Upgrade
Recording permission
We've introduced the ability for any authenticated participant to start a recording or transcription. ⚠️ This is the new default: to keep recording and transcription restricted to room admins and owners, set RECORDING_AUTHENTICATED_PARTICIPANTS_ENABLED to False.
Starting a recording is also now throttled per user, with START_RECORDING_THROTTLE_RATES (default 10/minute) and START_RECORDING_DAILY_THROTTLE_RATES (default 100/day). Stopping a recording is not throttled.
Purging deleted rooms
Deleting a room via the external API only soft deletes it: it is hidden but keeps its slug and PIN code. The purge_inactive_rooms command also permanently deletes soft-deleted rooms. See the room purge documentation.
- Inactive soft-deleted rooms are purged along with the other inactive rooms: if
ROOM_INACTIVITY_DELETION_DAYSis already set, nothing else is needed. - The new
ROOM_DELETED_RETENTION_DAYSsetting purges soft-deleted rooms that many days after their deletion, whether they are inactive or not. It is unset by default. - As for inactive rooms, a deleted room holding a saved recording its users may still access is kept until that recording expires.
What's new
Added
- ✨(all) allow any authenticated user to start a recording
- ✨(backend) add room soft-deletion to the external API
- ✨(backend) authenticate external API calls with Menshen exchanged tokens
- ✨(backend) add structured audit logging facility
- ✨(backend) audit external API token and room operations
- 🔒️(backend) audit writes and bulk actions made in the Django admin
- ✨(backend) audit recordings, transcripts and summaries
- ✨(backend) audit transit code issuance and exchange
- ✨(backend) audit Menshen calls and users created from introspected tokens
- ✨(backend) allow static feature flags without an analytics backend #1809
- ⚡️(backend) add UPPER(email) index for case-insensitive user lookups
- ✨(backend) add room soft-deletion to the external API
- ✨(all) allow any authenticated user to start a recording
- ✨(backend) authenticate external API calls with Menshen exchanged tokens
- ✨(backend) audit Menshen calls and users created from introspected tokens
Changed
- 🔖(helm) release chart 0.0.29
Fixed
- 🔒️(backend) upgrade brotli to 1.2.1 to fix CVE-2026-111497
- 🔒️(frontend) upgrade nginx to 1.30.6 to fix CVE-2026-15176
- 🔒️(frontend) build the Outlook add-in on Node 22.23.4
- 🔒️(backend) upgrade djangorestframework to 3.18.2 to fix CVE-2026-114136, CVE-2026-114137 and CVE-2026-114138
- 🔒️(docker) distrust compromised eMudhra emSign G3 CA roots
- 🔒️(backend) upgrade pillow to 13.0.0 to fix CVE-2026-112403
- 🔒️(frontend) upgrade libx11 to fix CVE-2026-88806
- 🔒️(backend) throttle the start recording endpoint
- 🐛(backend) put a timeout on every LiveKit API call
- 🔒️(backend) upgrade aiohttp to 3.14.5 to fix CVE-2026-111064
- ♿️(frontend) announce the microphone turning off on shortcut #1816
- 🐛(release) use env bash in prepare-release script for NixOS
Full Changelog: v1.35.0...v1.36.3