 1.32.0 in 2.7.9
- security fix(sec): fix(sec): API fix duplicates GHSA-4m48-49h7-f3c4 security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4 in 2.7.8
- security build(sec): set permissions for resque files [2.7] security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5966-9hw8-q96q in 2.7.8
- security [Snyk] Fix for 1 vulnerabilities in 2.7.8
- security [Snyk] Fix for 1 vulnerabilities in 2.7.7
- security [Snyk] Security upgrade sanitize-html from 2.7.1 to 2.12.1 in 2.7.5
- security [Snyk] Security upgrade axios from 1.6.0 to 1.6.3 html5 in 2.7.4
- security [Snyk] Security upgrade axios from 1.6.3 to 1.6.4 bbb-html5 in 2.7.4
- security fix(sec): validate URL for external upload of presentation https://github.com/bigbluebutton/bigbluebutton/commit/fd8c92714092b937dc1f099d2e9d0a72985cb738 security advisory will be published not earlier than Jan 31, 2024… in 2.7.4
- security fix(sec): filter tags in presentation name https://github.com/bigbluebutton/bigbluebutton/commit/59cdb136ad29859a3b6817ae56e83f057d44cf38 security advisory will be published not earlier than Jan 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-r3vv-c788-9fph in 2.7.4
- security [Snyk] Security upgrade axios from 0.26.0 to 1.6.4 bbb-export-annotations in 2.7.4
- security [Snyk] Fix for 2 vulnerabilities in 2.7.4
- security [Snyk] Security upgrade axios from 0.21.4 to 1.6.0 in 2.7.3
- security [Snyk] Security upgrade axios from 0.26.1 to 1.6.0 in 2.7.3
- security [Snyk] Security upgrade axios from 1.4.0 to 1.6.0 in 2.7.3
- security fix(sec): fix(sec): API fix duplicates GHSA-4m48-49h7-f3c4 security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4 in 2.6.18
- security [Snyk] Fix for 1 vulnerabilities in 2.6.18
- security build(sec): set permissions for resque files [2.6] security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5966-9hw8-q96q in 2.6.18
- security [Snyk] Security upgrade sanitize-html from 2.7.1 to 2.12.1 in 2.6.17
- security [Snyk] Security upgrade axios from 1.6.0 to 1.6.3 in 2.6.16
- security [Snyk] Security upgrade axios from 1.6.3 to 1.6.4 in 2.6.16
- security fix(sec) validate URL for external upload of presentation (backport to 2.6) https://github.com/bigbluebutton/bigbluebutton/commit/13657f1e6c988d717194f931e3bd16ea38d94b7b security advisory will be published not earlier than Jan 31, 2024… in 2.6.16
- security fix(sec): filter tags in presentation name (backport to 2.6) https://github.com/bigbluebutton/bigbluebutton/commit/08c838703793ac969e442d07486ff16e991ed40a security advisory will be published not earlier than Jan 31, 2024… in 2.6.16
- security [Snyk] Security upgrade axios from 1.6.0 to 1.6.4 export-annotations in 2.6.16
- security [Snyk] Security upgrade axios from 0.26.0 to 1.6.0 in 2.6.15
- security [Snyk] Security upgrade resque from 2.5.0 to 2.6.0 (backport) in 2.6.15
- security [Snyk] Security upgrade axios from 0.21.4 to 1.6.0 in 2.6.15
- security Fixes CVE-2023-43798: Blind SSRF When Uploading Presentation (mitigation bypass) in 2.6.12
- security fix(sec) (2.6): Getting wrong final URL (from redirect) on presentation upload expect a security advisory in mid September in 2.6.12
- security Fixes CVE-2023-43797: Stored XSS at Guest Lobby in 2.6.11
- security [Snyk] Security upgrade bbbevents from 1.2.0 to 2.0.0 in 2.6.11
- security Fixes CVE-2023-33176: Blind SSRF When Uploading Presentation in 2.6.9
- security fix(sec): SSRF fix expect a security advisory (4.8/10) to be published on June 20, 2023 or shortly after in 2.6.9
- security [Snyk] Security upgrade resque from 2.4.0 to 2.4.0 in 2.6.9
- security [Snyk] Security upgrade resque from 2.5.0 to 2.5.0 in 2.6.9
- security [Snyk] Security upgrade yaml from 1.10.2 to 2.2.2 in 2.6.6
Deprecations
- deprecated [3.0 external video share] remove deprecated parameters in 3.0.26
Every release in between
fixFix(html5): Move and add button are still shown if cursor is outside of the shared notes
other[3.0 presentation toolbar] fix: darkmode-aware CSS for infinite WB button
other[3.0]fix(waiting-users): order the guest lobby list by time of arrival
feature[3.0 WB] fix: add trailing to throttling for cursor updates
fixfix(video-provider): clear stale grid avatars when a presentation is open (3.0)
otherci(plugin/test): added test infrastructure for the plugins
other[3.0]test(breakout): stabilize lock-settings tests under load
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/25934
other[3.0 backport] fix: Upload error toast for a rejected presentation can't be dismissed and keeps reappearing
fixfix(akka-apps): Allow Locked Users to See Moderator Voice State
other[3.0]fix(export): render annotated slide backgrounds from the source PDF
other[3.0]fix(export-annotations):Fix export soft mask followups 30
fixfix(bbb-export-annotations): set xml:space through the XML namespace
other[3.0 backport] fix(bbb-export-annotations): prevent exported text overlap for width-constrained shapes
fixfix(recording): include sanitizeChatHTML in video playback
other[3.0 port] fix(recording): don't blank the presentation on screenshare-as-content
other[3.0 backport] fix(recording): use instance variable for segment break timestamp
other[3.0 port] fix(rap): hide every camera of a locked user in recordings- #25889
otherbuild(bbb-presentation-video): Update to 5.1.0-rc.4
otherbuild: Update bbb-playback from 5.4.7 to v5.4.8
otherdocs: Add recent releases in new-features.md
otherdocs: Catch-up on missed docs changes in BBB 3.0.33..39
otherbuild(deps-dev): bump postcss-selector-parser from 6.1.0 to 6.1.4 in /bbb-graphql-client-test
otherbuild(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /bbb-graphql-client-test
otherbuild(deps): bump sanitize-html from 2.17.6 to 2.17.7 in /bigbluebutton-html5
otherbuild(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /bbb-graphql-client-test
otherbuild(deps-dev): bump fast-uri from 3.1.4 to 3.1.7 in /bigbluebutton-html5
otherbuild(deps): bump qs from 6.15.2 to 6.16.0 in /bbb-shared-notes-server
otherbuild(deps): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-shared-notes-server
otherbuild(deps): bump colord from 2.9.2 to 2.10.0 in /bbb-learning-dashboard
otherchore: Merge 3.0.37 into v3.0.x develop
otherbuild(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-export-annotations
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /docs
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /bbb-learning-dashboard
otherbuild(deps): bump image-size and svgdom in /bbb-export-annotations
otherbuild(deps): bump image-size from 2.0.2 to 2.0.4 in /docs
otherbuild(deps): bump ip-address from 10.4.0 to 10.7.2 in /bbb-shared-notes-server
otherchore: Forward port BBB 3.0.38 into v3.0.x-develop
otherchore(client): bump tldraw to 2.0.0-alpha.36
+1 more item in the release notessecurityCommand Injection through "destination_number" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-f6gw-hpfv-5gxg
securityUnauthenticated access to a meeting's audio conference https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-49qg-pcv3-r2g6
securityBlockNote shared notes accessible to non-members of a meeting https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gjvc-jq4g-58xp
securityLive meeting streams remain accessible to a removed participant https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5gq-h48h-23r4
securityUnescaped poll text in presentation export enables SVG injection and server-side request forgery https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rr62-cx93-4fwh
securityHidden user list can be bypassed through voice and reaction data https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-52cv-pvw8-89c6
securityBreakout room access is not revoked after a participant is removed https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5p2g-ff34-ghm3
securityWhiteboard annotation authorship could be forged by a participant with whiteboard access https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x795-r9c3-rh9q
securityStored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h6m5-4xgx-pvpp
securityFixes GHSA-mvx6-hg8v-3x4j: Cross Meeting Page IDOR
securityCross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh
securityCross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c
securityGetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467
securityImproper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p
other[Backport of #25403] fix(data-consumption): prevent hook usage counter from going negative
fixfix: presentation download system message in chat export
featurefeat: Add support for custom text in the recording permission dialog
othertest: click the rectangle tool without opening the "More" geo popup
othertest(chat): wait for message state changes in deleted-message export test
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/25655 https://github.com/bigbluebutton/bigbluebutton/pull/25668
other[3.0 backport] core: Upgrade JVM Libraries and Applications to Java 21
fixfix(akka-apps): isolate failed database batch actions
otherbuild(freeswitch): v1.11.2 (up from v1.10.12)
other[3.0] build(freeswitch): v1.11.3 (up from v1.11.2)
otherdocs: iteration doc sync for 3.0.33
otherdocs: iteration doc sync for 3.0.36
otherbuild(deps): bump ip-address from 10.2.0 to 10.4.0 in /bbb-shared-notes-server
otherbuild(deps): bump fast-uri from 3.1.4 to 3.1.5 in /docs
otherbuild(deps-dev): bump fast-uri from 3.1.2 to 3.1.5 in /bbb-graphql-client-test
otherbuild(deps): bump sanitize-html from 2.17.4 to 2.17.5 in /bigbluebutton-html5
otherbuild(deps): bump brace-expansion from 1.1.13 to 1.1.18 in /docs
otherchore: use bbb- prefixed npm package names
otherbuild(deps): bump nanoid in /bigbluebutton-html5
otherbuild(deps): bump dompurify from 3.4.12 to 3.4.13 in /docs
otherbuild(deps): bump nanoid from 3.3.12 to 3.3.18 in /bbb-learning-dashboard
otherbuild(deps): bump js-yaml from 3.15.0 to 3.15.1 in /docs
otherbuild(deps): bump mermaid from 11.15.0 to 11.16.1 in /docs
otherbuild(deps): bump js-yaml from 3.15.0 to 3.15.1 in /bbb-learning-dashboard
otherbuild(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in /bbb-export-annotations
other[3.0]chore(core, client): bumped dependencies (snyk)- #25677
otherchore(core): [Fix bbb-web deploy script] modify directory navigation
other[3.0]chore(core): Grails 7.0.12 backport from BBB 4.0
otherchore: BigBlueButton 3.0.36 iteration
securityfix(sec): harden static asset path resolution by @prlanzarin https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c
otherchore: Update BigBlueButton release version to 3.0.34
fixfix(poll): drop out-of-range answerIds to avoid log noise
fixfix(html5): add real Panopto player to external video share
fixfix(html5): prevent crash from browser auto-translation
fixfix(video-provider): preview real user avatars in the camera overflow tile
fixfix(video): never let the grid overflow tile consume a camera slot, +
fixfix(quick-poll): keep parenthetical text in Smart Slides poll question
fixfix(html5): re-center microphone glyph in audio modal
fixfix(html5): correct recording timer when client clock is ahead of server
fixfix(html5): retry locale fetch on transient network failure
other[chore] fix children PropType in PresentationDownloadDropdownWrapper
fixfix: Presentation download: filename containing "&" is truncated and saved without its extension
fixfix: grid-aware resize snapping in camera dock
fixfix(html5): prevent white flash on slide change
fixfix: broadcast external video seek detected via onProgress discontinuity
otherBackport: "fix(audio): assorted fixes and improvements to LiveKit's floor manager"
fixfix(external-video): restore audio when autoplay starts the video muted
featurefeat(shared-notes): markdown export, init-from-markdown, and import modal
featurefeat: New useTimer hook
other[3.0] refactor(audio): better BBBLiveKit state reconciliation on reconnects, [email protected] #25550
othertest: add BlockNote shared notes e2e tests (backport of #25165)
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore: update SDK to version 0.0.103
featurefeat(plugins): support configurable button styles
featurefeat(plugin-sdk): add senderRole to useLoadedChatMessages
fixfix(akka-apps): [development] Correctly start bbb-apps-akka by creating symlinks
fixfix(bbb-web): Handle Null Meeting IDs on IsMeetingRunning Requests
fixfix(bbb-web): render a response when insertDocument body has no presentation module
fixfix(core): API parameter downloadable is not working
otherrefactor(bbb-web): process pre-uploaded slides async on a bounded pool
fixfix: MeetingActor analytics discards VoiceUserState.callerName, logs ERROR after user leaves
fixfix: The .csv export for LAD has the user 'Anonymous'
fixfix(recording): Ruby 3.2 File.exists? deprecation in BigBlueButton recording sanity worker
feature[3.0] build: Pull new image bumping Go and Nodejs
otherchore(bbb-conf): Add virtualBackgroundsDisabled to list of retired pr…
fixfix(document): add --build for development scripts of bbb-web
otherDocs: Add presentation parameter current
otherdocs: clarify allowOverrideClientSettingsOnCreateCall is a server setting, not a /create param
fixfix(docs): use valid font-weight for Open Sans SemiBold @font-face
otherDocs: Clarify voiceBridge range
otherdocs: Documentation catchup on 3.0 new features/configs since 3.0.28
+33 more items in the release notesfixfix(accessibility): change page title based on the content
fixfix(whiteboard): prevent crash when slide changes while a viewer is editing
fixfix(accessibility): Non-text contrast is insufficient
fixfix(shared-notes): prevent collaboration cursor name from leaking into links
fixfix: SVG support for notifications
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore: update SDK version for the last we have published
fixfix(bbb-graphql-server): lower connection_lifetime to limit Postgres memory growth
fixfix(bbb-export-annotations): rasterize background slides to prevent ODF export cropping (#25303)
fixfix(bbb-export-annotations): add viewBox to background slides missing one to prevent ODF export cropping
fixFix allowPromoteGuestToModerator
featureAdd analytics logging for breakout move-user request
otherSet MALLOC_ARENA_MAX=2 for bbb-web and bbb-apps-akka
otherchore: upgrade export-annotations dependencies
otherchore: upgrade bbb-shared-notes-server dependencies
otherbuild(deps): bump form-data from 3.0.4 to 3.0.5 in /bbb-learning-dashboard
otherbuild(deps): bump ws in /bbb-learning-dashboard
otherbuild(deps): bump ws from 7.5.10 to 7.5.11 in /docs
otherbuild: Bump Hasura from 2.48.14 to 2.49.3
otherbuild(deps): bump markdown-it from 14.1.1 to 14.2.0 in /bigbluebutton-html5
otherbuild(deps): bump form-data from 4.0.5 to 4.0.6 in /bigbluebutton-tests/playwright
fixfix(video-provider): show raised hand indicator on audio-only tiles
fixfix(chat): preserve text before links in reply message preview
featureAdd client setting to not display guest lobby position
fixFix breakout webcams only for moderator lock
fixfix(screenshare): keep startScreensharing name in minifier for tablet app
fixfix: Unified Layout: tile count plus aggregated users does not match total participant count (3.0)
fixfix(client): Accessibility updates
fixfix(html5): escape emoticon auto-conversion with a leading backslash
fixfix(audio): reinforce mute state on LK publish and reconnects
featurefeat(html5): Hide sessionToken from address bar
otherrefactor (graphql/html5): Always show most recently pinned user first, followed by the others
featureperf(html5): Enable json patch for GridUsers subscription (and reduce payload significantly)
otherstyle(client): Support plugin-specified button color in actions bar
othertest: updates to Whiteboard
otherwebpack: ignore .yalc/ from file watching and exclude tldraw from managed-path version caching for 3.0
otherTests: add Unified Layout minimize regression tests
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
featurefeat(plugins): stop screenshare and upload presentation
fixfix(presentation): snapshot of current slide is blank under cluster-proxy
fixfix(bbb-web): Return Better Errors From Presentation Upload
fixfix(akka, bbb-web): clientSettingsOverride fails silently
fixfix(shared-notes-server): export empty notes as a blank file, not an error
otherrefactor (gql-middleware): Enable the custom json patcher for subscriptions with user_camera type
featurefeat(LAD): add standalone build mode for LAD
fixfix(recording): reduce mem usage when audio cut extends into gap
fixrecording: Fix processing hangs from seeking in screenshare files with video
fixrecording: Fix hang in audio processing
featurefeat(recording): disable formats per meeting
otherbuild(bbb-web): Nginx cleanup
otherbuild(freeswitch): v1.11.1 (up from v1.10.12)
otherbuild(freeswitch): pick relevant changes from v1.11.0/1 into v1.10.12
otherdocs: Updated the options for the 'meetingLayout' parameter to include 'PARTICIPANTS_AND_CHAT_ONLY'.
