BigBlueButton 3.0.20 → 4.0.1
22 releases · 5 breaking changes · 30 security fixes · 28 advisories fixed
30security5breaking1deprecated45feature192fix
Vulnerabilities fixed by this upgrade
- 5.4 GHSA-5p2g-ff34-ghm3 Breakout room access is not revoked after a participant is removed
- 3.1 GHSA-x795-r9c3-rh9q Whiteboard annotation authorship could be forged by a participant with whiteboard access
- 7.3 GHSA-h6m5-4xgx-pvpp Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player
- 4.3 GHSA-52cv-pvw8-89c6 Hidden user list can be bypassed through voice and reaction data
- 5.0 GHSA-rr62-cx93-4fwh Unescaped poll text in presentation export enables SVG injection and server-side request forgery
- 4.3 GHSA-j5gq-h48h-23r4 Live meeting streams remain accessible to a removed participant
- 4.3 GHSA-gjvc-jq4g-58xp BlockNote shared notes accessible to non-members of a meeting
- 9.0 GHSA-f6gw-hpfv-5gxg Command Injection through "destination_number"
- 7.0 GHSA-49qg-pcv3-r2g6 Unauthenticated access to a meeting's audio conference
- 5.4 GHSA-j43j-jmqf-2fg6 Missing server-side enforcement of the maximum number of custom poll options
- 4.3 GHSA-c4v9-6mvh-px5p Improper enforcement of plugin role restrictions on custom chat messages
- 7.6 GHSA-8p8h-cw52-x467 GetJoinUrl Parameter Injection and Checksum Pollution
- 4.3 GHSA-mvx6-hg8v-3x4j Cross Meeting Page IDOR
- 4.3 GHSA-9v52-vhvw-4w5c Cross-Meeting Presentation Injection Due to an Unbound Upload Token
- 7.1 GHSA-g92v-3w29-55rh Cross-meeting audio access via unvalidated voice bridge
- 9.8 GHSA-q8vx-4cgc-7w4w Improper Authentication through /api/join via POST parameter "auth"
- 9.9 GHSA-h2rp-mcch-vgh9 Stored XSS in annotation through /graphql via GraphQL Mutation "url"
- 10.0 GHSA-4g74-4wqf-fr8c Path Traversal through etherpad-lite
- 5.4 CVE-2026-55491 Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
- 4.9 CVE-2026-55489 IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
- 7.1 CVE-2026-46355 Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
- 8.5 CVE-2026-46682 Blind SQL Injection AUTH (Moderator)
- 8.1 CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl
- 6.8 CVE-2026-46404 Presentation URL Security Hardening
- 8.1 CVE-2026-46351 Insecure Randomness allows to guess user's conference session token and impersonate them
- 6.5 CVE-2026-41127 Missing authorization allows viewer to inject/overwrite captions
- 4.3 CVE-2026-41126 Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL"
- 7.2 CVE-2026-27466 Exposed ClamAV port allowing denial of service
Breaking changes
- breaking bbb-web no longer recognizes the accessControlAllowOrigin and serviceEnabled properties. Neither has had any effect since BigBlueButton 2.2: serviceEnabled=false never switched the API off, and cross-origin access to bbb-web is configured with the grails.cors.* options described in the cluster… in 4.0.1
- breaking On BigBlueButton 4.0.0, bbb-conf --set-port-range wrote the LiveKit port range into /etc/bigbluebutton/livekit.yaml as quoted strings, which livekit-server refuses to load. The upgrade does not rewrite that file, so if you ran the command on 4.0.0, run it again after upgrading. Details in #26289. in 4.0.1
- breaking [3.0] fix(audio): remove the away status when talking with push-to-talk in 3.0.40
- breaking [3.0] docs: remove the dead captions value from disabledFeatures in 3.0.40
- breaking Ref(html5): Remove non-used settings in 3.0.25
Security changes
- security Command Injection through "destination_number" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-f6gw-hpfv-5gxg in 3.0.38
- security Unauthenticated access to a meeting's audio conference https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-49qg-pcv3-r2g6 in 3.0.38
- security BlockNote shared notes accessible to non-members of a meeting https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gjvc-jq4g-58xp in 3.0.38
- security Live meeting streams remain accessible to a removed participant https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5gq-h48h-23r4 in 3.0.38
- security Unescaped poll text in presentation export enables SVG injection and server-side request forgery https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rr62-cx93-4fwh in 3.0.38
- security Hidden user list can be bypassed through voice and reaction data https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-52cv-pvw8-89c6 in 3.0.38
- security Breakout room access is not revoked after a participant is removed https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5p2g-ff34-ghm3 in 3.0.38
- security Whiteboard annotation authorship could be forged by a participant with whiteboard access https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x795-r9c3-rh9q in 3.0.38
- security Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h6m5-4xgx-pvpp in 3.0.38
- security Fixes GHSA-mvx6-hg8v-3x4j: Cross Meeting Page IDOR in 3.0.37
- security Cross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh in 3.0.37
- security Cross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c in 3.0.37
- security GetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467 in 3.0.37
- security Improper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p in 3.0.37
- security fix(sec): harden static asset path resolution by @prlanzarin https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c in 3.0.35
- security fix: Block embeddable shape types in whiteboard annotations by @Tainan404 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h2rp-mcch-vgh9 in 3.0.29
