6382 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Vishnu NarayananandGitHub	e785620921	feat: read structured X-Chatwoot-* headers for mobile session metadata (#14762) ... Phase 2 of [INF-75](https://linear.app/chatwoot/issue/INF-75). Follows up on [#14753](https://github.com/chatwoot/chatwoot/pull/14753) (Phase 1 UA pattern fallback, already merged). When the request carries an \`X-Chatwoot-Client-Name\` header, \`UserSessionTrackingService\` now prefers the five structured \`X-Chatwoot-*\` headers over the User-Agent for populating the \`user_sessions\` row: | Header | Mapped column | |---|---| | \`X-Chatwoot-Client-Name\` | \`browser_name\` | | \`X-Chatwoot-Client-Version\` | \`browser_version\` | | \`X-Chatwoot-Device-Model\` | \`platform_name\` | | \`X-Chatwoot-Platform-Version\` | \`platform_version\` | | \`X-Chatwoot-Platform\` (+ model) | \`device_name\` (\`iPhone\` / \`iPad\` / \`Android\`) | When the header is absent or blank, the existing \`Browser.new\` path runs, with the Phase 1 legacy UA fallback still acting as the floor. Real browsers are untouched. A follow-up PR in [chatwoot-mobile-app](https://github.com/chatwoot/chatwoot-mobile-app) will start sending these headers from the React Native build. Until that ships, this PR is a no-op for production traffic, so it can land independently. Fixes INF-75.	2026-06-23 20:08:27 +05:30
Aakash BakhleandGitHub	0af9900be2	fix: model for false promise harness (#14824) ... fixes model for false promise harness	2026-06-23 18:42:34 +05:30
Aakash BakhleandGitHub	84fda8a323	fix(captain): move false promise harness setting to account (#14823) ... # Pull Request Template ## Description moves the harness to account settings rather than assistant settings ## Type of change refactor ## How Has This Been Tested? Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. locally and specs ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules	2026-06-23 16:55:42 +05:30
Aakash BakhleandGitHub	1c7e60880d	fix: add harness on false promises (#14672) ... # Pull Request Template ## Description https://linear.app/chatwoot/issue/AI-179/false-promise-soft-handoff-guard ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. Against negative cases identified by evals ## Checklist: - [ ] My code follows the style guidelines of this project - [ ] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [ ] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules	2026-06-23 16:30:14 +05:30
Aakash BakhleandGitHub	8e27ca4282	fix(firecrawl): get url in case sourceUrl is not available (#14820) ... # Pull Request Template ## Description Fixes inconsistency by adding a fallback to use `url` instead of `sourceUrl` when Firecrawl returns empty `sourceUrl` in production. We switched to v2 endpoints of Firecrawl in https://github.com/chatwoot/chatwoot/pull/14624 and it worked locally, but seems to fail for some cases in production. ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. locally ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules	2026-06-23 13:40:31 +05:30
4 people	ee5e20551d	fix(facebook): handle messenger post attachment type (#14813) ... Facebook Messenger messages that share a post no longer break message ingestion. Following the recent sticker change, Meta now sends a shared post as a new `post` attachment type. Chatwoot didn't recognise `post` as a valid attachment file type, so the webhook job crashed and the message — and any others in the same batch — failed to sync. Shared posts now appear in the conversation as a fallback link (title + URL), the same way `share` attachments already do. This is the same class of bug as #14793 (sticker), just a different attachment type. #### Root cause `post` was neither skipped as unsupported nor mapped to a valid `file_type`, so `attachment_params` produced `file_type: :post`. The `Attachment#file_type` enum has no `post` value, so it raised `ArgumentError: 'post' is not a valid file_type`, crashing `Webhooks::FacebookEventsJob`. #### Fix The Facebook builder already maps `share -> :fallback` because shared posts point to facebook.com page URLs rather than downloadable media. A `post` is the same kind of attachment, so map both `share` and `post` to `fallback` (stores the title/link, no download attempt). Also read the fallback title from `payload.title`, since the post payload nests it there rather than at the top level. ## How to reproduce 1. Connect a Facebook Page inbox. 2. Share a Facebook post into Messenger to that page. 3. Before this change: `Webhooks::FacebookEventsJob` raises `ArgumentError: 'post' is not a valid file_type` and the message is dropped. 4. After this change: the shared post shows up in the conversation as a fallback link. Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 11:03:04 +04:00
3 people	df79c0bbde	feat: exclude stale conversations via assignment policy age threshold (#14766) ... ## Linear ticket - https://linear.app/chatwoot/issue/CW-7137/assignment-v2-backlog-flush-overloads-agents ## Description Assignment policies now skip stale unassigned conversations automatically. Each policy carries an age threshold (defaults to 7 days), so auto-assignment only picks up recent backlog instead of draining very old, forgotten conversations. The threshold is configurable per policy and can be cleared to assign conversations regardless of age. Previously this control existed only on Enterprise capacity policies (`exclude_older_than_hours`); it now lives on the assignment policy itself, so every V2 inbox benefits without needing a capacity policy. ## Type of change - [ ] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? - Local UI flows ## Screenshots? <img width="645" height="822" alt="image" src="https://github.com/user-attachments/assets/ec58db86-c1fa-4f9e-be87-2e24ff02e077" /> ## Checklist: - [ ] My code follows the style guidelines of this project - [ ] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [ ] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules --------- Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-23 12:22:45 +05:30
3 people	647cfc2d83	feat: distinguish agent-declined calls with a rejected status (#14783) ... ## Linear ticket - https://linear.app/chatwoot/issue/CW-7374/agent-declined-voice-calls-miscounted-as-failed ## Description Agent rejections were stored with status: failed, so call reports lumped deliberate declines together with real technical failure. Fix: give declines their own terminal rejected status (Twilio + WhatsApp paths), keeping end_reason: agent_rejected. Genuine provider/network failures stay failed. Frontend renders declines exactly as before; existing rows backfilled via migration. ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? - Tested on UI ## Checklist: - [ ] My code follows the style guidelines of this project - [ ] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [ ] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules --------- Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-23 12:22:29 +05:30
Sivin VargheseandGitHub	961ec86ba9	chore: support custom variables in auto-resolution message (#14782) ... # Pull Request Template ## Description This PR adds support for custom variables in auto-resolution messages within Conversation Workflows. Agents can insert variables (e.g. `{{contact.name}}`) into the custom auto-resolution message using the variable picker by typing `{{`. These variables are resolved with actual conversation data when the auto-resolution message is sent. The field uses the existing editor with the formatting toolbar hidden, since auto-resolution messages are delivered across all channels, including SMS, where formatting isn't supported. Existing message content is preserved as-is, and typing `{{` opens the variable picker for quick insertion. Fixes https://linear.app/chatwoot/issue/CW-7369/support-custom-variables-in-conversations-workflow-text-fields ## Type of change - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? ### Screenshots <img width="1262" height="764" alt="image" src="https://github.com/user-attachments/assets/e43be22c-f86e-436a-9fdd-5bcb73c61ca3" /> ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules	2026-06-23 11:35:52 +05:30
Sojan JoseandGitHub	e86222034e	fix(auth): record attribution for oauth signups (#14796) ... Google OAuth signups now persist the same first-party attribution cookies as email signups on Chatwoot Cloud. This keeps attribution capture owned by the website and reuses the existing Enterprise-only account attribution service. The OAuth callback only records the already-shaped first-touch and last-touch cookie payload after a new account is created. ## What changed - Added Enterprise-only attribution persistence to the Google OAuth signup account creation path. - Reuses `Internal::Accounts::MarketingAttributionService`. - Keeps attribution best-effort so failures do not interrupt OAuth signup. - Leaves existing email signup and SAML behavior unchanged. ## How to test - Start from a Chatwoot Cloud-like setup with attribution cookies present. - Sign up using the Google OAuth button. - Confirm the created account has `internal_attributes['marketing_attribution']` with `first_touch` and `last_touch`. - Confirm existing Google OAuth login still redirects normally. Validation run locally: - `bundle exec rspec spec/enterprise/controllers/enterprise/devise_overrides/google_oauth_attribution_spec.rb` - `bundle exec rspec spec/controllers/devise/omniauth_callbacks_controller_spec.rb spec/enterprise/controllers/enterprise/devise_overrides/google_oauth_attribution_spec.rb` - `bundle exec rubocop enterprise/app/controllers/enterprise/devise_overrides/omniauth_callbacks_controller.rb spec/enterprise/controllers/enterprise/devise_overrides/google_oauth_attribution_spec.rb`	2026-06-22 06:51:09 -07:00
