BigBlueButton Files

This iteration of BigBlueButton 3.0 contains a couple of security fixes, and some client and core improvements.

We recommend administrators to update at earliest opportunity

Below is a list of the pull requests in this iteration, grouped by component.

Link to installation command / instructions/ schedule / planned features : https://docs.bigbluebutton.org/3.0/new-features

Big THANK YOU to all community members who helped for this release - both through sending pull requests and through reporting bugs or requesting enhancements! :confetti_ball:

HTML5 client

fixes

• Fix(html5): presentation moving to old position when enable infinite WB by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24556
• Fix(html5): missing space in some locales on waiting room queue by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24562

test and CI

• feat(ci): Restore upload of merge HTML reporter to publish tests by @antonbsa in https://github.com/bigbluebutton/bigbluebutton/pull/24479
• fix(ci): refine conditions for publishing test results and handling blob reports by @antonbsa in https://github.com/bigbluebutton/bigbluebutton/pull/24557

locales

• Updates for project BigBlueButton v3.0 HTML5 client and language hu_HU by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24547
• Updates for project BigBlueButton v3.0 HTML5 client and language ar by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24543

Core

• fix(bbb-web): Prevent Checksum Bypass With PresentationUploadExternalUrl by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/commit/36fd1b407488a0c56ce620b91184d5a8aea68b3d contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff will be made public not earlier than Feb 10, 2026
• fix(bbb-web): Use Secure PRNG for ID and Token Generation by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/commit/6c9be3b5ece68b873c5481f7b7d0e4ac7ff504d7 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h will be made public not earlier than Feb 10, 2026
• fix (akka-apps): list of breakout rooms doesn't update when user is promoted/demoted by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24558
• ref(plugin): refactor the code of plugin logger to be more robust by @GuiLeme in https://github.com/bigbluebutton/bigbluebutton/pull/24185

packaging and configuration

• fix(bbb-conf): Use turnutils_stunclient instead of old stun 0.97 client by @michelleDeko in https://github.com/bigbluebutton/bigbluebutton/pull/24554
• build: Bump bbb-pads to 1.5.7 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24563
• build: Bump bbb-pads to 1.5.8 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24573

documentation

• docs: Add docs for meta_analytics-callback-url by @michelleDeko in https://github.com/bigbluebutton/bigbluebutton/pull/24549
• docs: set a random domain as example in Docs by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24561

Full Changelog: https://github.com/bigbluebutton/bigbluebutton/compare/v3.0.20...v3.0.21

Release name

Passing -v jammy-300 to https://github.com/bigbluebutton/bbb-install/blob/v3.0.x-release/bbb-install.sh will always install the latest released BigBlueButton 3.0 version.

If for some reason you would like to install this specific release, pass -v jammy-300-3.0.21.

We still recommend using -v jammy-300 as this repository is continually updated with each BigBlueButton 3.0 release.

Client build: 1627