BigBlueButton 3.0.39 → 4.0.1
3 releases · 4 breaking changes · 0 security fixes · 1 advisory fixed
0security4breaking0deprecated10feature35fix
Vulnerabilities fixed by this upgrade
- 4.3 GHSA-c4v9-6mvh-px5p Improper enforcement of plugin role restrictions on custom chat messages
Breaking changes
- breaking bbb-web no longer recognizes the accessControlAllowOrigin and serviceEnabled properties. Neither has had any effect since BigBlueButton 2.2: serviceEnabled=false never switched the API off, and cross-origin access to bbb-web is configured with the grails.cors.* options described in the cluster… in 4.0.1
- breaking On BigBlueButton 4.0.0, bbb-conf --set-port-range wrote the LiveKit port range into /etc/bigbluebutton/livekit.yaml as quoted strings, which livekit-server refuses to load. The upgrade does not rewrite that file, so if you ran the command on 4.0.0, run it again after upgrading. Details in #26289. in 4.0.1
- breaking [3.0] fix(audio): remove the away status when talking with push-to-talk in 3.0.40
- breaking [3.0] docs: remove the dead captions value from disabledFeatures in 3.0.40
Security changes
None in the release notes.
Every release in between
breakingbbb-web no longer recognizes the accessControlAllowOrigin and serviceEnabled properties. Neither has had any effect since BigBlueButton 2.2: serviceEnabled=false never switched the API off, and cross-origin access to bbb-web is configured with the grails.cors.* options described in the cluster…
breakingOn BigBlueButton 4.0.0, bbb-conf --set-port-range wrote the LiveKit port range into /etc/bigbluebutton/livekit.yaml as quoted strings, which livekit-server refuses to load. The upgrade does not rewrite that file, so if you ran the command on 4.0.0, run it again after upgrading. Details in #26289.
fixfix: incorrect camera label in video preview
fixfix(client): Propagate the intended camera dock geometry instead of a zero one on phone landscape
fixfix(whiteboard): Fix presenter's two-finger pinch zoom on touch devices
fixfix(audio-captions): pre-select the configured transcription language
fixfix(client): round plugin and screenshare corners in the media area
fixfix(livekit): accept constraint objects in camera profiles
fixfix (html5): turn Share webcam into a Stop sharing webcam toggle, in profile-settings
fixfix(html5): keep rendererInterfaces a Map when neutering React DevTools hook
fixfix (html5): Keep the background list in place when selecting in the video preview (virtual-background modal)
fixfix (html5): chat - remember pinned message collapsed state
fixfix: userdata-bbb_initial_selected_tool with a shape id crashes the whiteboard
fixfix (html5): Hide camera settings when webcam sharing is locked in User Profile
featurefeat(audio): stop persisting the audio filter choice across sessions and meetings
featureperf(html5): cut video grid re-renders and speed up LiveKit camera subscriptions
featurefeat(webcams): allow limiting the pagination toggle to moderators
featurefeat(audio-captions): option to transcribe on the user's device only
featurefeat(html5): add Last-N audio to LiveKit selective subscription
featurefeat(html5): add static bbb-* CSS classes to key components for theming
fixfix: clean up the saved user-names file and small test-suite leftovers
fixfix(core): Authorize presenter changes by the request sender
feature[4.0] Add option to disable announcement of user away status in chat
featurefeat(graphql-actions): support a password-protected Redis
fixfix(graphql-middleware): wait for Redis at startup, exit on lost subscription
fixfix(bbb-web): check the unit before stopping bbb-web in deploy_to_usr_share.sh
fixfix(bbb-web): keep controller helpers out of the URL space, drop the dead 500 view, trust createNewFile() (#26002, 2/3)
fixfix(core): Harden breakoutRoomsPrivateChatEnabled and disabledFeatures=privateChat
fixfix(bbb-web): use the SecureRandom helper for every generated value
fixfix(bbb-web): finish dropping SVG from the presentation type lists
fixfix(core): Add two parameters to meetingEndedCallbackURL to show record-processing banner in GL- #25929
fixfix(bbb-web): Improve Presentation Upload Limits
fixfix(bbb-web): Fix 400 bbb web unknown action 404 error handler
fixfix(bbb-web): skip the presentation conversion when its meeting is already gone
fixfix(learning-dashboard): count a user online while any session is open
fixfix(recording): Rap yaml loader followups 40
fixfix(recording): read bigbluebutton.yml through read_props in every script