4 people	2b37fef0e0	fix(companies): sync contact company names (#14759) ... Fixes company-contact name drift when a company is renamed or deleted. Closes: N/A ## Why Contacts keep a denormalized `additional_attributes.company_name` for display and filtering. Company rename/delete flows could leave that copied value stale even though the actual `company_id` relationship changed. ## What changed - Enqueues an async company contact-name sync job when a company name changes. - Moves company deletion into `Companies::DeleteJob`. - The delete job unlinks linked contacts, clears only the copied `company_name`, and then deletes the company. - Uses bulk JSON updates for the cleanup path so contact records are not saved, which avoids contact update callbacks, webhook dispatch, and automation side effects. ## How to test - Link a contact to a company, rename the company, and confirm the contact company name updates after the job runs. - Delete a company with linked contacts and confirm the delete job removes the company, unassigns linked contacts, and preserves other contact additional attributes. --------- Co-authored-by: Sony Mathew <sony@chatwoot.com> Co-authored-by: Sony Mathew <2040199+sony-mathew@users.noreply.github.com>	2026-06-22 06:49:52 -07:00
4 people	44b32eacec	chore(deps): bump faraday from 2.14.2 to 2.14.3 (#14811) ... Bumps [faraday](https://github.com/lostisland/faraday) from 2.14.2 to 2.14.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lostisland/faraday/releases">faraday's releases</a>.</em></p> <blockquote> <h2>v2.14.3</h2> <h2>Security Note</h2> <p>This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.</p> <h2>What's Changed</h2> <ul> <li>Upgrade CI lint step from Ruby 3 to 4 by <a href="https://github.com/larouxn"><code>@​larouxn</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1673">lostisland/faraday#1673</a></li> <li>feat(test): add Stubs#clear to remove all stubs by <a href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1675">lostisland/faraday#1675</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/SAY-5"><code>@​SAY-5</code></a> made their first contribution in <a href="https://redirect.github.com/lostisland/faraday/pull/1675">lostisland/faraday#1675</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/lostisland/faraday/compare/v2.14.2...v2.14.3">https://github.com/lostisland/faraday/compare/v2.14.2...v2.14.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lostisland/faraday/commit/f1ace878bae16c1df298b6af7c34657f2c4dcddb"><code>f1ace87</code></a> Version bump to 2.14.3</li> <li><a href="https://github.com/lostisland/faraday/commit/36764bfc48aa9fc08336d36600ea67af149c80fa"><code>36764bf</code></a> Merge commit from fork</li> <li><a href="https://github.com/lostisland/faraday/commit/59334e0e9b1918bd26b143f4a7bbc8c765de3ac4"><code>59334e0</code></a> feat(test): add Stubs#clear to remove all stubs (<a href="https://redirect.github.com/lostisland/faraday/issues/1675">#1675</a>)</li> <li><a href="https://github.com/lostisland/faraday/commit/469f25c793f25bcfdd416a54edeb454d045c08d6"><code>469f25c</code></a> Upgrade CI lint step from Ruby 3 to 4 (<a href="https://redirect.github.com/lostisland/faraday/issues/1673">#1673</a>)</li> <li>See full diff in <a href="https://github.com/lostisland/faraday/compare/v2.14.2...v2.14.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/chatwoot/chatwoot/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-22 17:36:08 +05:30
4 people	5b7430f376	chore(deps): bump concurrent-ruby from 1.3.5 to 1.3.7 (#14810) ... Bumps [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby) from 1.3.5 to 1.3.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby-concurrency/concurrent-ruby/releases">concurrent-ruby's releases</a>.</em></p> <blockquote> <h2>v1.3.7</h2> <!-- raw HTML omitted --> <p>There are 3 security fixes in this release, so updating is recommended. These security vulnerabilities are not very likely to be hit in practice and have a corresponding <code>Low</code> severity score.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj">CVE-2026-54904</a> <code>AtomicReference#update</code> livelocks when the stored value is <code>Float::NAN</code>. Fix by <a href="https://github.com/joshuay03"><code>@​joshuay03</code></a> and <a href="https://github.com/eregon"><code>@​eregon</code></a></li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-wv3x-4vxv-whpp">CVE-2026-54905</a> <code>ReentrantReadWriteLock</code> read-count overflow grants a write lock without exclusivity. Fix by <a href="https://github.com/joshuay03"><code>@​joshuay03</code></a></li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr">CVE-2026-54906</a> <code>ReadWriteLock</code> allows wrong-thread write release and stray read-release counter corruption. Fix by <a href="https://github.com/joshuay03"><code>@​joshuay03</code></a></li> <li>concurrent-ruby-ext: fix build on Darwin 32-bit by <a href="https://github.com/barracuda156"><code>@​barracuda156</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1064">ruby-concurrency/concurrent-ruby#1064</a></li> <li>Add SECURITY.md by <a href="https://github.com/eregon"><code>@​eregon</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1104">ruby-concurrency/concurrent-ruby#1104</a></li> <li>Add Ruby 4.0 in CI by <a href="https://github.com/eregon"><code>@​eregon</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1106">ruby-concurrency/concurrent-ruby#1106</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/barracuda156"><code>@​barracuda156</code></a> made their first contribution in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1064">ruby-concurrency/concurrent-ruby#1064</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby-concurrency/concurrent-ruby/compare/v1.3.6...v1.3.7">https://github.com/ruby-concurrency/concurrent-ruby/compare/v1.3.6...v1.3.7</a></p> <h2>v1.3.6</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Run tests without the C extension in CI by <a href="https://github.com/eregon"><code>@​eregon</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1081">ruby-concurrency/concurrent-ruby#1081</a></li> <li>Fix typo in Promise docs by <a href="https://github.com/danieldiekmeier"><code>@​danieldiekmeier</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1083">ruby-concurrency/concurrent-ruby#1083</a></li> <li>Correct word in readme by <a href="https://github.com/wwahammy"><code>@​wwahammy</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1084">ruby-concurrency/concurrent-ruby#1084</a></li> <li>Fix mistakes in MVar documentation by <a href="https://github.com/trinistr"><code>@​trinistr</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1087">ruby-concurrency/concurrent-ruby#1087</a></li> <li>Fix multi require concurrent/executor/cached_thread_pool by <a href="https://github.com/OuYangJinTing"><code>@​OuYangJinTing</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1085">ruby-concurrency/concurrent-ruby#1085</a></li> <li>Use typed data APIs by <a href="https://github.com/nobu"><code>@​nobu</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1096">ruby-concurrency/concurrent-ruby#1096</a></li> <li>Add Joshua Young to the list of maintainers by <a href="https://github.com/eregon"><code>@​eregon</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1097">ruby-concurrency/concurrent-ruby#1097</a></li> <li>Asynchronous pruning for RubyThreadPoolExecutor by <a href="https://github.com/joshuay03"><code>@​joshuay03</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1082">ruby-concurrency/concurrent-ruby#1082</a></li> <li>Mark RubySingleThreadExecutor as a SerialExecutorService by <a href="https://github.com/meineerde"><code>@​meineerde</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1070">ruby-concurrency/concurrent-ruby#1070</a></li> <li>Allow TimerTask to be safely restarted after shutdown and avoid duplicate tasks by <a href="https://github.com/bensheldon"><code>@​bensheldon</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1001">ruby-concurrency/concurrent-ruby#1001</a></li> <li>Flaky test fix: allow ThreadPool to shutdown before asserting completed_task_count by <a href="https://github.com/bensheldon"><code>@​bensheldon</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1098">ruby-concurrency/concurrent-ruby#1098</a></li> <li><code>ThreadPoolExecutor#kill</code> will <code>wait_for_termination</code> in JRuby; ensure <code>TimerSet</code> timer thread shuts down cleanly by <a href="https://github.com/bensheldon"><code>@​bensheldon</code></a> in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1044">ruby-concurrency/concurrent-ruby#1044</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/danieldiekmeier"><code>@​danieldiekmeier</code></a> made their first contribution in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1083">ruby-concurrency/concurrent-ruby#1083</a></li> <li><a href="https://github.com/wwahammy"><code>@​wwahammy</code></a> made their first contribution in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1084">ruby-concurrency/concurrent-ruby#1084</a></li> <li><a href="https://github.com/trinistr"><code>@​trinistr</code></a> made their first contribution in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1087">ruby-concurrency/concurrent-ruby#1087</a></li> <li><a href="https://github.com/OuYangJinTing"><code>@​OuYangJinTing</code></a> made their first contribution in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1085">ruby-concurrency/concurrent-ruby#1085</a></li> <li><a href="https://github.com/nobu"><code>@​nobu</code></a> made their first contribution in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1096">ruby-concurrency/concurrent-ruby#1096</a></li> <li><a href="https://github.com/joshuay03"><code>@​joshuay03</code></a> made their first contribution in <a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/pull/1082">ruby-concurrency/concurrent-ruby#1082</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby-concurrency/concurrent-ruby/compare/v1.3.5...v1.3.6">https://github.com/ruby-concurrency/concurrent-ruby/compare/v1.3.5...v1.3.6</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md">concurrent-ruby's changelog</a>.