- security fix(bbb-web): Reject GET-Only Endpoint Requests With Request Bodies by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q8vx-4cgc-7w4w in 3.0.29
- security fix(playback): prevent stored XSS in recording playback by @germanocaumo https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9 in 3.0.29
- security fix(akka-apps): Verify Meeting ID on Presentation Delete Message by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g in 3.0.29
- security Missing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33 in 3.0.24
- security Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8 in 3.0.24
- security fix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will… in 3.0.23
- security fix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026 in 3.0.23
- security Fix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026 in 3.0.22
- security [3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026 in 3.0.22
- security fix(bbb-web): Prevent Checksum Bypass With PresentationUploadExternalUrl contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff will be made public not earlier than Feb 10, 2026 in 3.0.21
- security fix(bbb-web): Use Secure PRNG for ID and Token Generation contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h will be made public not earlier than Feb 10, 2026 in 3.0.21
Deprecations
- deprecated [3.0 external video share] remove deprecated parameters in 3.0.26
Every release in between
breakingbbb-web no longer recognizes the accessControlAllowOrigin and serviceEnabled properties. Neither has had any effect since BigBlueButton 2.2: serviceEnabled=false never switched the API off, and cross-origin access to bbb-web is configured with the grails.cors.* options described in the cluster…
breakingOn BigBlueButton 4.0.0, bbb-conf --set-port-range wrote the LiveKit port range into /etc/bigbluebutton/livekit.yaml as quoted strings, which livekit-server refuses to load. The upgrade does not rewrite that file, so if you ran the command on 4.0.0, run it again after upgrading. Details in #26289.
fixfix: incorrect camera label in video preview
fixfix(client): Propagate the intended camera dock geometry instead of a zero one on phone landscape
fixfix(whiteboard): Fix presenter's two-finger pinch zoom on touch devices
fixfix(audio-captions): pre-select the configured transcription language
fixfix(client): round plugin and screenshare corners in the media area
fixfix(livekit): accept constraint objects in camera profiles
fixfix (html5): turn Share webcam into a Stop sharing webcam toggle, in profile-settings
fixfix(html5): keep rendererInterfaces a Map when neutering React DevTools hook
fixfix (html5): Keep the background list in place when selecting in the video preview (virtual-background modal)
fixfix (html5): chat - remember pinned message collapsed state
fixfix: userdata-bbb_initial_selected_tool with a shape id crashes the whiteboard
fixfix (html5): Hide camera settings when webcam sharing is locked in User Profile
featurefeat(audio): stop persisting the audio filter choice across sessions and meetings
featureperf(html5): cut video grid re-renders and speed up LiveKit camera subscriptions
featurefeat(webcams): allow limiting the pagination toggle to moderators
featurefeat(audio-captions): option to transcribe on the user's device only
featurefeat(html5): add Last-N audio to LiveKit selective subscription
featurefeat(html5): add static bbb-* CSS classes to key components for theming
fixfix: clean up the saved user-names file and small test-suite leftovers
fixfix(core): Authorize presenter changes by the request sender
feature[4.0] Add option to disable announcement of user away status in chat
featurefeat(graphql-actions): support a password-protected Redis
fixfix(graphql-middleware): wait for Redis at startup, exit on lost subscription
fixfix(bbb-web): check the unit before stopping bbb-web in deploy_to_usr_share.sh
fixfix(bbb-web): keep controller helpers out of the URL space, drop the dead 500 view, trust createNewFile() (#26002, 2/3)
fixfix(core): Harden breakoutRoomsPrivateChatEnabled and disabledFeatures=privateChat
fixfix(bbb-web): use the SecureRandom helper for every generated value
fixfix(bbb-web): finish dropping SVG from the presentation type lists
fixfix(core): Add two parameters to meetingEndedCallbackURL to show record-processing banner in GL- #25929
fixfix(bbb-web): Improve Presentation Upload Limits
fixfix(bbb-web): Fix 400 bbb web unknown action 404 error handler
fixfix(bbb-web): skip the presentation conversion when its meeting is already gone
fixfix(learning-dashboard): count a user online while any session is open
fixfix(recording): Rap yaml loader followups 40
fixfix(recording): read bigbluebutton.yml through read_props in every script
fixfix(recording): log to stdout when not running under the systemd journal
fixfix(recording): keep chat links in video playback
fixfix(livekit): logging.level and --set-port-range fixes for LiveKit
+91 more items in the release notesfeatureRedesigned client interface with a new navigation sidebar and an Apps Gallery, where apps and plugins can be pinned, searched and shown as a list or a grid
otherSearch in the user list, a redesigned timer, a dedicated guest management panel, a redesigned permissions (lock viewers) modal and an overhauled mobile layout
otherAutomatic light/dark theme following the operating system, and a dedicated Audio settings tab with Advanced Filtering (WASM noise suppression), Standard Filtering and Original Audio modes
otherRequest to Present: viewers can ask for the presenter role and moderators approve or deny (lockSettingsPresenterPolicy)