otherdocs: Prepare docs changes for BBB 3.0.30
otherbuild(deps html5 client): bump launch-editor from 2.8.1 to 2.14.1 in /bigbluebutton-html5
otherbuild(deps-dev): bump launch-editor from 2.8.0 to 2.14.1 in /bbb-graphql-client-test
otherchore: Add SonarQube configuration for project analysis
otherchore: Merge 3.0.29 into v3.0.x-develop
otherchore: BigBlueButton 3.0.30 iteration
securityfix: Block embeddable shape types in whiteboard annotations by @Tainan404 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h2rp-mcch-vgh9
securityfix(bbb-web): Reject GET-Only Endpoint Requests With Request Bodies by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q8vx-4cgc-7w4w
securityfix(playback): prevent stored XSS in recording playback by @germanocaumo https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9
securityfix(akka-apps): Verify Meeting ID on Presentation Delete Message by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g
fixfix: bn- table crash with static toolbar
fixfix: activating the listen-in function results in an error (drop out of user from the breakout room)
fixfix (html5/shared-notes-server): Read-only fixes and new version for BlockNote
fixfix (html5/bbb-web): Preloading of slides not working for proxy setups
fixfix: Talking indicator some letters are cut off
fixfix (html5): Fix genaral blocknotes issues related with losing focus
fixfix(accessibility): settings dropdown keyboard navigation
fixfix (shared-notes-server): Simplify permission handling
fixfix (shared-notes-server): Badge not being showed when shared notes is changed (in BlockNote)
fixfix (shared-notes-server/cluster): Use $bbb_cors_origin for shared-notes-server Allow-Origin (CORS)
otherref: change text align select button to remove previous selector
featurefeat(livekit): add forceRelay/forceRelayOnFirefox settings, +
featurefeat(accessibility): add Esc shortcut to move focus in/out of the BlockNote shared notes editor
otherperf (html5): Improve video stream queries for server performance
featurefeat: Added patched flag to users basic info subscription
fixfix (tests): make Play/Pause test env-independent by comparing screenshots dynamically
fixfix(tests): stabilize "Upload multiple presentations" against toast race
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherrefactor (akka-apps / LAD): Improve session grouping after disconnect
otherrefactor(core): create public media groups groups lazily, +
otherperf (gql-middleware): improve json patcher, produce minimal patches via LCS-based move generation
featurefeat(core): recording parameter passthrough to breakouts
featurefeat(core): allow moderators to manage lock settings inside breakout rooms and optionally inherit parent meeting lock settings on creation
fixfix(core): breakout: propagate parent client settings override
fixfix(bbb-web): Enforce Presentation File Size Limits On All Paths
fixfix: Recordings break on nfs
otherRevert "fix: Recordings break on nfs"
fixfix(recording): address ffmpeg high memory usage from video PTS gaps
featurerecording: add internal docs for video edl/layout
otherbuild(shared-notes-server): Add postgresql-14 as a dependency in opts…
otherbuild(bbb-playback): Bump to bbb-playback to v5.4.7
otherbuild(deps): [email protected] (up from 2.17.1)
otherdocs: add CLAUDE.md with operational notes for the Docusaurus site
otherdocs: document bigbluebutton.properties additions in BBB 3.0.27
otherUpdate action text and documentation link
otherdocs: Add some missing properties of manifest.json in the docs
otherchore: update @bigbluebutton/tldraw from alpha.33 to alpha.34
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 2 updates
otherchore: update @bigbluebutton/tldraw from alpha.34 to alpha.35
otherbuild(deps): bump the npm_and_yarn group across 6 directories with 1 update
+8 more items in the release notesfixfix(html5): restore Ctrl+Z / Ctrl+Shift+Z in BlockNote
fixfix: Poll/quiz publishing does not show notification to viewers
fixfix: Guests note missing / disappearing
fixfix: lockSettingsHideUserList leaks usernames in the chat if a viewer was (temp) set to presenter
fixfix(client): Fix Android being too greedy with Safari user agent (fixes #24295)
fixfix: Fix performance issue with block-note dark mode
fixfix(breakouts): user id handling
fixFix(html5): Presenter whiteboard camera position moving on window resizing
fixfix: fix hardcoded colors scheme for exported notes.html
fixfix: bn- table crash with static toolbar
featurefeat: Enable users to pan outside the current presenters view during infinite whiteboard
otherrefactor(livekit): memoize useMediaSenders result (selective sub)
otherref: decrease size of block-note toolbar
fixfix (ci/tests): Stabilize cross-page slide comparison
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
fixfix(bbb-web): Add Callback URL Validation
otherrefactor (gql-middleware): Minor improvements
otherrefactor(bbb-web): Update Plugin URL Handling
fixfix (gql-server): Set typing=false once user edited a message
featurefeat: cache plugin manifest files with bbb-web
fixfix(presentation): Require SessionToken and PageToken on Presentation Page Requests
other[3.0 recording] fix: external video recording not shown after screenshare
fixfix(recording): add presentation minimized events + screenshare as content fixes
fixfix(recording): Fix events archiving on servers with blocknote
otherbuild: Update bbb-pads branch to v1.5.11
otherbuild: bump bbb-playback to 5.4.5
otherbuild: Update bbb-playback branch to v5.4.6
otherdocs(administration): fix typos in lti.md
otherdocs: rebuild "Other meeting configs available" table
otherchore: Migrate from deprecated GitHub Stale App to actions/stale, exempt milestone issues
otherchore: Replace defunct behaviorbot/welcome app with GitHub Actions workflow
otherchore: Expand welcome workflow first-time contributor detection
otheriteration: BigBlueButton 3.0.27
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 1 update
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 1 update
otherbuild(deps): bump ip-address from 10.1.0 to 10.2.0 in /bbb-learning-dashboard in the npm_and_yarn group across 1 directory
otherbuild(deps): bump the npm_and_yarn group across 4 directories with 1 update
otherbuild(deps): bump mermaid from 11.12.3 to 11.15.0 in /docs in the npm_and_yarn group across 1 directory
fixfix(html5): keep loading screen during graphql retries and show error screen on connection timeout
fixfix(html5): prevent pinch-to-zoom for viewers and WB users on touch devices
fixfix: suppress join/leave notifications for locked viewers when hideUserList is active
fixfix (html5): Export of Block Notes broken for cluster setup
fixfix: blocknote placeholder wrap when container size too small
other[3.0 port] fix: exclude audio-only tiles from SFU subscription and plugin buttons
featurefeat (html5): Implement static toolbar for BlockNote
deprecated[3.0 external video share] remove deprecated parameters
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore(livekit): enable reconnectOnFatalFailure by default
fixfix(livekit): dial-in unable to be heard by web users
other[3.0 port] fix(bbb-web): respond to /create before downloading pre-uploaded presentations
fixfix(bbb-web): Upgrade Dependencies
fixrecording: Fix hang when deskshare audio ends before video
fixfix (build): Install XDG_RUNTIME_DIR drop-in in Docker for bbb-shared-notes-server
otherdocs: Document lockSettingsHideViewersAnnotation /create parameter
otherdocs: Fix livekit setup commands
otherdocs: Mention sharedNotesEditor was added as a create param
otherdocs: Refactor/restructure BBB 3.0 api changes to be more readable
otherdocs: Fix - strings were being interpreted as True
otherdocs: Simplify bbb-web dev instructions
otherdocs: Document events.xml LayoutBroadcastedEvent addition
otherdocs: Fix typos and iterate over 3.0 docs
otherdocs: bump bbb version to 3.0.26
other[3.0 doc] Guide to use developing html5 client
otherci: bump GitHub Actions to Node 24 versions
fixfix(whiteboard): prevent presenter/viewer viewed-region desync after fullscreen
fixFix(html5): Make the cursor point respect the pointerDiameter setting
fixfix(html5): Notifications being clipped on mobile
fixfix(html5): fix question detection and indented option matching
fixfix: review breakout room moderator actions
fixfix: Breakouts: viewers sent to waiting lobby
fixFix(html5): WB camera position change on slide change when zoom applied
fixFix(html5): zoom with mouser wheel not being centered
fixfix: client crashes when a invalid layout is set in local storage(port to 3.0)
fixfix(html5, tests): only display allowed shapes in edit mode
fixfix(chat): display message timestamp using locale-aware time format
fixFix(html5): cursor zoom misalignment
fixFix(html5): cursor appearing on wrong position to viewers
fixfix: State events leak between user sessions or tabs
featurefeat: Block note integration
breakingRef(html5): Remove non-used settings
featurefeat: extend audio groups to cameras and screen sharing
otherrefactor(livekit): review camera and screen sharing quality presets and simulcast layers
featurefeat(livekit): option to use LiveKit as the client's audio state source
featurefeat(livekit): add a last N-like system to selective subscription (audio)
fixfix(livekit): only display screenshare volume control if there's audio
fixfix(livekit): use LK APIs for WebRTC stats gathering, fix edge cases
featurefeat(html5): Automate asset compression with Webpack
fixfix(html5): exclude .gz files from language selector list
otherRef(html5): Make webcam show ui on hover or touch hold
otherci: remove 3rd-party packages pull + install
othertests: update connection status tests
othertests: update flaky tests
fixfix(plugin-sdk): screenshare blocks snapshot of current slide for plugin-sdk
fixfix(plugin-sdk): Change loading value of a subscription when data didn't change
fixfix(LAD): Generic data keeps updating in plugin's table
featurefeat(plugin-sdk): Add svg icon for all extensible areas
fixfix(bbb-web): Disable External Entity Parsing in XML Services
featurefeat (bbb-web): Introduce a new /create param clientSettingsOverrideJsonUrl
fixfix(akka-apps): Remove Unnecessary Akka Apps Logging
fixfix(bbb-web): Upgrade Grails and Spring Boot
fixfix(bbb-web): Prevent SVGs From Being Generated With Zero Value Dimensions
fixFix(akka): Add Disable feature support for plugins
fixfix(LAD): Legacy dasboard data files not working with newer version of BBB
fixfix(recording): Address A/V sync issues, glitches on cuts, ffmpeg memory usage (audio)
+36 more items in the release notessecurityMissing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33
securityOpen Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8
fixFix(html5): The video preview and audio modals open even with the lock settings settings enabled
fixfix: trim spaces of external video url
otherUpdate external video label to remove unsupported platform
fixfix: WhiteBoard Ctrl+D work only once
fixfix: userdata-bbb_override_default_locale is ineffective in guest lobby
otherBreakouts: ensure moderator only functionality is not shown
featurefeat: Make webcamBackgroundURL available in breakouts
fixFix(html5): Space bar key problem on WB
otherstyle: Improve visual hierarchy and UX of guest lobby screen by @tylercopeland @ramonlsouza
fixFix(html5): Recalculate time sync when a new minimal rtt is available
fixfix: talking indicator behind webcam area - custom and smart layouts
fixfix(html5): session details closing when user talks
fixfix(whiteboard): scope slide zoom state to presentation id by @ramonlsouza @germanocaumo
otherrefactor(client): Reword You have been banned message
otherchore: temporarily disable breakout audio transfer UI when using LiveKit
othertest: add test cases for external video
fixfix (ci): attempt to fix: Error: Input required and not supplied: token for Cleanup Playwright reports workflow
otherci: avoid running GH workflows after PR is merged when it's not necessary at this point
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/24667 https://github.com/bigbluebutton/bigbluebutton/pull/24733
otherUpdates for project BigBlueButton v3.0 HTML5 client and language eu
fixfix (akka-apps): Prevent race condition when a user joins a breakout room
fixfix (gql-server): Not re-assigning users to their last breakout room
fixfix (akka-apps): not storing user activity for breakout rooms (only main meeting)
otherrefactor(core): Breakouts moderator vs viewer
otherrefactor: drop logging of password/authToken
securityfix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026
securityfix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026
fixfix: Additional checks in polls
securityfix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026
securityfix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will…
securityfix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026
otherchore(recording): Bump bbbevents to 2.0.3
fixfix(recording): Detect system sender correctly in breakouts recording
otherRecording: avoid short cuts in audio processing
otherbuild: require running redis for bbb-export-annotations.service
otherbuild: [email protected] (up from v1.9.9), [email protected] (up from v2.3.1), +
otherbuild: Update .gitlab-ci.yml with Go 1.26.0 and NodeJS 22.22.0
featureAdd firewalld support to apply-lib.sh
fixfix(conf): Avoid bbb-conf noise on empty bigbluebutton.properties
featurefeat(conf): Warn about retired bbb-web properties
+6 more items in the release notesfixFix(html5): Annotations get transferred to another presentation
otherrefactor: camera custom pagination settings
fixfix (html5): Always include presenter in cursors list
otherRefactor(html5): Improve deduplication logic for toastify
fixfix(audio): missing CC icon in talking indicator (mediasoup/FS)
fixfix: userdata-bbb_auto_share_webcam=true causes webcams to stay enabled when joining breakout rooms
fixfix: Leave meeting button oversize area
otherrefactor: remove unused component
fixfix: pushLayout default settings
fixfix: audio modal should have precedence over video modal
featureIntroduce showAudioOnlyOnFirstPage and maxAudioOnlyUsers settings
fixFix(html5): Eraser not being persisted in the batch
fixfix: audio-only tiles appear in all layouts
othertest(docs): Update README and remove config for browsers not fully supported
otherrefactor: Add data-test to a few user-list components
fixfix(workflow): Update publish-results workflow with robust PR resolution, cleanup, and in‑progress rerun handling
fixfix(workflow): Publish test-results under workflow ID
othertests: adjust toast element check
othertest(chore): [Snyk] Security upgrade axios from 1.12.2 to 1.13.5 https://github.com/bigbluebutton/bigbluebutton/pull/24632
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et https://github.com/bigbluebutton/bigbluebutton/pull/24600
otherrefactor (gql-middleware): Make message caches meeting-scoped
securityFix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026
fixfix(core): Fix transcription problem with multiple users speaking at the same time
fixfix(export): respect autoSize property for text annotations
otherchore(export-annot): Bump axios to 1.13.5 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24640
fix[3.0]docs: Fix broken links
otherdocs: Adjust wording of welcome message location
security[3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026
fixFix(html5): presentation moving to old position when enable infinite WB
fixFix(html5): missing space in some locales on waiting room queue
featurefeat(ci): Restore upload of merge HTML reporter to publish tests
fixfix(ci): refine conditions for publishing test results and handling blob reports
otherUpdates for project BigBlueButton v3.0 HTML5 client and language hu_HU
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar
securityfix(bbb-web): Prevent Checksum Bypass With PresentationUploadExternalUrl contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff will be made public not earlier than Feb 10, 2026
securityfix(bbb-web): Use Secure PRNG for ID and Token Generation contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h will be made public not earlier than Feb 10, 2026
fixfix (akka-apps): list of breakout rooms doesn't update when user is promoted/demoted
otherref(plugin): refactor the code of plugin logger to be more robust
fixfix(bbb-conf): Use turnutils_stunclient instead of old stun 0.97 client
otherbuild: Bump bbb-pads to 1.5.7
otherbuild: Bump bbb-pads to 1.5.8
otherdocs: Add docs for meta_analytics-callback-url
otherdocs: set a random domain as example in Docs
fixfix(livekit): trigger forced room reconnection on fatal errors
fixfix(livekit): frozen cams on reconn, camera bridge improvements
fixfix(livekit): frozen screen share on reconnects
other[3.0] fix(chat): audio alerts playing when panel is opened
fixfix: drop areas appearing when presentation is removed
fixfix (html5): Show chat message notification from html version of the message (instead of markdown)
fixfix: Virtual background image upload fails when userdata-bbb_hide_notifications is set to true
fixfix(html5/chat): Remove unstable chat scrolling log
fixFix(html5): chat counter stale due race condition on mark message as read
fixfix: Raise hand notification not working for second moderator
fixfix(html5): exclude worker.ts from ReactRefresh so hot reload can work
fixfix: Leave button opens empty dropdown
fixFix(html5): talking indicator being covered by webcam
otherrefactor(html5): Replace isMeteorConnected prop with isConnected across UI components
securityfix(audio): ensure MediaStreamTrack is disabled on first join + mute contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8 will be made public not earlier than Feb 10, 2026
fixFix(html5): moderators were unable to unlock users via the Raised Hand list.