fixfix(recording): log to stdout when not running under the systemd journal
fixfix(recording): keep chat links in video playback
fixfix(livekit): logging.level and --set-port-range fixes for LiveKit
+91 more items in the release notesfeatureRedesigned client interface with a new navigation sidebar and an Apps Gallery, where apps and plugins can be pinned, searched and shown as a list or a grid
otherSearch in the user list, a redesigned timer, a dedicated guest management panel, a redesigned permissions (lock viewers) modal and an overhauled mobile layout
otherAutomatic light/dark theme following the operating system, and a dedicated Audio settings tab with Advanced Filtering (WASM noise suppression), Standard Filtering and Original Audio modes
otherRequest to Present: viewers can ask for the presenter role and moderators approve or deny (lockSettingsPresenterPolicy)
otherPinned chat messages, larger emoji-only messages, optional user consent before a moderator unmutes them, and a Multi-Functional Mode that opens two sidebar panels side by side
otherLearning Dashboard for breakout rooms, with per-breakout data kept until the parent meeting ends
otherLiveKit is the default media framework for audio, cameras and screen sharing; bbb-webrtc-sfu and FreeSWITCH stay installed and can be selected per meeting or server-wide
otherBlockNote is the only shared notes editor; Etherpad is no longer installed
otherPlugin SDK 1.0 (bigbluebutton-html-plugin-sdk 1.0.0-beta.3)
otherdocs: 4.0.0 preparations
fixfix(client): re-arm stale connection watchdog after each stale period
fixfix(html5): keep unused webpack cache entries for the default period
fixfix(audio-captions): transcribe the microphone in use in the meeting (webspeech)
breaking[3.0] fix(audio): remove the away status when talking with push-to-talk
feature[3.0] feat: Add option to disable announcement of user away status in chat
other[3.0]test: Improve failing tests on layouts and recording
othertest: Add shared notes access coverage
otherci: post the in-progress tests comment once per run
other[3.0 port] test(whiteboard): port the same-run camera re-sync baseline, blur the idle viewer before the Pan screenshot
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/26225
other[3.0 port] fix(akka-apps & bbb-graphql-middleware): Log Failed Middleware Reconnection Requests and Deliver Stream Replay 3.0
other[3.0] fix(core): Authorize presenter changes by the request sender
other[3.0 port] build: upgrade bbb-web stack to Grails 8.0.0 / Spring Boot 4.1.1
other[3.0] build(bbb-web): bump embedded Tomcat to 11.0.27
other[3.0] build(bbb-web): bump the Gradle wrapper to 9.8.1
other[3.0 port] fix(bbb-export-annotations): wrap exported text exactly as the client does
fixfix(record-and-playback): deploy Gemfile.lock along with Gemfile
fixfix(recording): restore presentation panzoom after screenshare stops
other[3.0] build: move the 0.81 and 0.9.0 presentation players to an optional package
other[3.0]build: Update versions for Go 1.27.3, Gradle 9.8.1, and Node 22.23.4
otherbuild: let the build system name the version the legacy package pins to
breaking[3.0] docs: remove the dead captions value from disabledFeatures
otherdocs: iteration doc sync for 3.0.40
otherbuild(deps): bump joi from 17.13.6 to 17.13.8 in /docs
otherbuild(deps): bump brace-expansion from 1.1.18 to 1.1.21 in /docs
otherbuild(deps): bump axios from 1.18.0 to 1.20.0 in /bigbluebutton-tests/playwright
otherbuild(deps): bump dompurify from 3.4.14 to 3.4.16 in /docs
otherbuild(deps): bump brace-expansion in /bbb-graphql-client-test
otherbuild(deps): bump compression from 1.8.1 to 1.8.2 in /docs
otherbuild(deps): bump source-map-js from 1.2.1 to 1.2.2 in /docs
otherbuild(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /docs
otherbuild(deps): bump shell-quote from 1.10.0 to 1.12.0 in /docs
otherbuild(deps): bump compression from 1.8.1 to 1.8.2 in /bigbluebutton-html5
otherbuild(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /bigbluebutton-html5
otherbuild(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /bbb-graphql-client-test
otherbuild(deps-dev): bump shell-quote from 1.8.4 to 1.12.0 in /bbb-graphql-client-test
otherbuild(deps): bump source-map-js from 1.2.1 to 1.2.2 in /bigbluebutton-html5
otherbuild(deps): bump katex and mermaid in /docs
otherbuild(deps-dev): bump compression from 1.8.1 to 1.8.2 in /bbb-graphql-client-test
otherbuild(deps-dev): bump proxy-addr from 2.0.7 to 2.0.8 in /bbb-graphql-client-test
+4 more items in the release notes