</em></p> <blockquote> <h2>Release v1.3.7 (16 June 2026)</h2> <p>concurrent-ruby:</p> <ul> <li>See the <a href="https://github.com/ruby-concurrency/concurrent-ruby/releases/tag/v1.3.7">release notes on GitHub</a>.</li> </ul> <h2>Release v1.3.6 (13 December 2025)</h2> <p>concurrent-ruby:</p> <ul> <li>See the <a href="https://github.com/ruby-concurrency/concurrent-ruby/releases/tag/v1.3.6">release notes on GitHub</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/4c8fc28ab6bb9bd8258a4c0c2fa6d35ebe77b3cb"><code>4c8fc28</code></a> Release 1.3.7</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/d91ca9426cb819d6cc63f1bd64bfe54644d0beca"><code>d91ca94</code></a> Fix AtomicReference#update livelock when stored value is Float::NAN on JRuby ...</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/7e4d711bacf7a1dac3ef6bda44004387be2dc7e6"><code>7e4d711</code></a> Fix <code>ReentrantReadWriteLock</code> read hold overflow into write-lock bit</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/6e37e0644b83b182971dc540d2e4bee38df61386"><code>6e37e06</code></a> Fix <code>AtomicReference#update</code> livelock when stored value is <code>Float::NAN</code></li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/2825cfa12cb708b76557803957f76862eb1151a2"><code>2825cfa</code></a> Cleanup spec</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/3fd493283ca5f84f0ef4e84aabd43ad68df4626b"><code>3fd4932</code></a> Fix <code>ReadWriteLock</code> wrong-thread write release and stray read release</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/1974b4772efc034ee8eaa562b4370343f4c5c54b"><code>1974b47</code></a> Add Ruby 4.0 in CI</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/df8706d40c483d76bbb0b3a35a633c68fa9e17be"><code>df8706d</code></a> Add SECURITY.md (<a href="https://redirect.github.com/ruby-concurrency/concurrent-ruby/issues/1104">#1104</a>)</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/7a1b78941c081106c20a9ca0144ac73a48d254ab"><code>7a1b789</code></a> Bump actions/upload-pages-artifact from 4 to 5</li> <li><a href="https://github.com/ruby-concurrency/concurrent-ruby/commit/9b2dbf712896a638a73d2fa221206961c8d6484d"><code>9b2dbf7</code></a> Bump actions/deploy-pages from 4 to 5</li> <li>Additional commits viewable in <a href="https://github.com/ruby-concurrency/concurrent-ruby/compare/v1.3.5...v1.3.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/chatwoot/chatwoot/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-22 16:08:06 +05:30
4 people	5c00a1601a	chore(deps): bump dompurify from 3.4.0 to 3.4.11 (#14798) ... Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.0 to 3.4.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.11</h2> <ul> <li>Fixed an issue with a leaky config for hooks via <code>setConfig</code>, thanks <a href="https://github.com/trace37labs"><code>@​trace37labs</code></a></li> <li>Bumped vulnerable development dependencies to arrive at plain 0 with <code>npm audit</code></li> <li>Updated the <code>osv-scanner</code> suppression list as no vulnerable dependencies are left for now</li> <li>Updated up the linting tool-chain and removed now-redundant lint directives</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.10</h2> <ul> <li>Refactored codebase for clarity: extracted the public type declarations into <code>types.ts</code></li> <li>Decomposed the three largest sanitizer functions into focused helpers</li> <li>Removed duplicated defaults and dead branches, consolidated <code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li> <li>Improved per-node performance by hoisting the mXSS probe regexes and testing <code>textContent</code> before <code>innerHTML</code></li> <li>Added a deterministic micro-benchmark harness (<code>npm run bench</code>) with a <code>--compare</code> mode</li> <li>Reduced CI cost by running the full three-engine browser suite once per PR</li> <li>Refreshed the <code>demos/</code> folder so every demo runs again, and added a SVG-via-<code>&lt;img&gt;</code> demo</li> <li>Documented the bench and <code>test:happydom</code> scripts in the README</li> <li>Completed the Attack Classes &amp; Bypass History wiki page</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.9</h2> <ul> <li>Further improved the handling of Trusted Types config options, thanks <a href="https://github.com/offset"><code>@​offset</code></a></li> <li>Further improved the handling of <code>IN_PLACE</code> sanitization, thanks <a href="https://github.com/mozfreddyb"><code>@​mozfreddyb</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types related usage</li> <li>Bumped several dependencies where possible</li> <li>Updated README and wiki with more accurate documentation &amp; attack samples</li> </ul> <h2>DOMPurify 3.4.8</h2> <ul> <li>Cleaned up the repository root, renamed some and removed unneeded files</li> <li>Fixed an issue with handling of Trusted Types policies, thanks <a href="https://github.com/fulstadev"><code>@​fulstadev</code></a></li> <li>Fixed the node iterator for better template scrubbing, thanks <a href="https://github.com/IamLeandrooooo"><code>@​IamLeandrooooo</code></a></li> <li>Included formerly missing LICENSE-MPL in published npm package, thanks <a href="https://github.com/asamuzaK"><code>@​asamuzaK</code></a></li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.7</h2> <ul> <li>Hardened the handling of Shadow Roots when using <code>IN_PLACE</code>, thanks <a href="https://github.com/GameZoneHacker"><code>@​GameZoneHacker</code></a></li> <li>Removed a problem leading to permanent hook pollution, thanks <a href="https://github.com/offset"><code>@​offset</code></a></li> <li>Refactored the test suite and expanded test coverage significantly</li> </ul> <h2>DOMPurify 3.4.6</h2> <ul> <li>Fixed several issues with DOM Clobbering in <code>IN_PLACE</code> mode, thanks <a href="https://github.com/offset"><code>@​offset</code></a> &amp; <a href="https://github.com/Bankde"><code>@​Bankde</code></a></li> <li>Hardened the checks for cross-realm <code>IN_PLACE</code> and Shadow DOM sanitization, thanks <a href="https://github.com/offset"><code>@​offset</code></a> &amp; <a href="https://github.com/Bankde"><code>@​Bankde</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and general DOM Clobbering attacks</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.5</h2> <ul> <li>Fixed a bypass caused by the new HTML element <code>selectedcontent</code> added in 3.4.4, thanks <a href="https://github.com/KabirAcharya"><code>@​KabirAcharya</code></a></li> </ul> <p><strong>Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.</strong></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a"><code>0cae518</code></a> release: 3.4.11 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1494">#1494</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e"><code>6ee5716</code></a> release: 3.4.10 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1478">#1478</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc"><code>5210247</code></a> release: 3.4.9 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1459">#1459</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bcdd8285412dc9c4c149652aed2d712e790d6ccf"><code>bcdd828</code></a> release: 3.4.8 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1439">#1439</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"><code>ca30f07</code></a> release: 3.4.7 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1414">#1414</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae"><code>bb7739e</code></a> release: 3.4.6 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1394">#1394</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea"><code>011b0c7</code></a> release: 3.4.5 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1382">#1382</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/5817ad969c15e67dfcd6cb37248d6e9c1553e7c3"><code>5817ad9</code></a> release: 3.4.4 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1374">#1374</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/520edb0371a9638f9b51f1798051299a250c686b"><code>520edb0</code></a> release: 3.4.3 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1352">#1352</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6f67fd396a7b8c64294343999fe607ca1f5299c0"><code>6f67fd3</code></a> Sync/3.4.2 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1322">#1322</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.11">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/chatwoot/chatwoot/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-22 14:58:07 +05:30
