2026-05-11 (Loomio 3.0.24)

• Fixed: Prevent comment authors from editing or restoring comments that an admin has discarded.
• Fixed: Preserve group ownership when creating discussions from templates in grouped contexts.
• Improved: Hardened deployment/runtime behavior with trusted ingress IP allowlisting and exec-based Docker startup processes.
• Improved: Removed obsolete hocuspocus SQLite persistence and legacy document-list template calls.
• Improved: Background jobs now avoid retrying forever for records that have already been deleted.
• Maintenance: Updated dependencies including Devise, Vite, Bootsnap, Rollup, Sentry, Nokogiri, Puma, and tzinfo-data.

2026-05-06 (Loomio 3.0.23)

• Fixed: Do not notify the actor when they @mention their own group.
• Fixed: Improved German discussion context-menu translations and documented known translation traps.
• Fixed: Make received-email allow/block actions idempotent.
• Fixed: Retry mark-as-seen when concurrent requests hit a unique-constraint race.
• Fixed: Guard transcription analysis against detached blobs and non-rich-text records.
• Improved: Migrated legacy Document records to ActiveStorage attachments and removed the legacy Document model/workers.
• Improved: Removed Rails Pulse and related schema/dependency leftovers.
• Improved: Removed legacy loomio_channel_server setup.
• Improved: Raised the global request-per-IP throttle from 300 to 900 per 5 minutes.
• Improved: Made demo cloning more reliable by skipping Rails Pulse and bulk-writing translations.
• Maintenance: Updated dependencies including Nokogiri and Puma.

This release is mostly a security hardening pass across the whole app — auth flows, uploads, rate limiting, link previews, SSO, SQL input handling, and dependencies.

There's a new Single Transferable Vote (STV) poll type (beta — feedback welcome on GitHub)

We also added support for Cloudflare Turnstile challenge on sign-in, sign-up, and trial creation.

New

• STV (Single Transferable Vote) poll type — beta. Anonymous by default, results hidden until the poll closes. The form shows a warning asking users to report bugs and feedback on
  GitHub.
• Cloudflare Turnstile challenge on password sign-in, login-token requests, signup, and trial creation. Admin login-link sign-in bypasses the challenge; sign-in with a login code also
  bypasses it.
• Profile pictures via OAuth (OIDC defaults) on the OAuth client.
• Track email bounces separately from complaints.
• API v2b: new list endpoints for discussions and polls; limit/offset as the primary pagination params (per/from kept as aliases).
• Rails Pulse added for request monitoring (Blazer removed).

Security

• Hardened OAuth/SAML authentication flows; added Google and Nextcloud OAuth controller tests; trust SSO providers fully on auto-link.
• Fixed SQL injection in HasTimeframe via timeframe_for.
• Blocked SSRF in the link preview service; link previews now require auth and are throttled to 20/hour per user.
• Fixed operator precedence in the Group create ability.
• Restricted sensitive fields in serializers.
• Fixed trial email enumeration.
• Direct upload size limit (25 MB trial, 1 GB paid); blocked dangerous uploads.
• Stopped leaking errors in API responses; removed debug logging of secret tokens and emails from the hocuspocus controller.
• X-Robots-Tag: noindex header for non-public instances.
• Bumped vue-i18n to 9.14.5 (XSS + prototype pollution).
• Added Brakeman + bundler-audit to CI.
• Sent rate-limit events to Sentry (grouped by rule+IP to cut noise).
• Safelisted private-network IPs in rack_attack.
• Split the profile GET throttle (tight on email_status, looser elsewhere).
• Gave /bug_tunnel its own throttle and skipped Sentry alerts for it.

Fixes

• Refresh a user's groups after joining or being added to a group.
• Fix translator-mangled i18n interpolation vars + a CI check to catch regressions.
• Handle legacy ImageMagick-style variation keys and Vips::Error in the ActiveStorage variation translator.
• Return a token error on session failure when a login token is pending; translate sessions errors server-side; surface server errors on login code entry.
• Guard Events::PollExpired and real_participant fallback against nil / non-participant eventables.
• Fix demo poll cloning (missing opening_at/opened_at).
• Translation fixes: needs_a_rethink_meaning, "vote in" → "vote on", German typo in discard.