fixfix(audio): legacy listen only broken due to undefined argument
fixFix(html5): Pinch zoom not propagating on WB
fixFix(html5): enforce meetingId filtering across user-related data streams
fixfix(plugins-sdk): compare generic content items by their id
featurefeat(plugin): Add nameSortable and bot in the UsersBasicInfo data hook
featurefeat(plugin): added z-index to floating-window
featurefeat: added more fields to useMeeting hook and created a projection feature
featurefeat(publish-reports): add action to publish Playwright reports to GitHub Pages
fixfix(workflows): update repository references for Playwright reports
fixfix(workflows): Add artifact existence check for test reports in automated tests workflow
featurefeat (gql-server): Add breakout room participant activity tracking
featurerefactor (gql-middleware): Reject new mutations once the rate limit is reached, instead of delaying them
featurechore (gql-middleware): Introduce a config to dump queries to files (for debugging)
fixFix(graphql-server): Change type of some breakout name related fields to text
securityfix(bbb-web): Ignore ErrorRedirectUrl on Checksum Validation Failure contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx will be made public not earlier than Feb 10, 2026
featurefeat(LAD/akka): Added new functions for the plugin to publish data to LAD
featurefeat: added fields IP, User-Agent, Referer and sessionToken to UserJoinedMeetingEvtMsg
fixFix(akka, html5): Prevent upload error notifications when converting breakout rooms with no changes
fixfix(bbb-web): Fallback to Using Blank Files if Page Downscaling Fails
featurerecording: Add archival of learning analytics dashboard
featurefeat(recording): Recording dynamic video
fixfix(recording): Add check for notes_id undefined in events_worker.rb
fixfix: Build replaces part of variable names with client version
security[Snyk] Security upgrade lodash from 4.17.21 to 4.17.23
+35 more items in the release notesfeaturefeat: Layout System Revamp (no dialog, intro of Unified layout)
featurefeat: Layout System Revamp (Camera sorting and pagination)
fixfix(client): Fix possible undefined function
fixfix(livekit): broken volume control for plugin SDK and away mode
fixfix(livekit): SIP calls aren't accepted w/o published audio tracks
fixfix(livekit): stricter measures to prevent publish-unpublish loops, +
fixfix: Lock Settings should not be visible in breakout rooms
fixfix: LiveKit token update fails on database
fixfix(html5/user-list): Append both user name and user id
fixfix(tldraw): remove unnecessary extra zoom call +
fixfix: Can't start a quiz with "true/false" or "yes/no/abstention" in languages other than english
otherstyle(poll): Increase visible area of typed responses
fixfix: unified layout updates
feature(tests): Add tests for "create breakout rooms" buttons
feature(tests): Add tests for breakout rooms sharing audio and video
feature(tests): Add test for "group parameters" (breakout room pre-selection)
feature[3.0] Adds the test upload multiple presentation on ci
otherchore(client): [Snyk] Security upgrade validator from 13.12.0 to 13.15.22
otherchore: Drop SVG presentation file support (client side)
otherUpdates for project BigBlueButton v3.0 HTML5 client and language tr
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ru
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et
otherrefactor(bbb-web): Remove Support For SVG Uploads
otherchore(bbb-graphql-actions): [Snyk] Security upgrade express from 5.0.1 to 5.2.0
fixfix(sec): core: Bump spring-data-commons from 3.4.4 to 3.4.10
fixfix(sec): core: bbb-web commons-validator bump from 1.7 to 1.10.0
otherchore(core): Bump scalaVersion from 2.13.9 to 2.13.18
fixfix(bbb-web): Fix defaultHTML5ClientUrl trailing slash
fixfix(sec): core: Update tika related bbb-web dependencies
fixfix(bbb-web/akka): Error while loading plugins
fixfix: Do not allow private chat in Breakouts if it the parent room had it locked
otherrefactor: move pinned notes notification to backend
breakingindirectly: * fix(tldraw): remove unnecessary extra zoom call +
otherbuild(livekit): [email protected], [email protected], [email protected], @livekit/[email protected]
otherbuild: make bbb-web nginx config not executable
otherbuild(livekit): [email protected] (up from v1.9.4)
otherbuild(bbb-webrtc-sfu): v2.21.1
securitybuild: bbb-playback to 5.4.3 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv will be made public not earlier than Feb 2, 2026
+3 more items in the release notesotherUpdates for project BigBlueButton v3.0 HTML5 client and language de
otherbuild(bbb-webrtc-sfu): v2.21.0
featurefeat: New raise hand experience
fixFix(html5): Normalize correct answer to match options in QuickPollDropdown
fixfix: chat alert styles
fixfix(html5): Notification bar positioning
fixfix: do not enforce muteOnStart on dial-in participants, make behavior configurable
fixfix(livekit): mitigate audio publish timeouts from overlapping calls
fixfix(html5/whiteboard): Wrap annotation removals into remote change
fixfix: When locked settings for shared notes are applied, links in shared notes don't open in new window
fixfix: Poll Custom input don't work with .txt file
fixfix(html5/chat): Can't remove reactions
fixFix(html5): External video modal no longer opens unexpectedly on presenter change
fixfix: presence label margin
fixfix(html5/whiteboard): Do not allow unwanted shape deletion (local-only)
fixFix(html5): duplicated session joining full audio
fixfix(audio): edge cases with permission reset and input device rollbacks
fixFix(html5): System messages in sequence did not display the time
fixfix(html5): prevent local state mutation causing desync on modal close
fixFix(html5): tldraw capturing link edit input events
featureFeat(html5): Move rtt-check fetch to a worker
fixFix(html5): Make the share webcam removes away status
featureRef(html5): Re-introduce raise hand audio notification and full user options for raised hand users list
fixfix(audio): broken mute toggle when using LiveKit
fixfix: add null safety check for breakout room join
feature(tests): Add test for "Data savings", webcam and screensharing
featureci (feat): New workflow "Cleanup caches after PR merge"
fixfix(layout/plugin): Fix blue screen when updating generic content
featurefeat: New styling for custom chat messages and permission for editing custom plugin messages
fixfix(plugins/data-channel): Fix multiple connections not receiving data from data-channel
fixfix: webcam plugin helper overlaps menu
fixfix(plugin/data-channel): Fix data-channel interface type
featurefeat: Add prop version to plugins manifest to avoid browser caching
featurefeat(plugin): private chat messages commands
fixfix: Remove invalid fields on publiccode.yml
fixfix (bbb-web): Fix timeout units for pdftotext and generateThumbnail (seconds passed instead of milliseconds)
fixfix (bbb-web): systemd-run failures caused by accumulated failed transient units
fixfix(bbb-web): Improve SVG Dimension Calculation Speed
featureupdate(recording): add LayoutBroadcastedRecordEvent to events.xml
featureLAD (feat): Add more data (notes and annotations) to LAD data file
featurefeat(LAD): Add new activity columns (wb annotations and shared notes)
featurerecording: Add support for multiple presets to 'video' recording format
+60 more items in the release notessecurityFixes GHSA-v28f-mvg5-mv7m: Arbitrary local file read via crafted SVG presentation upload
featurehtml5: Adds event required by BBB App when sharing screen
featurefeat(audio): implements client sound alert to mute/unmute and user settings to configure, when livekit is active
fixfix(livekit): indicate user has left audio in user list/camera containers
fixfix: sidekick content title not updating
fixfix(livekit): audio input switch fails while unmuted (Windows), +
fixfix(whiteboard): Add ability to limit history stack size
otherRename Leave session in breakouts to Leave breakout
fixFix(html5): enable client read of X-Server-Epoch-Msec on cluster for proper time sync
fixfix(whiteboard): Remove duplicate annotation subscription
fixfix(whiteboard): Avoid useless mutation call
fixFix(html5): Add min version before load bundle and show a error banner
fixfix: Multi user whiteboard number of participants can be incorrect
otherrefactor: use whiteboardWriteAccess flag for presentation permission check
fixfix(html5): Error notification bar appears when presentation is removed
featurefeat(html5): add showConnectionErrors to control shown error codes
fixFix(html5): Add optional chainning for some reported undefined cases
fixfix(html5): skip chat message subscriptions when alerts are disabled
otherOption to create only one breakout room
fixFix(html5): Old chat messages being notified when nofications are enabled
otherrefactor: remove remaining presPagesWritable uses in the client by @ramonlsouza in #24031
fixfix: whiteboard access toggle in userlist by @ramonlsouza in #24047
othertests: Add playback recording test suite
othertests: Add test for "autohide whiteboard toolbar"
othertests: Add Error Logs Monitoring tests
featurerefactor (ci): Avoid generating APT Cache for every new PR
othertests: Add test for drag and drop webcam
otherrefactor(tests): Update test configurations to use only parallel execution
otherref(plugin): Refactor logic to reduce load on back-end
otherref: Change log level of payload coming null in data-channel
otherchore(client): bump tldraw to 2.0.0-alpha.31
otherchore: Add comment for maxHistoryStackSize in settings.yml
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et https://github.com/bigbluebutton/bigbluebutton/pull/23961
otherUpdates for project BigBlueButton v3.0 HTML5 client and language eu
breakingfix (gql-server): Remove length-constrained user columns (for values provided via API or config)
fixfix (bbb-web): Rework SVG dimension parsing using ImageMagick identify
featureperf (gql-server): New database indexes to improve graphql queries
featurerefactor (gql-middleware): Allow more than one subscription for streamings handled by the Middleware
fixfix(bbb-export-annotations): Fix text wrapping
fixfix(bbb-export-annotations): Use Tldraw v2's fonts
+18 more items in the release notesfixFix(html5): fix video stuttering on vimeo
feature[3.0 external video share] Add stop share video button
fixfix: Dark mode chat message cursor
fixFix: console warnings in the client
fixfix(html5): Typed responses are cut off in the poll results
fixfix: filter userlist items by meetingId
fixfix: hardcoded default camera position
fixfix: whiteboard toolbar fade not working after enabling auto hide
fixfix(virtual-backgrounds): restore MIME type for wasm files, configurable willReadFrequently
fixfix: webcamsOnlyForModerator broken
fixfix: missing default value for camera position
fixfix(captions): Unsupported captions should show warning instead of empty space
othertests: Add support for SDK flaky test exclusions in CI workflow
othertest: Updates the smart slides test
otherci: checkout from prebuilt merge ref
fixfix(CI): Avoid failure on merge blob-report step when files were not generated
otherci: add publiccode.yml validation workflow
security[Snyk] Security upgrade axios from 1.8.3 to 1.12.0
otherchore: upgrade axios from 1.8.3 to 1.12.0
otherUpdates for project BigBlueButton v3.0 HTML5 client and language el_GR
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v3.0 HTML5 client and language fr
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et
otherUpdates for project BigBlueButton v3.0 HTML5 client and language zh_TW
otherfeat (core): Enhance performance monitoring (traceLog, Prometheus metrics) and connection status handling
fixfix (gql-server): Only moderators should see the current breakout room of users (in the userlist)
otherrefactor (gql-server): tweak name of type breakoutRoom_user_summary
featurefeat(akka-apps): Monitor Presentation Conversion in Akka Apps and Enforce Max Conversion Time
otherrefactor (gql-middleware): Avoid blocking functions or nested lock() calls inside locked sections (and more)
otherperf (gql-server): Optimize the user list subscription by aligning the index with the ORDER BY
fixfix (gql-middleware): Add non-blocking and cancellable send options to SafeChannel
fixfix (bbb-web): Increase default bbb-web LimitNOFILE to 4096
fixfix: guarantee deafen is executed for dial-in users in lobby
fixfix(LAD): Fix unsafe optional chaining
fixvideo recording: Fix typos and missing escaping in index template
fixrecording: Fix processing fail when cut near start of recording
fixrecording: Fix flickering with overlapping video areas
otherbuild(bbb-webrtc-sfu): v2.19.1
otherbuild(bbb-webhooks): v3.4.0
+4 more items in the release notesfixfix: adjust locale dropdown to not display fallback id + include ru-RU en string
fixfix: Fullscreen by ENTER not working inside of the presentation
other[3.0] Extract multiple quick polls WITH text options
fixfix: quick external video share not working at fullscreen
other[3.0 Quick poll] number of options up to 19
featureFeat(html5): Add hot reload environment variable
fixFix(html5): Video preview modal keeps frozen when using bbb_auto_share_webcam and bbb_skip_video_preview
featurefeat: Tweak floating window to enhance usability and stability
fixfix(html5/whiteboard): Do not run resync code on change page
featureref: Added information to useUsersBasicInfo and ordered the results
fixfix(html5/whiteboard): Debounced function recreated on every render
breakingRefactor (html5): Remove Subscriptions and Add Conditional Execution for Performance Optimization
featurefeat(html5/bbb-web): layout engine wait for enforcedLayout finish loading
fixfix(html5): remove leading blank spaces from correct answer lines
otherRef(html5): Make useMeeting use MeetingStaticData
fixfix: skip invalid quick polls
otherRef(html5): Reduce user_current usage through the client.
