BigBlueButton 4.0.1

BigBlueButton 4.0.1 adds rate limits on presentation uploads, a speechProcessing setting to keep live transcription on the speaker's device, an experimental Last-N audio mode for the LiveKit bridge, static bbb-* CSS classes for custom styles, a setting to turn off the chat announcement of a user's away status, an option to show the webcam pagination toggle to moderators only and support for a password-protected Redis in bbb-graphql-actions; the meeting-ended callback now carries recordingmarks and meetingID, and presenter changes are authorized against the user who sends the request. It upgrades the LiveKit stack (server 1.13.7, SIP 1.17.0, livekit-client 2.22.3), bbb-webrtc-recorder to v0.18.0, bbb-playback to v5.4.8 and bbb-web's embedded Tomcat to 11.0.27, cuts video grid re-renders, and removes bbb-web code and settings left over from Grails 2 (#26002). Fixes cover the camera preview label, presenter pinch zoom on touch devices, the pre-selected transcription language, chat links in video-format playback, breakoutRoomsPrivateChatEnabled=false not reaching the breakout rooms, a whiteboard crash with userdata-bbb_initial_selected_tool and bbb-conf --set-port-range leaving LiveKit unable to start, alongside a large round of new and repaired Playwright tests and a nightly test workflow. Below is a list of the pull requests in this iteration, grouped by component.

Upgrade notes:

• bbb-web no longer recognizes the accessControlAllowOrigin and serviceEnabled properties. Neither has had any effect since BigBlueButton 2.2: serviceEnabled=false never switched the API off, and cross-origin access to bbb-web is configured with the grails.cors.* options described in the cluster proxy guide. Remove them from /etc/bigbluebutton/bbb-web.properties if you set them; bbb-conf --check lists them. If you keep a customized copy of /usr/share/bbb-web/WEB-INF/classes/spring/resources.xml, remove its serviceEnabled property too, or bbb-web will not start. Details in [#26204].
• On BigBlueButton 4.0.0, bbb-conf --set-port-range wrote the LiveKit port range into /etc/bigbluebutton/livekit.yaml as quoted strings, which livekit-server refuses to load. The upgrade does not rewrite that file, so if you ran the command on 4.0.0, run it again after upgrading. Details in [#26289].

Link to installation command / instructions / schedule / planned features: https://docs.bigbluebutton.org/4.0/new-features

Big THANK YOU to all community members who helped for this release - both through sending pull requests and through reporting bugs or requesting enhancements! :confetti_ball:

HTML5 client

fixes

• fix: incorrect camera label in video preview by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/26030
• fix(client): Propagate the intended camera dock geometry instead of a zero one on phone landscape by @AtilaU19 in https://github.com/bigbluebutton/bigbluebutton/pull/25808
• fix(whiteboard): Fix presenter's two-finger pinch zoom on touch devices by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26085
• fix(audio-captions): pre-select the configured transcription language by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26118
• fix(client): round plugin and screenshare corners in the media area by @germanocaumo in https://github.com/bigbluebutton/bigbluebutton/pull/26159
• fix(livekit): accept constraint objects in camera profiles by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26169
• fix (html5): turn Share webcam into a Stop sharing webcam toggle, in profile-settings by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/26194
• fix(html5): keep rendererInterfaces a Map when neutering React DevTools hook by @jibon57 in https://github.com/bigbluebutton/bigbluebutton/pull/26165
• fix (html5): Keep the background list in place when selecting in the video preview (virtual-background modal) by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/26209
• fix (html5): chat - remember pinned message collapsed state by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/26212
• fix: userdata-bbb_initial_selected_tool with a shape id crashes the whiteboard by @ramonlsouza in https://github.com/bigbluebutton/bigbluebutton/pull/26250
• fix (html5): Hide camera settings when webcam sharing is locked in User Profile by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/26215

features and refactors

• feat(audio): stop persisting the audio filter choice across sessions and meetings by @guiiBecker in https://github.com/bigbluebutton/bigbluebutton/pull/25744
• refactor(modal): migrate the client modals to BBBModal from bbb-ui-components-react by @guiiBecker in https://github.com/bigbluebutton/bigbluebutton/pull/25829
• perf(html5): cut video grid re-renders and speed up LiveKit camera subscriptions by @Arthurk12 in https://github.com/bigbluebutton/bigbluebutton/pull/26096
• feat(webcams): allow limiting the pagination toggle to moderators by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26206
• feat(audio-captions): option to transcribe on the user's device only by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/26179
• feat(html5): add Last-N audio to LiveKit selective subscription by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26211
• feat(html5): add static bbb-* CSS classes to key components for theming by @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/pull/26193

