GitHub Spotlight - 10/15/2026

Here's what's new in Rock's GitHub for Pre-Alpha Release 21.0.2, released on 10/14/2026.

v17.9 Highlights

v17.9 was released on Oct. 2, 2026. See the Release Notes for complete details.

• Various security improvements
• Improved the checks on where a person is sent after logging in.
• Improved validation on profile and photo updates.
• Improved how communication list subscriptions are validated, on web and mobile.
• Improved access controls for person contact information.
• Improved how uploaded files are served.
• Improved access controls for giving transactions.
• Improved permission checks before group members are added, changed, or moved.
• Improved how workflow permissions, including those inherited from categories, are enforced.

v17.10 Highlights

v17.10 was released on Oct. 6, 2026. See the Release Notes for complete details.

• Issue 7083: Fixed a bug in the Check Scanner, introduced in 17.9, 18.5, and 19.5, where financial workers with the RSR - Finance Worker or RSR - Finance Administration roles couldn't view and save scanned checks.

v17.11 Highlights

v17.11 was released on Oct. 14, 2026. See the Release Notes for complete details.

• Issue 7088: Fixed a bug where the "View List" workflow type entity permissions were not inherited by each workflow type.

v18.5 Highlights

v18.5 was released on Oct. 2, 2026. See the Release Notes for complete details.

• Various security improvements
• Improved the checks on where a person is sent after logging in.
• Improved validation on profile and photo updates.
• Improved how communication list subscriptions are validated, on web and mobile.
• Improved access controls for person contact information.
• Improved how uploaded files are served.
• Improved access controls for giving transactions.
• Improved permission checks before group members are added, changed, or moved.
• Improved how workflow permissions, including those inherited from categories, are enforced.
• Issue 6919: Fixed a bug where web servers using Azure Blob Storage could spike to high CPU usage with hanging requests after an application restart under concurrent load, requiring a manual restart to recover.

v18.6 Highlights

v18.6 was released on Oct. 6, 2026. See the Release Notes for complete details.

• Issue 7083: Fixed a bug in the Check Scanner, introduced in 17.9, 18.5, and 19.5, where financial workers with the RSR - Finance Worker or RSR - Finance Administration roles couldn't view and save scanned checks.

v19.5 Highlights

v19.5 was released on Oct. 2, 2026. See the Release Notes for complete details.

• Various security improvements
• Improved the checks on where a person is sent after logging in.
• Improved validation on profile and photo updates.
• Improved how communication list subscriptions are validated, on web and mobile.
• Improved access controls for person contact information.
• Improved how uploaded files are served.
• Improved access controls for giving transactions.
• Improved permission checks before group members are added, changed, or moved.
• Improved how workflow permissions, including those inherited from categories, are enforced.
• Issue 7062: Fixed a bug where saving a person's name containing Korean, Japanese kana, or other non-Latin characters was at times rejected or stripped.

v19.6 Highlights

v19.6 was released on Oct. 6, 2026. See the Release Notes for complete details.

• Issue 7083: Fixed a bug in the Check Scanner, introduced in 17.9, 18.5, and 19.5, where financial workers with the RSR - Finance Worker or RSR - Finance Administration roles couldn't view and save scanned checks.

v19.7 Highlights

v19.7 was released on Oct. 14, 2026. See the Release Notes for complete details.

• Issue 6992: Fixed a bug in Workflow Webhook Attribute Mappings where values mapped with Lava (like {{ RawBody }}) passed HTML-encoded text to the launched workflow instead of the data the webhook sent.

v20.0 Highlights

• Issue 7018: Fixed a bug in the Connections Hub Additional Requests list where requests appeared in arbitrary order instead of newest first.
• Issue 7035: Fixed a bug in the Connections Hub docked panel where reselecting the same Additional Request row after closing the panel didn't reopen it.
• Issue 7036: Added a Workflows panel to the Connections Hub docked view that lists the persisted workflows launched from a connection request, including trigger, current activity, start date, and status.
• Issue 7039: Fixed a bug where Rock's MCP endpoint failed when a connecting AI client sent its request identifier.
• Issue 7040: Fixed a bug in the Reminder List block where the Reassign flyout dismissed as soon as a person was selected.
• Issue 7044: Fixed a bug in the Content Channel Item List block where channels with many items could take minutes to load.
• Issue 7055: Fixed a bug in Bulk Update where the Individuals "N more" pill didn't expand to show the full list of people on the entry step.
• Issue 7056: Fixed a bug in the Group Detail block where editing a group location with map coordinates or a geofence showed an empty Location field.
• Issue 7058: Fixed a bug in the Transaction List block where custom grid columns using Row merge field properties rendered blank values.
• Issue 7061: Fixed a bug in the Group Detail block where schedules with specific dates showed raw HTML tags instead of a list of dates.
• Issue 7063: Fixed a bug in Category Detail where having Edit permission on a parent category didn't allow creating child categories under it.
• Issue 7072: Fixed a bug where attribute values saved by Lava entity-modify commands inside a {% dbtransaction %} block weren't rolled back along with the rest of the transaction.

v20.1 Highlights

• Added new tools that let people search for and join small groups near them, sorted by distance.
• Improved the performance of the Update Persisted Attribute Values job.
• Issue 6994: Fixed a bug in Communication Templates where the color picker popup appeared behind the full-screen Email Builder.
• Issue 6995: Fixed a bug in the Email Designer where sections could be nested deeply enough that Apple Mail on iOS would drop the content.
• Issue 7006: Fixed a bug where One-Time Communication Flows ignored changes to the flow's start date made before the first communication was sent.
• Issue 7033: Fixed a bug where an expired registration session blocked a registration from being deleted for up to 30 days after an abandoned redirect-gateway payment.
• Issue 7041: Fixed a bug where required attribute fields using the Person, Group, and several other pickers weren't enforced on Obsidian forms.
• Issue 7047: Fixed a bug where the Registration Detail block showed a blank group link when a registrant's group had been archived.
• Issue 7048: Fixed a bug in the Registration Entry block where a paid registration could be submitted with no payment method if the cost calculation request failed.
• Issue 7049: Fixed a bug where SMS opt-out auto-replies weren't sent to individuals even though the System Phone Number was configured to send them.
• Issue 7052: Fixed a bug where the Schedule Time field on Next-Gen check-in labels printed the check-in start time instead of the schedule's start time when a check-in start offset was set.
• Issue 7053: Fixed a bug in the Calendar Event Item Occurrence List where unqualified Event Item Occurrence attributes marked Show in Grid were omitted.
• Issue 7059: Fixed a bug in Next-Gen Check-in where a child could see "No Eligible Options Found" when Grade and Age Matching Behavior was set to Prioritize Grade Over Age and the only grade-matching group required a membership the child didn't have.
• Issue 7070: Fixed a bug where the OIDC authorization consent screen listed each requested scope twice.
• Issue 7071: Fixed a bug where new named schedules were sorted by creation order instead of start time in the Group Scheduler and other schedule lists.
• Issue 7075: Fixed a bug in the Connection Type Detail block where status automations reordered by drag and drop reverted to their original order after a reload, and the next save then silently undid the reorder.

v21 Highlights

• Fixed a bug where images in the "Internal Article List" homepage template failed to load when the page was viewed from a route deeper than the site root.

Mobile

• Issue 7089: Fixed a bug in Rock Mobile where profile photos and images uploaded with an unknown file type would not display.