BigBlueButton 3.0.38 → 4.0.1
4 releases · 4 breaking changes · 0 security fixes · 1 advisory fixed
0security4breaking0deprecated11feature40fix
Vulnerabilities fixed by this upgrade
- 4.3 GHSA-c4v9-6mvh-px5p Improper enforcement of plugin role restrictions on custom chat messages
Breaking changes
- breaking bbb-web no longer recognizes the accessControlAllowOrigin and serviceEnabled properties. Neither has had any effect since BigBlueButton 2.2: serviceEnabled=false never switched the API off, and cross-origin access to bbb-web is configured with the grails.cors.* options described in the cluster… in 4.0.1
- breaking On BigBlueButton 4.0.0, bbb-conf --set-port-range wrote the LiveKit port range into /etc/bigbluebutton/livekit.yaml as quoted strings, which livekit-server refuses to load. The upgrade does not rewrite that file, so if you ran the command on 4.0.0, run it again after upgrading. Details in #26289. in 4.0.1
- breaking [3.0] fix(audio): remove the away status when talking with push-to-talk in 3.0.40
- breaking [3.0] docs: remove the dead captions value from disabledFeatures in 3.0.40
Security changes
None in the release notes.
Every release in between
breakingbbb-web no longer recognizes the accessControlAllowOrigin and serviceEnabled properties. Neither has had any effect since BigBlueButton 2.2: serviceEnabled=false never switched the API off, and cross-origin access to bbb-web is configured with the grails.cors.* options described in the cluster…
breakingOn BigBlueButton 4.0.0, bbb-conf --set-port-range wrote the LiveKit port range into /etc/bigbluebutton/livekit.yaml as quoted strings, which livekit-server refuses to load. The upgrade does not rewrite that file, so if you ran the command on 4.0.0, run it again after upgrading. Details in #26289.
fixfix: incorrect camera label in video preview
fixfix(client): Propagate the intended camera dock geometry instead of a zero one on phone landscape
fixfix(whiteboard): Fix presenter's two-finger pinch zoom on touch devices
fixfix(audio-captions): pre-select the configured transcription language
fixfix(client): round plugin and screenshare corners in the media area
fixfix(livekit): accept constraint objects in camera profiles
fixfix (html5): turn Share webcam into a Stop sharing webcam toggle, in profile-settings
fixfix(html5): keep rendererInterfaces a Map when neutering React DevTools hook
fixfix (html5): Keep the background list in place when selecting in the video preview (virtual-background modal)
fixfix (html5): chat - remember pinned message collapsed state
fixfix: userdata-bbb_initial_selected_tool with a shape id crashes the whiteboard
fixfix (html5): Hide camera settings when webcam sharing is locked in User Profile
featurefeat(audio): stop persisting the audio filter choice across sessions and meetings
featureperf(html5): cut video grid re-renders and speed up LiveKit camera subscriptions
featurefeat(webcams): allow limiting the pagination toggle to moderators
featurefeat(audio-captions): option to transcribe on the user's device only
featurefeat(html5): add Last-N audio to LiveKit selective subscription
featurefeat(html5): add static bbb-* CSS classes to key components for theming
fixfix: clean up the saved user-names file and small test-suite leftovers
fixfix(core): Authorize presenter changes by the request sender
feature[4.0] Add option to disable announcement of user away status in chat
featurefeat(graphql-actions): support a password-protected Redis
fixfix(graphql-middleware): wait for Redis at startup, exit on lost subscription
fixfix(bbb-web): check the unit before stopping bbb-web in deploy_to_usr_share.sh
fixfix(bbb-web): keep controller helpers out of the URL space, drop the dead 500 view, trust createNewFile() (#26002, 2/3)
fixfix(core): Harden breakoutRoomsPrivateChatEnabled and disabledFeatures=privateChat
fixfix(bbb-web): use the SecureRandom helper for every generated value
fixfix(bbb-web): finish dropping SVG from the presentation type lists