otherrefactor(html5): Optimize audio functions and reduce prop drilling using MeetingStaticData
otherSubscription kills
featurefeat(html5): add structured logs for NotificationsBar connection errors
featurefeat(html5): Add global error listeners for runtime, resource, and unhandled errors
fixFix(html5): Tooltip not applying translation
other[3.0] fix: inconsistent hook component remounting due to count-based keys
fixfix: wrong zoom position on slide change
fixfix: Resolve missing or duplicated key problem in data-channel or custom-subscriptions
othertest: Update smart slides test
featureAdd tests for "End meeting" Functionality
fixfix (ci / aut-tests): "Too Many Requests" issue when downloading Libreoffice docker image
featureAdd Focus/Unfocus Webcam Automated Tests
featureci (aut-tests): Add cache for Playright binaries
featureAdd test for "mirror webcam"
featureAdd tests for "Leave meeting" Functionality
featurefeat(html5): add new PLUGINS_ONLY layout type
featurefeat (gql-server): Add new graphql flag componentFlags.hasSharedNotes
featureperf (gql-server): Optimize Meeting data fetching with new meetingStaticData endpoint and Nginx caching
featureperf (gql-server): Add more permissions for Hasura role bbb_client_not_in_meeting
featureperf (gql-server): Add more permissions for Hasura role bbb_client_not_in_meeting (part 2)
fixfix(bbb-learning-dashboard): Wrong poll answer count
fixfix(bbb-learning-dashboard): Quizzes table sorting toggling doesn't work
fixfix(bbb-export-annotations): Text wrapping in text shapes
+24 more items in the release notesfixFix(html5): quickPollConfirmationStep turning quiz to poll
otherRef(html5): Quiz style refinements
featuredev(client): add react-refresh in dev mode so hot reload can work
fixfix(html5): Add regex to handle missing question text in smart slides
otherChore(html5): add logCodes for initial connection steps
fixFix(html5): Add support to locales on annotation polls
fixFix(html5): prevent poll options from being hidden when the number of options was 10 or greater
fixfix(html5): Fix useMeeting hook returning undefined
fixFix: console warnings/errors in the client
fixfix: Device settings window disappears when recording permission prompt appears
fixFix(html5): Add support to audio elements on external video
fixFix(html5): Correct answer marker clipping on long options
securityrefactor: remove emoji id from chat reactions contains a security fix. https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5m8m-h7fj-8wx6 will be made public circa Sept 1, 2025
fixfix(html5/chat): Messages cannot be selected in the chat
fixfix(html5): Improve smart poll detection for typed-response slides without options
otherchore (html5): Disable error overlay for react-refresh feature
fixfix(video-preview): correct variable scope to prevent crash on unmount
fixFix(html5): Console errors on initial client load
fixfix: Listen-only participants show misleading crossed-out microphone icon instead of headphones icon
fixfix(livekit): unable to connect if /stuns maxTtl is undefined
featurefeat(html5): ui-command to better manipulate generic content in sidekick area
fixfix: Sequential numbering missing from saved whiteboards and notes in breakout rooms
otherChore: Add support to typescript on Husky
otherChore: Add logCodes to graphql connection errors and improve connection status messages
othertest: Add 'Video pagination' test
featureAdd User Leave Notification Test
featurefeat(html5): Added custom-query and custom-mutation for plugins
fixfix (bbb-web): Some presentation-related configs not being respected
securityfix (gql-actions): Add validation for mutation pollSubmitUserVote contains a security fix. https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5 will be made public circa Sept 1, 2025
featurefeat(akka/bbb-web): persist plugin errors from back-end to be logged into the front-end
fixfix(bbb-web): Add Presentation Upload Concurrency Explanation
fixfix(bbb-learning-dashboard): Poll/Quiz sorting
fixfix(bbb-learning-dashboard): Localize quiz answers
fixfix(bbb-learning-dashboard): Quizzes table showing user response as incorrect while the correct answer was not disclosed
featurerefactor (Learning Dashboard): Add info ended for Polls/Quizzes to LAD json
featureupdate(recording): add quiz info to presentation format
security[Snyk] Security upgrade form-data from 4.0.2 to 4.0.4
fixfix: Poll Results in the pdf-File
securitybuild: Bump bbb-pads to 1.5.4 contains a security fix. https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2 will be made public cicra Sept 1, 2025
featureDocs (plugins): Add example of javascriptEntrypointIntegrity and remove unimplemented features
+20 more items in the release notesfixfix: startup crash
otherstyle: use the same font for firefox and chrome toasts
featurefeat(learning-dashboard): Add support for markdown rendering in learning-dashboard - plugins table
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v3.0 HTML5 client and language de
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja
otherUpdates for project BigBlueButton v3.0 HTML5 client and language zh_TW
fixfix (gql-server): fix trigger to recount chat messages on delete
breakingrefactor (gql-server): Remove unused indexes from the bbb_graphql database
fixfix (akka-apps): Dynamically adjust poll annotation size based on question length and number of answers
otherchore: Update bbb-presentation-video to 5.0.0
featureFeat(html5): Add support for quizzes
featurefeat(bbb-learning-dashboard): Add support for quizzes
featurefeat(html5,akka): Add disable feature for quiz
featureRef(html5): Apply new style to quiz interface
featurefeat: persist whiteboard tools on unmount
other[3.0] fix(audio-captions): transcription stops after a long period of silence
fixfix(chat): "Start a private chat" menu option is still shown when chat is disabled
fixfix(livekit): block audio subscription if playback is blocked, autoplay handling is not always triggered
otherstyle: Fix reactions modal too big on mobile
fixfix(livekit): mute local camera when in "Away" mode
otherstyle: Fix chat spacing when typing indicator is disabled
otherstyle: adjust snapshot of current slide and presentation uploader notification styles
fixfix(livekit): stopping one local camera un-shares all instead
fixfix(livekit): cached output device isn't correctly applied on join
fixfix: typingIndicator.showNames: false does not work
fixFix(html5): Audio output change causing user to not hear other users
fixfix(html5/whiteboard): Tool config fixes
fixFix(html5): poll form fields clean up on poll start
fixfix(html5): Accessibility recommendations
fixfix: Breakout room numbers not showing
fixfix(html5): Quiz information isn't saved when navigating between tabs
otherrefactor(ci): Unify artifacts download and extraction process in CI workflow
otherValidate endpoints and env variables before running all tests
featurefeat(tests): Add dataTest attributes to audio, video, and presentation components for enabling sample plugin tests
otherchore: Temporarily disable merging and uploading blob reports in CI workflow
otherchore: Add comment on disableEmojis source for ids
otherchore(html5): include clientSessionUUID in log userInfo
otherchore(client): bump tldraw to 2.0.0-alpha.30
otherrefactor(html5/chat): Log high scroll activity
otherrefactor(bbb-learning-dashboard): Quizzes patch
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et
othergql-server (perf): Workaround to prevent Hasura from adding redundant nullability checks
otherrefactor (akka-apps): Ignore unknown properties when reading plugins manifests
featurebackend (feat): Add support for polls with correct answers (quizzes)
featurechore (gql-middleware): Add clientSessionUUID to all logs of gql-middleware
othergql-server (perf): Increase performance for chat queries
otherRef(akka,web,docs): Rename disable feature from quiz to quizzes
featurefeat (akka-apps): Add quiz info to events.xml
+6 more items in the release notesotherProvide context for localizations instead of just 0, 1
feature[3.0] fix(layout): allow longer strings for cameraWithFocus
fixFix(html5): Add localization to live polls
fixFix(html5): Add support to numeric TLD
otherRevert "fix: Switching slides causes the next slide to slightly zoom in"
otherRefactor(html5,akka): Let akka-apps extract external video start time directly from the URL instead of relying on the client/player
fixfix (html5): Copy new translations placeholders from en.json to all languages
other[3.0] fix(layout): ensure the camera position is not undefined
fixfix(html5/whiteboard): Fixes a few keyboard shortcuts
fixfix: multi user pen only not working
fixFix(html5): Remove list and index params from youtube url for external video
fixfix: Whiteboard context menu shortcuts missing key modifiers in Safari
featurefeat(akka): Introduce Settings Schema Definition in Plugin Manifest
featurefeat(common-web): added plugin_ parameters and default value support for manifest.json placeholders
featurefeat(common-web): Add Main version replacements for placeholders in plugin manifest URLs
othertest: Enforce layout parameter
othertest: Remove flaky tag from Zoom In/Out test and add snapshots
fixfix(test): Add assertion for video elements count on Enforce Layout - VIDEO_FOCUS
fixfix(test/chat): update expected message strings
othertest: Add 'clear all status icon' test
othertest: Adds a check for the duration bar on breakouts tests
otherupdate text for localization strings with has/was
otherchore(sec): Bump tomcatEmbed to 9.0.106
otherchore(sec): bump brace-expansion to 1.1.12
otherUpdates for project BigBlueButton v3.0 HTML5 client and language zh_TW
otherUpdates for project BigBlueButton v3.0 HTML5 client and language eu
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et
otherUpdates for project BigBlueButton v3.0 HTML5 client and language pt_BR
otherrefactor (akka-apps): Convert notifications.messageValues to Map(String,String) instead of Vector(String)
fixFix(bbb-common-web): Change flag to priotize the text order on pdf to text conversion
fixfix (akka-apps): Unpin Shared Notes before sharing External Video
otherrefactor (akka-apps, gql-middleware): General improvements to prevent system stalling and enhance debugging
otherbuild: Bump Hasura from v2.45.0 to v2.48.1
otherbuild: Update LibreOffice to 25.2.4
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 1 update
otherdocs: Correct values for removable and downloadable api.md
featurefeat: New ui-data-getter and refactor of ui-data's
fixFix(html5): External video unsync when presenter resume session
fixfix(html5): data-channel dispatching multiple replace/delete messages to akka
fixfix(html5): Make poll chat message accessible for screen readers
fixFix(html5): Player not emitting play event when Presenter changes
fixfix: start private chat option is available when chat is disabled via disabledFeatures
fixFix(html5): chat Emoji picker not being diabled when lock settings enabled
fixstyles(html5): Fix positioning of the session details modal
fixfix(html5): Open presentation+annotations in a new tab
fixfix: make emoji auto convert ignore shortcodes from disableEmojis setting
fixfix(html5): Place polling modal at the end of the DOM tree
fixfix: Clear all reactions missing
fixFix(html5): external video desync on player seek
fixfix: SmartSlide Poll Option Removed When Editing Custom Input
featurefeat(html5/chat): Filter out unallowed emojis from search results
featurefeat(html5): Add emojiPicker to the list disabledFeatures
fixfix(html5): add rollback to video-preview gUM and option to skip initial enumerateDevices
fixfix(html5): Unable to mark messages as seen on Safari
fixfix(whiteboard): Viewer zoom desync caused by incorrect initial zoom
otherChange publish poll button text to publish results
fixfix(audio-captions): check for Speech Recognition API support before accessing voices
fixfix(html5/whiteboard): Use correct base zoom value
fixfix(plugin): Fix some typos in the SDK
fixfix(tests): Add timeout before export breakout tests to ensure the zoom is stabilized
otherrefactor(tests): Set default viewport size in the playwright config file
othertest: Adds screenshots for viewers with layout changes
featurefeat: Add plugin (samples) tests setup to CI workflow
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 2 updates
otherbuild(deps-dev): bump webpack-dev-server from 5.2.1 to 5.2.2 in /bigbluebutton-html5 in the npm_and_yarn group across 1 directory
otherUpdates for project BigBlueButton v3.0 HTML5 client and language fa_IR
featurefeat(bbb-web): Adds placeholder replacements for pluginManifests URLs
fixfix(akka-bbb-apps): Improve logs for user lock messages
featurefeat(screnshare): add ParticipantStatusChange event for screen sharing, +
fixfix(bbb-web): URL encode presentation name
featurechore (gql-middleware): Add more logs to clarify the reasons behind WebSocket disconnections from the browser and Hasura
fixfix: reintroduce meta_hack-record-viewer-video
featureAdded publiccode.yml for public administrations directories
featureadd missing info fields
fixFix typo in customize.md
securityUpdate SECURITY.md
+19 more items in the release notesfeaturefeat(html5): Add shortcut for custom poll
featurefeat: Add option to disable reactions
fixfix(html5): remove fragments with only one child
fixfix(html5/external-video): Show viewer controls only on hover
fixfix(html5): rename useState variables and functions to solve sonarcloud alerts about destructuring pattern
fixfix(html5): remove unnecessary unused imports
fixfix(whiteboard): remove stale annotations on reconnect edge case
fixFix(html5): Shared Notes not being pinned when hidePresentationOnJoin setting is enabled
fixfix(html5): remove unused assignments
fixFix(html5): Mute state inconsistencies on the player during presenter changes.