Internal

• Ruby 4.0.2; Puma 8; Vite 8; Vue Router 5; many dep bumps.
• Switched to Minitest/fixtures for group export and OAuth controller tests.

Changes to the Discussion and Poll templates UI. I've had people tell me they couldn't find how to create a template. Now there is a New template button, which opens the example templates page, you can use an example as the starting point for a new template.

Fewer discussion templates in a group by default. Updates to the Sense Check poll options, so they're more helpful.

• Materialize default discussion templates as DB records by @robguthrie in https://github.com/loomio/loomio/pull/12182
• Discussion template UI improvements by @robguthrie in https://github.com/loomio/loomio/pull/12181
• Add opening_at to polls for scheduled voting by @robguthrie in https://github.com/loomio/loomio/pull/12174
• Poll template updates by @robguthrie in https://github.com/loomio/loomio/pull/12184

This release also addresses a minor security issue, where a member of a group could see the names of secret subgroups they did not belong to, if they inspected the server responses of the reports controller.

Some fairly substantial changes here, with lots more work in the pipeline too, hold on to your hats!

Convert HAML view templates to Phlex

Using Phlex makes life easier. View code is just ruby. This makes maintaining all our server generated views so much easier.

Replace SocketIO with ActionCable (remove loomio_channel_server)

I'm on a mission to reduce the complexity of Loomio's architecture.

loomio_channel_server ran a SocketIO server to send realtime updates to connected clients. Now the rails app handles websocket connections directly.

Move hocuspocus server into the main Loomio repository

Another repository removed. We now include the hocuspocus collaboration server within the main Loomio repository.

Handle Matrix bot notfications from Rails app

We no longer use loomio_channel_server to host a matrix_bot_sdk. We do that work from the Rails app now.

Please see this loomio-deploy PR to read how to upgrade your server:
https://github.com/loomio/loomio-deploy/pull/130

The convenient thing about these changes is, even if you don't update your server setup, it will work correctly, you'll just have unused services.

As a result of this, there are two fewer repositories, and one fewer containers.

The intention is to eventually remove Redis from the system by switching to SolidCache and SolidQueue. Then we'll just have App, Worker, DB, Hocuspocus and Haraka services.

Bugfixes and improvements

• Fix OAuth login finding orphan identities instead of linked ones.
• Change user avatar email/print partial to say user name rather than initials - So you can give the print view of a thread to an AI chatbot and it can understand who is talking
• Add LOOMIO_VERIFY_PARTICIPANTS_ADMIN_ONLY to restrict verify participants to admins only - Recently we introduced the "Verify participants" feature on polls. This means you can audit who was invited to an anonyous poll (to ensure that the admin did not invite, eg fake accounts), without revealing how voters voted. This flag makes this feature only available to admins, for member privacy.
• Show specific errors in flash messages - Now when there is an error submitting a form, it will say what the problem is, rather than a generic "Please check the form".
• Add remove logo and cover photo to group settings - You can now remove your group logo if you want to.

• Removed the ability to set your profile picture from SSO provider list on change_picture_form.
• Massive rewrite of the rspec test suite to minitest. This drops the runtime from 14 to 3 minutes on Github Actions. Makes a huge difference in local development productivity.

Note.. in app version still says 3.0.18. I forgot to bump the version in the code before making this release.

We've rewritten how sign in and sign up work with SSO. Previously if you signed in via SSO and were already signed into Loomio it would link your accounts together. Now Loomio will not automatically link accounts, it will always ask you to confirm.
Also when you sign in for the first time, via SSO, we don't ask if you want to create account or link account, we just create a new account for you.

• Add LOOMIO_RESTRICT_EXPLORE_TO_SIGNED_IN_USERS by @robguthrie in https://github.com/loomio/loomio/pull/12143
• Add polls to vote on page by @robguthrie in https://github.com/loomio/loomio/pull/12142
• Replace invite-only terminology with direct discussions by @robguthrie in https://github.com/loomio/loomio/pull/12144
• fix for missing translation on invite only discussions page

• Fix duplicate email crashes in OAuth and SAML SSO authentication
• remove unused canViewPublicGroups code
• Prevent non-members from seeing tags on closed groups
• remove hiredis gem

The last release was broken. Apologies. This addresses those problems.