otherPinned chat messages, larger emoji-only messages, optional user consent before a moderator unmutes them, and a Multi-Functional Mode that opens two sidebar panels side by side
otherLearning Dashboard for breakout rooms, with per-breakout data kept until the parent meeting ends
otherLiveKit is the default media framework for audio, cameras and screen sharing; bbb-webrtc-sfu and FreeSWITCH stay installed and can be selected per meeting or server-wide
otherBlockNote is the only shared notes editor; Etherpad is no longer installed
otherPlugin SDK 1.0 (bigbluebutton-html-plugin-sdk 1.0.0-beta.3)
otherdocs: 4.0.0 preparations
fixfix(client): re-arm stale connection watchdog after each stale period
fixfix(html5): keep unused webpack cache entries for the default period
fixfix(audio-captions): transcribe the microphone in use in the meeting (webspeech)
breaking[3.0] fix(audio): remove the away status when talking with push-to-talk
feature[3.0] feat: Add option to disable announcement of user away status in chat
other[3.0]test: Improve failing tests on layouts and recording
othertest: Add shared notes access coverage
otherci: post the in-progress tests comment once per run
other[3.0 port] test(whiteboard): port the same-run camera re-sync baseline, blur the idle viewer before the Pan screenshot
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/26225
other[3.0 port] fix(akka-apps & bbb-graphql-middleware): Log Failed Middleware Reconnection Requests and Deliver Stream Replay 3.0
other[3.0] fix(core): Authorize presenter changes by the request sender
other[3.0 port] build: upgrade bbb-web stack to Grails 8.0.0 / Spring Boot 4.1.1
other[3.0] build(bbb-web): bump embedded Tomcat to 11.0.27
other[3.0] build(bbb-web): bump the Gradle wrapper to 9.8.1
other[3.0 port] fix(bbb-export-annotations): wrap exported text exactly as the client does
fixfix(record-and-playback): deploy Gemfile.lock along with Gemfile
fixfix(recording): restore presentation panzoom after screenshare stops
other[3.0] build: move the 0.81 and 0.9.0 presentation players to an optional package
other[3.0]build: Update versions for Go 1.27.3, Gradle 9.8.1, and Node 22.23.4
otherbuild: let the build system name the version the legacy package pins to
breaking[3.0] docs: remove the dead captions value from disabledFeatures
otherdocs: iteration doc sync for 3.0.40
otherbuild(deps): bump joi from 17.13.6 to 17.13.8 in /docs
otherbuild(deps): bump brace-expansion from 1.1.18 to 1.1.21 in /docs
otherbuild(deps): bump axios from 1.18.0 to 1.20.0 in /bigbluebutton-tests/playwright
otherbuild(deps): bump dompurify from 3.4.14 to 3.4.16 in /docs
otherbuild(deps): bump brace-expansion in /bbb-graphql-client-test
otherbuild(deps): bump compression from 1.8.1 to 1.8.2 in /docs
otherbuild(deps): bump source-map-js from 1.2.1 to 1.2.2 in /docs
otherbuild(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /docs
otherbuild(deps): bump shell-quote from 1.10.0 to 1.12.0 in /docs
otherbuild(deps): bump compression from 1.8.1 to 1.8.2 in /bigbluebutton-html5
otherbuild(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /bigbluebutton-html5
otherbuild(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /bbb-graphql-client-test
otherbuild(deps-dev): bump shell-quote from 1.8.4 to 1.12.0 in /bbb-graphql-client-test
otherbuild(deps): bump source-map-js from 1.2.1 to 1.2.2 in /bigbluebutton-html5
otherbuild(deps): bump katex and mermaid in /docs
otherbuild(deps-dev): bump compression from 1.8.1 to 1.8.2 in /bbb-graphql-client-test
otherbuild(deps-dev): bump proxy-addr from 2.0.7 to 2.0.8 in /bbb-graphql-client-test
+4 more items in the release notesfixFix(html5): Move and add button are still shown if cursor is outside of the shared notes
other[3.0 presentation toolbar] fix: darkmode-aware CSS for infinite WB button
other[3.0]fix(waiting-users): order the guest lobby list by time of arrival
feature[3.0 WB] fix: add trailing to throttling for cursor updates
fixfix(video-provider): clear stale grid avatars when a presentation is open (3.0)
otherci(plugin/test): added test infrastructure for the plugins
other[3.0]test(breakout): stabilize lock-settings tests under load
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/25934
other[3.0 backport] fix: Upload error toast for a rejected presentation can't be dismissed and keeps reappearing
fixfix(akka-apps): Allow Locked Users to See Moderator Voice State
other[3.0]fix(export): render annotated slide backgrounds from the source PDF
other[3.0]fix(export-annotations):Fix export soft mask followups 30
fixfix(bbb-export-annotations): set xml:space through the XML namespace
other[3.0 backport] fix(bbb-export-annotations): prevent exported text overlap for width-constrained shapes
fixfix(recording): include sanitizeChatHTML in video playback
other[3.0 port] fix(recording): don't blank the presentation on screenshare-as-content
other[3.0 backport] fix(recording): use instance variable for segment break timestamp
other[3.0 port] fix(rap): hide every camera of a locked user in recordings- #25889
otherbuild(bbb-presentation-video): Update to 5.1.0-rc.4
otherbuild: Update bbb-playback from 5.4.7 to v5.4.8
otherdocs: Add recent releases in new-features.md
otherdocs: Catch-up on missed docs changes in BBB 3.0.33..39
otherbuild(deps-dev): bump postcss-selector-parser from 6.1.0 to 6.1.4 in /bbb-graphql-client-test
otherbuild(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /bbb-graphql-client-test
otherbuild(deps): bump sanitize-html from 2.17.6 to 2.17.7 in /bigbluebutton-html5