fixFix(html5): External video playback rate unsync
fixFix(html5): External video reset when presenter Refresh client
featurerefactor (html5): Add class for plugins floating window content
fixFix(html5): Breakout duration edit not allowing time shorter than 5 minutes
fixfix: Avoid Cannot read properties of null (reading 'avatar')
fixfix: Failproof hasTimer of undefined
fixfix: Failproof showRemainingTime of undefined
fixfix(html5): Skip font embeding when taking snapshot of current slide
fixfix: Avoid Cannot read properties of undefined (reading 'length')
fixfix(html5/poll): Save poll state on unmount, restore it on mount
fixFix(html5): Cleaning connections errors
fixfix(html5/whiteboard): Add missing whiteboard shortcuts
fixfix: Switching slides causes the next slide to slightly zoom in
fixFix(html5): External video player not restoring presenter's volume
fixfix(livekit): ensure camera subscription on meeting join
fixfix(audio): use storage to check if input device was previously set
fixfix(screenshare): remove instability UI
fixfix(whiteboard): Eliminate DOM side-effects causing toolbar tools to disappear
featureBackport(html5): blocks MiBrowser & feat: adds WebRTC API browser support check
fixFix(html5): Whiteboard cursor deteriorates near border
fixFix(html5): Ensure audio autoplay permission for playAlertSound method
fixFix(html5): Audio captions get stucked when hardware muted
fixFix(html5): Race condition leading to an error in conditionally rendered chat hooks.
featurefeat(plugins): Add support for the plugin to unmount on meeting end
featurefeat: Add plugin-sdk version compatibility check
featurechore (html5): Add temporary logs to the EndMeeting component to debug OK button
breakingfix (gql-server): Remove unused voiceConf fields from Graphql and fix UserVoice race condition
featurefeat(bbb-web): Parameter to add all pluginManifests at once
breakingcleanup (gql-server): Removes graphql Type meeting_metadata
breakingRecording: Remove 'duration' lines from ffmpeg playlist
+26 more items in the release notesfeaturefeat(livekit): selective audio subscription, initial audio groups implementation, leave audio, floor mgmt, +
fixfix: External youtube video is not syncing
fixFix(html5): Whiteboard autohide not working for opened menus
fixfix: Add clear annotations action to presentation menu options
otherref (html5): Restore the button Delete to whiteboard (instead of Clear all annotations)
fixFix(html5): Whiteboard crash when clipboard permission is denied
fixfix(whiteboard): Lock selected tool to prevent automatic switching to select mode
fixfix(html5): fix actions-bar extensible area breaking when plugin used old SDK
fixfix(html5/whiteboard): Reset selection state after editing frame name
fixfix(html5/chat): Save unsent messages on session storage
fixfix(html5/external-video): Make the player respect timestamp from URL
fixfix(html5): Add timeout to redirect on meeting end
fixfix: Screenshare fullscreen button sometimes requires two clicks
fixfix: Fix locale problem when having multiple plugins
fixfix(html5/layout): Keep correct shared notes state after minimizing presentation and changing layout
otherRefactor(html5): Create breakout room state management
fixfix: learning analytics button text message not showing after session end
fixFix(html5): Breakouts could exceed main room time
fixfix: Youtube video not synced when chaging video speed
fixfix: Unable to resize webcams/screen sharing when there's no presentation uploaded
fixFix(html5): Error 3006 when granting WB access with no presentation
fixFix(html5): Update Selected room if user is moved by moderator
fixFix(html5): Handle undefined case on streamId
fixfix(html5): Add a bunch of null checks
breakingrefactor (bbb-html5): Remove unused fields from breakoutRoom subscriptions
otherRefactor(html5): Remove Breakouts from user current subscription
featurefeat(html5/plugin): add support for custom svg for actions bar buttons
othertest: logoutURL parameter
othertest: Support for firefox browser tests
othertest(chat): Add tests for new chat features (reply, edit, delete and react)
otherci: Add support for run plugin tests in BBB's CI
otherbuild(deps): bump the npm_and_yarn group across 4 directories with 1 update
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT https://github.com/bigbluebutton/bigbluebutton/pull/22963 https://github.com/bigbluebutton/bigbluebutton/pull/23014 https://github.com/bigbluebutton/bigbluebutton/pull/23085…
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ru https://github.com/bigbluebutton/bigbluebutton/pull/23004 https://github.com/bigbluebutton/bigbluebutton/pull/23031
fixfix(core): increase max authToken size to 50 chars in user table
featurerefactor (bbb-web): Allow getJoinUrl parameters for non-moderators
fixfix (akka-apps): Breakout rooms not inheriting disabledFeatures from the parent meeting
fixfix (bbb-web): Check if meeting exists before download/upload presentation cache
fixfix (gql-server): Showing invitation forever when user joined in a different room instead of the assigned one
featurefeat: Add persistent captions view to postgres
+29 more items in the release notesfeaturefeat(quick-poll): Autofill poll creation form
fixFix(html5): Presenters height not propagating for another user when fit to width is enabled
otherFx(html5): External video no seeking when sliding the progress bar
fixFix(html5): viewer being able to select tool via shortcuts
fixfix(html5): Prevent users from changing external video native volume using arrow keys
fixFix(html5): Version being incorrectly placed in CSS
fixfix (html5): Modify the messageToMarkdown function to support uppercase links
otherstyle: adjust raise hand toast with many users
fixfix(client): log info about multiple users being returned from current user subscription and filter results
fixfix(html5): syncing issue receiving annotations too quickly
fixFix(html5): Whiteboard assets tool appearing on main bar for viewers
featurehtml5: Add stream ids to webcam video tags
fixfix(html5): Unmute microphone message is cut off on mobile
fixfix: The pencil tool should look like a pencil while using it
fixfix: Emojis can't be reverted
fixfix (html5): avoid cannot read prop of null for isLocalStream param
fixfix(html5): Clean up states of the voice activity hooks upon disconnection
fixfix(whiteboard): remove un-synced local annotations on reconnection
fixFix(html5): Fix player unsync on webm files
fixfix(html5): Chat auto scrolling glitch
fixfix(html5): Chat scroll not sticking to bottom
fixfix(html5|external-video): Unable to play on mobile
featurefeat(ci): New step in CI to publish in digital oceanic spaces (mockup)
featurerefactor (tests): Add explicit flags to identify local and current user streams
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT https://github.com/bigbluebutton/bigbluebutton/pull/22963
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ru
otherUpdates for project BigBlueButton v3.0 HTML5 client and language uk_UA https://github.com/bigbluebutton/bigbluebutton/pull/22929
otherUpdates for project BigBlueButton v3.0 HTML5 client and language zh_TW https://github.com/bigbluebutton/bigbluebutton/pull/22959
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ko_KR
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar https://github.com/bigbluebutton/bigbluebutton/pull/22957
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja https://github.com/bigbluebutton/bigbluebutton/pull/22976
otherUpdates for project BigBlueButton v3.0 HTML5 client and language el_GR
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 2 updates
fixfix(bbb-export-annotations): Preserve whitespaces in text shapes
fixfix(bbb-export-annotations): Fix rendering of sticky notes
featurefeat: Support to disable raise hand feature via disabledFeatures
fixfix(bbb-web): Enforce maximum SVG dimensions after rasterization
fixfix(API): Use meeting to get ID for insertDocument
fixfix(API): Add error handling to document conversion threads by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/pull/22969
fixfix(recording): split audio render command for each segment
+7 more items in the release notesfixFix(html5): Users being moved to room zero on running meetings causes a crash
fixfix: error acquiring wake lock
fixfix: prevent undefined functions in external video component
fixfix: crash due to MediaDevices EventTarget unavailability
fixfix: undo and redo buttons do not fade away
otherRefactor(html5): Make logs by level
fixfix: adjust allowDefaultLogoutUrl param behavior
fixfix: enable support to older chrome version
otherrefactor: browser support improvements
fixfix(html5): Prevent undefined rect
fixfix (html5): Limit html5 to generate one single bundle (no more chunks) to make it work in Safari 15
fixfix(html5): Add missing subscription data for current user
fixFix(html5): Dark mode flicker on presentation snapshot
fixFix(html5): Whiteboard dark mode buttons
fixfix: adjust webpack config to only use safari bundle in production
otherbreakouts: randomly assign users to rooms in an evenly distributed manner
fixFix(html5): Client error log related to missing name of user bby @Tainan404
othertest(shared-notes): Fix steps and assertions on Pin and unpin notes onto whiteboard
othertests(whiteboard): Update all whiteboard tests [+refactor; +fixes]
othertest: Add session details modal (join parameter) test
othertest(refactor): Use dynamic count assertion
otherrefactor(tests/npm scripts): Add npm scripts without CI=true
fixfix(plugin/html5): fix ui-command changeEnforcedLayout for plugins
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et https://github.com/bigbluebutton/bigbluebutton/pull/22846
otherUpdates for project BigBlueButton v3.0 HTML5 client and language fa_IR
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja https://github.com/bigbluebutton/bigbluebutton/pull/22838
otherchore(html5): [Snyk] Security upgrade axios from 1.8.2 to 1.8.3
otherchore(html5): Add logs for breakout management
fixfix(recording): Fix recording processing hang introduced by #22703
otherbuild(deps): bump perfect-freehand from 1.0.16 to 1.2.2 in /bbb-export-annotations
otherbuild(deps): bump form-data from 4.0.0 to 4.0.2 in /bbb-export-annotations
otherbuild(deps): bump svgdom from 0.1.17 to 0.1.20 in /bbb-export-annotations
otherbuild(deps): bump @svgdotjs/svg.js from 3.2.0 to 3.2.4 in /bbb-export-annotations
otherbuild(deps): bump redis from 4.0.3 to 4.7.0 in /bbb-export-annotations
fixfix(bbb-export-annotations): @svgdotjs/svg.js not respecting provided image dimensions
breakingSMALL FIX : Remove duplicate jobId in logger
fixfix(bbb-export-annotations): Fix incorrect import statement
fixfix(freeswitch): add basic dialplan instructions to reject anonymous UAs
fixfix(doc): fix broken link in presentationConversionCacheEnabled
breakingremove: Clean up after user feedback form removal
+11 more items in the release notesfeaturefeat(html5): add control over default setting of breakout recordings
featurefeat: introduce offerRecordingForBreakouts parameter by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/22783
featurefeat(html5): Adds translations for Tldraw
otherrefactor: remove unused config customHeartbeat
fixfix: client warnings
fixFix(html5): Whiteboard tools auto hide
fixfix: Raise hand notification not well aligned on 75% font-size
fixFix(html5): First item not being focused in user list dropdown
fixFix(html5): controls on fullscreen screenshare
fixFix(html5): Zoom reset not working on preseter's change
fixfix(html5): Prevent the whole audio modal from re-rendering
fixfix: client crash in breakout room mgmt panel
fixFix(html5): Connection status bars not showing colors on dark mode
fixfix: restore unsupported browser check
fixfix (html5): Fix whiteboard crash on Safari versions <= 16
fixFix: whiteboard crash on second user join
fixfix(html5): Whiteboard crash when trying to use the rectangle shortcut
fixfix(html5): Extra padding on whiteboard toolbar when cursor is outside + auto hide enabled
otherupdate minBrowserVersions to include safari 14 + 15
fixfix(html5): Fix ephemeral webcam settings
otherRefactor(html5): Disable assets tool on whiteboard
fixfix(chat): Resize input + fix scroll odd behavior
othertest: Set same CI font-family to avoid unexpected failures + update snapshots
othertest: Ignore folders prefixed pr-
otherci: Skip publish action on merge event
othertest(fix): Update user talking indicator check to use regex for exact match
otherci(fix): Correct formatted run script
othertest: [Snyk] Security upgrade axios from 1.8.2 to 1.8.3
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja https://github.com/bigbluebutton/bigbluebutton/pull/22789
otherUpdates for project BigBlueButton v3.0 HTML5 client and language eu
otherUpdates for project BigBlueButton v3.0 HTML5 client and language zh_TW
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
otherbuild(deps): bump the npm_and_yarn group across 4 directories with 4 updates
otherSpeed up compositing of video in recording processing
otherbuild(bbb-webrtc-recorder): v0.8.0
otherdocs: Clarify conflict resolution in pluginManifests
fixfix(html5): Memoize whiteboard custom UI overrides config
fixfix: add checks for undefined values
fixFix(HTML5): Volume not being persisted on players remount
security(html5) [Snyk] Security upgrade axios from 1.7.8 to 1.8.2
fixfix: typescript warning
fixFix(html5): Rtt error when trying to register instability on network
fixfix(chat): Use message id as key
fixFix(html5): Zoom not being persisted on presenter change
fixfix(whiteboard): Default to Draw tool on tldraw mount
fixFix captions getting stuck and showing with wrong timing
fixfix (html5): Fix multiple markdown-related chat bugs
fixfix(chat): Automatic scrolling on reply click not working when chat is paginated
otherrefactor: allow custom polls with one option
fixFix(html5): External video mute not being persisted
fixfix(whiteboard): Add Undo/Redo UI controls and Delete All button
other(html5) perf: Skip messageToMarkdown if the message doesn't contain http
fixfix: Avoid reading properties of null
fixfix(chat): General chat fixes
otherbuild(deps): bump recharts from 2.12.7 to 2.15.1 in /bigbluebutton-html5
otherchore: bump tldraw to 2.0.0-alpha.27
otherchore: enable highlight tool by default (whiteboard)
othertest: Fix restore presentation customParameter steps
othertest: Mute users tests update
othertest: Re-enable reconnection tests
othertest(docs): Add instructions to "Check test results" locally
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja
otherUpdates for project BigBlueButton v3.0 HTML5 client and language fa_IR
otherUpdates for project BigBlueButton v3.0 HTML5 client and language zh_TW
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
featurefeat(bbb-web): added presentationConversionCacheEnabled as a create param
fixfix (gql-middleware): Handle error when request Origin is not authorized
security(gql actions) [Snyk] Security upgrade axios from 1.7.8 to 1.8.2
fixfix (akka-apps): Increase default akka-apps LimitNOFILE to 4096
other[3.0]chore(sec): bump embedded tomcat to 9.0.102
otherRefactor(html5, akka): Make fit to width be persisted between presenters changes
otherchore: bump klauspost/compress
featurefeat(API): Add new create parameter maxNumPages
otherbuild: Bump bbb-playback to 5.3.0
security[Snyk] Security upgrade axios from 1.7.8 to 1.8.2
featureFeat(bbb-record): Support screenshare quick swap on record
security[Snyk] Security upgrade rubocop from 1.34.1 to 1.66.0
+16 more items in the release notesfixfix(chat) Improve accessibility