• The app would not boot due to redis and sidekiq connection_pool incompatibilities
• Google SSO was broken.

If you tried 3.0.15, sorry for wasting your time. We've improved the testing environment to catch these problems sooner.

Upgrade note: If you're running loomio-deploy, you will need to edit docker-compose.yml and update redis to 8.4

  redis:
    container_name: loomio-redis
    image: redis:8.4

Note: If you're running loomio-deploy, you will need to edit docker-compose.yml and update redis to 8.4

  redis:
    container_name: loomio-redis
    image: redis:8.4

Rails 8 upgrade and SSO features

• With FEATURES_DISABLE_EMAIL_LOGIN=1, and someone signs in via SSO, and they don't have a Loomio account we just create user and sign them in. No link/Create account screen (and no Terms of Service acceptance either).

• You can prevent users changing their name, email, username. Set LOOMIO_SSO_FORCE_USER_ATTRS=1

Group settings changes:

• How do people join? supports "Anyone can join”. Meaning registered users can just click “Join group” - no invitation or approval required. Set FEATURES_DISABLE_CREATE_USER=1 and Group privacy to “closed”.

• List in group directory, means the group will show on /explore (also linked from the sidebar as “Find a group”. Set FEATURES_EXPLORE_PUBLIC_GROUPS=1

To test SSO flows I created https://github.com/loomio/dev-saml-idp for SAML and used https://github.com/bencase/dev-sso-idp for ODIC testing.

I believe this release fixes #11903 - the edit comment bug.

Please try it and let me know if you see or don't see the bug. 🤞

Fix an issue with the Github Action that builds docker images.

We should now be building amd64 and arm64 images, under the same tag, for branches and releases.

Happy new year, Loomio friends! I'm slowly getting back into work - we have a new baby at home - so sleep and work time are less available to me right now.

However, I'm very excited about Loomio in 2026 - we some very exciting news coming soon. Thanks for your continued support. This is a small business supporting a small community of people with an open source product - I'm reminded how rare that is, and we are so grateful for you all.

BUG WATCH: If you upgrade to this version and continue to see the edit comment bug (ie: you click edit comment, or edit discussion, and the content is missing) please let me know. I think this bug may be fixed in this release - so please let me know either way.

What's Changed

• Upgrade to Tiptap v3 by @robguthrie in https://github.com/loomio/loomio/pull/12026
• Autotranslate off by default
• Add zh_tw locale
• fix for missing poll actions menu
• say "superseded" rather than "outdated" when someone changes their vote
• fix problem removing delegate status from user
• make user content h1's bolder

New Contributors

• @Clayblockunova made their first contribution in https://github.com/loomio/loomio/pull/12019

Full Changelog: https://github.com/loomio/loomio/compare/v3.0.11...v3.0.12

Terminology Change

• Rename Thread and Decision to Discussion and Poll by @robguthrie in https://github.com/loomio/loomio/pull/11995

New features

• Add B2 API endpoint for creating comments by @etiennechabert in https://github.com/loomio/loomio/pull/11963
• update email settings page to see each group setting by @robguthrie in https://github.com/loomio/loomio/pull/11947
• automatic translation of user generated content by @robguthrie in https://github.com/loomio/loomio/pull/11954
• auto translate user content in emails by @robguthrie in https://github.com/loomio/loomio/pull/11982
• Add zh_CN locale by @robguthrie in https://github.com/loomio/loomio/pull/12008

Bug fixes

• Fix RFC 2047 encoded email subject headers not being decoded by @etiennechabert in https://github.com/loomio/loomio/pull/11964
• addressing error: Invalid Stance: mismatched poll_options by @robguthrie in https://github.com/loomio/loomio/pull/11979
• Fix poll option deletion by preserving _destroy parameter by @etiennechabert in https://github.com/loomio/loomio/pull/12017
• Fix NoMethodError in avatar_kind for Rails 7.2 by @etiennechabert in https://github.com/loomio/loomio/pull/11949

Full Changelog: https://github.com/loomio/loomio/compare/v3.0.10...v3.0.11

Special thanks to @etiennechabert for all the fantastic contributions!

