What's new

• ✨ Tray presence: the tray icon and menu now show your workspace's presence status (online/away/busy/offline), with a distinct icon while disconnected, and it's hidden when the active server fails to load. (#3466, #3472)
• 🐛 Windows notifications: quick replies are now delivered reliably — replies typed after a toast is dismissed to the Action Center are no longer lost, and a single reply no longer posts twice. (#3464, #3468)

✨ Improvements

• Log viewer, downloads, settings, and the document viewer now open as separate windows on a shared native shell. Each window can be sized and placed independently, remembers its bounds across restarts, and the log viewer, downloads, and settings reopen at launch if they were open at shutdown. (#3444)

🔧 Internal

• Release builds now trigger only on semver tag pushes, and PR checks cover release/X.Y.x patch lines. (#3454)
• yarn release:tag now fails closed unless the tagged commit belongs to the correct branch for its channel. (#3452)
• New branching model documented and wired from README and AGENTS.md: dev for development, master for releases, release/X.Y.x for patches. (#3455)

Highlights

A new workspace navigation system with three switchable layouts, a unified window chrome across all three platforms, security hardening from a 2022 pentest follow-up, and an upgrade to React 19.

✨ New workspace navigation: Tabs, Sidebar, or Titlebar

Workspace switching has been reworked into three interchangeable layouts, selectable in Settings → General or via the View menu (⌘/Ctrl+Shift+S cycles through them):

• Tabs — a horizontal browser-style tab strip with favicon, label, unread/mention badges, a keyboard-shortcut chip, drag-to-reorder, and an add-workspace button.
• Sidebar — a narrow, icon-only vertical column with square favicon tabs and badges, keyboard navigation, and improved contrast when a workspace's favicon matches the background.
• Titlebar — no sidebar and no tab strip, just the title bar with a compact server switcher.

The whole desktop chrome is now theme-aware, and the Theme selector is back in Settings. (#3424, #3394, #3419, #3413, #3403)

✨ Unified window chrome across Windows, Linux, and macOS

• Menu bar on Windows and Linux is now hidden by default — press Alt to reveal it temporarily, or pin it permanently visible from Settings → General → Menu bar, the View menu, or Ctrl+Shift+M. Existing installs are migrated automatically without overriding a choice you've already made.
• Linux now uses the same client-side window chrome as Windows: window controls embedded in the tab strip instead of relying on the desktop environment's title bar, plus softly rounded outer corners. (#3450, #3449)
• Updates are now surfaced as a titlebar label instead of a modal dialog, with clearer feedback for manual update checks and more resilient silent background checks. (#3439, #3427)
• Downloads get a new tab-strip indicator with a cleaner, more compact presentation. (#3443, #3441)
• Added a Cmd+, shortcut to open Preferences on macOS. (#3340)

🔒 Security hardening

Follow-up fixes from pentest review, tightening several areas that previously relied on broader trust than necessary:

• Restricted geolocation, notifications, and fullscreen permission prompts in the server view to trusted, configured server origins only. (CORE-1121, #3395)
• Blocked main-frame navigation to non-http(s) schemes inside the server webview. (CORE-1123, #3397)
• Tightened the Content-Security-Policy on local renderer windows. (CORE-1126, #3316)
• Session data (cookies, localStorage, indexedDB) is now cleared automatically when a user logs out of a server through the normal web app UI, not only via the manual "Clear Cache" action. (CORE-1130, #3398)
• Documented a risk-acceptance decision on certificate pinning for the auto-updater (CORE-1128) for future reference. (#3396)

🐛 Fixes

• Fixed workspace tabs intermittently getting stuck on the loading throbber after a webview boot failure — the app now recovers automatically instead of requiring a full restart. (#3436)
• Fixed a renderer infinite re-render loop that could throw "Maximum update depth exceeded". (#3435)
• Fixed an unread-badge update storm that could crash tab bar rendering, and corrected badge rendering/priority. (#3437, #3434)
• Fixed the screen-share picker appearing at app launch with no user interaction on Linux Wayland (Fedora Flatpak, Ubuntu deb) — source enumeration was running before the picker was ever opened. (#3400)
• Fixed the screen picker to show on the window that actually requested it (rather than always the main window) and to queue concurrent requests instead of dropping them. (#3399)
• Fixed screen-picker source stability under Electron 42's macOS capture stack. (#3414)
• Fixed workspaces with a valid uniqueId-scoped support exception incorrectly showing the "Unsupported" screen. (#3404, #3406, #3407)
• Fixed the sidebar tooltip showing "null" for servers beyond the 9th position. (#3326)
• Fixed the TopBar not rendering on Linux when using the Sidebar or Titlebar layouts. (#3449)
• Fixed dependency subpath imports not being externalized correctly in the Rollup build. (#3411)

🔧 Internal

• Upgraded React 18.3 → 19 and Fuselage 0.78 → 0.80. (#3384, #3383)
• Added a silent installation guide for enterprise deployments. (#3178)
• Added test coverage across preload and module boundaries. (#3393)
• Applied least-privilege permissions to GitHub Actions workflows. (#3410)
• Updated translations from Lingohub. (#3447, #3392)

Full Changelog: 4.15.6...4.16.0

✨ Improvements

• Updates now surface as a titlebar pill instead of a modal (#3427) — when an update is available, a blue "Update" pill appears in the window chrome. Clicking it opens a compact panel with the version change and install/skip actions; during download the pill shows live progress, and once complete it becomes the restart button. The About dialog's manual check hands over to the same panel, and the update channel selector remains in the About dialog.