test and CI

• test: stabilize recording screenshare transitions by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/26009
• test(recording): stop reading the player's progress bar too early by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26088
• test: rewrite the quarantined user tests against the 4.0 client by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/26091
• test: wait for the download control and check the join pop-up switch by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26103
• test: bound the stress tests and drop connections without sudo by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26105
• test: sort out the Firefox-only failures (fix what is test-side, skip with a reason what is not) by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26107
• test: add API, media, push-to-talk and client feature tests for behaviour that had no coverage by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26108
• test(playwright): make settings-gated and assertion-less tests verify behaviour by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26116
• test(playwright): un-quarantine tests that pass reliably on a default server by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26153
• fix: clean up the saved user-names file and small test-suite leftovers by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26152
• ci: one quarantine list, retried tests in the summary, sample discovery for the SDK job by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26161
• test: stop depending on external hosts for fixtures and external video by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26155
• test: cover settings guards, session details, reaction lifecycle, RTL, the echo test and camera caps by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26154
• test(playwright): make the setup join check validate the join by @germanocaumo in https://github.com/bigbluebutton/bigbluebutton/pull/26073
• test: add second-priority tests for client flows, media errors, breakouts, the dashboard and conversion errors by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26156
• test: Add shared notes access coverage by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/26016
• [4.0 port]ci: post the in-progress tests comment once per run by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26184
• test: add nightly tests for recorded media, playback content, pause/resume and breakout recording by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26157
• test: repair the remaining broken, racy and misleading tests by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26160
• test: wait for conditions instead of fixed delays and make test titles unique by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26158
• test: Automated Audio Streams Tests by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/pull/26006
• test: assert the server applied a clientSettingsOverride sent on create by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26177
• test(api): more ways a request can fail the checksum check by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26280
• test(api): probe the session and document helpers of ApiController by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26281
• test(breakout): run the breakout time-limit test nightly by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26287
• ci: add a nightly workflow for the tests the per-PR gate leaves out by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26190
• ci: raise the Run tests step timeout from 25 to 40 minutes by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26297
• ci: raise the legacy media tests step timeout from 25 to 40 minutes by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26307
• ci: let forks choose runners through repository variables by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26295
• ci: Test official plugins against BigBlueButton 4.0 in CI by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/25775

locales

• [4.0 locales] Updates for file bigbluebutton-html5/public/locales/en.json by @transifex-integration[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26067

Core

• fix(core): Authorize presenter changes by the request sender by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/25887
• [4.0] Add option to disable announcement of user away status in chat by @samuelwei in https://github.com/bigbluebutton/bigbluebutton/pull/26090
• feat(graphql-actions): support a password-protected Redis by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/26110
• fix(graphql-middleware): wait for Redis at startup, exit on lost subscription by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/26109
• refactor: read meeting-wide lock settings as data instead of reconnecting every viewer by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/26004
• refactor(akka-apps): stop sending userdata-bbb_parent_room_moderator to breakouts by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26087
• fix(bbb-web): check the unit before stopping bbb-web in deploy_to_usr_share.sh by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26071
• chore(bbb-web): remove the handler-less validatePad nginx location by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26120
• chore(bbb-web): remove the dead api/guestWait route by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26117
• chore(bbb-web): remove the dead PresentationController.delegate action by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26119
• chore(bbb-web): correct three stale comments in bigbluebutton.properties by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26122
• chore(bbb-web): remove the leftover feedback request validation by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26191
• chore(bbb-web): remove Grails 2 leftovers and inert settings (#26002, 1/3) by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26201
• fix(bbb-web): keep controller helpers out of the URL space, drop the dead 500 view, trust createNewFile() (#26002, 2/3) by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26202
• build(bbb-web): fix the Gradle 9 deprecation warnings (#26002, 3/3) by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26203
• [4.0]build(bbb-web): bump embedded Tomcat to 11.0.27 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26241
• [4.0] build(bbb-web): bump the Gradle wrapper to 9.8.1 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26259
• fix(core): Harden breakoutRoomsPrivateChatEnabled and disabledFeatures=privateChat by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26269
• fix(bbb-web): use the SecureRandom helper for every generated value by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26279
• fix(bbb-web): finish dropping SVG from the presentation type lists by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26278
• fix(core): Add two parameters to meetingEndedCallbackURL to show record-processing banner in GL- [#25929] by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26243
• fix(bbb-web): Improve Presentation Upload Limits by @paultrudel in https://github.com/bigbluebutton/bigbluebutton/pull/25786
• fix(bbb-web): Fix 400 bbb web unknown action 404 error handler by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26292
• fix(bbb-web): skip the presentation conversion when its meeting is already gone by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26291

bbb-export-annotations

• [4.0] fix(bbb-export-annotations): wrap exported text exactly as the client does by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26013

Learning dashboard

• refactor(learning-dashboard): Replace deprecated toGMTString() by @samuelwei in https://github.com/bigbluebutton/bigbluebutton/pull/26097
• fix(learning-dashboard): count a user online while any session is open by @germanocaumo in https://github.com/bigbluebutton/bigbluebutton/pull/26093

Recording

• fix(recording): Rap yaml loader followups 40 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26078
• fix(recording): read bigbluebutton.yml through read_props in every script by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/26112
• fix(recording): log to stdout when not running under the systemd journal by @imdt-claudiop in https://github.com/bigbluebutton/bigbluebutton/pull/26111
• chore(bbb-record): correct --republish help, drop the timer from --list by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26123
• fix(recording): keep chat links in video playback by @Tainan404 in https://github.com/bigbluebutton/bigbluebutton/pull/26064