fixFix missing top padding for NotificationBar
fixfix(guest-waiting): update guest as loggedOut in database
fixfix(whiteboard): Add NaN check for zoom calculation
fixfix: External Video is played in CAMERAS_ONLY Layout
fixfix: Changing slide while a poll is open closes the poll
fixfix: Show users who have not responded to the poll results
fixfix: Presentation overlapping Webcams with userdata-bbb_hide_nav_bar
fixFix(html5): Non subscription error triggering 3006 error
otherRefactor(html5): Make screenshare audio be muted when quick swap is enabled and when non media layout is selected
fixfix: Client crash when exporting a presentation (not every time)
fixfix(whiteboard): Refetch shapes after toggling fit-to-width
fixFix(html5): User leave notification burst
otherAccessibility improvements
fixFix(html5): Make modal z-index be under notification z-index
fixfix: Add checks to avoid undefined and crashes
fixfix: Webcams are played in PRESENTATION_ONLY Layout
fixfix (html5): Change textToMarkdown func removing regex lookbehind
fixFix(html5): Add more details for error log on rtt fail
fixfix (html5): Tweak textToMarkdown to handle images properly
fixfix: only use AbortSignal.timeout if available
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ja
fixfix(bbb-export-annotations): fix image export being blank
fixfix (akka-apps): Prevents line breaks in logs
otherdocs: preparation for BBB 3.0.0
otherdocs: Adjust yq commands to yq version 4.16.2
otherdocs: update the portion about reducing webcam bandwidth
featureSupport for plugins to extend the functionality of the core
otherImproved chat with editing, adding emojis, and follow-up messages
otherImproved whiteboard a build of tldraw 2.0
otherJoin audio with microphone (able to configure no more listen-only/microphone)
otherImproved Away mode (one click to set away)
otherPush to talk
otherIntegration with LiveKit for audio, webcams and screen share
otherInfinite whiteboard
featureSupport for ClamAV as presentation file scanner
security[Snyk] Security upgrade meteor-node-stubs from 1.2.10 to 1.2.12
fixfix: Snapshot of slide shows only annotations but no image
otherchore(sec): bbb-html5 npm audit
fixfix(webcam): add option to skip initial enumerateDevices
fixfix(webcam): add rollback to video-preview gUM, improve logs
fixfix: Apostrophe character not displayed correctly in guest panel [2.7]
security[Snyk] Security upgrade axios from 1.7.7 to 1.7.8
othertest: [Snyk] Security upgrade axios from 1.7.4 to 1.7.8
othertest: adds the reactions tests for 2.7
otherUpdates for project BigBlueButton v2.7 HTML5 client and language nb_NO
otherUpdates for project BigBlueButton v2.7 HTML5 client and language gl
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ko_KR
fixfix(bbb-web): Check to see if moderator has left in moderator count
otherchore(sec): bump embedded tomcat to 9.0.96
otherchore(sec): bump tika (mime type detection) to 3.0.0
otherRefactor(bbb-web): Remove unnecessary pagination data and fix total elements bug
otherbuild(bbb-webrtc-sfu): v2.16.1
other[2.7]build: update link to download FS sounds.tar.gz
securityexport-ann: [Snyk] Security upgrade axios from 1.7.4 to 1.7.8
fixfix: Check if user is found before looking up role
fixfix (LAD/cluster) (backport 2.7): Enable LearningDashboard cookie support across different subdomains
fixfix (html5): prevent error if learningDashboardBase is missing
otherUpdates for project BigBlueButton v2.7 HTML5 client and language nb_NO
otherdocs: clarify on LAD default value comment
otherdocs: Update url for LAD in cluster proxy setup
fixfix: Space out approval of guests to better handle larger groups
othertest: Override default presentation on CREATE meeting API call
othertest: breakout room with different presentations
othertest: Prevent user from posting public chat
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fa_IR
other[2.7] build(bbb-webrtc-sfu): v2.16.0
otherConsistently call docker with sudo privileges (2.7 backport)
otherbuild: Umask fixes for 2.7 build scripts
otherdocs: allowPromoteGuestToModerator documentation tweak [2.7]
featurefeat: add WebRTC stats information to client logs
featurefeat: add experimental support for ICE restart
fixfix(audio): change unmute/unhold flow to work around FS unmute stutter
fixFix: Conference PIN (phone dial-in) doesn't show the needed pound sign in popup
fixfix(users-context): phantom user
fixfix: disable ICE restart for recvonly endpoints
fixfix(whiteboard): Update shape restriction logic
fixfix: Correct cursor position calculation for touch events by @KDSBrowne in #20748
otherchore: update link to which locales are supported by Gladia
otherchore(client): Security upgrade axios, meteor-node-stubs
otherchore(client): Add logs for recording notify action
othertest: removing temporally external video test from ci
othertest: Backporting timer/stopwatch test to 2.7
othertest: backport test disable self-view
othertest: Backport share camera as content test to 2.7
security[Snyk] Security upgrade axios from 1.6.4 to 1.7.4 (test)
security[Snyk] Security upgrade axios from 1.6.4 to 1.7.4
othertest: Update timer test to avoid false failures + fix hide presentation param on unrelated tests by @antonbsa in #21190
othertest: add test webcam background by passing URL by @gabriellpr in #21007
otherUpdates for project BigBlueButton v2.7 HTML5 client and language pt_BR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ja
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ca
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ru
otherUpdates for project BigBlueButton v2.7 HTML5 client and language hu_HU
otherUpdates for project BigBlueButton v2.7 HTML5 client and language gl
otherUpdates for project BigBlueButton v2.7 HTML5 client and language cs_CZ
other[2.7] build(bbb-webrtc-sfu): v2.14.2
other[2.7] build(bbb-webrtc-sfu): v2.15.0
other[2.7] build: Bump bbb-pads to 1.5.3
otherchore: upgrade FreeSWITCH to 1.10.12 (port)
otherbuild: Require libmagickcore-6.q16-6-extra for export-annotations by @antobinary in #21216
security[Snyk] Security upgrade @docusaurus/preset-classic from 3.0.1 to 3.5.0
otherdocs: Testing plan update (what's new features)
otherdocs: escape non mdx compliant characters
otherdocs: fix name for notifyRecordingIsOn create parameter [2.7]
security[Snyk] Security upgrade axios from 1.6.4 to 1.7.4 (export-ann)
fixfix: Breakout rooms show incorrect presentation filename
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 7 updates
fixfix (akka-apps): Banned users being able to rejoin (when they have customdata) by @gustavotrott in #21210
fixfix: Improve screen reader accessibility for polling modal
fixfix(audio): transparent listen only state inconsistencies, build(bbb-webrtc-sfu): v2.14.0
fixfix(video): camera cannot be shared as content
fixfix(presentation): presentation snapshot overflowing the slide [2.7]
fixfix(video): webcam fails to be loaded on preview when changing profiles
fixfix: Ensure size estimate is applied to text shapes while typing
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fa_IR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ar
otherUpdates for project BigBlueButton v2.7 HTML5 client and language et
otherUpdates for project BigBlueButton v2.7 HTML5 client and language tr
otherbuild(bbb-webrtc-sfu): v2.14.1
otherdocs: remove extra entry for webcamBackgroundURL
otherdocs: fix name of errorRedirectUrl in api docs
fixfix(bbb-export-annotations): Handle text rendering issue by @danielpetri1 in #20857
fixfix: Dial-In participants are not visible in the participants
otherenhancement(webcam): custom virtual backgrounds
otherUpdates for project BigBlueButton v2.7 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fa_IR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language eu
otherrefactor: enable warn logs; add a warning when we are skipping an ann…
fixfix: Layout VIDEO_FOCUS shows empty tiles for other participants when see other viewers is locked
fixfix: Manage Layouts ignores disabledFeatures
fixfix: Breakouts calculation for valid users incorrect
fixfix: external video can be seen through sidebar on mobile
fixfix: Emoji animations are not being turned off by using the slider in settings.
fixfix: [2.7] Breakout room invitation option missing from user dropdown
otherbuild(deps): bump the npm_and_yarn group across 5 directories with 6 updates
fixfix: Breakouts - do not allow slide/presentation change on breakout update
featurefeat(config): introduce allowPresentationManagementInBreakouts to be able to block breakouts pres uploads
fixfix(webcam): client failing to apply virtual background effect
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fr
otherUpdates for project BigBlueButton v2.7 HTML5 client and language es
otherUpdates for project BigBlueButton v2.7 HTML5 client and language el_GR https://github.com/bigbluebutton/bigbluebutton/pull/20762
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ar https://github.com/bigbluebutton/bigbluebutton/pull/20761
otherchore(core): Update grails-plugin-databinding
otherchore(core): upgrade embedded tomcat
featurefeat(events): Add user custom data to events.xml
fixfix: Enable download of the presentation not possible for temporarily presenters
featurefeat(bbb-html5): Ban specific users from the public chat
fixfix(bbb-web and html5): removed .odi and .odc file-type supports (back-port)
featurefeat: Pass a different presentation to each breakout
featurefeat: Accept custom webcamBackgroundURL
otherbuild(deps-dev): bump postcss from 8.4.32 to 8.4.33 in /bbb-learning-dashboard in the npm_and_yarn group across 1 directory
otherbuild(deps-dev): bump postcss from 8.4.33 to 8.4.34 in /bbb-learning-dashboard in the npm_and_yarn group across 1 directory #20773
otherdocs: 2.7.10 features breakouts with own pres; ban posts from user by @antobinary in #20774
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fr https://github.com/bigbluebutton/bigbluebutton/pull/20385
otherUpdates for project BigBlueButton v2.7 HTML5 client and language uk_UA
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ca
otherUpdates for project BigBlueButton v2.7 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fa_IR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language gl
otherUpdates for project BigBlueButton v2.7 HTML5 client and language et
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fi
otherUpdates for project BigBlueButton v2.7 HTML5 client and language es_ES
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ru
fixfix: only allow POST for insertDocument in UrlMappings.groovy [2.7]
fixfix(API): Allow additional parameters in content type headers
featurefeat (backport 2.7): Introduces allowPromoteGuestToModerator config
otherbuild(fix): File permissions in packages should not depend on umask of build system
fixfix(recording): Add participants, raw size, and playback size information to video metadata
security[Snyk] Security upgrade rubocop from 1.31.2 to 1.32.0
otherchore: npm audit fix for learning dashboard
otherdocs: Make clear in docs that parameters are case sensitive.
otherdocs: Various fixes by @MBM1607
otherdocs: adjust correct default value for breakouts being recorded
otherdocs(GL): correct statements about presentations not being migrated and how to fix entity too large errors
otherdocs: Clarify that allowPromoteGuestToModerator is a CREATE parameter by @antobinary in #20559
fixfix(whiteboard): Inconsistent Zoom Between Live Session And Recording
fixfix(whiteboard): Disable Duplication Shortcut Key While Drawing
otherUpdates for project BigBlueButton v2.7 HTML5 client and language eu
securityfix(sec): fix(sec): API fix duplicates GHSA-4m48-49h7-f3c4 security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4
otherrefactor(bbb-web): Add message key to insertDocument responses
securitybuild(sec): set permissions for resque files [2.7] security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5966-9hw8-q96q
security[Snyk] Fix for 1 vulnerabilities
othertest: [Snyk] Security upgrade jest from 27.5.1 to 29.0.0
otherdocs: drop plugin @cmfcmf/docusaurus-search-local
fixfix(poll): avoid rendering polling component twice
fixfix: breakout styles
fix[2.7] fix(reactions): crash when interactionsButton coords are absent
other[2.7] fix(audio): acquire streams before negotiation when peer is answerer
fix[2.7] fix(bbb-html5): crash when stopping WebRTC peers
fix[2.7] fix(bbb-html5): crash due to undefined metadataProp access
feature[2.7] fix(screen-reader): add safeguards for adding alerts
fix[2.7] fix: crash due to invalid UA version number in WKWebView (backport)
other[2.7] fix(audio): minimize redundant audio exit toasts
feature[2.7] fix: add safeguards when returning user roles
fix[2.7] fix(bbb-html5): crash on video-provider unmount
fixfix(whiteboard): check before manipulating pan tool class list
fixFix: user reaction not showing right emoji
fixfix: undefined accesses causes crashes in actions-bar breakout utils
fixfix(audio): review device selection in mobile endpoints
fixfix: crash at meeting-ended due to undefined access + incorrect meetingID
other[2.7] fix(audio): review audio modal help screen
fixfix(audio): broken connection stats on Firefox >= 125
other[2.7] Support more transcription languages
other[2.7] fix(presentation): toolbar width on small screens
fixfix(bbb-html5): validate before getting user-list element attribute by @Arthurk12 @prlanzarin
fixfix(bbb-html5): filter poll users array before processing by @Arthurk12 @prlanzarin
fixfix(bbb-html5): potential crash in Youtube captions toggle by @Arthurk12 @prlanzarin
fixfix(bbb-html5): correct parameter type for wake lock log codes by @Arthurk12 @prlanzarin
otherchore: Bump requirement for safari versions
otherchore: bump npm deps
otherUpdates for project BigBlueButton v2.7 HTML5 client and language tr https://github.com/bigbluebutton/bigbluebutton/pull/20165
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fa_IR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language eu
otherUpdates for project BigBlueButton v2.7 HTML5 client and language zh_TW
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fr https://github.com/bigbluebutton/bigbluebutton/pull/20065
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ar https://github.com/bigbluebutton/bigbluebutton/pull/20126
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ja https://github.com/bigbluebutton/bigbluebutton/pull/20169
otherUpdates for project BigBlueButton v2.7 HTML5 client and language el_GR https://github.com/bigbluebutton/bigbluebutton/pull/20131
otherUpdates for project BigBlueButton v2.7 HTML5 client and language de https://github.com/bigbluebutton/bigbluebutton/pull/20146
fixfix(sec): Bump org.json:json (backport)
fixfix(sec): Bump tomcatEmbed to 9.0.86 (#19814) (backport)
fixfix(sec): Bump logback-classic (backport)
fixfix(bbb-export-annotations): Flag to force CairoSVG to embed images
security[Snyk] Fix for 1 vulnerabilities
+2 more items in the release notesfixfix(locale): Remove duplicate localization row
fixfix(client): undefined currentUserAway
otherUpdates for project BigBlueButton v2.7 HTML5 client and language el_GR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fr
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ar
otherUpdates for project BigBlueButton v2.7 HTML5 client and language de
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ja
other[2.7] build(bbb-webrtc-sfu): v2.13.2
other[2.7] build(bbb-webrtc-recorder): v0.7.0
other[2.7] build(bbb-webrtc-sfu): v2.13.3
otherbash script reads /etc/turnserver.conf to get realm and secret.