otherbuild(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /bbb-graphql-client-test
otherbuild(deps-dev): bump fast-uri from 3.1.4 to 3.1.7 in /bigbluebutton-html5
otherbuild(deps): bump qs from 6.15.2 to 6.16.0 in /bbb-shared-notes-server
otherbuild(deps): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-shared-notes-server
otherbuild(deps): bump colord from 2.9.2 to 2.10.0 in /bbb-learning-dashboard
otherchore: Merge 3.0.37 into v3.0.x develop
otherbuild(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-export-annotations
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /docs
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /bbb-learning-dashboard
otherbuild(deps): bump image-size and svgdom in /bbb-export-annotations
otherbuild(deps): bump image-size from 2.0.2 to 2.0.4 in /docs
otherbuild(deps): bump ip-address from 10.4.0 to 10.7.2 in /bbb-shared-notes-server
otherchore: Forward port BBB 3.0.38 into v3.0.x-develop
otherchore(client): bump tldraw to 2.0.0-alpha.36
+1 more item in the release notessecurityCommand Injection through "destination_number" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-f6gw-hpfv-5gxg
securityUnauthenticated access to a meeting's audio conference https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-49qg-pcv3-r2g6
securityBlockNote shared notes accessible to non-members of a meeting https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gjvc-jq4g-58xp
securityLive meeting streams remain accessible to a removed participant https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5gq-h48h-23r4
securityUnescaped poll text in presentation export enables SVG injection and server-side request forgery https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rr62-cx93-4fwh
securityHidden user list can be bypassed through voice and reaction data https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-52cv-pvw8-89c6
securityBreakout room access is not revoked after a participant is removed https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5p2g-ff34-ghm3
securityWhiteboard annotation authorship could be forged by a participant with whiteboard access https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x795-r9c3-rh9q
securityStored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h6m5-4xgx-pvpp
securityFixes GHSA-mvx6-hg8v-3x4j: Cross Meeting Page IDOR
securityCross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh
securityCross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c
securityGetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467
securityImproper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p
other[Backport of #25403] fix(data-consumption): prevent hook usage counter from going negative
fixfix: presentation download system message in chat export
featurefeat: Add support for custom text in the recording permission dialog
othertest: click the rectangle tool without opening the "More" geo popup
othertest(chat): wait for message state changes in deleted-message export test
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/25655 https://github.com/bigbluebutton/bigbluebutton/pull/25668
other[3.0 backport] core: Upgrade JVM Libraries and Applications to Java 21
fixfix(akka-apps): isolate failed database batch actions
otherbuild(freeswitch): v1.11.2 (up from v1.10.12)
other[3.0] build(freeswitch): v1.11.3 (up from v1.11.2)
otherdocs: iteration doc sync for 3.0.33
otherdocs: iteration doc sync for 3.0.36
otherbuild(deps): bump ip-address from 10.2.0 to 10.4.0 in /bbb-shared-notes-server
otherbuild(deps): bump fast-uri from 3.1.4 to 3.1.5 in /docs
otherbuild(deps-dev): bump fast-uri from 3.1.2 to 3.1.5 in /bbb-graphql-client-test
otherbuild(deps): bump sanitize-html from 2.17.4 to 2.17.5 in /bigbluebutton-html5
otherbuild(deps): bump brace-expansion from 1.1.13 to 1.1.18 in /docs
otherchore: use bbb- prefixed npm package names
otherbuild(deps): bump nanoid in /bigbluebutton-html5
otherbuild(deps): bump dompurify from 3.4.12 to 3.4.13 in /docs
otherbuild(deps): bump nanoid from 3.3.12 to 3.3.18 in /bbb-learning-dashboard
otherbuild(deps): bump js-yaml from 3.15.0 to 3.15.1 in /docs
otherbuild(deps): bump mermaid from 11.15.0 to 11.16.1 in /docs
otherbuild(deps): bump js-yaml from 3.15.0 to 3.15.1 in /bbb-learning-dashboard
otherbuild(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in /bbb-export-annotations
other[3.0]chore(core, client): bumped dependencies (snyk)- #25677
otherchore(core): [Fix bbb-web deploy script] modify directory navigation
other[3.0]chore(core): Grails 7.0.12 backport from BBB 4.0
otherchore: BigBlueButton 3.0.36 iteration
securityfix(sec): harden static asset path resolution by @prlanzarin https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c
otherchore: Update BigBlueButton release version to 3.0.34
fixfix(poll): drop out-of-range answerIds to avoid log noise
fixfix(html5): add real Panopto player to external video share
fixfix(html5): prevent crash from browser auto-translation
fixfix(video-provider): preview real user avatars in the camera overflow tile
fixfix(video): never let the grid overflow tile consume a camera slot, +
fixfix(quick-poll): keep parenthetical text in Smart Slides poll question
fixfix(html5): re-center microphone glyph in audio modal
fixfix(html5): correct recording timer when client clock is ahead of server
fixfix(html5): retry locale fetch on transient network failure
other[chore] fix children PropType in PresentationDownloadDropdownWrapper
fixfix: Presentation download: filename containing "&" is truncated and saved without its extension