4 people	a4be38f8f3	fix(facebook): handle messenger sticker attachment type (#14793) ... Facebook Messenger sticker messages no longer break message ingestion. Meta recently changed its webhook payloads so a sticker now arrives as a new `sticker` attachment type (alongside the existing `image` attachment during the transition period). Chatwoot didn't recognise `sticker` as a valid attachment file type, so the webhook job crashed and the message — and any others in the same batch — failed to sync. Stickers now appear in the conversation as a single image, just like before. Fixes https://linear.app/chatwoot/issue/PLA-177 ## How to reproduce 1. Connect a Facebook Page inbox. 2. Send a sticker from Messenger to that page. 3. Before this change: the `Webhooks::FacebookEventsJob` raises `ArgumentError: 'sticker' is not a valid file_type` and the message is dropped. 4. After this change: the sticker shows up in the conversation as a single image attachment. --------- Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-22 12:40:23 +04:00
4 people	6fcc888aee	chore(deps): bump oj from 3.16.10 to 3.17.3 (#14809) ... Bumps [oj](https://github.com/ohler55/oj) from 3.16.10 to 3.17.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ohler55/oj/releases">oj's releases</a>.</em></p> <blockquote> <h2>v3.17.3</h2> <h2>What's Changed</h2> <ul> <li>Fix stack limits by <a href="https://github.com/ohler55"><code>@​ohler55</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1014">ohler55/oj#1014</a></li> <li>Fix intern.c and fast.c by <a href="https://github.com/ohler55"><code>@​ohler55</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1015">ohler55/oj#1015</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ohler55/oj/compare/v3.17.1...v3.17.3">https://github.com/ohler55/oj/compare/v3.17.1...v3.17.3</a></p> <h2>v3.17.1</h2> <h2>What's Changed</h2> <ul> <li>Add <code>max_integer_digits</code> limit for legacy integer parsing by <a href="https://github.com/meinac"><code>@​meinac</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1009">ohler55/oj#1009</a></li> <li>fix: remove unsafe exec() in fast.c by <a href="https://github.com/orbisai0security"><code>@​orbisai0security</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1011">ohler55/oj#1011</a></li> <li>Revert &quot;fix: remove unsafe exec() in fast.c&quot; by <a href="https://github.com/ohler55"><code>@​ohler55</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1012">ohler55/oj#1012</a></li> <li>Fix reentrant parser by <a href="https://github.com/ohler55"><code>@​ohler55</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1013">ohler55/oj#1013</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/orbisai0security"><code>@​orbisai0security</code></a> made their first contribution in <a href="https://redirect.github.com/ohler55/oj/pull/1011">ohler55/oj#1011</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ohler55/oj/compare/v3.17.0...v3.17.1">https://github.com/ohler55/oj/compare/v3.17.0...v3.17.1</a></p> <h2>v3.17.0</h2> <h2>What's Changed</h2> <ul> <li>Implement Oj::Parser.safe with configurable JSON safety limits by <a href="https://github.com/meinac"><code>@​meinac</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1007">ohler55/oj#1007</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ohler55/oj/compare/v3.16.17...v3.17.0">https://github.com/ohler55/oj/compare/v3.16.17...v3.17.0</a></p> <h2>v3.16.17</h2> <h2>What's Changed</h2> <ul> <li>Use fast_memcpy16 to quickly copy up to 16 bytes for tail handling in ARM Neon code and small copies when generating JSON. by <a href="https://github.com/samyron"><code>@​samyron</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/998">ohler55/oj#998</a></li> <li>Bump jidicula/clang-format-action from 4.15.0 to 4.17.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/ohler55/oj/pull/999">ohler55/oj#999</a></li> <li>Array hash as json by <a href="https://github.com/ohler55"><code>@​ohler55</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1003">ohler55/oj#1003</a></li> <li>Bump jidicula/clang-format-action from 4.17.0 to 4.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/ohler55/oj/pull/1001">ohler55/oj#1001</a></li> <li>Handle unterminated strings in usual parser by <a href="https://github.com/meinac"><code>@​meinac</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1002">ohler55/oj#1002</a></li> <li>Fix read() not handling partial reads for large files by <a href="https://github.com/ursm"><code>@​ursm</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1004">ohler55/oj#1004</a></li> <li>Raise error for incomplete primitive literals by <a href="https://github.com/meinac"><code>@​meinac</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/1005">ohler55/oj#1005</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ursm"><code>@​ursm</code></a> made their first contribution in <a href="https://redirect.github.com/ohler55/oj/pull/1004">ohler55/oj#1004</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ohler55/oj/compare/v3.16.16...v3.16.17">https://github.com/ohler55/oj/compare/v3.16.16...v3.16.17</a></p> <h2>v3.16.14</h2> <h2>What's Changed</h2> <ul> <li>Change first arg to oj_parse_options by <a href="https://github.com/ohler55"><code>@​ohler55</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/987">ohler55/oj#987</a></li> <li>Fix illegal instruction error on CPUs without SSE4.2 support by <a href="https://github.com/sebyx07"><code>@​sebyx07</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/993">ohler55/oj#993</a></li> <li>Optimize <code>oj_dump_cstr</code> using SSE4.2 and SSSE3. by <a href="https://github.com/samyron"><code>@​samyron</code></a> in <a href="https://redirect.github.com/ohler55/oj/pull/973">ohler55/oj#973</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ohler55/oj/compare/v3.16.13...v3.16.14">https://github.com/ohler55/oj/compare/v3.16.13...v3.16.14</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ohler55/oj/blob/develop/CHANGELOG.md">oj's changelog</a>.</em></p> <blockquote> <h2>3.17.3 - 2026-06-04</h2> <ul> <li>Fixed issue in intern.c and fast.c.</li> </ul> <h2>3.17.2 - 2026-05-27</h2> <ul> <li>Fixed multiple issues related to extreme sizes.</li> </ul> <h2>3.17.1 - 2026-05-15</h2> <ul> <li>Fixed &quot;quoted string not terminated&quot; error.</li> </ul> <h2>3.17.0 - 2026-04-19</h2> <ul> <li>A &quot;safe&quot; parser has been added as a variation of the Oj:Parser thanks to <a href="https://github.com/meinac"><code>@​meinac</code></a>.</li> </ul> <h2>3.16.17 - 2026-04-12</h2> <ul> <li> <p>Rails optimize for Hash and Array now overrides <code>as_json</code> for those classes. Note that when either is optimized with <code>Oj.optimize_rails</code> the <code>Array.as_json</code> and <code>Hash.as_json</code> will not be called.</p> </li> <li> <p>Add support for the rails encoder <code>:only</code> and <code>:except</code> options.</p> </li> <li> <p>Handle unterminated strings in usual parser (<a href="https://redirect.github.com/ohler55/oj/issues/1002">#1002</a>)</p> </li> <li> <p>Fix read() not handling partial reads for large files (<a href="https://redirect.github.com/ohler55/oj/issues/1004">#1004</a>)</p> </li> <li> <p>Raise error for incomplete primitive literals (<a href="https://redirect.github.com/ohler55/oj/issues/1005">#1005</a>)</p> </li> </ul> <h2>3.16.16 - 2026-03-13</h2> <ul> <li>Not closed arrays and objects are reported corrected in the usual parser.</li> </ul> <h2>3.16.15 - 2026-02-05</h2> <ul> <li>Fixed by putting the ostruct dependency back until a better way is found to conditionally include it.</li> </ul> <h2>3.16.14 - 2026-02-04</h2> <ul> <li> <p>Fixed SSE issue <a href="https://redirect.github.com/ohler55/oj/issues/989">#989</a>.</p> </li> <li> <p>Removed ostruct dependency.</p> </li> <li> <p>Removed generic object JSON gem tests.</p> </li> </ul> <h2>3.16.13 - 2025-12-05</h2> <ul> <li>Fixed rails encoding for Hash and Array subclasses.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f"><code>bbde91a</code></a> Fix intern.c and fast.c (<a href="https://redirect.github.com/ohler55/oj/issues/1015">#1015</a>)</li> <li><a href="https://github.com/ohler55/oj/commit/495cc38fc5a02681da2175960d4a667fae48f3c9"><code>495cc38</code></a> Update changelog</li> <li><a href="https://github.com/ohler55/oj/commit/810a57acc7aaacef8410b460559c08762d0eb61a"><code>810a57a</code></a> Update changelog</li> <li><a href="https://github.com/ohler55/oj/commit/ec368dbe936ef0104b782e4b0f67b17d6c7276f7"><code>ec368db</code></a> Fix stack limits (<a href="https://redirect.github.com/ohler55/oj/issues/1014">#1014</a>)</li> <li><a href="https://github.com/ohler55/oj/commit/4587e87e23adc9a4163834dc8c9ba9d7206c6501"><code>4587e87</code></a> Fix reentrant parser (<a href="https://redirect.github.com/ohler55/oj/issues/1013">#1013</a>)</li> <li><a href="https://github.com/ohler55/oj/commit/ea0c3b8fdc006807dfd768606548f6f15639b7dc"><code>ea0c3b8</code></a> Fix compile warnings</li> <li><a href="https://github.com/ohler55/oj/commit/45d13099a64c37e231f6cd32bb126ce0270d81c4"><code>45d1309</code></a> Revert &quot;fix: V-001 security vulnerability (<a href="https://redirect.github.com/ohler55/oj/issues/1011">#1011</a>)&quot; (<a href="https://redirect.github.com/ohler55/oj/issues/1012">#1012</a>)</li> <li><a href="https://github.com/ohler55/oj/commit/93ce414fc0b9b1ad2a19311101b6a443ec666320"><code>93ce414</code></a> fix: V-001 security vulnerability (<a href="https://redirect.github.com/ohler55/oj/issues/1011">#1011</a>)</li> <li><a href="https://github.com/ohler55/oj/commit/d68a31ac5bcaaeeed22fb32aeff35aef467ab8d2"><code>d68a31a</code></a> Add <code>max_integer_digits</code> limit for legacy integer parsing (<a href="https://redirect.github.com/ohler55/oj/issues/1009">#1009</a>)</li> <li><a href="https://github.com/ohler55/oj/commit/babd7a11e78a221f6434c5e9e8b9ede9947243e3"><code>babd7a1</code></a> Remove out of date performance comparisons</li> <li>Additional commits viewable in <a href="https://github.com/ohler55/oj/compare/v3.16.10...v3.17.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/chatwoot/chatwoot/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-22 14:09:28 +05:30
