Loomio Files

Loomio 3.11.0 focuses on editing reliability and consistent access as group membership changes. It adds more flexible subgroup joining settings and reduces unnecessary database work. Self-hosted installations need a background count repair after upgrading.

• New: Configure subgroup visibility and joining separately, including joining without approval for parent group members
• Fix: Switching editor modes could lose formatting and Markdown edits. Conversion now preserves supported content and your latest edits
• Fix: Leaving a group could leave private polls and live updates accessible. Access now follows your current membership and is restored when you rejoin
• Fix: Polls could disappear from Need your vote when someone else voted. The filter now checks whether you have voted
• Fix: Deleting or deactivating an account could remove submitted votes from open polls. Those votes and their reasons now remain and continue to count
• Fix: Deeply nested replies could show the wrong parent. They now show the actual parent, with a warning if it has been deleted
• Fix: Changing a reaction created repeated notifications. Changes within two minutes now update the existing notification
• Fix: Concurrent changes could leave counts incorrect or publish replies before their parent counts were updated. Counts now update in the same transaction as their records
• Fix: Expired passkey sessions, incomplete poll dates, and failed form loads could interrupt editing. These cases now prompt sign-in, preserve the deadline, or show an error page

Subgroup visibility and joining

Subgroup administrators can now choose Visible to parent group and let parent group members Join without approval. Parent members can find and join these subgroups, leave, and rejoin while they remain eligible. People outside the parent group need an invitation. Joining grants ordinary membership; it does not grant administrator rights. Parent members' ability to read subgroup threads without joining remains a separate setting.

Open and Closed subgroups can also allow immediate joining. Because those subgroups are publicly visible, anyone can join when that option is selected. Secret subgroups remain invitation only. Guests invited to a parent group's threads do not inherit access to subgroups visible only to parent members.

Existing Closed subgroups hidden under a private parent now display Visible to parent group, preserving their existing access. They remain hidden from outsiders if the parent becomes public. Making a parent private also restricts its public subgroups and their threads, while preserving Secret subgroups. A Secret parent supports only Visible to parent group and Secret subgroups; Open and Closed subgroups require a public parent.

See Subgroups and Group privacy.

Poll access and pending votes

After leaving a group or being removed by an administrator, people could still see private polls in their dashboard and receive private group live updates. Retained voter records could also allow voting if a closed poll was reopened. These paths now check current access: inaccessible private polls, including subgroup polls, disappear from the dashboard and voting list, and connected browsers stop receiving private group live updates. Public polls remain readable, but leaving removes voting rights.

Rejoining could leave the browser showing outdated poll access. It now restores topic access and existing votes in active polls without requiring a page refresh. Direct poll authors and current topic guests retain the access appropriate to their invitations; group poll authorship alone does not bypass membership restrictions.

The Need your vote filter previously excluded polls when anyone had voted, even if you had not. Anonymous polls could remain listed after you submitted a ballot. The filter now checks your own pending vote or anonymous ballot-submission status. A poll stays listed when someone else votes and leaves the list when you vote. Closed polls, expired polls, and polls outside your current voting access are excluded.

See Member management.

Votes after account deletion or deactivation

Deleting or deactivating an account previously revoked its submitted votes in open polls, changing the results even though the person had already voted. Submitted votes and reasons now remain part of the poll and continue to count. They retain their rankings, weights, revision history, and quorum contribution. Poll settings continue to control result visibility. Deleting an account removes its name and personal information from contributions.

Account deletion or deactivation removes group access and pending invitations and prevents further voting. Leaving a group or being removed by a coordinator continues to remove votes from open polls. Previously revoked votes remain revoked. Anonymous ballots retain their existing storage and behavior.

Rich text and Markdown

Switching to Markdown could flatten tables, remove task checkboxes, and turn ordinary styled text into a broken mention. Switching back to rich text could restore a cached collaborative draft and discard edits made in Markdown. Conversion now preserves basic tables, checked and nested tasks, images, links, inline and fenced code, mention handles, and your latest edits. Styled text retains its words, and videos, audio, and embedded content become links.

The Markdown source editor and preview remain available. Markdown cannot retain text colors, highlights, underlining, alignment, full table layout, or task due dates and reminders. Returning to rich text creates new task identities with the preserved text and checked state.

Thread Markdown exports also include the original thread URL in their front matter. See Formatting.

Notifications, replies, and interface fixes

Each change to a reaction previously created another notification. Changing a reaction within two minutes of first reacting now updates the existing notification with the latest emoji. Read notifications stay read, different people's reactions stay separate, and changes after two minutes create a new notification.