fixfix: grid-aware resize snapping in camera dock
fixfix(html5): prevent white flash on slide change
fixfix: broadcast external video seek detected via onProgress discontinuity
otherBackport: "fix(audio): assorted fixes and improvements to LiveKit's floor manager"
fixfix(external-video): restore audio when autoplay starts the video muted
featurefeat(shared-notes): markdown export, init-from-markdown, and import modal
featurefeat: New useTimer hook
other[3.0] refactor(audio): better BBBLiveKit state reconciliation on reconnects, [email protected] #25550
othertest: add BlockNote shared notes e2e tests (backport of #25165)
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore: update SDK to version 0.0.103
featurefeat(plugins): support configurable button styles
featurefeat(plugin-sdk): add senderRole to useLoadedChatMessages
fixfix(akka-apps): [development] Correctly start bbb-apps-akka by creating symlinks
fixfix(bbb-web): Handle Null Meeting IDs on IsMeetingRunning Requests
fixfix(bbb-web): render a response when insertDocument body has no presentation module
fixfix(core): API parameter downloadable is not working
otherrefactor(bbb-web): process pre-uploaded slides async on a bounded pool
fixfix: MeetingActor analytics discards VoiceUserState.callerName, logs ERROR after user leaves
fixfix: The .csv export for LAD has the user 'Anonymous'
fixfix(recording): Ruby 3.2 File.exists? deprecation in BigBlueButton recording sanity worker
feature[3.0] build: Pull new image bumping Go and Nodejs
otherchore(bbb-conf): Add virtualBackgroundsDisabled to list of retired pr…
fixfix(document): add --build for development scripts of bbb-web
otherDocs: Add presentation parameter current
otherdocs: clarify allowOverrideClientSettingsOnCreateCall is a server setting, not a /create param
fixfix(docs): use valid font-weight for Open Sans SemiBold @font-face
otherDocs: Clarify voiceBridge range
otherdocs: Documentation catchup on 3.0 new features/configs since 3.0.28
+33 more items in the release notesfixfix(accessibility): change page title based on the content
fixfix(whiteboard): prevent crash when slide changes while a viewer is editing
fixfix(accessibility): Non-text contrast is insufficient
fixfix(shared-notes): prevent collaboration cursor name from leaking into links
fixfix: SVG support for notifications
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore: update SDK version for the last we have published
fixfix(bbb-graphql-server): lower connection_lifetime to limit Postgres memory growth
fixfix(bbb-export-annotations): rasterize background slides to prevent ODF export cropping (#25303)
fixfix(bbb-export-annotations): add viewBox to background slides missing one to prevent ODF export cropping
fixFix allowPromoteGuestToModerator
featureAdd analytics logging for breakout move-user request
otherSet MALLOC_ARENA_MAX=2 for bbb-web and bbb-apps-akka
otherchore: upgrade export-annotations dependencies
otherchore: upgrade bbb-shared-notes-server dependencies
otherbuild(deps): bump form-data from 3.0.4 to 3.0.5 in /bbb-learning-dashboard
otherbuild(deps): bump ws in /bbb-learning-dashboard
otherbuild(deps): bump ws from 7.5.10 to 7.5.11 in /docs
otherbuild: Bump Hasura from 2.48.14 to 2.49.3
otherbuild(deps): bump markdown-it from 14.1.1 to 14.2.0 in /bigbluebutton-html5
otherbuild(deps): bump form-data from 4.0.5 to 4.0.6 in /bigbluebutton-tests/playwright
fixfix(video-provider): show raised hand indicator on audio-only tiles
fixfix(chat): preserve text before links in reply message preview
featureAdd client setting to not display guest lobby position
fixFix breakout webcams only for moderator lock
fixfix(screenshare): keep startScreensharing name in minifier for tablet app
fixfix: Unified Layout: tile count plus aggregated users does not match total participant count (3.0)
fixfix(client): Accessibility updates
fixfix(html5): escape emoticon auto-conversion with a leading backslash
fixfix(audio): reinforce mute state on LK publish and reconnects
featurefeat(html5): Hide sessionToken from address bar
otherrefactor (graphql/html5): Always show most recently pinned user first, followed by the others
featureperf(html5): Enable json patch for GridUsers subscription (and reduce payload significantly)
otherstyle(client): Support plugin-specified button color in actions bar
othertest: updates to Whiteboard
otherwebpack: ignore .yalc/ from file watching and exclude tldraw from managed-path version caching for 3.0
otherTests: add Unified Layout minimize regression tests
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
featurefeat(plugins): stop screenshare and upload presentation
fixfix(presentation): snapshot of current slide is blank under cluster-proxy
fixfix(bbb-web): Return Better Errors From Presentation Upload
fixfix(akka, bbb-web): clientSettingsOverride fails silently
fixfix(shared-notes-server): export empty notes as a blank file, not an error
otherrefactor (gql-middleware): Enable the custom json patcher for subscriptions with user_camera type
featurefeat(LAD): add standalone build mode for LAD
fixfix(recording): reduce mem usage when audio cut extends into gap
fixrecording: Fix processing hangs from seeking in screenshare files with video
fixrecording: Fix hang in audio processing
featurefeat(recording): disable formats per meeting
otherbuild(bbb-web): Nginx cleanup
otherbuild(freeswitch): v1.11.1 (up from v1.10.12)
otherbuild(freeswitch): pick relevant changes from v1.11.0/1 into v1.10.12
otherdocs: Updated the options for the 'meetingLayout' parameter to include 'PARTICIPANTS_AND_CHAT_ONLY'.
