Core: Fixed an issue where profile photos uploaded from Rock Mobile, and images uploaded or imported with an unknown file type, would not display.
Communication: Fixed the Rock Cleanup job removing System Communication logos, email editor background images and video preview images a day after they were uploaded.
Communication: Fixed an issue where SMS attachments that are not images (PDFs, video, contact cards) would not open in SMS Conversations, the mobile SMS Conversation blocks and the Communication Entry Wizard.
Core: Fixed rendering issues with the Social Media Account field type.
Workflow: Fixed an issue where Workflow Webhook attribute mappings that use Lava, like {{ RawBody }}, passed encoded text to the launched workflow instead of the data the webhook sent.
AI: Improved the AI agent tools for steps, notes, content channel items, connection requests and communications to better match the behavior of the corresponding Rock blocks.
CMS: Improved security by restricting which server files and folders the File System asset storage provider can access.
Group: Improved security by limiting the group and group member pickers to groups the person is allowed to view.
Core: Improved security by tightening permission checks on file and image uploads and treating uploads from signed-out visitors as temporary files.
CMS: Improved security by protecting root and restricted folders in the Asset Manager.
CRM: Improved security by strengthening group permission checks in the Edit Family block.
Mobile: Improved security by validating Microsoft Entra sign-in in the mobile app against the application's configured Entra tenant and client.
Core: Improved security by strengthening permission checks in the attribute editor and Form Builder.
Workflow: Improved security by updating how the Set Attribute to Current Person workflow action behaves when no one is signed in.
CMS: Improved security by requiring edit access to manage files with the Asset Manager in the File Asset Manager and communication blocks.
Group: Improved security by strengthening group permission checks in the RSVP Detail and RSVP List blocks.
Finance: Improved security by limiting the Contribution Statement List Lava block to statements the viewer is allowed to see when Use Person Context is enabled.
Finance: Improved security by strengthening permission checks on saved payment accounts and bank accounts in the Saved Account List and Bank Account List blocks.
Other: Improved security by strengthening permission checks when saving in a number of WebForms and Obsidian blocks, including Registration Entry.
Event: Improved security by limiting group placement in the Registration Entry block to groups linked to the registration instance.
Core: Improved security by requiring location edit access to add new locations from the Location List field type.
Reporting: Improved security by limiting the Query Hint setting on reports to a set of supported hints.
CMS: Improved security by limiting custom root folders used by the file browser and uploaders to the Content folder.
API: Improved security by blocking sensitive person and login fields from Entity Search results.
Core: Improved security by honoring the Disable Predictable IDs site setting for person avatars.
Reporting: Improved security by checking metric permissions before showing partition names on metric charts.
API: Improved security by strengthening permission checks on REST API updates, including changes to security role groups.
Lava: Improved security by limiting the files the Lava stylesheet command can import.
Event: Improved security by applying registration template permissions across the event registration detail blocks.
Security: Improved security for the Account Entry block when a new login is matched to an existing person.
Communication: Improved security by always validating Twilio webhook signatures for incoming text messages.
Finance: Improved security by adding a time limit for saving a payment account after registration.
Finance: Improved security by encoding the participant introduction in the Fundraising Participant block.
CMS: Improved security by requiring sign-in to view File Browser thumbnails.
Security: Improved security by validating profile photos imported from external sign-in providers.
Core: Improved security by limiting merge sets in the Merge Template Entry block to the person who created them.
Finance: Improved security by limiting the Account Picker to public accounts for people without financial account access.
Mobile: Improved security by strengthening permission checks when saving requests in the mobile Add Connection Request block.
CMS: Improved security by tightening how the Email Form block processes Lava and recipient addresses.
Mobile: Improved security by aligning the mobile Group Attendance Entry block's permission checks with the Group Attendance Detail block.
Prayer: Improved security by strengthening note permission checks in the Prayer Comment Detail block.
Workflow: Improved security by validating requests to Text To Workflow.
Check-in: Improved security by limiting changes signed-out visitors can make to existing person records in the Attendance Self Entry block.