BigBlueButton Files

This iteration of BigBlueButton 3.0 contains several audio (livekit) fixes, a couple of client and core improvements. Several direct security fixes and a few transitive ones are included.

Below is a list of the pull requests in this iteration, grouped by component.

Link to installation command / instructions/ schedule / planned features : https://docs.bigbluebutton.org/3.0/new-features

Big THANK YOU to all community members who helped for this release - both through sending pull requests and through reporting bugs or requesting enhancements! :confetti_ball:

HTML5 client

fixes

• fix(livekit): trigger forced room reconnection on fatal errors by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24403
• fix(livekit): frozen cams on reconn, camera bridge improvements by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24404
• fix(livekit): frozen screen share on reconnects by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24405
• [3.0] fix(chat): audio alerts playing when panel is opened by @Arthurk12 in https://github.com/bigbluebutton/bigbluebutton/pull/24243
• fix: drop areas appearing when presentation is removed by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24381
• fix (html5): Show chat message notification from html version of the message (instead of markdown) by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24421
• fix: Virtual background image upload fails when userdata-bbb_hide_notifications is set to true by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24422
• fix(html5/chat): Remove unstable chat scrolling log by @JoVictorNunes in https://github.com/bigbluebutton/bigbluebutton/pull/24112
• Fix(html5): chat counter stale due race condition on mark message as read by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24423
• fix: Raise hand notification not working for second moderator by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24444
• fix(html5): exclude worker.ts from ReactRefresh so hot reload can work by @germanocaumo in https://github.com/bigbluebutton/bigbluebutton/pull/24447
• fix: Leave button opens empty dropdown by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24476
• Fix(html5): talking indicator being covered by webcam by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24475
• refactor(html5): Replace isMeteorConnected prop with isConnected across UI components by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24171
• fix(audio): ensure MediaStreamTrack is disabled on first join + mute by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/commit/3aa47832bc2b17178799bd932453c226e8f95703 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8 will be made public not earlier than Feb 10, 2026
• Fix(html5): moderators were unable to unlock users via the Raised Hand list. by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24489
• fix(audio): legacy listen only broken due to undefined argument by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24510
• Fix(html5): Pinch zoom not propagating on WB by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24521
• Fix(html5): enforce meetingId filtering across user-related data streams by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24539

plugin related

• fix(plugins-sdk): compare generic content items by their id by @germanocaumo in https://github.com/bigbluebutton/bigbluebutton/pull/24219
• feat(plugin): Add nameSortable and bot in the UsersBasicInfo data hook by @JoVictorNunes in https://github.com/bigbluebutton/bigbluebutton/pull/24213
• feat(plugin): added z-index to floating-window by @GuiLeme in https://github.com/bigbluebutton/bigbluebutton/pull/24258
• feat: added more fields to useMeeting hook and created a projection feature by @GuiLeme in https://github.com/bigbluebutton/bigbluebutton/pull/24351

test and CI

• chore: Added data-test to all extensible-area components by @GuiLeme in https://github.com/bigbluebutton/bigbluebutton/pull/24362
• test: [Snyk] Fix for 1 vulnerabilities by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24443
• test: update "give and remove whiteboard access" test by @pinhaum in https://github.com/bigbluebutton/bigbluebutton/pull/24441
• tests: Replace type with fill for text input unrelated to keystrokes by @antonbsa in https://github.com/bigbluebutton/bigbluebutton/pull/24454
• feat(publish-reports): add action to publish Playwright reports to GitHub Pages by @antonbsa in https://github.com/bigbluebutton/bigbluebutton/pull/24471
• fix(workflows): update repository references for Playwright reports by @antonbsa in https://github.com/bigbluebutton/bigbluebutton/pull/24516
• fix(workflows): Add artifact existence check for test reports in automated tests workflow by @antonbsa in https://github.com/bigbluebutton/bigbluebutton/pull/24520

chore

• chore: upgrade qs dependency from 6.14.0 to 6.14.1 by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24419
• chore(client): bump tldraw to 2.0.0-alpha.32 by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24463
• chore(client): upgrade webpack-dev-server to 5.2.3 by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24508
• chore(client): bump tldraw to 2.0.0-alpha.33 by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24517

locales

• Updates for project BigBlueButton v3.0 HTML5 client and language it_IT by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24409
• Updates for project BigBlueButton v3.0 HTML5 client and language zh_TW by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24414
• Updates for project BigBlueButton v3.0 HTML5 client and language ar by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24412
• Updates for project BigBlueButton v3.0 HTML5 client and language it_IT by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24411
• Updates for project BigBlueButton v3.0 HTML5 client and language tr by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24461
• Updates for project BigBlueButton v3.0 HTML5 client and language ja by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24434
• Updates for project BigBlueButton v3.0 HTML5 client and language et by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24496
• Updates for project BigBlueButton v3.0 HTML5 client and language zh_TW by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24522
• Updates for project BigBlueButton v3.0 HTML5 client and language it_IT by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24536

