Loomio Files

This release helps group coordinators investigate invitation email problems and improves email processing, privacy, and API reliability. Self-hosted installations need database migrations and should review the upgrade notes before deploying.

• New: Group coordinators can view invitation delivery history, including resends, custom messages, and recorded delivery problems
• New: Instance administrators can review and clear email address blocks, with an optional Amazon SES suppression check
• New: Gravatar is now an explicit profile picture choice; new accounts use initials unless a picture is uploaded
• Fix: JSON requests to the User API could lose poll options and the group ID. Creating or editing a poll now preserves the supplied fields
• Fix: Queued group exports could run after the requester's access was revoked. JSON and CSV exports now recheck access when prepared
• Fix: Adapting a default poll template could leave the original visible. The adapted version now replaces it in the group's template list
• Fix: Explicit self-mentions could be omitted or treated as replies. They now produce mention notifications in Markdown and rich text
• Fix: Visiting a discussion or poll could leave an invitation marked as pending. These visits now record acceptance
• Fix: Link previews could start unbounded downloads and concurrent requests. Preview fetching now has limits on batch size, response size, duration, and shared request volume
• Fix: The application page could lose its cache prevention directive. It now consistently sends Cache-Control: no-store

Invitation delivery history

Group coordinators can open Invitation delivery history from a person's menu on the Members page. It shows recorded invitations and resends, their custom messages, and email status. Expand an invitation to see the delivery details. The history remains available after the person joins.

Completed sends and linked bounce or complaint reports are recorded separately. A successful send does not confirm that the message reached the recipient's inbox. Older invitations without a recorded email delivery are not described as sent.

Only coordinators of the relevant group can view this history. Each person's history includes their own delivery details without exposing other recipients of a batch invitation. See Inviting people.

Email address blocks and delivery feedback

Permanent bounces and spam complaints now create individual address blocks instead of incrementing account-wide failure counters. Temporary failures do not permanently block an address. The invitation history shows whether the person's current address is blocked separately from the outcomes of earlier invitations.

Signing in with a password, email code, or email link clears Loomio's blocks for the person's current address. Instance administrators can also review and clear these blocks from the user's admin page. Clearing a Loomio block does not clear a separate block enforced by the mail provider.

Delivery feedback requires the mail provider to forward bounce and complaint reports to Loomio and a trusted inbound relay to supply passing DKIM results. The bundled Haraka relay supplies these authentication results. Operators can override the report sender addresses with BOUNCE_ADDRESS and COMPLAINTS_ADDRESS.

For installations using Amazon SES, the admin interface can optionally check the provider's suppression status. Set SES_SUPPRESSION_REGION to the sending region and give the web process ses:GetSuppressedDestination through the AWS SDK credential chain. SMTP credentials are not used for this check. The check is read only and is not required for sending email or processing delivery feedback.

Incoming email and sender approvals

Incoming message content and attachments now use Action Mailbox storage. Pending sender approvals retain their IDs and keep the original message available until the approval is resolved. Processing retries use the stored message identity to avoid creating duplicate threads, and a held message keeps its original destination if a group's email handle changes.

Processed incoming email sources have a 60-day retention period. Messages awaiting sender approval or held by a sender block remain available while held; resolving a hold does not restart the retention period. If an emailed comment is rejected because it is invalid, the rejection email now includes its validation errors.

Custom approval clients must change /api/v1/received_emails to /api/v1/pending_emails and the response root from received_emails to pending_emails.

Poll creation through the User API

JSON requests could lose virtual fields such as poll options and the group ID, creating a direct poll instead of a poll in the intended group. Flat and explicitly nested JSON requests now preserve these fields when creating or editing polls, with the same access checks as before.

The User API documentation includes examples using simple option names or detailed options with meanings and reason prompts. Omitting a closing date disables voting; it does not hide the poll from people who can read its thread.

Group export access

An export could remain queued after its requester lost administrator access and still be generated. JSON and CSV group exports now check access again when the job runs. JSON exports also determine the included subgroups using current access. Sending an export to a chosen email address requires instance administrator rights when the job runs.

Previously queued JSON GroupExportWorker jobs use the old argument format. Let these finish before upgrading, or request the exports again after deployment.

Profile pictures, templates, and notifications

New accounts previously checked Gravatar automatically using the email address. They now use initials unless an uploaded picture is available. People can select Use Gravatar in their profile picture settings. Existing Gravatar selections and uploaded pictures are preserved.

Adapting a default poll template could leave both the adapted version and the original in the group's template list because hiding the original was not saved. Saving an adaptation now also hides the original. Group administrators can restore it through Show hidden templates.

Explicit self-mentions could be excluded from Markdown mentions or treated as replies when replying to your own content. They now create ordinary mention notifications in both Markdown and rich text.

Opening a discussion or poll could fail to mark a pending group invitation as accepted. These visits now record acceptance, as visiting the group page already did.

Resource limits and caching

Link previews previously started a separate thread for every supplied URL and could download oversized responses. Each batch now fetches at most five distinct URLs, limits each response to 1 MiB, and has a ten-second deadline. Previews completed before the deadline can still be returned.

The existing limit of 20 preview requests per user per hour is joined by a shared limit of 100 requests per hour. Operators can change the shared limit with THROTTLE_MAX_LINK_PREVIEWS_GLOBAL. Requests over either limit return HTTP 429. These limits reduce the work allowed for one request; production latency and memory use have not been benchmarked.

The application's HTML boot page could lose its no-store directive when Rails rebuilt the cache headers. It now consistently sends Cache-Control: no-store to prevent browsers and shared caches from storing it.

Upgrade and compatibility

This release adds three database migrations for email delivery history, address blocks, and incoming message storage. Existing bounce and complaint counters become blocks for the account's current email address. Pending sender approvals retain their IDs, and missing original sources are reconstructed from stored email content and attachments where needed.

Back up the database and Active Storage before migrating. Migrations 20261021000002 and 20261021000003 are irreversible, and reconstructing incoming sources can upload data to storage. Rolling back requires restoring a compatible backup. Upgrade web and worker processes together. Follow Upgrading Loomio for the deployment procedure.

This release also removes unused internal EventBus broadcasts for content, membership, group, and user changes. Custom extensions subscribing to those internal events should review their integrations before upgrading. Subscription engine hooks remain in place.

See the full changelog.