fixfix(core): Add two parameters to meetingEndedCallbackURL to show record-processing banner in GL- #25929
fixfix(bbb-web): Improve Presentation Upload Limits
fixfix(bbb-web): Fix 400 bbb web unknown action 404 error handler
fixfix(bbb-web): skip the presentation conversion when its meeting is already gone
fixfix(learning-dashboard): count a user online while any session is open
fixfix(recording): Rap yaml loader followups 40
fixfix(recording): read bigbluebutton.yml through read_props in every script
fixfix(recording): log to stdout when not running under the systemd journal
fixfix(recording): keep chat links in video playback
fixfix(livekit): logging.level and --set-port-range fixes for LiveKit
+91 more items in the release notesfeatureRedesigned client interface with a new navigation sidebar and an Apps Gallery, where apps and plugins can be pinned, searched and shown as a list or a grid
otherSearch in the user list, a redesigned timer, a dedicated guest management panel, a redesigned permissions (lock viewers) modal and an overhauled mobile layout
otherAutomatic light/dark theme following the operating system, and a dedicated Audio settings tab with Advanced Filtering (WASM noise suppression), Standard Filtering and Original Audio modes
otherRequest to Present: viewers can ask for the presenter role and moderators approve or deny (lockSettingsPresenterPolicy)
otherPinned chat messages, larger emoji-only messages, optional user consent before a moderator unmutes them, and a Multi-Functional Mode that opens two sidebar panels side by side
otherLearning Dashboard for breakout rooms, with per-breakout data kept until the parent meeting ends
otherLiveKit is the default media framework for audio, cameras and screen sharing; bbb-webrtc-sfu and FreeSWITCH stay installed and can be selected per meeting or server-wide
otherBlockNote is the only shared notes editor; Etherpad is no longer installed
otherPlugin SDK 1.0 (bigbluebutton-html-plugin-sdk 1.0.0-beta.3)
otherdocs: 4.0.0 preparations
fixfix(client): re-arm stale connection watchdog after each stale period
fixfix(html5): keep unused webpack cache entries for the default period
fixfix(audio-captions): transcribe the microphone in use in the meeting (webspeech)
breaking[3.0] fix(audio): remove the away status when talking with push-to-talk
feature[3.0] feat: Add option to disable announcement of user away status in chat
other[3.0]test: Improve failing tests on layouts and recording
othertest: Add shared notes access coverage
otherci: post the in-progress tests comment once per run
other[3.0 port] test(whiteboard): port the same-run camera re-sync baseline, blur the idle viewer before the Pan screenshot
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/26225
other[3.0 port] fix(akka-apps & bbb-graphql-middleware): Log Failed Middleware Reconnection Requests and Deliver Stream Replay 3.0
other[3.0] fix(core): Authorize presenter changes by the request sender
other[3.0 port] build: upgrade bbb-web stack to Grails 8.0.0 / Spring Boot 4.1.1
other[3.0] build(bbb-web): bump embedded Tomcat to 11.0.27
other[3.0] build(bbb-web): bump the Gradle wrapper to 9.8.1
other[3.0 port] fix(bbb-export-annotations): wrap exported text exactly as the client does
fixfix(record-and-playback): deploy Gemfile.lock along with Gemfile
fixfix(recording): restore presentation panzoom after screenshare stops
other[3.0] build: move the 0.81 and 0.9.0 presentation players to an optional package
other[3.0]build: Update versions for Go 1.27.3, Gradle 9.8.1, and Node 22.23.4
otherbuild: let the build system name the version the legacy package pins to
breaking[3.0] docs: remove the dead captions value from disabledFeatures
otherdocs: iteration doc sync for 3.0.40
otherbuild(deps): bump joi from 17.13.6 to 17.13.8 in /docs
otherbuild(deps): bump brace-expansion from 1.1.18 to 1.1.21 in /docs
otherbuild(deps): bump axios from 1.18.0 to 1.20.0 in /bigbluebutton-tests/playwright