🐛 Fixes

• Workspace tab unread badges render one indicator at a time, by priority (#3434) — logged-out warning first, then mention count, then the unread dot; badge colors now follow the design system tokens in both themes, and all badge variants anchor to the same point on vertical tabs.
• Eliminated a render-loop error storm during startup (#3435, #3437) — hardened the workspace tab strip against "Maximum update depth exceeded" errors: stabilized re-render triggers across tab components (#3435) and coalesced the per-room unread events that servers emit at boot, which could flood the window with state updates when unread rooms were present (#3437).
• Workspaces stuck on the loading screen now recover automatically (#3436) — when a workspace's boot wedges (a state that previously required restarting the app), the desktop app now forces a reload with service worker and cache clearing, capped at two attempts per session.

🔧 Internal

• Dev-only boot watchdog that captures forensic reports (event timeline, console buffer, in-page probe, service worker state) whenever a workspace boot hangs — enabled in development, opt-in via ROCKETCHAT_BOOT_WATCHDOG=true (#3436)
• Update flow simulation entry in the Help menu (developer mode only) for exercising the new update pill without a real update (#3427)

What's Changed

• fix: align workspace tab bar spacing with Chrome tab strip metrics by @jeanfbrito in #3419
• feat: rework workspace navigation into Tabs, Sidebar and Titlebar layouts by @rodrigok in #3424
• chore: bump version to 4.16.0-alpha.2 by @jeanfbrito in #3432

Full Changelog: 4.16.0-alpha.1...4.16.0-alpha.2

🐛 Fixes

• Windows: notification reply sent duplicated (#3420) — Replying to a desktop notification from the Windows toast could send the message twice. Electron 42 enabled inline-reply events on Windows but can deliver a single reply through more than one activation path; the app now dispatches each notification reply exactly once per display cycle.

🐛 Fixes

• Video calls: first Jitsi call after a fresh install or cleared cache now joins directly instead of landing on the pre-join screen. The loading watchdog no longer interrupts slow first-time loads, and its recovery path now preserves the call's authentication token and logs its activity in production. (#3416)
• Video calls: screen sharing in the call window works again on 4.15.x — a build-pipeline gap left a react-dom/client chunk without its module wrapper (ReferenceError: exports is not defined); dependency subpath imports are now externalized and a build-time guard prevents recurrence. (#3417, backport of #3411)
• Screen sharing: picker sources stay stable under the Electron 42 macOS capture stack. (#3417, backport of #3414)
• Sidebar: fixed a crash when formatting shortcut tooltips. (#3417, backport of #3326, fixes #3244)

🐛 Fixes

• Keep screen picker sources stable under the Electron 42 macOS capture stack (#3414)
• Workspace tabs QA feedback (CORE-2312) (#3413)
• Externalize dependency subpath imports in rollup bundles (#3411)

🔧 Internal

• Apply least privilege pattern to GitHub Actions workflows (#3410)

Full Changelog: 4.16.0-alpha.0...4.16.0-alpha.1

🐛 Fixes

• Conference deep links now open in a dedicated call window. Conference links that carry only a conference id (e.g. conference/<id>, without an explicit call URL) previously loaded the conference over the workspace webview, leaving no way back to the workspace. These links now open the conference in the standalone video call window, so closing it returns you to an untouched workspace. Links that already include an explicit call URL are unchanged. (#3412)

🔧 Internal

• CI: run pull-request build and validation workflows for hotfix/** base branches.

First alpha of the 4.16.0 line.

✨ Improvements

• Workspace tabs as a display option — new default layout (#3394)
• Screen picker now opens on the originating popout window; concurrent capture requests are queued (#3399)
• Cmd+, shortcut opens Preferences on macOS (#3340)

🐛 Fixes

• Sidebar tooltip crash in shortcut formatting (#3326)
• Supported-versions hardening: exception scoping, malformed enforcement dates, and alignment with the real /api/info contract (#3404, #3407, #3406 — also shipped in 4.15.3)
• Startup screen-capture enumeration no longer opens the Wayland picker on launch (#3400 — also in 4.15.3)

🔒 Security

• Permission requests (geolocation/notifications/fullscreen) bound to known server origin (#3395)
• Non-http(s) main-frame navigation blocked in the server webview (#3397)
• Session data cleared on logout (#3398)
• Tightened CSP on local renderer windows (#3316)

🔧 Internal

• React 18.3 → 19 (#3384)
• Fuselage 0.78 → 0.80 (#3383)
• Expanded test coverage across preload and modules (#3393)
• Translation updates (#3392)
• Silent installation guide for enterprise deployments (#3178)