Summary by CodeRabbit

• Chores

  • Recorded multiple patch releases and a security hotfix.

• New Features / Security

  • Hardened Apple Sign‑In: safer token validation and client secret generation; web login hidden when config incomplete.
  • HTML exports and emailed exports now escape content and include a restrictive Content‑Security‑Policy.

• Bug Fixes / Permissions

  • File downloads limited to file owner; stricter upload access and deletion authorization.
  • Fingerprint API now requires manage‑cloud permission (403 when unauthorized).

• Tests

  • Added coverage for Apple auth, file access/deletion, and export HTML safety.

You can see below a preview of the release change log:

8.5.1

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.63.0

Patch Changes

• Bump @rocket.chat/meteor version.

• (#40917 by @dionisio-bot) Escapes HTML tags in exported data

• (#40891 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#40904 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint

• (#40938 by @dionisio-bot) Fixes an issue where description was incorrectly being used as alternative text for image attachments

• Updated dependencies [01a184640f635866bf4c1c612696acc4eed62311]:

  • @rocket.chat/federation-matrix@0.1.5
  • @rocket.chat/core-typings@8.5.1
  • @rocket.chat/rest-typings@8.5.1