From f826dc2d15d7ec407e23770ccf8279f11473e749 Mon Sep 17 00:00:00 2001 From: Pranav Date: Thu, 19 Feb 2026 17:48:06 -0800 Subject: [PATCH 1/4] fix: Rate-limit meta endpoint calls to 30/min (#13596) Meta endpoints are now rate limited to 1 call per every minute. This rate limit is done at the user level not the browser. --- config/initializers/rack_attack.rb | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 1f500243a..b193c2e14 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -221,6 +221,19 @@ class Rack::Attack match_data[:account_id] if match_data.present? end + ## Prevent increased use of conversations meta API per user + throttle('/api/v1/accounts/:account_id/conversations/meta/user', + limit: ENV.fetch('RATE_LIMIT_CONVERSATIONS_META', '30').to_i, period: 1.minute) do |req| + match_data = %r{/api/v1/accounts/(?\d+)/conversations/meta}.match(req.path) + next unless match_data.present? && req.get? + + user_uid = req.get_header('HTTP_UID') + api_access_token = req.get_header('HTTP_API_ACCESS_TOKEN') || req.get_header('api_access_token') + user_identifier = user_uid.presence || api_access_token.presence + + "#{user_identifier}:#{match_data[:account_id]}" if user_identifier.present? + end + ## ----------------------------------------------- ## end From 26c38a90f2c2bfb371087862818f0c0a255e4643 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 19 Feb 2026 17:55:08 -0800 Subject: [PATCH 2/4] chore(deps): bump nokogiri from 1.18.9 to 1.19.1 (#13586) Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.18.9 to 1.19.1.
Release notes

Sourced from nokogiri's releases.

v1.19.1 / 2026-02-16

Security

  • [CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.
cfdb0eafd9a554a88f12ebcc688d2b9005f9fce42b00b970e3dc199587b27f32
nokogiri-1.19.1-aarch64-linux-gnu.gem
1e2150ab43c3b373aba76cd1190af7b9e92103564063e48c474f7600923620b5
nokogiri-1.19.1-aarch64-linux-musl.gem
0a39ed59abe3bf279fab9dd4c6db6fe8af01af0608f6e1f08b8ffa4e5d407fa3
nokogiri-1.19.1-arm-linux-gnu.gem
3a18e559ee499b064aac6562d98daab3d39ba6cbb4074a1542781b2f556db47d
nokogiri-1.19.1-arm-linux-musl.gem
dfe2d337e6700eac47290407c289d56bcf85805d128c1b5a6434ddb79731cb9e
nokogiri-1.19.1-arm64-darwin.gem
1e0bda88b1c6409f0edb9e0c25f1bf9ff4fa94c3958f492a10fcf50dda594365
nokogiri-1.19.1-java.gem
110d92ae57694ae7866670d298a5d04cd150fae5a6a7849957d66f171e6aec9b
nokogiri-1.19.1-x64-mingw-ucrt.gem
7093896778cc03efb74b85f915a775862730e887f2e58d6921e3fa3d981e68bf
nokogiri-1.19.1-x86_64-darwin.gem
1a4902842a186b4f901078e692d12257678e6133858d0566152fe29cdb98456a
nokogiri-1.19.1-x86_64-linux-gnu.gem
4267f38ad4fc7e52a2e7ee28ed494e8f9d8eb4f4b3320901d55981c7b995fc23
nokogiri-1.19.1-x86_64-linux-musl.gem
598b327f36df0b172abd57b68b18979a6e14219353bca87180c31a51a00d5ad3
nokogiri-1.19.1.gem

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

11a97ecc3c0e7e5edcf395720b10860ef493b768f6aa80c539573530bc933767
nokogiri-1.19.0-aarch64-linux-gnu.gem
eb70507f5e01bc23dad9b8dbec2b36ad0e61d227b42d292835020ff754fb7ba9
nokogiri-1.19.0-aarch64-linux-musl.gem
572a259026b2c8b7c161fdb6469fa2d0edd2b61cd599db4bbda93289abefbfe5
nokogiri-1.19.0-arm-linux-gnu.gem
23ed90922f1a38aed555d3de4d058e90850c731c5b756d191b3dc8055948e73c
nokogiri-1.19.0-arm-linux-musl.gem
0811dfd936d5f6dd3f6d32ef790568bf29b2b7bead9ba68866847b33c9cf5810
nokogiri-1.19.0-arm64-darwin.gem
5f3a70e252be641d8a4099f7fb4cc25c81c632cb594eec9b4b8f2ca8be4374f3
nokogiri-1.19.0-java.gem
05d7ed2d95731edc9bef2811522dc396df3e476ef0d9c76793a9fca81cab056b
nokogiri-1.19.0-x64-mingw-ucrt.gem
1dad56220b603a8edb9750cd95798bffa2b8dd9dd9aa47f664009ee5b43e3067
nokogiri-1.19.0-x86_64-darwin.gem
f482b95c713d60031d48c44ce14562f8d2ce31e3a9e8dd0ccb131e9e5a68b58c
nokogiri-1.19.0-x86_64-linux-gnu.gem
1c4ca6b381622420073ce6043443af1d321e8ed93cc18b08e2666e5bd02ffae4
nokogiri-1.19.0-x86_64-linux-musl.gem
e304d21865f62518e04f2bf59f93bd3a97ca7b07e7f03952946d8e1c05f45695
nokogiri-1.19.0.gem