fixfix(bbb-html5): customHeartbeat would not close stale sessions, +
otherrefactor: End meeting button tweaks
fixfix: Drop heavy log from sendBulkAnnotations.js
security[Snyk] Security upgrade sanitize-html from 2.7.1 to 2.12.1
fixfix(layout): defaultLayout join parameter
otherrefactor: Changes to layout toast's workflow
fixfix: Incorrect hover style on the upload presentation button in the polling menu (2.7)
fixfix: Upload the exported users list to presentation breaks the whiteboard
fixfix: Download presentation popup window is broken
fixfix(bbb-html5): Use CDN for resource of layouts
fixfix: Avoid presentation conversion causing a crash
fixFix: Modal of the inactivity inspection does not show up
othertest: update playwright tests to support sha256 and sha512 algorithms
otherUpdates for project BigBlueButton v2.7 HTML5 client and language sv_SE
otherUpdates for project BigBlueButton v2.7 HTML5 client and language hu_HU
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fr #19594 #19740
otherUpdates for project BigBlueButton v2.7 HTML5 client and language nb_NO
otherUpdates for project BigBlueButton v2.7 HTML5 client and language lt_LT
otherUpdates for project BigBlueButton v2.7 HTML5 client and language pt
other[2.7] build(bbb-webrtc-recorder): v0.6.0
otherbuild(bbb-webrtc-sfu): v2.12.2
otherUnset all local variables
otherbuild(export-annotations): Add dependency poppler-utils
featurefeat(config): add checkSumAlgorithmForBreakouts in akka-apps (port)
fixfix(sec): bump postgresql to 42.7.2
fixFix (akka-apps) (2.7): Config from /etc not being read when running through sbt reStart
fixfix: Reduce logs in SendWhiteboardAnnotationPubMsgHdlr.scala
other!fix(captions): disable recording event TranscriptUpdatedEvent
fixfix: Several Gladia transcription fixes
featurefeat: Record raiseHand, away and Reaction events (backport)
otherrecording: work around invalid locale in caption events
fixfix(bbb-export-annotations): handle missing textbox size in Tldraw
featurefeat(config): Add option to disabled "Download session data" on Learning Dashboard (backport)
otherdocs: Close code block in customize md
otherdocs: Tweaks to gladia io docs
otherdocs: capitalize Support title
otherdocs: drop old links #18295 from wilkis3/wilkis3-doc-admin-install-links (backport)
otherdocs: Update FreeSWITCH configs - Nine digits PIN
featurefeat: Initial implementation of Gladia transcriptions to BBB 2.7
featurefeat: labelless leave meeting button with dropdown selection for Leave/End
featurefeat: join param for default animations setting value by @ramonlsouza in #19434
fixfix: Add Transitions To Improve Cursor Movement Fluidity
fixfix: Improve Wheel Zoom Stability
otherupgrade tooltip dependency and fix open tooltip on mobile
fixfix (backport): Button 'Open Tablet app' breaks when the meeting name contains white space
security[Snyk] Security upgrade axios from 1.6.0 to 1.6.3 html5
security[Snyk] Security upgrade axios from 1.6.3 to 1.6.4 bbb-html5
fixfix(chat): exported presentation notification by @Arthurk12 in #19281
fixfix: away and raiseHands 'reactions' being hidden by avatar image by @Ithanil in #19266
othertest: Removing flaky flags
othertest:[Snyk] upgrade axios from 1.6.0 to 1.6.3
othertest: [Snyk] upgrade axios from 1.6.3 to 1.6.4
othertest: [Snyk] upgrade axios from 1.6.0 to 1.6.4
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ja
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fa_IR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fr by @transifex-integration in #19188 #19322 #19342 #19345
otherUpdates for project BigBlueButton v2.7 HTML5 client and language tr
otherUpdates for project BigBlueButton v2.7 HTML5 client and language eu
otherUpdates for project BigBlueButton v2.7 HTML5 client and language es
otherUpdates for project BigBlueButton v2.7 HTML5 client and language es_ES
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ru by @transifex-integration in #19214 #19255 #19270
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ar
otherUpdates for project BigBlueButton v2.7 HTML5 client and language uk_UA
otherUpdates for project BigBlueButton v2.7 HTML5 client and language et
otherUpdates for project BigBlueButton v2.7 HTML5 client and language ko_KR
otherbuild(bbb-webrtc-sfu): v2.12.1
otherbuild(bbb-webrtc-recorder): v0.5.2
otherbuild(sec): upgrade FreeSWITCH to 1.10.11 +sofia-sip +libks
securityfix(sec): validate URL for external upload of presentation https://github.com/bigbluebutton/bigbluebutton/commit/fd8c92714092b937dc1f099d2e9d0a72985cb738 security advisory will be published not earlier than Jan 31, 2024…
securityfix(sec): filter tags in presentation name https://github.com/bigbluebutton/bigbluebutton/commit/59cdb136ad29859a3b6817ae56e83f057d44cf38 security advisory will be published not earlier than Jan 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-r3vv-c788-9fph
otherchore: Upgrade Grails to 6.1
fixfix: Bump spring-boot-starter-validation to 2.7.17 to match bbb-web
security[Snyk] Security upgrade axios from 0.26.0 to 1.6.4 bbb-export-annotations
fixfix: Bump Etherpad's export rate limiting (2.7)
security[Snyk] Fix for 2 vulnerabilities
otherdocs: Docs backport
fixUpdate bbb-conf.md - fix typo in word 'easi'
featuredoc: what's new in 2.7 link not proper
+4 more items in the release notesfeaturefeat: leave meeting button
fixfix(user-list): center icons on apple devices
fixfix: Moderator lowering hand from toast broken
fixfix: The shortcut for raising hand is not functioning as expected @ 2.7.1
fixfix: Waiting room indicator sound defective
otherrefactor: rename Songs to Music in BBB Timer
otherrefactor: Add a toast warning you that your webcam is still streaming…
otherrefactor: Move manage layouts to three-dots menu
security[Snyk] Security upgrade axios from 0.21.4 to 1.6.0
othertest: Adds @flaky to other presentation format test
security[Snyk] Security upgrade axios from 0.26.1 to 1.6.0
security[Snyk] Security upgrade axios from 1.4.0 to 1.6.0
otherUpdates for project BigBlueButton v2.7 HTML5 client and language pt_BR
otherUpdates for project BigBlueButton v2.7 HTML5 client and language el_GR #19083 #19075
otherUpdates for project BigBlueButton v2.7 HTML5 client and language es
otherUpdates for project BigBlueButton v2.7 HTML5 client and language es_ES
otherbuild(bbb-webrtc-sfu): v2.12.0-beta.2
otherbuild(bbb-webrtc-sfu): v2.12.0
otherchore: Bump bbb-pads to 1.5.2
otherchore: Upgrade LibreOffice to 7.6.2
otherchore: Bump Etherpad to 1.9.4
otherbuild(bbb-webhooks): v2.6.1 by @prlanzarin in #19095
otherci (backport 2.7): Refresh package's cache whenever there are changes in its build directory
fixfix: specify a unique mock authToken for dial-in users, + by @prlanzarin in #19084
fixfix (learning-dashboard): Learning Dashboard not showing Reactions by @gustavotrott in #19088
fixFix: Poll answers not being translated in learning dashboard
featurefeat(reactions): port new reactions and fix emojiRain by @lfzawacki @AtilaU19 #18804
fixfix: Tooltip added to timer
fixfix: String substitution whenever the word constructor is typed in general chat
fixfix: RTL on mobile - webcam not centered
fixfix: video dropdown chevron in rtl
fixfix: Add Bounds to Presentation Zoom Changer
otherHotfix: Audio captions not working properly
fixfix(user-list): center icons on IOS devices
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage el_GR #18843
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage gl
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage hu_HU #18836
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage fa_IR #18866
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage ja
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage es_ES
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage es
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage eu
otherUpdates for project BigBlueButton v2.7 HTML5 client and language et
otherUpdates for project BigBlueButton v2.7 HTML5 client and language fr
othertest: Update screenshot presentation (3.0 backport) by @gabriellpr in #18982
otherbbb-presentation-video: Update to 4.0.4
otherbuild(etherpad): Bump etherpad-lite to 1.9.3
otherbuild(bbb-libreoffice): Switch the LibreOffice Docker image to use the one built by BBB (backport to 2.7) by @antobinary in #18945
other(sec)build(bbb-libreoffice): bump to 7.5.7.1 by @antobinary in #18974
otherchore: npm audit fixes for bbb-learning-dashboard by @antobinary in #18979
otherchore: npm audit fixes bbb-html5 by @antobinary in #18978
otherchore: upgrade Spring to 2.7.17 by @antobinary in #18981
fixfix: End breakout rooms when ENDED_DUE_TO_NO_MODERATOR
fixfix (akka-apps): None.get error on change user Emoji
featurefeature (api): Add preUploadedPresentation param to API's /create via GET by @GuiLeme @gustavotrott in #18953
fixfix: check for presence of parentMeetingID if isBreakout is true by @ithanil in #18975
fixfix (bbb-web): Null pointer exception when parent meeting does not exist by @paultrudel @gustavotrott #18986
fixfix(recording): Deskshare audio processing hang
otherdocs: add notes on how to tweak screen sharing quality
otherdocs: Add support documentation
otherdocs: Add script to easily setup video recording format
otherdocs: Add info on reactions animations by @antobinary in #18970
otherdocs: preUploadedPresentation and preUploadedPresentationName by @antobinary in #18985
otherdocs: add example for preUploadedPresentation by @antobinary in #18990
featurefeat: Disable download of original and converted presentation by @GuiLeme in #18570
fixfix (accessibility): Improve Keyboard Functionality With Tldraw Style Menu
fixfix: Mouse Wheel Zoom Disrupting Slide Position
fixfix: size prop type warning (backport)
fixfix: videoPreview not working
fixfix: Raised hand button incorrect state
fixfix: incorrect set logoutUrl in join handler by @ramonlsouza @gustavotrott in #18771
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage de on branch v2.7.x-release #18769
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage eu on branch v2.7.x-release
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage fa_IR on branch v2.7.x-release #18800
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage es_ES on branch v2.7.x-release by @transifex-integration in #18797
otherUpdates for project BigBlueButton v2.7 HTML5 client and lanuage es on branch v2.7.x-release by @transifex-integration in #18798
otherchore: Merge BBB 2.6.14 into v2.7.x-release
other!build: require node 18 to install bbb packages
otherbuild: fix nodejs version paste error in #18686
otherbuild(bbb-webrtc-sfu): v2.12.0-beta.1, build(bbb-webrtc-recorder): v0.5.1
fixfix(build): do not package .git for bbb-transcription-controller by @danimo in #18756 (https://github.com/bigbluebutton/bigbluebutton/commit/a1d8f4bf7e964080a8ce42623df3aeb03e5f670d and #18787 cancel each other out)
otherchore: Bump bbb-playback to 5.0.1 #18788
otherbuild: bbb-webhooks set secret and url by @antobinary in #18789
otherbbb-webhooks was rebuilt to include a carried forward fix about 'unsafe-perm' https://github.com/bigbluebutton/bigbluebutton/issues/18734
fixfix(recording): handle archive remux failures
otherdocs: better quality header
otherdocs: info on what disabledFeatures options were added in 2.7 by @antobinary in #18792
otherGrid layout
otherCamera as content
otherDisable viewing your own video stream
otherRestore downloading of original presentation
otherTimer and stopwatch
otherWake lock
otherReactions bar
otherModerators invited to breakout rooms
featureSupport for VOSK as a speech-to-text backend
otherLock viewers to not see others' whiteboard annotations (better visual assessment)
otherchore: bump up release to 2.7.0 by @antobinary in #18725
otherdocs: 2.7 released docs by @antobinary in #18732
otherUpdates for file bigbluebutton-html5/public/locales/en.json in fr
otherUpdates for file bigbluebutton-html5/public/locales/en.json in tr
otherUpdates for file bigbluebutton-html5/public/locales/en.json in zh_TW
otherUpdates for file bigbluebutton-html5/public/locales/en.json in el_GR
securityfix(sec): fix(sec): API fix duplicates GHSA-4m48-49h7-f3c4 security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4
security[Snyk] Fix for 1 vulnerabilities
securitybuild(sec): set permissions for resque files [2.6] security advisory will be published not earlier than May 31, 2024 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5966-9hw8-q96q
otherdocs: drop plugin @cmfcmf/docusaurus-search-local [2.6]
security[Snyk] Security upgrade sanitize-html from 2.7.1 to 2.12.1
otherUpdates for file bigbluebutton-html5/public/locales/en.json in ar
otherUpdates for file bigbluebutton-html5/public/locales/en.json in hu_HU
otherUpdates for file bigbluebutton-html5/public/locales/en.json in fa_IR
otherUpdates for file bigbluebutton-html5/public/locales/en.json in tr
otherUpdates for file bigbluebutton-html5/public/locales/en.json in ru
featurefeat(config): add checkSumAlgorithmForBreakouts in akka-apps
fixfix(sec): bump postgresql to 42.7.2 (backport)
fixfix(chat): exported presentation notification (backport to 2.6)
security[Snyk] Security upgrade axios from 1.6.0 to 1.6.3
security[Snyk] Security upgrade axios from 1.6.3 to 1.6.4
otherUpdates for file bigbluebutton-html5/public/locales/en.json in ar
otherUpdates for file bigbluebutton-html5/public/locales/en.json in de
otherUpdates for file bigbluebutton-html5/public/locales/en.json in fr by @transifex-integration #19453
otherbuild(sec): upgrade FreeSWITCH to 1.10.11 +sofia-sip +libks
securityfix(sec) validate URL for external upload of presentation (backport to 2.6) https://github.com/bigbluebutton/bigbluebutton/commit/13657f1e6c988d717194f931e3bd16ea38d94b7b security advisory will be published not earlier than Jan 31, 2024…
securityfix(sec): filter tags in presentation name (backport to 2.6) https://github.com/bigbluebutton/bigbluebutton/commit/08c838703793ac969e442d07486ff16e991ed40a security advisory will be published not earlier than Jan 31, 2024…
security[Snyk] Security upgrade axios from 1.6.0 to 1.6.4 export-annotations
otherdocs: comply to MDX v3 (stricter markdown)
otherdocs: use npm only - drop yarn [2.6 portion]
fixfix: fix logoutUrl (backport)
otherUpdates for file bigbluebutton-html5/public/locales/en.json in gl on branch v2.6.x-release
otherchore: npm dependencies upgrades in bbb-html5
security[Snyk] Security upgrade axios from 0.26.0 to 1.6.0
otherchore: Bump Etherpad to 1.9.4 (backport)
otherchore: Bump LibreOffice to 7.6.2 (backport)
otherchore: upgrade Spring to 2.7.17 (backport)
otherchore: Bump bbb-playback to 5.0.2 (backport)
otherbuild(bbb-webhooks): v2.6.1 (backport)
otherchore: Bump bbb-pads to 1.5.2 (backport)
security[Snyk] Security upgrade resque from 2.5.0 to 2.6.0 (backport)
otherRecording fix backports for 2.6
security[Snyk] Security upgrade axios from 0.21.4 to 1.6.0