Replies at the nesting limit could show an ancestor instead of the comment being answered. They now show the actual parent. Replying to deleted content also lacked a warning; reply authors now see one if their parent item has been deleted.

Other fixes address these cases:

• Saved discussion and poll edit notes were missing from timelines. Timelines now display them.
• Guests notified about a poll edit could lack access to its thread. They now receive the corresponding topic access.
• Notifications could include discarded content. Accessible notifications now exclude it.
• Managing passkeys after a session expired could fail without a way to continue. The interface now prompts sign-in and reloads credentials afterward.
• Clearing or partially entering a poll deadline could cause an invalid-date error. The existing deadline now remains until a valid replacement is entered.
• Discussion form-loading failures could leave the form unusable. They now open the error page or prompt signed-out visitors to sign in.
• Viewing a poll could leave permission-check state that crashed the tag field. The tag field now works after viewing a poll.
• A failed attachment request could stop the group files panel from loading. The panel now skips failed requests.
• Opening user or poll URLs could return a 404 titled Not found. They now return the application page with the correct metadata, and user-page titles also update during navigation.

Counts, concurrency, and performance

Count updates could run after the underlying records committed, leaving totals incorrect during concurrent changes and publishing replies before their parent counts were current. Counts now commit with the records they describe. Poll and timeline writes lock the topic before dependent records, refresh reads after waiting, and recheck affected permissions. Replies have their parent counts updated before live publication.

Group imports could retain counts for records absent from the archive. They now rebuild retained counts from the records actually imported. Old group archives remain importable.

Membership edits and repeated topic reads previously recounted unrelated totals. Local regression measurements on the count changes reduced a membership title edit from five count queries to zero and a repeated topic read from two count queries to zero. Poll and notification responses also repeated avatar, membership, and access lookups; they now batch voter-avatar loading and reuse cached membership checks, access checks, and creation items. Pending-vote filtering previously loaded all decided poll IDs into application memory; it now uses viewer-specific database subqueries. Request latency and production memory were not benchmarked.

Busy threads can make simultaneous writers wait on the same topic. Organization recounts and membership restoration still scale with affected members, polls, and records. Historical repair scans the relevant tables in bounded batches; total repair time depends on database size. Markdown conversion runs in the browser, with processing and temporary memory growing with document size; table padding and deeply nested content can increase the cost further.

Upgrade and compatibility

This release adds three database migrations. Two remove orphaned stance records, clear missing actor references, and enforce existing-user participant references. Stored historical poll results are not recounted by this cleanup. The third removes eight unused count columns while preserving retained count values. Counter removal is irreversible; rolling back to older application code requires restoring a compatible backup.

Follow Upgrading Loomio for the normal migration and restart process. Stop application and worker processes before migrating, and restart all of them with the new code and queue configuration before repairing counts. The migration does not rebuild historical counts. After deployment, enqueue their repair:

:::sh
docker compose exec app rake loomio:repair_record_counts

The bundled queue configuration runs record_count_repair in a separate worker process with one thread. Custom queue configurations must serve this queue separately from ordinary jobs. The repair preserves content and timestamps, updates only incorrect counts, and can run while Loomio is in use. Its defaults are 100 owners per transaction, a 0.1-second pause between batches, and a one-second timeout per query. Busy or timed-out records are deferred; check worker logs and rerun affected tables from the beginning if the job reports deferred records. The count repair guide documents audits, tuning, progress, and retries. Production migration and repair durations have not been measured.

API clients and operators should account for these changes:

• Group group_privacy can now be parent_members. Immediate joining uses the existing membership_granted_upon: request value; no subgroup schema migration is needed.
• Group responses remove closed_polls_count, delegates_count, discussion_templates_count, and org_discussions_count. subgroups_count remains available and is calculated from current records.
• Topic responses replace anonymous_polls_count with the boolean has_anonymous_polls and remove members_count and closed_polls_count. Anonymous reading-history masking includes closed and discarded anonymous polls.
• Personal poll responses add voter_has_access; shared realtime poll payloads omit this viewer-specific field. Electorate inclusion alone does not establish permission to vote.
• Malformed client versions could cause a server error at the boot version endpoint. They now return HTTP 400.
• The Sentry SDK could forward warning, error, and fatal logs without an explicit opt-in. Log forwarding now requires SENTRY_ENABLE_LOGS to be present; ordinary error reporting remains configured independently. Default performance sampling is reduced from 10% to 5%, configurable through SENTRY_SAMPLE_RATE.

See the full changelog.