Merge branch 'develop' into saml-redirect-validation

Author: julio-rocketchat

.changeset/fluffy-turtles-admire.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes race condition causing duplicate open livechat rooms per visitor token.

.changeset/spotty-poems-smash.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": patch
+"@rocket.chat/models": patch
+---
+
+Fixes an issue where, sometimes, updatedAt was not being set during the subscription creation

.changeset/strict-ajv-coercion.md

@@ -0,0 +1,16 @@
+---
+"@rocket.chat/rest-typings": minor
+"@rocket.chat/meteor": patch
+---
+
+Splits the single AJV validator instance into two: `ajv` (coerceTypes: false) for request **body** validation and `ajvQuery` (coerceTypes: true) for **query parameter** validation.
+
+**Why this matters:** Previously, a single AJV instance with `coerceTypes: true` was used everywhere. This silently accepted values with wrong types — for example, sending `{ "rid": 12345 }` (number) where a string was expected would pass validation because `12345` was coerced to `"12345"`. With this change, body validation is now strict: the server will reject payloads with incorrect types instead of silently coercing them.
+
+**What may break for API consumers:**
+
+- **Numeric values sent as strings in POST/PUT/PATCH bodies** (e.g., `{ "count": "10" }` instead of `{ "count": 10 }`) will now be rejected. Ensure JSON bodies use proper types.
+- **Boolean values sent as strings in bodies** (e.g., `{ "readThreads": "true" }` instead of `{ "readThreads": true }`) will now be rejected.
+- **`null` values where a string is expected** (e.g., `{ "name": null }` for a `type: 'string'` field without `nullable: true`) will no longer be coerced to `""`.
+
+**No change for query parameters:** GET query params (e.g., `?count=10&offset=0`) continue to be coerced via `ajvQuery`, since HTTP query strings are always strings.

.github/actions/restore-packages/action.yml

@@ -0,0 +1,16 @@
+name: 'Restore Packages Build'
+description: 'Downloads and unpacks the packages build artifact'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore packages build
+      uses: actions/download-artifact@v8
+      with:
+        name: packages-build
+        path: /tmp
+
+    - name: Unpack packages build
+      shell: bash
+      run: |
+        tar -xzf /tmp/RocketChat-packages-build.tar.gz -C .

.github/workflows/ci-code-check.yml

@@ -43,16 +43,7 @@ jobs:
 
       - uses: rharkor/caching-for-turbo@v1.8
 
-      - name: Restore packages build
-        uses: actions/download-artifact@v8
-        with:
-          name: packages-build
-          path: /tmp
-
-      - name: Unpack packages build
-        shell: bash
-        run: |
-          tar -xzf /tmp/RocketChat-packages-build.tar.gz -C .
+      - uses: ./.github/actions/restore-packages
 
       - name: Cache TypeCheck
         uses: actions/cache@v5
@@ -86,7 +77,7 @@ jobs:
 
       - name: TS TypeCheck
         if: matrix.check == 'ts'
-        run: yarn turbo run typecheck
+        run: yarn turbo run typecheck --concurrency=5
 
       - name: Cache eslint
         uses: actions/cache@v5

.github/workflows/ci-test-e2e.yml

@@ -125,16 +125,7 @@ jobs:
 
       - uses: rharkor/caching-for-turbo@v1.8
 
-      - name: Restore packages build
-        uses: actions/download-artifact@v8
-        with:
-          name: packages-build
-          path: /tmp
-
-      - name: Unpack packages build
-        shell: bash
-        run: |
-          tar -xzf /tmp/RocketChat-packages-build.tar.gz -C .
+      - uses: ./.github/actions/restore-packages
 
       # Download Docker images from build artifacts
       - name: Download Docker images

.github/workflows/ci-test-storybook.yml

@@ -37,16 +37,7 @@ jobs:
 
       - uses: rharkor/caching-for-turbo@v1.8
 
-      - name: Restore packages build
-        uses: actions/download-artifact@v8
-        with:
-          name: packages-build
-          path: /tmp
-
-      - name: Unpack packages build
-        shell: bash
-        run: |
-          tar -xzf /tmp/RocketChat-packages-build.tar.gz -C .
+      - uses: ./.github/actions/restore-packages
 
       - uses: ./.github/actions/setup-playwright
 

.github/workflows/ci-test-unit.yml

@@ -41,16 +41,7 @@ jobs:
 
       - uses: rharkor/caching-for-turbo@v1.8
 
-      - name: Restore packages build
-        uses: actions/download-artifact@v8
-        with:
-          name: packages-build
-          path: /tmp
-
-      - name: Unpack packages build
-        shell: bash
-        run: |
-          tar -xzf /tmp/RocketChat-packages-build.tar.gz -C .
+      - uses: ./.github/actions/restore-packages
 
       - name: Unit Test
         run: yarn testunit --concurrency=1

.github/workflows/ci.yml

@@ -296,16 +296,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Restore packages build
-        uses: actions/download-artifact@v8
-        with:
-          name: packages-build
-          path: /tmp
-
-      - name: Unpack packages build
-        shell: bash
-        run: |
-          tar -xzf /tmp/RocketChat-packages-build.tar.gz -C .
+      - uses: ./.github/actions/restore-packages
 
       # we only build and publish the actual docker images if not a PR from a fork
       - name: Image ${{ matrix.service[0] }}

README.md

@@ -99,6 +99,7 @@ Develop your own apps that can be integrated with Rocket.Chat. We provide an [op
 Join thousands of members worldwide in our [community server](https://open.rocket.chat).
 Join [#support](https://open.rocket.chat/channel/support) and [#general](https://open.rocket.chat/channel/general) for help from the community.
 
+![Alt](https://repobeats.axiom.co/api/embed/1efe0f0a7c366bd58068a1ab1f555ab912ec3895.svg "Repobeats analytics image")
 
 # 👥 Contributions