Rock RMS Developer Changelog

A running digest of notable developer-facing changes across Rock RMS’s currently-active major versions — the pre-alpha branch plus every hotfix branch from the current General-release floor up through the newest — cross-referenced against the public pre-alpha and release notes pages to surface changes that are in the code but not yet written up for administrators.

v21 (pre-alpha)

⚠️ In code, not in release notes

• 2026-09-09 — BREAKING Obsidian block conversions: added the SignUpDetail, ConnectionOpportunitySearch, and ContributionStatementListLava Obsidian blocks, each chopping (removing) the corresponding legacy WebForms block. 8b47a49
• 2026-09-09 — Consolidated Obsidian attribute filtering into a shared helper, fixing filters that were being silently dropped. 6f47204
• 2026-09-09 — API MigrationHelper.DeleteEntityType now removes referencing [Auth] records before deleting the [EntityType], preventing FK_dbo.Auth_dbo.EntityType_EntityTypeId violations on future EntityType deletions. Useful pattern for plugin migrations that delete entity types. f5beae1
• 2026-09-09 — Improved Lava test suite performance by 2-3x. 02d1b48
• 2026-09-08 — BREAKING Added the Obsidian DataAutomationSettings block and chopped the legacy WebForms version. abf35fb
• 2026-09-08 — API Converted usages of new RockContext() to the new RockApp.Current.CreateRockContext() pattern across the codebase — the preferred way to obtain a RockContext going forward. 4746cfd
• 2026-09-04 — Fixed the Edit Person block not actually enforcing its “Require Full Birthdate” block attribute. 76ef734
• 2026-09-04 — BREAKING Group Member Detail block converted to Obsidian. 29b09ad
• 2026-09-03 — Added an opt-in Select All to the Obsidian GroupPicker (via treeItemPicker) and enabled it on the Check-in Manager En Route block, matching the WebForms picker’s behavior. b910be4
• 2026-09-02 — Improved the RedirectConnectionRequestDetailToHub migration to seed attribute values with the Hub’s default page route for any values that were missing. 6dd8e52
• 2026-09-02 — Improved the Obsidian Group Type Map block’s rendering in dark/light mode. ee51b72
• 2026-09-01 — Fixed a migration issue that was preventing clean databases from being created successfully, which was also causing integration tests to fail. 053c1c1
• 2026-09-01 — API Expanded the Rock AI Agent framework: added ListWorkflow/GetWorkflow tools to the WorkflowSkill and roughly 45 additional AI tools across existing skills (notably the CMS skill). 43facba
• 2026-09-01 — Improved user-agent parser cache-hit performance by moving the size-cap check off the hot path, avoiding a locking ConcurrentDictionary.Count call on every parse. Also fixed a null-reference exception in the same parser when a request had no User-Agent header. 3483353
• 2026-08-31 — Fixed the Markdown attribute field to allow basic HTML. 66cb7a5
• 2026-08-30 — Fixed several Connection Request Entry block issues found in QA. cb2963e
• 2026-08-28 — Restored legacy parity in the Obsidian Mobile Check-in Launcher block: kiosks configured to print from the server now print immediately when check-in completes on the phone, before any QR code is scanned. 642561c
• 2026-08-28 — BREAKING Chopped the legacy Communication Entry Wizard block and obsoleted the legacy New Communication page guid. 641531a
• 2026-08-28 — Added Event Personalization Filtering for Calendar surfaces. c4db487
• 2026-08-28 — BREAKING Added the Obsidian GroupTypeMap block and chopped the legacy WebForms version. 115b77f
• 2026-08-28 — API Redirected core Connection Request links to the new Connections Hub, and taught the legacy Connection Request Detail page to accept the Hub’s page parameter names. Also added support for deep-linking to the Hub with the Add Connection Request modal pre-opened and preselected by Connection Type or Opportunity. d7c608e

v20 (hotfixes)

