Loomio Files

This release fixes a sign-in bug that caused valid codes to fail when the email address was entered with different capitalization. Sign-in codes now work regardless of email address capitalization.

• Fix: Email sign-in codes could be rejected when the address used different capitalization. Codes now accept matching email addresses regardless of capitalization
• New: Retrieve User API groups, webhooks, and thread items in bounded pages with limit, offset, and the full matching count in meta.total

Email sign-in codes

Entering an email address with different capitalization from the stored address could cause a valid sign-in code to be rejected or trigger another CAPTCHA check. Email matching is now case insensitive in both code verification and the check that decides whether another CAPTCHA is needed.

A code must still belong to the matching account and be unused, unexpired, and within its failed-attempt limit. A code belonging to another account cannot sign you in or bypass the CAPTCHA check. Existing restrictions on inactive accounts and sites that require single sign-on continue to apply.

User API pagination and compatibility

The User API previously returned all matching groups, webhooks, or thread items in a single response. These endpoints now return 50 primary records by default, accept limit and offset, and cap each page at 500 primary records:

• GET /api/b2/groups
• GET /api/b2/chatbots?group_id=…
• GET /api/b2/threads/:id/items

Existing integrations must fetch subsequent pages to retrieve complete collections larger than the page size. meta.total reports the full matching count. Group and webhook pages use ascending ID order; thread item pages use ascending sequence order with ID as the tiebreaker. Related records included in responses do not count toward the primary-record limit.

Access continues to follow the API-key user's permissions. Group discovery lists current memberships, webhook management requires group-administrator permission, and thread items require access to the thread. Pagination does not grant additional access.

The complete thread Markdown endpoint still returns the entire visible document in one response. Search remains limited to 20 results, and participation reports remain unpaginated. See the User API documentation for endpoint-specific behavior.

Performance

Pagination limits the primary records loaded and serialized for each affected request, reducing per-request payloads and application memory for large collections. Retrieving every record now requires multiple requests, each of which still counts the full matching collection. Total work grows with collection size and page count; large offsets can increase database work, and included related records can increase response size beyond the primary-record limit. Production query costs, latency, and memory were not benchmarked.

Upgrade

This release adds no database migrations or environment-variable changes. Upgrading from 3.11.0 requires no additional operator steps beyond the normal upgrade process; integrations using the affected API collections need the pagination changes described above.

Follow Upgrading Loomio, including the relevant version-specific steps when upgrading from an older release.

See the full changelog.