Merge branch 'develop' into chore/migrate-livechat-omnichannel-openapi

Author: NAME-ASHWANIYADAV

.changeset/fluffy-turtles-admire.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/models': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes race condition causing duplicate open livechat rooms per visitor token.

.changeset/late-pots-teach.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/i18n": patch
+"@rocket.chat/ui-voip": patch
+---
+
+Fixes mismatched translations for Voice calling UI

.changeset/new-students-attack.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue when forwarding messages to a password-protected room.

.changeset/small-pants-reflect.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes the download of attachments with non-unicode names on E2EE rooms

.changeset/spotty-news-burn.md

@@ -0,0 +1,9 @@
+---
+'@rocket.chat/core-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/ui-composer': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds support for multiple files in message composer, improving file upload experience

.changeset/spotty-poems-smash.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": patch
+"@rocket.chat/models": patch
+---
+
+Fixes an issue where, sometimes, updatedAt was not being set during the subscription creation

.changeset/strict-ajv-coercion.md

@@ -0,0 +1,16 @@
+---
+"@rocket.chat/rest-typings": minor
+"@rocket.chat/meteor": patch
+---
+
+Splits the single AJV validator instance into two: `ajv` (coerceTypes: false) for request **body** validation and `ajvQuery` (coerceTypes: true) for **query parameter** validation.
+
+**Why this matters:** Previously, a single AJV instance with `coerceTypes: true` was used everywhere. This silently accepted values with wrong types — for example, sending `{ "rid": 12345 }` (number) where a string was expected would pass validation because `12345` was coerced to `"12345"`. With this change, body validation is now strict: the server will reject payloads with incorrect types instead of silently coercing them.
+
+**What may break for API consumers:**
+
+- **Numeric values sent as strings in POST/PUT/PATCH bodies** (e.g., `{ "count": "10" }` instead of `{ "count": 10 }`) will now be rejected. Ensure JSON bodies use proper types.
+- **Boolean values sent as strings in bodies** (e.g., `{ "readThreads": "true" }` instead of `{ "readThreads": true }`) will now be rejected.
+- **`null` values where a string is expected** (e.g., `{ "name": null }` for a `type: 'string'` field without `nullable: true`) will no longer be coerced to `""`.
+
+**No change for query parameters:** GET query params (e.g., `?count=10&offset=0`) continue to be coerced via `ajvQuery`, since HTTP query strings are always strings.

.changeset/tame-tables-complain.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes "Join" button on Outlook Calendar bubbling click event, also opening the calendar event details.

.github/actions/restore-packages/action.yml

@@ -0,0 +1,16 @@
+name: 'Restore Packages Build'
+description: 'Downloads and unpacks the packages build artifact'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore packages build
+      uses: actions/download-artifact@v8
+      with:
+        name: packages-build
+        path: /tmp
+
+    - name: Unpack packages build
+      shell: bash
+      run: |
+        tar -xzf /tmp/RocketChat-packages-build.tar.gz -C .

.github/actions/update-version-durability/index.js

@@ -103,7 +103,7 @@ async function generateTable({ owner, repo } = {}) {
 		minorDate.setDate(1);
 		supportDateStart = minorDate;
 		supportDate = new Date(minorDate);
-		supportDate.setMonth(supportDate.getMonth() + (lts ? 9 : 6));
+		supportDate.setMonth(supportDate.getMonth() + (lts ? 12 : 6));
 
 		releaseData.push({
 			release: {