fix: imported fixes 08-18-2026

Merged
JU
2mo ago
+127-36

Proposed changes (including videos or screenshots)

Approvals have already been added to the private PRs.

Issue(s)

https://github.com/RocketChat/Rocket.Chat-private-security-fork/pull/853
https://github.com/RocketChat/Rocket.Chat-private-security-fork/pull/854
https://rocketchat.atlassian.net/browse/CORE-2478
https://rocketchat.atlassian.net/browse/VLN-532

Steps to test or reproduce

Further comments

Summary by CodeRabbit

  • Security

    • Improved validation for thread and room requests to reject invalid identifiers.
    • Restricted room notifications to authenticated subscribers and approved event types.
    • Prevented unauthorized or unrelated events from being relayed to room members.

  • Bug Fixes

    • Ensured thread messages and thread lists are retrieved using validated room and thread records.

  • Tests

    • Added coverage for notification authorization, subscription checks, and permitted event delivery.