Aakash BakhleandGitHub	c27a5916bb	fix: auto enable document auto-sync (#14806) ... # Pull Request Template ## Description Auto enables document auto-sync on paid plans fixes: https://linear.app/chatwoot/issue/AI-186/captain-auto-sync-doesnt-turn-on-automatically-on-subscription ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules	2026-06-22 13:39:43 +05:30
Sony MathewandGitHub	66609f06fd	fix: Bump Nokogiri to 1.19.4 (#14807) ... # Pull Request Template ## Description This updates Nokogiri from `1.19.3` to `1.19.4` so the bundle-audit lint step stops flagging the newly published Nokogiri advisories. Chatwoot's direct Nokogiri usage appears limited to ordinary HTML/XML parsing and selector traversal, but the locked dependency is below the patched floor, so the safe remediation is the patch-level upgrade rather than an advisory override. Fixes [CW-7397](https://linear.app/chatwoot/issue/CW-7397/upgrade-nokogiri-to-1194-for-bundle-audit-advisories) ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? Reference failed build in CI because of bundle audit: https://app.circleci.com/pipelines/github/chatwoot/chatwoot/114392/workflows/8a252bf9-5e58-45fd-af18-a32dbebe978b/jobs/160423 - `bundle exec bundle audit update && bundle exec bundle audit check -v` passed with no vulnerabilities found. - `bundle exec rspec spec/services/website_branding_service_spec.rb spec/presenters/html_parser_spec.rb spec/enterprise/services/enterprise/website_branding_service_spec.rb spec/enterprise/services/captain/tools/simple_page_crawl_service_spec.rb` passed with 27 examples and 0 failures. - `bundle exec rubocop app/services/website_branding_service.rb app/presenters/html_parser.rb enterprise/app/services/page_crawler_service.rb enterprise/app/services/captain/tools/html_page_parser.rb enterprise/app/services/captain/tools/simple_page_crawl_service.rb` passed with no offenses. - `git diff --check` passed. Note: broad `bundle exec rubocop --parallel` still reports existing generated DB/schema offenses unrelated to this lockfile-only dependency bump. ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules	2026-06-22 12:07:58 +04:00
3 people	6a262287d2	feat(captain): allow agents to report Captain messages (#14799) ... Adds a cloud-only flow for agents to flag incorrect or problematic Captain (AI) responses. Right-clicking a Captain message surfaces a "Report message" option that opens a dialog to pick a problem type and add a description, persisted to a new captain_message_reports table for the team to review. <img width="636" height="542" alt="Screenshot 2026-06-20 at 9 15 56 AM" src="https://github.com/user-attachments/assets/afaa233d-6bd6-455a-8a33-a3796a3e3ef6" /> <img width="580" height="502" alt="Screenshot 2026-06-20 at 9 16 03 AM" src="https://github.com/user-attachments/assets/2d220d99-98cc-4c5e-a325-778ceb4f7bc9" /> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-20 14:47:08 -07:00
Sojan JoseandGitHub	dfd656a7d9	feat(account): persist signup attribution (#14761) ... This keeps Chatwoot-side attribution persistence intentionally small and Enterprise-only. The website owns attribution capture, normalization, and source classification. Chatwoot Cloud only reads the already-shaped first-party attribution cookies during the current web signup account creation path and stores the decoded payload in internal account metadata. Self-hosted installs remain unchanged in this repo. ## What changed - Added Enterprise-only attribution persistence to the current Cloud web signup account creation path. - Stores attribution only when `ChatwootApp.chatwoot_cloud?` is true. - Reads the existing first-touch and last-touch attribution cookies. - Saves only the documented scalar attribution fields under account internal metadata. - Preserves raw attribution values and leaves escaping to display boundaries. - Bounds stored attribution values to the website field-size limit. - Keeps OSS controller code unchanged. - Keeps signup attribution request coverage in Enterprise specs. - Avoids backend attribution derivation, referrer parsing, or fallback classification. - Skips authenticated add-workspace flows so additional workspaces are not counted as signup attribution. - Does not hook unused account creation paths or OmniAuth account creation. ## How to test - `bundle exec rubocop spec/controllers/api/v1/accounts_controller_spec.rb spec/enterprise/controllers/api/v1/accounts_controller_spec.rb enterprise/app/controllers/enterprise/api/v1/accounts_settings.rb enterprise/app/services/internal/accounts/marketing_attribution_service.rb spec/enterprise/services/internal/accounts/marketing_attribution_service_spec.rb` - `bundle exec rspec spec/controllers/api/v1/accounts_controller_spec.rb spec/enterprise/controllers/api/v1/accounts_controller_spec.rb spec/enterprise/services/internal/accounts/marketing_attribution_service_spec.rb` - On a cloud-like setup, create an account through the current web signup path with attribution cookies and confirm account internal metadata is populated. - On a non-cloud setup or authenticated add-workspace flow, confirm account-create behavior is unchanged and no attribution is stored.	2026-06-19 11:01:12 -07:00
Vishnu NarayananandGitHub	b02e732dd1	fix: throttle DELETE conversation API per account (CW-7356) (#14747) ... ## Description A single account deleted ~167,000 conversations via the API in 60 minutes (avg 46 rps, peak 151 rps/min) on 15 Jun 2026 21:00 to 22:00 IST. The cascade through `dependent: :destroy_async` on conversations, then messages, then reporting_events, created enough job queue and DB pressure to drive RDS CPU to ~93%, triggering 5xx alerts and connection-pool timeouts. This adds a `Rack::Attack` per-account throttle on `DELETE /api/v1/accounts/:id/conversations/:id`: - Default 60 req/min per account; configurable via the `RATE_LIMIT_CONVERSATION_DELETE` env var. Fixes [CW-7356](https://linear.app/chatwoot/issue/CW-7356)	2026-06-19 15:11:39 +05:30
3 people	80b132e155	feat(tiktok): add cloud warning (#14768) ... Adds Cloud-only warning on the TikTok connect page while North American account connections may be temporarily unavailable. Fixes https://linear.app/chatwoot/issue/CW-7322/cloud-show-tiktok-north-america-warning-on-connect-page --------- Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>	2026-06-19 12:29:07 +04:00
Sivin VargheseandGitHub	32b63ad0c0	feat: add search to Help Center admin pages (#14772)	2026-06-19 12:41:21 +05:30
Sivin VargheseandGitHub	ac15339456	fix: Resolve Firefox input issues and persist advanced filters (#14781) ... # Pull Request Template ## Description This PR fixes a few issues in Global Search and removes a non-functional control. * Fixes an issue in Firefox where characters could be dropped while typing in the search input. The search now uses the latest input value directly, preventing searches from running one character behind. * Removes a stale query sync in `SearchHeader` that could overwrite recently typed characters during the debounce window, causing the input to appear out of sync. * Fixes advanced search filters being removed from the URL on page reload. The search page now waits for account data to load before parsing URL parameters, ensuring agent, inbox, and date range filters are preserved. * Removes the non-functional "Sort by relevance" button from the search tabs bar, as it was disabled and had no effect. Fixes https://github.com/chatwoot/chatwoot/issues/14684 [CW-7305](https://linear.app/chatwoot/issue/CW-7305/global-search-drops-characters-while-typing-in-firefox-query-truncated) [CW-7370](https://linear.app/chatwoot/issue/CW-7370/remove-non-functional-relevance-placeholder-button-from-global-search) ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? ### Screencast **Before** https://github.com/user-attachments/assets/48d72a4e-20f4-4f24-91f4-2c9a9c065eba **After** https://github.com/user-attachments/assets/0e41a803-b4fd-410d-a739-549f72d418d6 ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules	2026-06-19 10:46:47 +04:00