otherdocs: Prepare docs changes for BBB 3.0.30
otherbuild(deps html5 client): bump launch-editor from 2.8.1 to 2.14.1 in /bigbluebutton-html5
otherbuild(deps-dev): bump launch-editor from 2.8.0 to 2.14.1 in /bbb-graphql-client-test
otherchore: Add SonarQube configuration for project analysis
otherchore: Merge 3.0.29 into v3.0.x-develop
otherchore: BigBlueButton 3.0.30 iteration
securityfix: Block embeddable shape types in whiteboard annotations by @Tainan404 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h2rp-mcch-vgh9
securityfix(bbb-web): Reject GET-Only Endpoint Requests With Request Bodies by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q8vx-4cgc-7w4w
securityfix(playback): prevent stored XSS in recording playback by @germanocaumo https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9
securityfix(akka-apps): Verify Meeting ID on Presentation Delete Message by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g
fixfix: bn- table crash with static toolbar
fixfix: activating the listen-in function results in an error (drop out of user from the breakout room)
fixfix (html5/shared-notes-server): Read-only fixes and new version for BlockNote
fixfix (html5/bbb-web): Preloading of slides not working for proxy setups
fixfix: Talking indicator some letters are cut off
fixfix (html5): Fix genaral blocknotes issues related with losing focus
fixfix(accessibility): settings dropdown keyboard navigation
fixfix (shared-notes-server): Simplify permission handling
fixfix (shared-notes-server): Badge not being showed when shared notes is changed (in BlockNote)
fixfix (shared-notes-server/cluster): Use $bbb_cors_origin for shared-notes-server Allow-Origin (CORS)
otherref: change text align select button to remove previous selector
featurefeat(livekit): add forceRelay/forceRelayOnFirefox settings, +
featurefeat(accessibility): add Esc shortcut to move focus in/out of the BlockNote shared notes editor
otherperf (html5): Improve video stream queries for server performance
featurefeat: Added patched flag to users basic info subscription
fixfix (tests): make Play/Pause test env-independent by comparing screenshots dynamically
fixfix(tests): stabilize "Upload multiple presentations" against toast race
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherrefactor (akka-apps / LAD): Improve session grouping after disconnect
otherrefactor(core): create public media groups groups lazily, +
otherperf (gql-middleware): improve json patcher, produce minimal patches via LCS-based move generation
featurefeat(core): recording parameter passthrough to breakouts
featurefeat(core): allow moderators to manage lock settings inside breakout rooms and optionally inherit parent meeting lock settings on creation
fixfix(core): breakout: propagate parent client settings override
fixfix(bbb-web): Enforce Presentation File Size Limits On All Paths
fixfix: Recordings break on nfs
otherRevert "fix: Recordings break on nfs"
fixfix(recording): address ffmpeg high memory usage from video PTS gaps
featurerecording: add internal docs for video edl/layout
otherbuild(shared-notes-server): Add postgresql-14 as a dependency in opts…
otherbuild(bbb-playback): Bump to bbb-playback to v5.4.7
otherbuild(deps): [email protected] (up from 2.17.1)
otherdocs: add CLAUDE.md with operational notes for the Docusaurus site
otherdocs: document bigbluebutton.properties additions in BBB 3.0.27
otherUpdate action text and documentation link
otherdocs: Add some missing properties of manifest.json in the docs
otherchore: update @bigbluebutton/tldraw from alpha.33 to alpha.34
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 2 updates
otherchore: update @bigbluebutton/tldraw from alpha.34 to alpha.35
otherbuild(deps): bump the npm_and_yarn group across 6 directories with 1 update
+8 more items in the release notesfixfix(html5): restore Ctrl+Z / Ctrl+Shift+Z in BlockNote
fixfix: Poll/quiz publishing does not show notification to viewers
fixfix: Guests note missing / disappearing
fixfix: lockSettingsHideUserList leaks usernames in the chat if a viewer was (temp) set to presenter
fixfix(client): Fix Android being too greedy with Safari user agent (fixes #24295)
fixfix: Fix performance issue with block-note dark mode
fixfix(breakouts): user id handling
fixFix(html5): Presenter whiteboard camera position moving on window resizing
fixfix: fix hardcoded colors scheme for exported notes.html
fixfix: bn- table crash with static toolbar
featurefeat: Enable users to pan outside the current presenters view during infinite whiteboard
otherrefactor(livekit): memoize useMediaSenders result (selective sub)
otherref: decrease size of block-note toolbar
fixfix (ci/tests): Stabilize cross-page slide comparison
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
fixfix(bbb-web): Add Callback URL Validation
otherrefactor (gql-middleware): Minor improvements
otherrefactor(bbb-web): Update Plugin URL Handling
fixfix (gql-server): Set typing=false once user edited a message
featurefeat: cache plugin manifest files with bbb-web
fixfix(presentation): Require SessionToken and PageToken on Presentation Page Requests
other[3.0 recording] fix: external video recording not shown after screenshare
fixfix(recording): add presentation minimized events + screenshare as content fixes
fixfix(recording): Fix events archiving on servers with blocknote
otherbuild: Update bbb-pads branch to v1.5.11
otherbuild: bump bbb-playback to 5.4.5
otherbuild: Update bbb-playback branch to v5.4.6
otherdocs(administration): fix typos in lti.md