otherbuild(deps): bump dompurify from 3.4.14 to 3.4.16 in /docs
otherbuild(deps): bump brace-expansion in /bbb-graphql-client-test
otherbuild(deps): bump compression from 1.8.1 to 1.8.2 in /docs
otherbuild(deps): bump source-map-js from 1.2.1 to 1.2.2 in /docs
otherbuild(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /docs
otherbuild(deps): bump shell-quote from 1.10.0 to 1.12.0 in /docs
otherbuild(deps): bump compression from 1.8.1 to 1.8.2 in /bigbluebutton-html5
otherbuild(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /bigbluebutton-html5
otherbuild(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /bbb-graphql-client-test
otherbuild(deps-dev): bump shell-quote from 1.8.4 to 1.12.0 in /bbb-graphql-client-test
otherbuild(deps): bump source-map-js from 1.2.1 to 1.2.2 in /bigbluebutton-html5
otherbuild(deps): bump katex and mermaid in /docs
otherbuild(deps-dev): bump compression from 1.8.1 to 1.8.2 in /bbb-graphql-client-test
otherbuild(deps-dev): bump proxy-addr from 2.0.7 to 2.0.8 in /bbb-graphql-client-test
+4 more items in the release notesfixFix(html5): Move and add button are still shown if cursor is outside of the shared notes
other[3.0 presentation toolbar] fix: darkmode-aware CSS for infinite WB button
other[3.0]fix(waiting-users): order the guest lobby list by time of arrival
feature[3.0 WB] fix: add trailing to throttling for cursor updates
fixfix(video-provider): clear stale grid avatars when a presentation is open (3.0)
otherci(plugin/test): added test infrastructure for the plugins
other[3.0]test(breakout): stabilize lock-settings tests under load
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/25934
other[3.0 backport] fix: Upload error toast for a rejected presentation can't be dismissed and keeps reappearing
fixfix(akka-apps): Allow Locked Users to See Moderator Voice State
other[3.0]fix(export): render annotated slide backgrounds from the source PDF
other[3.0]fix(export-annotations):Fix export soft mask followups 30
fixfix(bbb-export-annotations): set xml:space through the XML namespace
other[3.0 backport] fix(bbb-export-annotations): prevent exported text overlap for width-constrained shapes
fixfix(recording): include sanitizeChatHTML in video playback
other[3.0 port] fix(recording): don't blank the presentation on screenshare-as-content
other[3.0 backport] fix(recording): use instance variable for segment break timestamp
other[3.0 port] fix(rap): hide every camera of a locked user in recordings- #25889
otherbuild(bbb-presentation-video): Update to 5.1.0-rc.4
otherbuild: Update bbb-playback from 5.4.7 to v5.4.8
otherdocs: Add recent releases in new-features.md
otherdocs: Catch-up on missed docs changes in BBB 3.0.33..39
otherbuild(deps-dev): bump postcss-selector-parser from 6.1.0 to 6.1.4 in /bbb-graphql-client-test
otherbuild(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /bbb-graphql-client-test
otherbuild(deps): bump sanitize-html from 2.17.6 to 2.17.7 in /bigbluebutton-html5
otherbuild(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /bbb-graphql-client-test
otherbuild(deps-dev): bump fast-uri from 3.1.4 to 3.1.7 in /bigbluebutton-html5
otherbuild(deps): bump qs from 6.15.2 to 6.16.0 in /bbb-shared-notes-server
otherbuild(deps): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-shared-notes-server
otherbuild(deps): bump colord from 2.9.2 to 2.10.0 in /bbb-learning-dashboard
otherchore: Merge 3.0.37 into v3.0.x develop
otherbuild(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-export-annotations
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /docs
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /bbb-learning-dashboard
otherbuild(deps): bump image-size and svgdom in /bbb-export-annotations
otherbuild(deps): bump image-size from 2.0.2 to 2.0.4 in /docs
otherbuild(deps): bump ip-address from 10.4.0 to 10.7.2 in /bbb-shared-notes-server
otherchore: Forward port BBB 3.0.38 into v3.0.x-develop
otherchore(client): bump tldraw to 2.0.0-alpha.36
+1 more item in the release notes