Sony Mathew	f99187646e	Merge branch 'release/4.15.1' into develop	2026-06-17 18:07:48 +05:30
Sony Mathew	5ce6e00730	Bump version to 4.15.1	2026-06-17 18:06:42 +05:30
Vishnu NarayananandGitHub	f66b551c7d	revert: Sidebar unread counts for filters (CW-7262) (#14769) ... ## Description Reverts [#14726](https://github.com/chatwoot/chatwoot/pull/14726) (\"feat: Add sidebar unread counts for filters (CW-7262)\"), which shipped in 4.15.0. After 4.15.0 rolled out to prod the unread-counts-for-filters code path caused a cascading incident: - `Counter#ensure_filters_cache!` fires on every `/unread_counts/index` and `update_last_seen` request. - On cache miss it calls `Builder#build_filters_for!`, which: - invokes `store.clear_user_filters!` -> `delete_matching` -> a Redis `SCAN_each` over a per-user pattern keyspace, and - runs 4 fresh SQL passes per user (mentions, participating, unattended, and per-folder `Conversations::FilterService` queries). - Threads blocked in the SCAN held their DB connections, the connection pool exhausted, Sidekiq jobs were discarded with `ActiveJob::DeserializationError: could not obtain a connection from the pool`, and the enqueued queue blew past 200K. Related: [CW-7262](https://linear.app/chatwoot/issue/CW-7262/unread-counts-for-filters-folders) ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality not to work as expected) - [ ] This change requires a documentation update ## How Has This Been Tested? ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules	2026-06-17 14:58:48 +04:00
Sony Mathew	af9b81afc9	ci(docker): optimize CI build caching	2026-06-17 12:31:04 +05:30
Sony Mathew	c12e1f8348	Merge branch 'release/4.15.0' into develop	2026-06-17 00:11:59 +05:30
Sony Mathew	124782938d	Bump version to 4.15.0	2026-06-17 00:10:47 +05:30
Vishnu NarayananandGitHub	c70a57407d	fix: label Chatwoot Mobile sessions instead of 'Unknown Device' (#14753) ... ## Description Sessions created by logins from the Chatwoot Mobile app currently render as "Unknown Device" in the dashboard sessions UI. The mobile app's HTTP layer sends: - Android: `User-Agent: okhttp/4.9.2` - iOS: `User-Agent: Chatwoot/<build> CFNetwork/<v> Darwin/<v>` Neither pattern is classifiable by the `browser` gem, so \`browser_name\`, \`platform_name\`, and \`device_name\` all end up "Unknown". This change adds a backend-only fallback in \`UserSessionTrackingService\`. When \`Browser.new(ua)\` returns "Unknown Browser" and the UA matches a known Chatwoot Mobile pattern, the labels are overridden to \`Chatwoot Mobile\` + \`Android\` / \`iPhone\`. The Vue sessions list (\`ActiveSessions.vue\`) then renders "Chatwoot Mobile on Android" or "Chatwoot Mobile on iPhone" with the smartphone icon. This is the immediate floor. A follow-up will add structured \`X-Chatwoot-*\` headers from the mobile app so we can render full version + device model. Fixes INF-75. ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? - Added specs ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules	2026-06-17 00:05:29 +05:30
3 people	fe6368b42e	feat: Add sidebar unread counts for filters (CW-7262) (#14726) ... ## Description Extends the conversation unread-count system so the left sidebar can show unread badges for Mentions, Participating, Unattended, and saved conversation folders. Folder badges reuse the existing `custom_filters` conversation filter semantics, store user-scoped Redis sets lazily, and skip unsupported folder filters so invalid saved folders continue to render without a badge. The Unattended badge counts all visible unread open conversations that match the existing unattended conversation scope. Closes - [CW-7262](https://linear.app/chatwoot/issue/CW-7262/unread-counts-for-filters-folders) ## What changed - Added user-scoped unread-count Redis keys and cache builders for mentions, participating conversations, unattended conversations, and saved folder filters. - Reused `Conversations::FilterService` through a relation-returning path so folder counts match the folder conversation list behavior. - Invalidated user filter caches from mention, participant, custom-filter, and relevant conversation update events. - Extended the unread-count endpoint payload and sidebar Vuex/sidebar rendering for the new badge counts, including the Unattended sidebar item. - Added Ruby, Enterprise, request, listener, and frontend store coverage for the new unread-count dimensions. ## Type of change - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? - Created local validation folders for `john@acme.inc` and confirmed the unread-count payload includes open, resolved, and high-priority folder badges while excluding the invalid unsupported folder. - Added coverage for the Unattended badge rule: all visible unread open conversations matching `Conversation.unattended`. - Ran focused unread-count Ruby specs, including service, listener, request, and Enterprise counter coverage. - Ran frontend unread-count store specs. - Ran RuboCop on the touched Ruby files. - Ran ESLint through the project script; it completed with warnings in existing unrelated files and no errors. <img width="369" height="525" alt="Screenshot 2026-06-13 at 10 51 39 PM" src="https://github.com/user-attachments/assets/36b1d2c4-dac1-4f6f-9c0e-7ef5a6cc2975" /> ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [x] Documentation changes are not required for this internal unread-count behavior - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] No dependent downstream changes are required --------- Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>	2026-06-16 23:46:49 +05:30
Sivin VargheseandGitHub	352f120c6a	feat: add dedicated color tokens for voice call widget (#14745) ... # Pull Request Template ## Description This PR introduces dedicated color tokens for the floating voice call widget instead of reusing generic design tokens. This allows the widget to maintain a distinct dark-card appearance across both light and dark themes. Adds the following tokens and applies them to `CallCard`: * `--call-widget` * `--call-widget-border` * `--call-widget-text` * `--call-widget-sub-text` Fixes https://linear.app/chatwoot/issue/CW-7353/call-notification-window-theme-update-design ## Type of change - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? ### Screenshots **Light mode** <img width="1466" height="815" alt="Screenshot 2026-06-16 at 3 47 32 PM" src="https://github.com/user-attachments/assets/732164b1-5488-4cc1-8c71-01245d906842" /> **Dark mode** <img width="1466" height="815" alt="Screenshot 2026-06-16 at 3 46 54 PM" src="https://github.com/user-attachments/assets/536ab632-4c7c-486b-8fc4-a061ee40b22a" /> ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules	2026-06-16 20:01:31 +05:30
Vishnu NarayananandGitHub	a585853690	chore: expose advanced_search flag in super_admin UI for self-hosted (#14750) ... ## Description Removes `chatwoot_internal: true` from the `advanced_search` feature flag so self-hosted enterprise userss can toggle it from the super_admin UI instead of going through a rails console.	2026-06-16 07:10:24 -07:00
4 people	64b0ebd8dc	feat: Script to migrate images between providers (#9117) ... # Pull Request Template ## Description Storage migration functionality, which allows the transfer of images from one on-premises provider to another (e.g. AWS, Google, etc.) using Active Storage. I ran the unit and integration tests and they all passed correctly. **The command to execute the migration is `FROM=from_service TO=to_service rake storage:migrate`** Fixes #7907 ## Type of change Please delete options that are not relevant. - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? I have tested the storage migration functionality by running the provided unit and integration tests. Additionally, I manually tested the migration process in a local development environment by following these steps: Set up two storage services (e.g., AWS S3 and Google Cloud Storage) with valid configurations. Execute the `FROM=local TO=amazon rake storage:migrate` task with appropriate FROM and TO arguments to migrate blobs between the services. Verified that the blobs were successfully transferred to the target storage service. Checked for any error messages or unexpected behavior during the migration process. ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [x] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules --------- Co-authored-by: Sony Mathew <sony@chatwoot.com> Co-authored-by: Sony Mathew <2040199+sony-mathew@users.noreply.github.com>	2026-06-16 19:12:49 +05:30
Vishnu NarayananandGitHub	cf6ee13665	feat: scale email rate limits by agent count for paid plans (#13966) ... Paid plan accounts with many agents were hitting the flat daily email rate limit cap. This multiplies the plan base limit by the account's agent seat count, so larger teams get proportionally higher limits. Free/hacker plan keeps the flat limit unchanged. Fixes https://linear.app/chatwoot/issue/CW-6664 ## How to test 1. Set up `ACCOUNT_EMAILS_PLAN_LIMITS` config with plan limits (e.g., `{"hacker": 10, "startups": 20, "business": 30, "enterprise": 40}`) 2. Create an account on a paid plan (e.g., startups) with multiple agent seats 3. Verify `account.email_rate_limit` returns `base_limit × agent_seats` (e.g., 20 × 5 = 100) 4. Create an account on the hacker plan — verify limit stays flat (10) 5. Set a per-account override via super admin `limits.emails` — verify it takes priority over the multiplied limit ## What changed - `plan_email_limit` now multiplies the base plan limit by agent seat count for paid plans - Added `free_plan?` helper to skip the multiplier for the default/free plan	2026-06-16 18:56:30 +05:30