otherdocs: rebuild "Other meeting configs available" table
otherchore: Migrate from deprecated GitHub Stale App to actions/stale, exempt milestone issues
otherchore: Replace defunct behaviorbot/welcome app with GitHub Actions workflow
otherchore: Expand welcome workflow first-time contributor detection
otheriteration: BigBlueButton 3.0.27
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 1 update
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 1 update
otherbuild(deps): bump ip-address from 10.1.0 to 10.2.0 in /bbb-learning-dashboard in the npm_and_yarn group across 1 directory
otherbuild(deps): bump the npm_and_yarn group across 4 directories with 1 update
otherbuild(deps): bump mermaid from 11.12.3 to 11.15.0 in /docs in the npm_and_yarn group across 1 directory
fixfix(html5): keep loading screen during graphql retries and show error screen on connection timeout
fixfix(html5): prevent pinch-to-zoom for viewers and WB users on touch devices
fixfix: suppress join/leave notifications for locked viewers when hideUserList is active
fixfix (html5): Export of Block Notes broken for cluster setup
fixfix: blocknote placeholder wrap when container size too small
other[3.0 port] fix: exclude audio-only tiles from SFU subscription and plugin buttons
featurefeat (html5): Implement static toolbar for BlockNote
deprecated[3.0 external video share] remove deprecated parameters
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore(livekit): enable reconnectOnFatalFailure by default
fixfix(livekit): dial-in unable to be heard by web users
other[3.0 port] fix(bbb-web): respond to /create before downloading pre-uploaded presentations
fixfix(bbb-web): Upgrade Dependencies
fixrecording: Fix hang when deskshare audio ends before video
fixfix (build): Install XDG_RUNTIME_DIR drop-in in Docker for bbb-shared-notes-server
otherdocs: Document lockSettingsHideViewersAnnotation /create parameter
otherdocs: Fix livekit setup commands
otherdocs: Mention sharedNotesEditor was added as a create param
otherdocs: Refactor/restructure BBB 3.0 api changes to be more readable
otherdocs: Fix - strings were being interpreted as True
otherdocs: Simplify bbb-web dev instructions
otherdocs: Document events.xml LayoutBroadcastedEvent addition
otherdocs: Fix typos and iterate over 3.0 docs
otherdocs: bump bbb version to 3.0.26
other[3.0 doc] Guide to use developing html5 client
otherci: bump GitHub Actions to Node 24 versions
fixfix(whiteboard): prevent presenter/viewer viewed-region desync after fullscreen
fixFix(html5): Make the cursor point respect the pointerDiameter setting
fixfix(html5): Notifications being clipped on mobile
fixfix(html5): fix question detection and indented option matching
fixfix: review breakout room moderator actions
fixfix: Breakouts: viewers sent to waiting lobby
fixFix(html5): WB camera position change on slide change when zoom applied
fixFix(html5): zoom with mouser wheel not being centered
fixfix: client crashes when a invalid layout is set in local storage(port to 3.0)
fixfix(html5, tests): only display allowed shapes in edit mode
fixfix(chat): display message timestamp using locale-aware time format
fixFix(html5): cursor zoom misalignment
fixFix(html5): cursor appearing on wrong position to viewers
fixfix: State events leak between user sessions or tabs
featurefeat: Block note integration
breakingRef(html5): Remove non-used settings
featurefeat: extend audio groups to cameras and screen sharing
otherrefactor(livekit): review camera and screen sharing quality presets and simulcast layers
featurefeat(livekit): option to use LiveKit as the client's audio state source
featurefeat(livekit): add a last N-like system to selective subscription (audio)
fixfix(livekit): only display screenshare volume control if there's audio
fixfix(livekit): use LK APIs for WebRTC stats gathering, fix edge cases
featurefeat(html5): Automate asset compression with Webpack
fixfix(html5): exclude .gz files from language selector list
otherRef(html5): Make webcam show ui on hover or touch hold
otherci: remove 3rd-party packages pull + install
othertests: update connection status tests
othertests: update flaky tests
fixfix(plugin-sdk): screenshare blocks snapshot of current slide for plugin-sdk
fixfix(plugin-sdk): Change loading value of a subscription when data didn't change
fixfix(LAD): Generic data keeps updating in plugin's table
featurefeat(plugin-sdk): Add svg icon for all extensible areas
fixfix(bbb-web): Disable External Entity Parsing in XML Services
featurefeat (bbb-web): Introduce a new /create param clientSettingsOverrideJsonUrl
fixfix(akka-apps): Remove Unnecessary Akka Apps Logging
fixfix(bbb-web): Upgrade Grails and Spring Boot
fixfix(bbb-web): Prevent SVGs From Being Generated With Zero Value Dimensions
fixFix(akka): Add Disable feature support for plugins
fixfix(LAD): Legacy dasboard data files not working with newer version of BBB
fixfix(recording): Address A/V sync issues, glitches on cuts, ffmpeg memory usage (audio)
+36 more items in the release notessecurityMissing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33
securityOpen Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8
fixFix(html5): The video preview and audio modals open even with the lock settings settings enabled
fixfix: trim spaces of external video url
otherUpdate external video label to remove unsupported platform
fixfix: WhiteBoard Ctrl+D work only once
fixfix: userdata-bbb_override_default_locale is ineffective in guest lobby
