BigBlueButton Files

This iteration of BigBlueButton 3.0 contains multiple client and core improvements, most notably in breakout rooms. Several direct security fixes are included. We encourage administrators to update!

Note: insertDocumentBlockedHosts and insertDocumentSupportedProtocols bbb-web properties were renamed, check below for more info.

Below is a list of the pull requests in this iteration, grouped by component.

Link to installation command / instructions/ schedule / planned features : https://docs.bigbluebutton.org/3.0/new-features

Big THANK YOU to all community members who helped for this release - both through sending pull requests and through reporting bugs or requesting enhancements! :confetti_ball:

HTML5 client

fixes

• Fix(html5): The video preview and audio modals open even with the lock settings settings enabled by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24628
• fix: trim spaces of external video url by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24662
• Update external video label to remove unsupported platform by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24687
• fix: WhiteBoard Ctrl+D work only once by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24688
• fix: userdata-bbb_override_default_locale is ineffective in guest lobby by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24685
• Breakouts: ensure moderator only functionality is not shown by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24698
• feat: Make webcamBackgroundURL available in breakouts by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24695
• Fix(html5): Space bar key problem on WB by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24651
• style: Improve visual hierarchy and UX of guest lobby screen by @tylercopeland @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24650
• Fix(html5): Recalculate time sync when a new minimal rtt is available by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24717
• fix: talking indicator behind webcam area - custom and smart layouts by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24645
• fix(html5): session details closing when user talks by @tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/24636
• fix(whiteboard): scope slide zoom state to presentation id by @ramonlsouza @germanocaumo in https://github.com/bigbluebutton/bigbluebutton/pull/24732
• refactor(client): Reword You have been banned message by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24731
• chore: temporarily disable breakout audio transfer UI when using LiveKit by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24739

test and CI

• test: add test cases for external video by @pinhaum in https://github.com/bigbluebutton/bigbluebutton/pull/24458
• fix (ci): attempt to fix: Error: Input required and not supplied: token for Cleanup Playwright reports workflow by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24697
• ci: avoid running GH workflows after PR is merged when it's not necessary at this point by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24700

locales

• [3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24658 https://github.com/bigbluebutton/bigbluebutton/pull/24667 https://github.com/bigbluebutton/bigbluebutton/pull/24733
• Updates for project BigBlueButton v3.0 HTML5 client and language eu by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24654

Core

• fix (akka-apps): Prevent race condition when a user joins a breakout room by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24660
• fix (gql-server): Not re-assigning users to their last breakout room by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24683
• fix (akka-apps): not storing user activity for breakout rooms (only main meeting) by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/24686
• refactor(core): Breakouts moderator vs viewer by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24704
• refactor: drop logging of password/authToken by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24718
• fix(bbb-web): Make ApiController Helper Methods Private by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/commit/190e22f8cc8c5f42f9f72055525441bd1e67cb46 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026
• fix(core): enforce maxCustom poll settings on akka by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/commit/73fbddc13b736264c01893c8c21fe24daadd8abc contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026
• fix: Additional checks in polls by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/24723
• fix(akka-apps): Use Bind Parameters in SQL Query by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/commit/3365e340e0c102de0f8ea007c05053b562b6fa2b contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026
• fix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will be made public not earlier than March 24, 2026
• fix(core): enforce chat min-max character settings on akka by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/commit/19bb12f453f6fef5df7fc2455697329ac1578374 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026

recording

• chore(recording): Bump bbbevents to 2.0.3 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24646
• fix(recording): Detect system sender correctly in breakouts recording by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24641
• Recording: avoid short cuts in audio processing by @kepstin in https://github.com/bigbluebutton/bigbluebutton/pull/24669

packaging and configuration

• build: require running redis for bbb-export-annotations.service by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24652
• build: livekit-server@v1.9.11 (up from v1.9.9), livekit-client@v2.13.2 (up from v2.3.1), + by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/24629
• build: Update .gitlab-ci.yml with Go 1.26.0 and NodeJS 22.22.0 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24716
• Add firewalld support to apply-lib.sh by @ghazitriki in https://github.com/bigbluebutton/bigbluebutton/commit/0a34e0c61ba334e7e7bcb5d11efdb4079a50069a
• fix(conf): Avoid bbb-conf noise on empty bigbluebutton.properties by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24740
• feat(conf): Warn about retired bbb-web properties by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24748

chore

• build(deps): bump the npm_and_yarn group across 5 directories with 3 updates by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24663
• build(deps): bump the npm_and_yarn group across 7 directories with 3 updates by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24692
• build(deps): bump the npm_and_yarn group across 2 directories with 3 updates by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24706
• build(deps): bump the npm_and_yarn group across 1 directory with 1 update by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24709
• build(deps): bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24715
• build(deps): bump the npm_and_yarn group across 3 directories with 1 update by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/24752

Full Changelog: https://github.com/bigbluebutton/bigbluebutton/compare/v3.0.22...v3.0.23

Release name

Passing -v jammy-300 to https://github.com/bigbluebutton/bbb-install/blob/v3.0.x-release/bbb-install.sh will always install the latest released BigBlueButton 3.0 version.

If for some reason you would like to install this specific release, pass -v jammy-300-3.0.23.

We still recommend using -v jammy-300 as this repository is continually updated with each BigBlueButton 3.0 release.

Client build: 1665