5 people	41a3ab6dfa	feat(companies): add contact company selector (#14496) ... Adds a company selector to the contact details form so agents can associate a contact with an existing company directly from the contact page. Closes - None Why Contacts already expose company information through the CRM fields, but the form only accepted free-text company names. As we split company CRM work into smaller PRs, this keeps the contact page aligned with the structured company model while preserving the existing company-name behavior used by automations. What changed - Shows a company dropdown in the contact details form when the Companies feature is enabled. - Keeps legacy free-text company names editable when a contact has no structured `company_id`. - Allows Enterprise contact create/update APIs to accept account-scoped `company_id`. - Syncs `additional_attributes.company_name` when a contact is associated with a company, including the existing email-domain auto-association path. - Serializes `company_id` in the contact model payload so the form can show the current association. How to test 1. Enable Companies for an account and open a contact details page. 2. In Edit contact details, use the Company field to select an existing company. 3. Save the contact and refresh the page. 4. Confirm the selected company remains visible and the contact is associated with that company. 5. Confirm contacts with only a legacy free-text company name still show the text input instead of an empty selector. --------- Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com> Co-authored-by: iamsivin <iamsivin@gmail.com> Co-authored-by: Sony Mathew <2040199+sony-mathew@users.noreply.github.com>	2026-06-16 15:29:27 +05:30
3 people	de137e8297	feat: Capture CTWA referral metadata for WhatsApp conversations (#14681) ... Adds support for capturing Click-to-WhatsApp ad referral metadata from incoming WhatsApp messages. This stores Meta Cloud API `referral` payloads on the incoming message `content_attributes` and normalizes Twilio `Referral*` callback fields into the same shape. The UI display is intentionally deferred until Instagram, Messenger, and TikTok referral payloads are captured as well, so we can design one cross-channel referral surface instead of a WhatsApp-only sidebar block. Why message-level storage Meta sends CTWA referral details as part of the inbound message payload, not as a stable conversation-level webhook. The referral represents the exact ad click that produced that specific customer message, and later messages in the same conversation may not carry the same context. Storing the normalized referral on the message preserves the original webhook semantics, avoids adding conversation-level attribution that could become stale or ambiguous, and keeps support for both Cloud API and Twilio payloads aligned behind `content_attributes.referral`. Fixes https://linear.app/chatwoot/issue/CW-7090/surface-meta-ctwa-referral-on-incoming-whatsapp-messages-cloud-api Closes https://github.com/chatwoot/chatwoot/issues/13995, https://github.com/chatwoot/chatwoot/issues/12560, https://github.com/chatwoot/chatwoot/issues/13006 Related community PRs - https://github.com/chatwoot/chatwoot/pull/13130 - https://github.com/chatwoot/chatwoot/pull/14180 - https://github.com/chatwoot/chatwoot/pull/14121 Related follow-ups - https://linear.app/chatwoot/issue/CW-7301/capture-instagram-ad-referral-metadata-on-incoming-messages - https://linear.app/chatwoot/issue/CW-7302/capture-messenger-ad-referral-metadata-on-facebook-page-conversations - https://linear.app/chatwoot/issue/CW-7303/capture-tiktok-ad-referral-metadata-from-im-referral-msg-events How to test 1. Send or replay a WhatsApp Cloud API inbound message that contains a `messages[0].referral` payload from a Click-to-WhatsApp ad. 2. Confirm the generated incoming message stores the payload under `content_attributes.referral`. 3. Repeat with a Twilio WhatsApp callback containing `Referral*` fields and confirm the stored message has the same normalized `content_attributes.referral` structure. --------- Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com>	2026-06-16 09:58:29 +04:00
Sivin VargheseandGitHub	a3d05ef55d	chore: Update emoji picker in widget (#14741)	2026-06-16 10:39:47 +05:30
4 people	dda25c0b51	fix(portal): emit valid BCP 47 html lang attribute (#14680) ... Locales are stored with underscores (e.g. pt_BR), but the HTML lang attribute requires hyphens (pt-BR). Convert via a helper in the public portal layouts. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>	2026-06-15 14:34:52 -07:00
Sivin VargheseandGitHub	1713cabdf2	feat: Add emoji & icon picker for Help Center categories (#14702)	2026-06-16 02:10:05 +05:30
4 people	d8a16278b9	fix: added ordering capability for sidebar sections folders, teams, channels and labels (CW-7193) (#14609) ... ## Description * Added the ability to sort for 4 sub-sections under conversations folders, teams, channels and labels. * the sort options are basically created at, alphabetical and unread counts along with both directions. * for folders we don't have an unread count, so we sort it by only created and alphabetical. * all the sort preferences are stored on the frontend - easiest implementation for now. Fixes # CW-7193 ## Type of change Please delete options that are not relevant. - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality not to work as expected) - [ ] This change requires a documentation update ## How Has This Been Tested? Tested this locally by visually verifying the changes. Also ran the newly added tests for component level changes. Here is the screenshot of the changes: Added the sort option to sub sections in the conversation sidebar: <img width="282" height="848" alt="Screenshot 2026-06-02 at 1 58 12 AM" src="https://github.com/user-attachments/assets/4a7c6061-86e3-438a-92ae-ee643a0128b6" /> The sort options looks like this: <img width="783" height="698" alt="Screenshot 2026-06-02 at 1 58 49 AM" src="https://github.com/user-attachments/assets/a15bb0a7-b810-4423-a88c-fbd84d0476c0" /> ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules --------- Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com> Co-authored-by: iamsivin <iamsivin@gmail.com>	2026-06-15 21:34:19 +05:30
Sony MathewandGitHub	4816e923b6	chore: added a new sort by unread option for conversations (CW-7152) (#14512) ... ## Description Added a new option for the sort by option in conversation filters called unread. This is to filter out unread conversations. Fixes # CW-7152 ## Type of change Please delete options that are not relevant. - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality not to work as expected) - [ ] This change requires a documentation update ## How Has This Been Tested? Tested manually in local. <img width="1397" height="603" alt="Screenshot 2026-05-20 at 10 40 20 PM" src="https://github.com/user-attachments/assets/6c60263e-907b-419f-a7ed-06010bbe8736" /> ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules	2026-06-15 17:58:04 +05:30
3 people	396631ad7d	feat: enforce concurrent session limit with login picker (CW-7169) (#14621) ... ## Description Cap active sessions at `MAX_USER_SESSIONS` which defaults to existing value of `25` per user. This ensure existing user login behavior is not affected for self-hosted installations. Browser users at the cap see a session picker (409 response) to choose which session to end. Non-browser clients and partially-tracked users get silent oldest-session eviction. Depends on #14556. ## Type of change - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? Specs cover: under limit, at limit (browser picker, non-browser eviction), partial tracking fallback, revoke single/all sessions during login, session row creation on successful login. --------- Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-15 17:28:13 +05:30
Vishnu NarayananandGitHub	ba0ba46c9c	fix: skip session tracking and use short-lived token for impersonation (CW-7169) (#14622) ... ## Description SuperAdmin impersonation SSO logins no longer create UserSession rows visible to the customer. Impersonation tokens use a 2-day lifespan instead of ~2 months, so they naturally evict first and don't linger in the user's token list. Server-side detection via Redis value (`'impersonation'` vs `'normal'`) without changing the `valid_sso_auth_token?` signature. Backward compatible with in-flight tokens. Depends on #14556. ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? Specs cover: impersonation login skips UserSession creation, impersonation token has short lifespan, normal SSO login still creates UserSession row. ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules	2026-06-15 17:14:34 +05:30