otherBreakouts: ensure moderator only functionality is not shown
featurefeat: Make webcamBackgroundURL available in breakouts
fixFix(html5): Space bar key problem on WB
otherstyle: Improve visual hierarchy and UX of guest lobby screen by @tylercopeland @ramonlsouza
fixFix(html5): Recalculate time sync when a new minimal rtt is available
fixfix: talking indicator behind webcam area - custom and smart layouts
fixfix(html5): session details closing when user talks
fixfix(whiteboard): scope slide zoom state to presentation id by @ramonlsouza @germanocaumo
otherrefactor(client): Reword You have been banned message
otherchore: temporarily disable breakout audio transfer UI when using LiveKit
othertest: add test cases for external video
fixfix (ci): attempt to fix: Error: Input required and not supplied: token for Cleanup Playwright reports workflow
otherci: avoid running GH workflows after PR is merged when it's not necessary at this point
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/24667 https://github.com/bigbluebutton/bigbluebutton/pull/24733
otherUpdates for project BigBlueButton v3.0 HTML5 client and language eu
fixfix (akka-apps): Prevent race condition when a user joins a breakout room
fixfix (gql-server): Not re-assigning users to their last breakout room
fixfix (akka-apps): not storing user activity for breakout rooms (only main meeting)
otherrefactor(core): Breakouts moderator vs viewer
otherrefactor: drop logging of password/authToken
securityfix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026
securityfix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026
fixfix: Additional checks in polls
securityfix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026
securityfix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will…
securityfix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026
otherchore(recording): Bump bbbevents to 2.0.3
fixfix(recording): Detect system sender correctly in breakouts recording
otherRecording: avoid short cuts in audio processing
otherbuild: require running redis for bbb-export-annotations.service
otherbuild: [email protected] (up from v1.9.9), [email protected] (up from v2.3.1), +
otherbuild: Update .gitlab-ci.yml with Go 1.26.0 and NodeJS 22.22.0
featureAdd firewalld support to apply-lib.sh
fixfix(conf): Avoid bbb-conf noise on empty bigbluebutton.properties
featurefeat(conf): Warn about retired bbb-web properties
+6 more items in the release notesfixFix(html5): Annotations get transferred to another presentation
otherrefactor: camera custom pagination settings
fixfix (html5): Always include presenter in cursors list
otherRefactor(html5): Improve deduplication logic for toastify
fixfix(audio): missing CC icon in talking indicator (mediasoup/FS)
fixfix: userdata-bbb_auto_share_webcam=true causes webcams to stay enabled when joining breakout rooms
fixfix: Leave meeting button oversize area
otherrefactor: remove unused component
fixfix: pushLayout default settings
fixfix: audio modal should have precedence over video modal
featureIntroduce showAudioOnlyOnFirstPage and maxAudioOnlyUsers settings
fixFix(html5): Eraser not being persisted in the batch
fixfix: audio-only tiles appear in all layouts
othertest(docs): Update README and remove config for browsers not fully supported
otherrefactor: Add data-test to a few user-list components
fixfix(workflow): Update publish-results workflow with robust PR resolution, cleanup, and in‑progress rerun handling
fixfix(workflow): Publish test-results under workflow ID
othertests: adjust toast element check
othertest(chore): [Snyk] Security upgrade axios from 1.12.2 to 1.13.5 https://github.com/bigbluebutton/bigbluebutton/pull/24632
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et https://github.com/bigbluebutton/bigbluebutton/pull/24600
otherrefactor (gql-middleware): Make message caches meeting-scoped
securityFix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026
fixfix(core): Fix transcription problem with multiple users speaking at the same time
fixfix(export): respect autoSize property for text annotations
otherchore(export-annot): Bump axios to 1.13.5 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24640
fix[3.0]docs: Fix broken links
otherdocs: Adjust wording of welcome message location
security[3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026
fixFix(html5): presentation moving to old position when enable infinite WB
fixFix(html5): missing space in some locales on waiting room queue
featurefeat(ci): Restore upload of merge HTML reporter to publish tests
fixfix(ci): refine conditions for publishing test results and handling blob reports
otherUpdates for project BigBlueButton v3.0 HTML5 client and language hu_HU
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar
securityfix(bbb-web): Prevent Checksum Bypass With PresentationUploadExternalUrl contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff will be made public not earlier than Feb 10, 2026
securityfix(bbb-web): Use Secure PRNG for ID and Token Generation contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h will be made public not earlier than Feb 10, 2026
fixfix (akka-apps): list of breakout rooms doesn't update when user is promoted/demoted
otherref(plugin): refactor the code of plugin logger to be more robust
fixfix(bbb-conf): Use turnutils_stunclient instead of old stun 0.97 client
otherbuild: Bump bbb-pads to 1.5.7
otherbuild: Bump bbb-pads to 1.5.8
otherdocs: Add docs for meta_analytics-callback-url
otherdocs: set a random domain as example in Docs