Loomio Files

• New: Apply tags to polls, outcomes, and comments, then find them by tag
• New: Create accounts and manage group memberships and roles through the Server API
• Fix: Weighted quorum and eligible vote share requirements counted people. They now count vote weights
• Fix: Ruby's regular expression compiler and Crass's CSS parser had security flaws. Ruby 4.0.9 and Crass 1.0.8 include the fixes
• Fix: Finished background jobs accumulated because no worker processed the cleanup queue. Workers now run the hourly cleanup

Tags on contributions

Use Apply tags in a poll, outcome, or comment's action menu. Authors can tag their own contributions, and thread coordinators can tag any contribution in an unlocked thread. Organization tag permissions still control who can create and manage tag names.

Select a tag in the thread sidebar to see matching contributions with their parent context. Group tag filters include threads with any matching contribution. Global search finds explicitly tagged contributions, with or without a search phrase.

Existing thread tags stay on the opening discussion or poll. Tags remain shared metadata when poll results are hidden. See Category tags for permissions and template defaults.

Server API provisioning

Use /api/b3 to create accounts, list groups and memberships, invite or synchronize members, remove memberships, and change administrator or delegate roles. These operations use B3_API_KEY alone, without a user key or bot account in each group. The server key grants instance-wide access.

Bulk updates add people by default; remove_absent replaces the group's membership list. Removing a member also revokes their subgroup membership, group thread access, and active poll participation. See the Server API guide for examples.

Weighted quorum and vote share requirements

Quorum and vote share requirements based on eligible voters previously counted people in weighted polls. They now use assigned vote weights, including the weights of people who have not voted. Requirements based on votes cast use submitted weighted totals.

Results label percentages as Eligible vote weight or Vote weight cast. These corrections apply to existing weighted polls, including closed results, so displayed quorum and vote share requirement results can change after upgrading. See Weighted voting.

Poll comments and closing

Members can read poll comments and reply to votes before voting in polls that hide results until voting. Polls that hide results until closing allow ordinary comments but keep vote choices and reasons hidden until closing.

Polls that hid results until closing could previously be reopened after revealing results. They now remain closed; coordinators can still extend the closing time while voting is open.

Security updates

Ruby's regular expression compiler had memory corruption bugs used for remote code execution on GitLab servers. The upgrade from Ruby 4.0.5 to 4.0.9 includes fixes related to CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. See the Ruby advisory.

Malformed CSS URLs could bypass sanitizers using Crass. Crass 1.0.8 corrects the parsing error. See the CSS sanitizer bypass advisory.

Upgrade and compatibility

Finished-job cleanup was queued hourly but never ran because workers did not serve solid_queue_recurring. The general worker pool now serves that queue. Restart workers to process the backlog and restore cleanup (one day's retention by default). Custom worker configurations must also include this queue. See #12991.

Three migrations preserve existing tags, build thread tag summaries, and update search indexes. Workers complete the queued search reindexing after deployment.

Source installations require Ruby 4.0.9 and Node.js 26. The Docker image includes these updates.

Follow the Upgrading Loomio guide. Integrations using tag searches should account for tags now matching individual contributions rather than every item in a tagged thread.

See the full changelog.