LoginSign Up
← Back to all sparks
Rocket.Chat logo

Rocket.Chat

COLLAB
Velocity6.3

Open-source team communication platform

rocket.chat ↗

Rocket.Chat is methodically migrating off Meteor DDP toward a REST core

ddp-to-restself-hostingfederationsecurityabacopen-source
◆Current state
Rocket.Chat is mid-flight on its 8.5/8.6 release-candidate cycle. Beneath a steady stream of RC version bumps, the substantive work is a deliberate migration of client traffic from legacy Meteor DDP methods to REST endpoints, plus security hardening, federation fixes, and self-hostable building blocks like LibreTranslate auto-translation.
◆Where it's heading
Two arcs run in parallel. The first is architectural: deprecating DDP methods (kept until 9.0.0) while routing clients through REST, which decouples the product from its Meteor heritage and makes external SDK/mobile clients first-class. The second is enterprise/sovereignty: on-prem translation, Virtru-backed ABAC, phishing-resistant OAuth — features aimed at self-hosting and regulated buyers.
◆Prediction
Expect the DDP-to-REST migration to keep advancing endpoint by endpoint toward the 9.0.0 removal, and continued investment in self-hosted, governance-heavy capabilities that differentiate Rocket.Chat from SaaS-only chat competitors.

◆Recent moves

  1. 1d ago

    8.6.0-rc.1: federation sync, SSRF, and 2FA token fixes

    A patch RC fixing a federation bug where editing/deleting a message stopped subsequent cross-server sync, an SSRF-validation issue blocking integrations from internal hosts, and a 2FA check that wrongly rejected bypass-enabled Personal Access Tokens. Cleanup work stabilizing the 8.6 line ahead of release.

    View source ↗
  2. 6d ago

    8.6.0-rc.0: DDP-to-REST migration, presence engine, self-hosted auto-translate

    ⚡ SPARK

    The substantive release of the cycle: a batch of new REST endpoints (rooms.join, im.blockUser, batched settings, e2e key requests) replacing deprecated DDP methods, a unified priority-based presence engine, self-hostable LibreTranslate auto-translation, and Virtru as an external ABAC attribute store. This is the architectural spine of the 8.x direction.

    View source ↗
  3. 17d ago

    8.5.0-rc.6: dependency bump only

    A release candidate containing only a Meteor version bump and dependency updates. No user-visible change.

    View source ↗
  4. 17d ago

    8.5.0-rc.5: dependency bump only

    A release candidate with only a Meteor version bump and dependency updates. No user-visible change.

    View source ↗
  5. 22d ago

    8.5.0-rc.4: dependency bump only

    A release candidate with only a Meteor version bump and dependency updates. No user-visible change.

    View source ↗
  6. 23d ago

    8.5.0-rc.3: bot agents skip chat-limit lock

    A near-empty RC whose only substantive change lets bot agents skip the chat-limits locking mechanism since they aren't rate-limited. Minor behavioral fix amid routine version bumps.

    View source ↗