Packaging and configuration

• build(bbb-webrtc-recorder): v0.15.0 by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26038
• build(bbb-webrtc-recorder): v0.16.0 by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26068
• build(bbb-webrtc-recorder): v0.17.0 by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26081
• build(bbb-webrtc-recorder): v0.18.0 by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26253
• build: upgrade LiveKit stack components (server 1.13.7, sip 1.17.0, livekit-client 2.22.3) by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/25912
• build(bbb-playback): Update to v5.4.8 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26069
• [Port to v4.0.x-develop] fix(build): version final-release debs above their release candidates [#26049] by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26066
• build: Update version numbers for Go 1.27.3, Gradle 9.8.1, and Node 24.22.1 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26145
• [4.0 follow up to]build: move the 0.81 and 0.9.0 presentation players to an optional package by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26185
• fix(livekit): logging.level and --set-port-range fixes for LiveKit by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26289

Documentation

• docs: redraw internal network connections diagram in Mermaid by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/25983
• docs(chore): Updates to docusaurus on BBB 4.0 (nodejs 24, docusaurus 3.10) by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26059
• docs: list the userdata-bbb_* join parameters on the API page by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26086
• docs(testing): update the manual release test plan for 4.0 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26102
• docs, bbb-conf: point API Mate links to bigbluebutton.github.io by @TiagoJacobs in https://github.com/bigbluebutton/bigbluebutton/pull/26162
• docs: clientSettingsOverrideJsonUrl is not gated by allowOverrideClie… by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26178
• docs: meetingExpireWhenLastUserLeftInMinutes=0 ends the meeting at once by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26246
• docs: drop freeswitch from the documented audioBridge values by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26239
• docs: bring the privacy page up to date for 4.0 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26070
• docs: adjustments to the LiveKit dial-in dialplan + bundled FreeSWITCH by @prlanzarin in https://github.com/bigbluebutton/bigbluebutton/pull/26265
• docs: bring the administration pages up to date for 4.0 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26074
• docs: Catch up on 4.0.0 to 4.0.1 docs by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26290
• docs: iteration doc sync for 4.0.1 (part 2) by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26311

Chore

• build(deps-dev): bump fast-uri from 3.1.2 to 3.1.8 in /bbb-graphql-client-test by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26063
• build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /bbb-learning-dashboard by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26061
• build(deps-dev): bump baseline-browser-mapping from 2.10.0 to 2.11.28 in /bbb-graphql-client-test by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26062
• build(deps): bump postcss-selector-parser, postcss-modules-local-by-default and postcss-modules-scope in /bigbluebutton-html5 by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26092
• build(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /bbb-export-annotations by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26124
• build(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /docs by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26125
• build(deps-dev): bump launch-editor from 2.14.1 to 2.14.2 in /bbb-graphql-client-test by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26140
• build(deps): bump follow-redirects from 1.16.0 to 1.16.1 by @germanocaumo in https://github.com/bigbluebutton/bigbluebutton/pull/26181
• build(deps): bump sanitize-html from 2.18.0 to 2.18.1 in /bigbluebutton-html5 by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26168
• build(deps): bump ip-address from 10.7.3 to 10.7.4 in /bbb-shared-notes-server by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26183
• chore(publiccode): set softwareVersion to 4.0.0 and releaseDate to 2026-10-14 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26147
• ci: let Dependabot propose base image updates by @tibroc in https://github.com/bigbluebutton/bigbluebutton/pull/26222
• chore: BigBlueButton 4.0.1 iteration by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26058
• build(deps): bump undici from 7.30.0 to 7.30.1 in /docs by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26294
• build(deps): bump qs from 6.16.0 to 6.16.2 in /docs by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26293
• chore(core): update dependencies by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26296
• build(deps): bump qs from 6.16.0 to 6.16.2 in /bigbluebutton-html5 by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26299
• build(deps): bump crass from 1.0.7 to 1.0.8 in /record-and-playback/core by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26298
• build(deps): bump body-parser from 1.20.8 to 1.20.9 in /docs by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26301
• build(deps): bump fast-uri from 3.1.8 to 3.1.9 in /docs by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26300
• build(deps): bump qs and express in /bbb-graphql-client-test by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26303
• build(deps-dev): bump postcss-selector-parser from 6.1.0 to 6.1.5 in /bbb-graphql-client-test by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26302
• build(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 in /bbb-graphql-client-test by @dependabot[bot] in https://github.com/bigbluebutton/bigbluebutton/pull/26304
• chore: BigBlueButton 4.0.1(part 2) by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/26309

Full Changelog: https://github.com/bigbluebutton/bigbluebutton/compare/v4.0.0...v4.0.1

Release name

Passing -v noble-400 to https://github.com/bigbluebutton/bbb-install/blob/v4.0.x-release/bbb-install.sh will always install the latest released BigBlueButton 4.0 version.

If for some reason you would like to install this specific release, pass -v noble-400-4.0.1.

We still recommend using -v noble-400 as this repository is continually updated with each BigBlueButton 4.0 release.