Summary by CodeRabbit

Bug Fixes
- users.presence correctly accepts multiple IDs (comma-separated or repeated).
- users.deactivateIdle now revokes cleared login tokens when deactivating idle accounts.
- Auto-translate requires authentication, validates inputs, and denies access for non-members (forbidden).
Tests
- Added end-to-end tests for presence queries, deactivateIdle token revocation, and auto-translate input/access checks (API and method-call).
Chores
- Updated package metadata and API typings for patch releases.

You can see below a preview of the release change log:

8.4.2

(#40627 by @dionisio-bot) Ensures OAuth tokens are cleaned up after user deactivation
Bump @rocket.chat/meteor version.
(#40527 by @dionisio-bot) Fixes the users.presence endpoint returning an empty array when called with multiple comma-separated IDs, caused by ajvQuery coercing the string into a single-element array after the OpenAPI migration
(#40559 by @dionisio-bot) Ensures that deactivated users have their login tokens cleaned up in users.deactivateidle
(#40539 by @dionisio-bot) Ensures the Meteor method for translateMessage validates access and types
(#40577 by @dionisio-bot) Ensures the visitor token is not present in the visitors.info response
(#40547 by @dionisio-bot) Ensures the autotranslate.translateMessage endpoint checks for room access
Updated dependencies [b0c593db9bc0bbbb603e673ddcdc48aad4f4e721, f422eb613d8cae43dc1e44d71b6ecb5a0a9c5d92, 3a3f0e1103bd0b8aaf93c16300ed664aed7a67a1]:
- @rocket.chat/model-typings@2.2.2
- @rocket.chat/models@2.2.2
- @rocket.chat/rest-typings@8.4.2
- @rocket.chat/core-typings@8.4.2