otherchore: npm dependencies upgrades in bbb-export-annotations
otherchore: npm dependencies upgrades in bbb-learning-dashboard
fixfix: Mouse Wheel Zoom Disrupting Slide Position
fixfix (accessibility): Improve Keyboard Functionality With Tldraw Style Menu
otherbuild: Upgrade to Java17, NodeJS 18
other!build: require node 18 to install bbb packages by @antobinary in #18686 #18697
otherdocs: add info on NodeJS v18 and Java 17 upgrade paths by @antobinary in #18695 #18718
securityFixes CVE-2023-43798: Blind SSRF When Uploading Presentation (mitigation bypass)
fixfix: Add dedupe to messages based on referenceId (backport of #18230 from 2.7)
fixfix: Stop Presentation Jerks While Panning
fixfix: Handle Slide Change With Fit To Width
fixfix: Enhance Smart Slide Question And URL Detection
fixfix: Correct Tab Order For Presentation Options Dropdown
fixfix: do not escape text twice
fixfix: Correct Slide Positioning After Zoom and Sync During Presentation Change
fixfix: Move Presentation Option Dropdown To The Left Side
fixfix: Add Whiteboard Dropdown As Element To Autohide
fixfix(html5): backport 'Replace wasm detection library #18557' to 2.6
othertest: Skip webcam test to run on CI
otherUpdates for file bigbluebutton-html5/public/locales/en.json in et on branch v2.6.x-release
otherUpdates for file bigbluebutton-html5/public/locales/en.json in fr on branch v2.6.x-release
otherUpdates for file bigbluebutton-html5/public/locales/en.json in gl on branch v2.6.x-release #18512 #18520 #18531
otherUpdates for file bigbluebutton-html5/public/locales/en.json in zh_TW on branch v2.6.x-release
otherUpdates for file bigbluebutton-html5/public/locales/en.json in ja on branch v2.6.x-release
otherUpdates for file bigbluebutton-html5/public/locales/en.json in tr on branch v2.6.x-release
otherUpdates for file bigbluebutton-html5/public/locales/en.json in ca on branch v2.6.x-release [Manual Sync]
securityfix(sec) (2.6): Getting wrong final URL (from redirect) on presentation upload expect a security advisory in mid September
otherbuild(freeswitch): v1.10.10 (backport to 2.6)
otherchore: upgrade Meteor 2.12 to 2.13 (backport to 2.6)
securityFixes CVE-2023-43797: Stored XSS at Guest Lobby
fixfix: Improve Focus When Changing Modal Tabs With Keyboard
fixfix(accessibility): Enhance Color Contrast, Language Dropdown, and Screen Reader Feedback
fixfix: Whiteboard Crash When Switching Between Zoomed-In Slides
fixfix: Whiteboard Cursor Offset Switching Back To Custom Layout
fixfix: Add Quick Poll Options For 'F' And 'G'
fixfix: Add Resize Event When Whiteboard Mounts
fixfix: panning with space bar shortcut does not work
fixfix: Preserve pinned notes after screenshare
fixfix: Promote and demote users is reopening closed private chats
fixfix: Multiple selection polling not showing entirely a long option line
fixfix(accessibility): implement the list of users within the session logs as a list
fixfix: pinning shared notes should restore presentation
fixfix: Fix join audio in breakout room
fixfix: Make quick poll result labels consistent with the uploaded slides
fixfix(accessibility): Restore Roving Functionality To User Chats And Captions List
fixfix: use connection id to determine if a user is ejected or not
fixfix(sec): Improve text sanitizing of lobby messages expect an advisory in 30 days or shortly after
othertest: Add create parameters tests + refactoring
othertest: restore presentation on pin notes to whiteboard
othertest: Fix wrong imports
othertest: separate create and join parameters
othertest: update connection status selector
othertest: Zoom presentation test improvement
othertest: Connection status element selector fix by @antonbsa in #18391
otherUpdates for bigbluebutton-html5/public/locales/en.json in fa_IR on branch v2.6.x-release
otherUpdates for bigbluebutton-html5/public/locales/en.json in ko_KR
otherUpdates for bigbluebutton-html5/public/locales/en.json in zh_TW
otherUpdates for bigbluebutton-html5/public/locales/en.json in es
otherUpdates for bigbluebutton-html5/public/locales/en.json in es_ES
otherUpdates for bigbluebutton-html5/public/locales/en.json in gl
otherUpdates for bigbluebutton-html5/public/locales/en.json in uk_UA
fixfix(sec): Upgrade embedded Tomcat to 9.0.78
otherrefactor: Fix original presentation download link in cluster setups
otherbuild(bbb-webrtc-sfu): v2.9.14 which fixes the audio - video out of sync issue in some recordings -- see https://github.com/bigbluebutton/bigbluebutton/pull/18288
otherbuild(bbb-webrtc-sfu): v2.9.15
otherbuild(freeswitch): revert "fix(freeswitch): include signalwire PR 1914 as a patch (backport from 2.7)"
otherchore: Bump Etherpad to 1.9.1
otherchore: Bump bbb-pads to 1.5.0
otherchore: Bump bbb-pads to 1.5.1
+3 more items in the release notesfeaturefeat(config): Configurable presentation pointer size
fixfix: copy event in breakout panel
fixfix: Preserve Canvas Position On Slide Change
fixfix: pinning shared notes should restore presentation
fixfix: open documents download presentation in new tab
fixfix: Presentation area in front of talking indicator elements.
fixfix: White squares displayed when rotating to mobile orientation
fixfix: Add Debounce To handleResize And zoomChanger
othertest: Reference snapshots update
othertest: Disabled features exclude
othertest: Update rewrite snapshots script
othertest: wait for public chat element when openning it and improve test config file
otherUpdates for bigbluebutton-html5/public/locales/en.json in fa_IR
otherUpdates for bigbluebutton-html5/public/locales/en.json in ja
otherUpdates for bigbluebutton-html5/public/locales/en.json in et
otherUpdates for bigbluebutton-html5/public/locales/en.json in de
otherUpdates for bigbluebutton-html5/public/locales/en.json in tr
otherUpdates for bigbluebutton-html5/public/locales/en.json in eu
otherUpdates for bigbluebutton-html5/public/locales/en.json in el_GR
otherUpdates for bigbluebutton-html5/public/locales/en.json in ru
otherUpdates for bigbluebutton-html5/public/locales/en.json in fr by @transifex-integration #18199
fixfix: Added check for parentMeetingId if isBreakout is true
fixfix: Allow default presentation to bypass URL validation
otherrefactor(bbb-web): Use Tika as MIME type detection tool
otherrefactor: Remove commons file upload
otherbuild: recover installation of bbb-webhooks
otherchore: Enable French captions by default
otherdocs: Added a mention of disabledFeaturesExclude in the api changes f…
otherdocs: Added a note for recording processing with recordFullDurationMedia
otherdocs: (rewording) Added a note for recording processing with recordFu…
otherdocs: Document maxNumberOfAnnotations
otherdocs: Add a note in the 2.6-whats-new about max annotations cap
otherdocs: add missing configuration option for cluster setup
fixfix(greenlight docs): remove GLv2 docs from docusaurus
securityFixes CVE-2023-33176: Blind SSRF When Uploading Presentation
fixfix: Cameras behind drop areas and presentation when dragging
fixfix: Empty 'E' on polls answer options
fixfix: UI Overlap Toolbar Options Button
fixfix: Viewer gets blank presentation after minimize/restore
fixfix(video): autoplay handling fails due to wrong mediaElement reference
fixfix(video): drag-and-drop virtual background isn't applied
othertest: Audio serial mode
othertest: Increase tests running on CI
othertest: Improve smart slides
othertest: Updates hide presentation
otherTranslations for bigbluebutton-html5/public/locales/en.json in ru
otherTranslations for bigbluebutton-html5/public/locales/en.json in fa_IR
featurefeat(bbb-web): Disabled features exclude
fixfix(sec): Upgrade org.json
fixfix(sec): Upgrade Spring
fixfix(sec): Upgrade tomcat
fixfix(sec): Upgrade spring-webmvc
fixfix(sec): Upgrade grails-core
featurefeat: only record media while meeting is being actively recorded
securityfix(sec): SSRF fix expect a security advisory (4.8/10) to be published on June 20, 2023 or shortly after
fixfix(Meeting API): Only include online users in attendee list
fixfix: Update links in bbb-conf to the new docs structure
otherbuild(bbb-webrtc-sfu): v2.9.12
otherbuild(bbb-webrtc-sfu): v2.9.13 by @prlanzarin as part of https://github.com/bigbluebutton/bigbluebutton/pull/18044
security[Snyk] Security upgrade resque from 2.4.0 to 2.4.0
security[Snyk] Security upgrade resque from 2.5.0 to 2.5.0
fixfix(recording): missing cursor
otherfeat (html5): Virtual backgrounds now accepts webp format
fixfix: ignore restore on update for first load of initial presentation
fixfix: remove legacy iOS UA checks that borked camera sharing in iPads
fixfix(bbb-html5): Successful annotated export toast
fixfix(whiteboard): Font selection is reset on slide change
fixfix: Localize Regular Expressions for Quick Poll Options
fixfix: Send to chat presentation not having unread notification
fixfix: Some images are not shown in presentation if using Firefox as client and using a PDF created by MS Office by @ramonlsouza in #17983
otherstyle: remove unnecessary fit-to-width style
otherstyle: Change style of fit-to-width button when it's on
othertest: chat and audio reconnection tests
othertest: Sharednotes serial mode
othertest: fix hide presentation on join test
otherTranslations for bigbluebutton-html5/public/locales/en.json in de
otherTranslations for bigbluebutton-html5/public/locales/en.json in sv_SE
otherTranslations for bigbluebutton-html5/public/locales/en.json in el_GR
otherTranslations for bigbluebutton-html5/public/locales/en.json in hy
otherTranslations for bigbluebutton-html5/public/locales/en.json in ja
otherTranslations for bigbluebutton-html5/public/locales/en.json in fr
otherTranslations for bigbluebutton-html5/public/locales/en.json in es
otherTranslations for bigbluebutton-html5/public/locales/en.json in et
otherTranslations for bigbluebutton-html5/public/locales/en.json in gl
otherTranslations for bigbluebutton-html5/public/locales/en.json in tr
otherTranslations for bigbluebutton-html5/public/locales/en.json in pt
otherTranslations for bigbluebutton-html5/public/locales/en.json in nl
otherTranslations for bigbluebutton-html5/public/locales/en.json in fa_IR #17940
otherTranslations for bigbluebutton-html5/public/locales/en.json in eu
otherTranslations for bigbluebutton-html5/public/locales/en.json in es_ES
otherTranslations for bigbluebutton-html5/public/locales/en.json in uk_UA
fixfix: Add check for no passwords in meeting create
otherbuild(bbb-webrtc-sfu): v2.9.11
fixfix(sec): upgrade FS dep sofia-sip to 1.13.15
fixfix: Fix a minor mistyping
otherdocs: Fix broken links
fixfix: Joining a meeting with pinned shared notes you don't see presentation area
fixfix (html5): User prevent the second user from opening private chat
fixfix: Toast notifications shows again when the language is switched
fixfix: editable polls.
fixfix: Making poll results editing possible to presenter by @Scroody in #17879
fixfix: Order of first and last names in save users
fixfix(poll): fix Yes/No quick poll button
fixfix: Closed captions hindering elements
fixfix(bbb-html5): Inconsistent current presentation indicator
fixfix: Update Question Regex to Exclude URLs
fixfix: overlapping screen end alerts and invisible cameras on reconnections by @atilau19 in #17554
otherrefactor: ensure setTimeout and clearTimeout run within Fiber
othertest: Polls parallel/serial mode
otherTranslate en.json in tr_TR [Manual Sync] by @transifex-integration[bot] in #17901
otherTranslate en.json in de [Manual Sync] by @transifex-integration[bot] in #17898
fixfix: Learning dashboard is available in breakout rooms
fixfix(sec): Switched PRNG to secure PRNG
fixfix(sec): Unreleased streams fix
fixfix: maxParticipants check counting users that have left
fixfix(freeswitch): include signalwire PR 1914 as a patch (backport from 2.7)
fixfix(config): check status of other recording formats
otherrefactor: clarify information on docs regarding recording
otherdocs: Update localization.md to include info about integration with T…
otherdocs: Update location of default.pdf and favicon.ico -- assets/
otherdocs: Add lockSettingsHideUserList param and fix lockSettingsDisableNotes
fixfix: Draggable cameras when presentation minimized.
fixfix: Bigger presentation now restore on update as well
fixfix: duplicate messages when start a new chat
fixfix: Meteor migration async annotation tweaks
fixfix: Cameras don't obstruct buttons anymore.
fixfix: Transfer button not displayed in tablets
fixfix: Part of the camera border is not resizable when positioned below the chat
fixfix: typing indicator does not work in private chat
fixfix: cursor not appearing for non-presenter when multi-user whiteboard is enabled by @ramonlsouza in #17806
fixfix: Default cursor not appearing when entering meeting. by @Scroody in #17792
fixfix: Use meteor.setTimeout to keep call inside fiber by @paultrudel in #17817
fixfix(chat): character limit warning is not removed on submit by @ramonlsouza in #17818
otherchore: Upgrade Meteor from 2.10 to 2.12
security[Snyk] Security upgrade yaml from 1.10.2 to 2.2.2
otherrefactor: adding logs for closing the connection due to invalid user by @antobinary in #17820
othertest: adds three tests for presentation
othertest: options serial mode
othertest: Chat to serial mode by @gabriellpr in #17745
othertest: Layout tests additions and serial mode migration by @antonbsa in #17811
otherTranslate 'bigbluebutton-html5/public/locales/en.json' in 'uk_UA'
otherTranslate 'bigbluebutton-html5/public/locales/en.json' in 'eu'
otherTranslate 'bigbluebutton-html5/public/locales/en.json' in 'sv_SE'
otherTranslate 'bigbluebutton-html5/public/locales/en.json' in 'ja' by @transifex-integration in #17825
fixfix(export-annotations): Support .jpg images by @danielpetri1 in #17813
featurenginx config: Allow overriding the $scheme variable
otherdocs: typo and missing image in the customize section #17803
otherdocs: Correcting the virtual background images upload path
otherdocs: Update LTI docs
otherdocs: Updated docs to enable live captions
otherdocs: Fix an incorrect path for overriding turn-stun-servers.xml.
otherdocs: Update the path for forceRelayOnFirefox in settings.yml
fixfix: Wrong style for set status dropdown button on iPhone
fixfix: Prevent Webcam Styling Crash On iPhones
fixfix: Disable Canvas Magnifier On iPad While Using Canvas
fixfix: Do not format maxUsers in the getMeetings API response by @danimo in #17690
fixfix: Patch Auto Hidden Tools To Stay Invisible On Page Change by @KDSBrowne in #17667
fixFix: Presentation un-minimizing when exiting external video or screen sharing. by @ramonlsouza in #17673
fixfix: Prevent Canvas Selection While Using Stylus On iPad by @KDSBrowne in #17678
fixfix: dial-in-participants not appearing in the participant list by @gustavotrott in #17674
fixfix (bbb-conf): warning about property 'disabledFeatures' has no value by @gustavotrott in #17672