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.1 / 2026-02-16

Security

  • [CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

v1.18.10 / 2025-09-15

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.
  • [CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18
Commits
  • d913045 version bump to v1.19.1
  • b81cb98 doc: update CHANGELOG for upcoming v1.19.1
  • 8e66809 C14n raise on failure (#3600)
  • 5b77f3d Raise RuntimeError when canonicalization fails
  • edc5595 Thank sponsors in the README
  • d4dc245 dep: update rdoc to v7
  • d77bfb6 version bump to v1.19.0
  • 1eb5c2c dev: convert scripts/test-gem-set to use mise
  • 88a120f dep: Add native Ruby 4 support, drop Ruby 3.1 support (v1.19.x) (#3592)
  • f8c8f74 Skip the parser compression test for Windows system libs
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.18.9&new-version=1.19.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/chatwoot/chatwoot/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Gemfile.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 717ec2a02..aad0438cf 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -583,14 +583,14 @@ GEM newrelic_rpm (9.6.0) base64 nio4r (2.7.3) - nokogiri (1.18.9) + nokogiri (1.19.1) mini_portile2 (~> 2.8.2) racc (~> 1.4) - nokogiri (1.18.9-arm64-darwin) + nokogiri (1.19.1-arm64-darwin) racc (~> 1.4) - nokogiri (1.18.9-x86_64-darwin) + nokogiri (1.19.1-x86_64-darwin) racc (~> 1.4) - nokogiri (1.18.9-x86_64-linux-gnu) + nokogiri (1.19.1-x86_64-linux-gnu) racc (~> 1.4) oauth (1.1.0) oauth-tty (~> 1.0, >= 1.0.1) From dbab0fe8da3b831d7c13cbdb9176faadc93eff63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nat=C3=A3?= <66445721+dollyzn@users.noreply.github.com> Date: Fri, 20 Feb 2026 02:54:37 -0300 Subject: [PATCH 3/4] fix: search header overlap with new conversation form (#13548) --- app/javascript/dashboard/components/ChannelSelector.vue | 2 +- .../dashboard/modules/search/components/SearchResultSection.vue | 2 +- .../dashboard/contacts/components/ContactsBulkActionBar.vue | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/javascript/dashboard/components/ChannelSelector.vue b/app/javascript/dashboard/components/ChannelSelector.vue index 9e593af51..2e3ea7d86 100644 --- a/app/javascript/dashboard/components/ChannelSelector.vue +++ b/app/javascript/dashboard/components/ChannelSelector.vue @@ -47,7 +47,7 @@ defineProps({
{{ $t('CHANNEL_SELECTOR.COMING_SOON') }} 🚀 diff --git a/app/javascript/dashboard/modules/search/components/SearchResultSection.vue b/app/javascript/dashboard/modules/search/components/SearchResultSection.vue index 40d1ca6c6..77a7f3bd3 100644 --- a/app/javascript/dashboard/modules/search/components/SearchResultSection.vue +++ b/app/javascript/dashboard/modules/search/components/SearchResultSection.vue @@ -33,7 +33,7 @@ const titleCase = computed(() => props.title.toLowerCase());

{{ title }}

diff --git a/app/javascript/dashboard/routes/dashboard/contacts/components/ContactsBulkActionBar.vue b/app/javascript/dashboard/routes/dashboard/contacts/components/ContactsBulkActionBar.vue index e8ddd5223..e56a2dda7 100644 --- a/app/javascript/dashboard/routes/dashboard/contacts/components/ContactsBulkActionBar.vue +++ b/app/javascript/dashboard/routes/dashboard/contacts/components/ContactsBulkActionBar.vue @@ -94,7 +94,7 @@ const handleAssignLabels = labels => {