Vishnu NarayananandGitHub	ee6382109a	feat: prevent deleted email conversations from syncing again (#14612) ... # Pull Request Template ## Description Prevent deleted email conversations from being synced into Chatwoot again while they are still within the IMAP sync window. When an admin explicitly deletes an email conversation, the incoming email message IDs are stored temporarily in Redis. IMAP sync checks these recently deleted message IDs in addition to existing message records. Each Redis key expires automatically after two days. This applies only to explicit conversation deletion. Individual message deletion, inbox deletion, and account deletion keep their existing behavior. Fixes [CW-7214](https://linear.app/chatwoot/issue/CW-7214/deleted-mails-in-gmail-inbox-gets-synced-again)	2026-06-15 17:06:40 +05:30
Sivin VargheseandGitHub	35bef21f83	feat: add media view for contacts (#14393)	2026-06-15 15:42:11 +05:30
4 people	e5c140158e	fix(new-conversation): stop writing literal "undefined" as mail_subject (#14383) ... ## Description This PR fixes a data-corruption bug in the new conversation flow that surfaces in conversation search results as `Subject: undefined`. ### The Problem When creating a conversation through the "New conversation" modal without typing a subject (every non-email channel never shows the subject input, and email channels can be left blank), the conversation gets persisted with `additional_attributes.mail_subject = "undefined"` (the literal string). The bogus value shows up in conversation search results as `Subject: undefined`, which started rendering after #10843. ### Root Cause `createConversationPayload` in `app/javascript/dashboard/store/modules/contactConversations.js` appends the `mail_subject` field unconditionally: ```js payload.append('additional_attributes[mail_subject]', mailSubject); ``` `composeConversationHelper.js` only sets `payload.mailSubject` when `subject` is truthy, so when no subject is provided, `mailSubject` is destructured as `undefined` in `createConversationPayload`. `FormData.append` coerces `undefined` to the string `"undefined"`, and the backend persists it as-is into the JSONB column. ### The Fix Skip the append when `mailSubject` is falsy. The backend already treats a missing key the same as an empty subject (the email mailer falls back to a default subject when `mail_subject` is `nil`), so omitting the field is safe across channels. ### Key Changes - Guarded the `additional_attributes[mail_subject]` append in `createConversationPayload`. - Added a spec covering the case where `mailSubject` is omitted. > Note: existing rows persisted before this fix will continue to show `Subject: undefined` in search until cleaned up. A simple SQL cleanup for non-email inboxes: > > ```sql > UPDATE conversations > SET additional_attributes = additional_attributes - 'mail_subject' > FROM inboxes > WHERE conversations.inbox_id = inboxes.id > AND inboxes.channel_type <> 'Channel::Email' > AND conversations.additional_attributes->>'mail_subject' = 'undefined'; > ``` > > I'm leaving any data-cleanup migration out of this PR since it's a maintenance concern that may be handled differently per installation. ## Type of change - [X] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? 1. Open the "New conversation" modal on a non-email inbox (e.g., WhatsApp, SMS, API). 2. Create a conversation without filling any subject (field is not present on those, so regular flow). 3. Open the global search and search for the conversation. 4. **Before:** the result card shows `Subject: undefined`. **After:** the subject row is hidden. 5. Repeat on an email inbox leaving the subject blank — same result. 6. On an email inbox, type a subject and verify it still persists and renders correctly. 7. Run the new spec: `pnpm test contactConversations`. ## Checklist: - [X] My code follows the style guidelines of this project - [X] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [X] My changes generate no new warnings - [X] I have added tests that prove my fix is effective or that my feature works - [X] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules Co-authored-by: Sojan Jose <sojan@pepalo.com> Co-authored-by: Sony Mathew <sony@chatwoot.com>	2026-06-14 08:57:38 +05:30
4 people	274e92e0e4	chore: collapse conversation sidebar sections (folders, teams, inboxes and labels) - CW-7059 (#14509) ... ## Description Added ability to collapse conversation sidebar sections (folders, teams, inboxes and labels) Fixes #CW-7059 ## Type of change Please delete options that are not relevant. - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality not to work as expected) - [ ] This change requires a documentation update ## How Has This Been Tested? Tested locally. Added specs. Attaching the loom for them same. https://github.com/user-attachments/assets/40d613e7-6c82-4078-abf4-79739a00f718 ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules --------- Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com> Co-authored-by: iamsivin <iamsivin@gmail.com>	2026-06-14 06:54:18 +05:30
5 people	27404b4a27	fix: redact sensitive integration secrets from API responses (#14147) ... ## Summary The `GET /api/v1/accounts/:id/integrations/apps` endpoint returns raw secret values (OpenAI API keys, Google service account private keys, Linear refresh tokens, etc.) in hook settings within the JSON response. Although gated behind an administrator check, these secrets are visible in the browser network tab. This PR filters hook settings through the existing `visible_properties` whitelist defined in `config/integration/apps.yml`, and adds explicit whitelists to integrations that were missing them. Closes #14042 ## Bug reproduction **Setup:** Created an OpenAI integration hook with a fake API key (`sk-test-secret-12345`). **Step 1 — Browser Network tab shows raw secrets:** <img width="1676" height="869" alt="Screenshot 2026-04-24 at 14 32 28" src="https://github.com/user-attachments/assets/6fc69463-365e-458b-b216-98a7390bf528" /> Navigate to Settings > Integrations as an admin. Open DevTools Network tab and observe the response from `GET /api/v1/accounts/:id/integrations/apps`. The hook settings contain the full API key in plaintext: ```json "hooks": [ { "id": 1, "app_id": "openai", "settings": { "api_key": "sk-test-secret-12345", "label_suggestion": false } } ] ``` **Step 2 — API call confirms the leak:** ```bash curl -s "http://localhost:3000/api/v1/accounts/2/integrations/apps" \ -H "access-token: <token>" \ -H "client: <client>" \ -H "uid: user@test.com" \ | jq '.payload[] | select(.id == "openai") | {id, name, hooks: [.hooks[] | {id, app_id, settings}]}' ``` Response: ```json { "id": "openai", "name": "OpenAI", "hooks": [ { "id": 1, "app_id": "openai", "settings": { "api_key": "sk-test-secret-12345", "label_suggestion": false } } ] } ``` Any admin user can extract the raw API key from the response. The same applies to other integrations — Dialogflow exposes full Google service account credentials, Linear exposes refresh tokens, etc. ## After fix After applying this change, the GET /api/v1/accounts/:id/integrations/apps endpoint no longer returns sensitive secret values in hook settings. Instead, the response is filtered using each integration’s visible_properties whitelist, ensuring only safe, user-facing fields are exposed. For example, OpenAI integrations return non-sensitive fields like label_suggestion while excluding raw API keys. This prevents secrets from being exposed in the browser network tab or API responses, even for authenticated admin users. ```bash curl -X GET "http://localhost:3000/api/v1/accounts/2/integrations/apps" \ -H "Accept: application/json" \ -H "Authorization: Bearer eyJhY2Nlc3MtdG9rZW4iOiJqZG5jOWg4TnljaWFJa3JlZkxGQzRnIiwidG9rZW4tdHlwZSI6IkJlYXJlciIsImNsaWVudCI6Ik81bjVnTDFEOVVhbGpwbWxjaHZNanciLCJleHBpcnkiOiIxNzgyMzMyNTA4IiwidWlkIjoidXNlckB0ZXN0LmNvbSJ9" \ -H "access-token: jdnc9h8NyciaIkrefLFC4g" \ -H "client: O5n5gL1D9UaljpmlchvMjw" \ -H "uid: user@test.com" \ | jq '.payload[] | select(.id == "openai") | {id, name, hooks: [.hooks[] | {id, app_id, settings}]}' % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 10174 100 10174 0 0 33232 0 --:--:-- --:--:-- --:--:-- 33357 { "id": "openai", "name": "OpenAI", "hooks": [ { "id": 1, "app_id": "openai", "settings": { "label_suggestion": false } } ] } ``` ## What changed - Added `visible_properties` accessor to `Integrations::App` model to expose the whitelist from config - Updated `_hook.json.jbuilder` to filter `resource.settings` through the associated app's `visible_properties` instead of returning the full hash - Added `visible_properties` to integrations that were missing it: - Linear: `[]` (settings contain refresh_token) - Notion: `[]` (OAuth-based, no user-facing settings) - Slack: `['channel_name']` (UI needs this to display connected channel) - Shopify: `[]` (no settings) App config metadata (`_app.json.jbuilder`) is left unchanged — hook_type, settings_form_schema, etc. are not secrets and the frontend depends on them. ## How to test 1. Create an OpenAI integration hook with an API key 2. As an admin, call `GET /api/v1/accounts/:id/integrations/apps` 3. Verify hook settings include `api_key` (whitelisted) but not raw credential objects 4. For Dialogflow hooks, verify `credentials` (private key JSON) is excluded while `project_id` is included 5. For Slack hooks, verify `channel_name` is still returned 6. For Linear hooks, verify `refresh_token` is not returned --------- Co-authored-by: Botshelo Nokoane (Konstruktors) <botshelo@entersekt.com> Co-authored-by: Sony Mathew <sony@chatwoot.com> Co-authored-by: Sony Mathew <2040199+sony-mathew@users.noreply.github.com>	2026-06-14 06:53:13 +05:30