chatwoot

v4.16.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 8d Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

actioncable chat-widget conversation customer-support web design

+12 more

docker heroku intercom javascript livechat opensource rails ruby sass vuejs whatsapp zendesk

ReleasePort's take

Moderate signal

editorial:auto 8d

ChatWoot v4.16.0 adds Uzbek language support and migrates video call integration to Cloudflare RealtimeKit, while enhancing security across multiple system components.

Why it matters: Security improvements (severity 70) affect widget identity verification, agent tokens, dashboard apps, inbox limits, IMAP, and dependencies; consider reviewing related configurations before upgrade.

Summary

AI summary

Conversation assignment policies can now exclude stale conversations from automatic assignment.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Improves security and reliability across widget identity verification, agent bot access tokens, dashboard apps, inbox limits, IMAP, and dependencies. Improves security and reliability across widget identity verification, agent bot access tokens, dashboard apps, inbox limits, IMAP, and dependencies. Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Low	Adds Uzbek language support. Adds Uzbek language support. Source: llm_adapter@2026-07-18 Confidence: high	—
Refactor	Medium	Migrates video call integration from Dyte to Cloudflare RealtimeKit. Migrates video call integration from Dyte to Cloudflare RealtimeKit. Source: llm_adapter@2026-07-18 Confidence: high	—

Full changelog

ChangeLog

Help Center improvements including staged edits for published articles, admin search, article reordering, and popular content by locale
Captain assistant overview and drill-down analytics (Enterprise)
Conversation and message drilldowns for reports
Support WhatsApp Calls for non-embedded signup inboxes
Intercom import workflow for contacts and conversations
Assignment policies can now exclude stale conversations from automatic assignment
Security and reliability improvements across widget identity verification, agent bot access tokens, dashboard apps, inbox limits, IMAP, and dependencies
New Language: Uzbek
Numerous bug fixes and enhancements

Thanks to @abh and @gausi-sudo for the contributions.

Note: The video call integration has moved from Dyte to Cloudflare RealtimeKit. If you use this integration, delete the existing Dyte integration and configure it again with your Cloudflare Account ID, RealtimeKit App ID, and an API token with Realtime Admin permissions.

Breaking Changes

Dyte video call integration removed; migrate to Cloudflare RealtimeKit by deleting the Dyte config and reconfiguring with Cloudflare Account ID, App ID, and API token.

Security Fixes

Security and reliability improvements across widget identity verification, agent bot access tokens, dashboard apps, inbox limits, IMAP, and dependencies

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track chatwoot

Get notified when new releases ship.

About chatwoot

Open-source live-chat, email support, omni-channel desk. An alternative to Intercom, Zendesk, Salesforce Service Cloud etc.

All releases →