Core

• refactor: Simplify whiteboard access management with new multi-user flags by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24199
• refactor (gql-server): Refactor breakout room schema to simplify user linkage by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24228
• feat (gql-server): Add breakout room participant activity tracking by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24233
• refactor (gql-middleware): Reject new mutations once the rate limit is reached, instead of delaying them by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24373
• chore (gql-middleware): Introduce a config to dump queries to files (for debugging) by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24465
• Fix(graphql-server): Change type of some breakout name related fields to text by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24486
• fix(bbb-web): Ignore ErrorRedirectUrl on Checksum Validation Failure by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx will be made public not earlier than Feb 10, 2026
• feat(LAD/akka): Added new functions for the plugin to publish data to LAD by @GuiLeme in https://github.com/bigbluebutton/bigbluebutton/pull/23619
• feat: added fields IP, User-Agent, Referer and sessionToken to UserJoinedMeetingEvtMsg by @AtilaU19 in https://github.com/bigbluebutton/bigbluebutton/pull/24451
• Fix(akka, html5): Prevent upload error notifications when converting breakout rooms with no changes by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24466
• refactor (gql-middleware): Reduce cache key collision risk by switching to uint64 message keys by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24523
• fix(bbb-web): Fallback to Using Blank Files if Page Downscaling Fails by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/pull/24177

recording

• recording: Add archival of learning analytics dashboard by @TiagoJacobs in https://github.com/bigbluebutton/bigbluebutton/pull/24125
• feat(recording): Recording dynamic video by @kepstin in https://github.com/bigbluebutton/bigbluebutton/pull/24483
• fix(recording): Add check for notes_id undefined in events_worker.rb by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24532

packaging and configuration

• build(livekit): livekit-server@v1.9.9 (up from v1.9.7) by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24402
• build(bbb-webrtc-recorder): v0.14.0 by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24396
• build(livekit): livekit-server@v1.9.10 (up from v1.9.9) by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24429
• build: Bump Hasura from v2.48.1 to v2.48.9 by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24445
• build(livekit): livekit-server@v1.9.9 (downgraded from v1.9.10) by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24459
• build(livekit): remove logging.level: debug from after-install by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24464
• build(bbb-webrtc-sfu): v2.22.0 by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24470
• build(bbb-webhooks): v3.6.0 by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24511
• build: bump bbb-playback to 5.4.4 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24518
• build: Bump bbb-presentation-video to 5.1.0-beta.2 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24528
• fix: Build replaces part of variable names with client version by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24529

various dependency bumps

• chore(bbb-graphql-client-test): move react-scripts to devDependencies by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24502
• build(deps): bump the npm_and_yarn group across 5 directories with 4 updates by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24514
• build(deps): bump the npm_and_yarn group across 4 directories with 1 update by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24527
• [Snyk] Security upgrade lodash from 4.17.21 to 4.17.23 by @jfederico in https://github.com/bigbluebutton/bigbluebutton/pull/24524
• build(deps): bump ch.qos.logback:logback-core from 1.5.13 to 1.5.25 in /bbb-recording-imex in the maven group across 1 directory by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24531

documentation

• chore(docs): npm audit on docs + testing by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24493
• docs: Added new features to what is new by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24537
• Update install.md - How to reset user password in Greenlight v3 through cli by @sripathroy in https://github.com/bigbluebutton/bigbluebutton/pull/23852
• docs: Explain deleteRecordings API behaviour and implications by @ghazitriki in https://github.com/bigbluebutton/bigbluebutton/pull/23041

Full Changelog: https://github.com/bigbluebutton/bigbluebutton/compare/v3.0.19...v3.0.20

Release name

Passing -v jammy-300 to https://github.com/bigbluebutton/bbb-install/blob/v3.0.x-release/bbb-install.sh will always install the latest released BigBlueButton 3.0 version.

If for some reason you would like to install this specific release, pass -v jammy-300-3.0.20.

We still recommend using -v jammy-300 as this repository is continually updated with each BigBlueButton 3.0 release.

Client build: 1622