Here's the most significant stuff. It's a minor release.

• Unsubscribe from poll via email footer link - stance_created was missing the unsubscribe link
• Fix translations and ensure we don't have any missing placeholders
• ARM64 support for docker images (beta)
• Attempt to address stance voting bug, where poll option ids were from another poll
• Show error and offer to reload if loading fails
• return a "message was not delivered" email when people reply to notifications email address rather than reply-to value

I'm currently in conversation with a few customers about how to improve email notifications, with reports that people are receiving too many notifications - but I've not seen evidence that there is a bug, rather this is a design issue. If you have feedback about this, get in touch.

This release adds support for receiving inbound email via ActionMailbox. There is a complimentary Haraka docker image to support this.

This replaces Mailin, which, somehow has been just amazing, serving Loomio installs without issue for years. However the time has come for better performance, security & maintainability.

To upgrade a loomio-deploy install

Either:

• pull loomio-deploy changes: run git pull origin master and it will update your docker-compose.yml file. (recommended)
• or manually update your docker-compose.yml file, by copying the current master text over the top of your existing file.

Then add the following ENV's to your .env file:

HARAKA_CONTAINER_IMAGE=loomio/haraka-rails-docker
HARAKA_CONTAINER_TAG=stable
CHANNELS_CONTAINER_IMAGE=loomio/loomio_channel_server
CHANNELS_CONTAINER_TAG=stable
PUBLIC_APP_URL=https://REPLACE_WITH_HOSTNAME
PRIVATE_APP_URL=http://app:3000
RAILS_INBOUND_EMAIL_URL=http://app:3000/rails/action_mailbox/relay/inbound_emails
RAILS_INBOUND_EMAIL_PASSWORD=make_up_a_strong_password_here

Pull the fresh docker images

If you've pulled down loomio-deploy changes, then you'll notice that I've moved scripts/update to ./update.sh
If you don't have the update script, all we're really doing is

docker compose pull && docker compose down && docker compose run app rake db:migrate && docker compose down && docker compose up -d --remove-orphans

Test it's working

You should be able to send email to your group email address and have it appear as a thread.

Trouble shooting

You may want to review the updated default env_template and docker-compose.yml files and compare them to your own setup.

Other (non dependabot) changes in this release:

• switch to dartsass-sprockets
• improving print styles since vue3 upgrade
• don't disable submit button when form is invalid, show errors on save
• add missing error translations
• dont show any value for '% of points' column for undecided voters. fixes
• ensure we update outdated votes even when websocket is unavailable
• fix some pt-br translations
• fix translation for email settings
• dashboard: fix check to display no polls message
• ensure that unrecognised sender notifiations show up in-app
• better languge for ranked choice number of choices
• Show how current user voted after poll has closed. Inspired by
• ruby 3.4.7
• silence those damn method already exists warnings

Features:
verify participants in anonymous polls
enable vote share requirement for Simple Poll

Fixes:

• Fix issue where edit comment form was blank
• Fix erroneous Dutch translation
• ensure we don't run premailer on forwarded emails
• ensure we dont repeat notify on unknown sender
• remove focused background color
• fix participation report - labels were reversed
• Fix weird error updating score poll stance with nil

Introducing Quorum and Vote share requirement features.

This work was sponsored by Igalia, and we're so grateful for their support. Thank you @anarute!

The release notes are my first draft for the help manual update. Please let me know if you have any comments or feedback.

Quorum

You can now specify what percentage of eligible voters must participate for the results to be considered valid.
For example you could say, we need 80% of the group to vote on this for the results to be significant.

Vote share requirement

You can also specify what percentage of support an option needs for the proposal to pass.
For example you could have both of these rules at once

• At least 70% of votes cast must be for Consent
• No more than 5% of votes should be Objection
  
  
  
  
  
  

This release is dedicated to all of you nice people who've felt frustrated with how Loomio works with large discussions.

The major focus of work in this release has been refining the thread page. We focused on feedback from users having large discussions often with hundreds of comments.

The visual design has been updated. Previously we made the "stem" colour of a comment change when it was unread. It was not obvious what this meant, and also it looked a bit garish. Now we have a little "new" badge in the comment header to indicate new comments since you last read the thread.

We no longer support reversing the order of the thread. Previously you could rearrange the thread "Newest First" so new comments appeared at the top of the page. This created an uncertainty - the thread could be going in either direction and it's not obvious which direction is applied. Now threads always display newest comments at the bottom.

We support a more dynamic loading system when returning to a thread with some new comments - we collapse/hide content you've already read, allowing the new comments and their parent comments to be more easily read - I hope this makes catching up on large conversations easier, with a more deliberate display of new comments.

We've reworked "Load more". I think it's best to experience this yourself, but the gist of it is that we don't always show all the replies to replies. Instead the thread will display the first few comments from each nested set of comments, allowing you to drill down into a particular part of the conversation, or skip over tangents and see the boarder discussion.

Previously there were lots of bugs that meant that clicking "load more" could make the page jump and you would lose your place. I believe I've fixed all cases where this happened.

If you're using Loomio in a realtime setting, the page will no longer jump around as new comments appear. Instead the "x more" button will appear, allowing you to choose to see the new comments when it suits you. This is similar to how Gmail or other apps notify you that new messages have arrived. Poll results and edits will still update in real time. After clicking "x more" live updates will just appear, so you only need to click once to switchto a continuously updating view of the discussion.

The right sidebar - where we show some navigation options for the thread has been improved. You can easily jump to Latest or Unread or Top - and there is a button on mobile screens to open this sidebar.

Other fixes and improvements

• fix a bug where notifications could show a blank page when clicked
• Show the group URL when adjusting group settings to "Ask to join"
• Fix for adding aliases for member email addresses when inbound email is received
• Hide the onboarding checklist for groups older than 28 days
• Add ability to customize the light and dark theme colours from ENVs
• Fix for the Participation report for large datasets. Now you can see all the data. (broken since v3 release)
• Some fixes so the page does not overflow on mobile screens - more to come very soon
• Add a "View all votes" button so it's easier to get to the poll page
• Add a "Search" button to the serach modal - this fixes searching on mobile
• Fix for handling quoted text in comments sent via email

There is ongoing work to fix problems with Loomio on mobile phones. I hope to fix the remaining issues in the next week or so.

We have LOTS of new stuff coming. Including quorum rules, vote auditing tools and more. Thanks for reading you absolute legends!

Fix issue with missing SECRET_KEY_BASE

Fix a horrid bug where attachments would be dropped when you edit the thread layout (ie: change direction or nesting levels).

Other changes include

• include attachments in tracked changes
• move to rails Rails 7.2
• fix CSS when you attach a file with a very long name

• fix edit another users username modal
• fix missing Sentry error when locale is not supported
• score poll min score defaults to 0 rather than 1
• fix move comments modal
• update the poll preview list item to handle long titles and show the group name
• validate that stances are not corrupted with a poll option from another poll
• update npm and gem dependencies as usual

I'm so pleased to say we've released Loomio 3!

This release represents more than 18 months of work to upgrade our core UI libraries (Vue.js and Vuetify) from version 2 to version 3.

The goal of the v3 release was that users wouldn't notice anything had changed. They might notice it looks better and is faster, but otherwise it's a drop in replacement for v2.

There has been more than 6 months of testing in production for this release. Using feature flags, we've been running v3 alongside v2 on loomio.com. This has allowed us to do extensive real world testing and be confident that v3 is in every way an improvement on v2.

If I were to describe what all the work means, it's pretty simple:

• The UI looks better, is smaller to download, faster to respond and fit for future development
• Creating and joining subgroups has been moved to the sidebar
• We have a new onboarding experience to help groups get started

With this work done, we're able to focus on delivering our mobile app (PWA) and AI integrations.

Just so it's linked to the release notes, here's the PR: https://github.com/loomio/loomio/pull/10150