hotfix-20.1

⚠️ In code, not in release notes

• 2026-09-21 — Fixed the Obsidian Workflow Entry block masking a workflow-processing error with a carried-over “submitted successfully” message from an earlier form action: a workflow error (e.g. a Send Email action failing on a bad SMTP server) now always takes precedence and is shown as a bulleted list, matching WebForms’ behavior instead of hiding the failure behind a false success message. ea00325
• 2026-09-21 — (Event) Fixed the Calendar Event Item Occurrence List block omitting Event Item Occurrence attributes marked “Show in Grid” when the attribute wasn’t qualified to a specific Calendar/Event Item. (Fixes #7053) a3b6231
• 2026-09-21 — Fixed the Dynamic Report block persisting a normalized version of a filter selection back to its underlying Data View, which could silently change the filter’s comparison type (e.g. “Starts With” becoming “Contains”) every time the report was viewed. 7b992d8
• 2026-09-18 — (Event/Group) Fixed the Registration Detail and Group Member Detail blocks erroring or showing a blank link when a registrant’s group had been archived: Registration Detail now hides the group link once its group is archived, Group Detail treats an archived group as not found (with a warning) instead of rendering it, and Group Member Detail shows a warning rather than throwing when the member’s group is archived. This supersedes an initial same-day fix that only patched the symptom without hiding the archived group. (Fixes #7047) 247672a
• 2026-09-18 — SCHEMA (Core) Improved the Update Persisted Attribute Values job: fixed a SQL index so its lookups actually use it and fixed a bug that could cause it to update the wrong attribute’s persisted values, then further reduced the number of database queries the job issues per run so it finishes faster with less database load. b0c0fc8
• 2026-09-18 — (Event) Fixed the Obsidian Registration Entry block letting a paid registration submit with no payment method selected when the async cost-calculation request failed after the payment step had already rendered — the block now blocks submission and surfaces an error instead of silently proceeding. (Fixes #7048) 0c2fc65
• 2026-09-17 — API (AI) Continued the experimental Code Composer Agent work: extended LavaApplicationBuilderSkill’s Lava-authoring tools and the AudienceMatchResult/LavaEndpointDetailResult/SecurityRoleResult payloads, and added a configurable Agent reasoning-level setting to ChatAgentImplementation/RockIntelligence. f852ca1
• 2026-09-17 — (CMS) Fixed the Content Channel Navigation Obsidian block not updating the browser URL when a channel or category is selected, so the current filtered view can now be shared as a link. 9db9821
• 2026-09-17 — Fixed the Rock installer’s Install.aspx so a ?Version= query-string override also controls which version folder the Rock payload itself downloads from (previously it only affected which installer-script folder was used), by introducing a separate installerVersion that both paths read from. 1ce2f2a
• 2026-09-17 — Modernized the Rock installer pages (Start.aspx, Install.aspx, Complete.aspx) to restore an external-CDN update from 2019 that had never reached Install.aspx: Bootstrap 3.4.1 and jQuery 1.12.4 now load from cdnjs with SRI integrity hashes, external links use HTTPS, and Complete.aspx’s hard-coded baseVersion is corrected from 2_9_0 to 2_9_5. Per the commit, these page changes still need to be manually copied into the 2_9_5 blob-storage folder the published installer downloads from. 6b57770
• 2026-09-16 — (CMS) Fixed the tree picker (treeListItem.obs, used by the Page Map picker among others) wrapping long item labels onto a second line instead of overflowing/truncating horizontally. d5fbba7
• 2026-09-16 — (CMS) Fixed the Content Channel Item List block taking minutes to load channels with many items: eager-loads the shared ContentChannel/ContentChannelType (and item slugs when an Item URL is configured) instead of lazy-loading them per row, and batches event-occurrence existence checks into a single query instead of one per item — eliminating an N+1 query pattern. (Fixes #7044) fb2adfc
• 2026-09-16 — Renamed the Activate Communication Flow workflow action’s “Communication Flow” setting to “Communication Flow Attribute” and clarified its description. 9a46f0b
• 2026-09-15 — (CRM) Fixed the Reminder List Reassign flyout dismissing itself when a person was selected in the PersonPicker search dialog — the flyout’s outside-click handler now also exempts clicks inside .person-picker-popup, matching the existing datepicker exemption. (Fixes #7040) 573a749
• 2026-09-15 — API (AI) Added FindNearbyGroups and FindNearbyGroupsForMe tools to the AI Agent GroupSkill, letting agents locate groups near a location or near a person’s family, sorted by distance. eeca4db
• 2026-09-15 — API (AI) Fixed the MCP endpoint erroring on a string JSON-RPC id (JSON-RPC 2.0 permits either a string or a number). JsonRpcRequest.Id and JsonRpcResult.Id now hold the raw JsonElement instead of a long? so the identifier’s original type is echoed back unchanged, and a malformed or non-object payload now produces a proper JSON-RPC error response instead of throwing. (Fixes #7039) 7d9a0c6
• 2026-09-15 — Fixed a null-reference exception in the Obsidian tooltip directive’s updated/beforeUnmount hooks when they ran on an element whose tooltip state had already been cleared. f509a7d
• 2026-09-14 — (Finance) Fixed the Print Statement button on Contribution Statements failing silently, by restoring print support to the Contribution Statement Generator’s statement display. (Fixes #7038) 230354b
• 2026-09-14 — (Communication) Fixed the color picker popup appearing behind the full-screen Email Builder in Communication Templates. (Fixes #6994) 0bc85e4
• 2026-09-14 — (Connection) Fixed the Connections Hub Additional Requests list so requests are ordered newest first instead of arbitrary database order. (Fixes #7018) c28539e
• 2026-09-14 — (Connection) Added a Workflows panel to the Connections Hub docked view listing the persisted workflows launched from the selected connection request (trigger, current activity, start date, status), with row click opening the workflow entry form or detail page. (Fixes #7036) 8b523d9
• 2026-09-14 — API (Event) Fixed expired registration sessions blocking a registration from being deleted for up to 30 days after an abandoned redirect-gateway payment — the new RegistrationSessionService.RemoveExpiredSessionsForRegistration clears timed-out sessions before the delete’s CanDelete check runs. (Fixes #7033) 2252421
• 2026-09-14 — Fixed the Registration Instance Registrant List block throwing an error when a duplicate registrant existed and a Group Member or Person attribute value was displayed in the grid. 0b437fd
• 2026-09-14 — Fixed the PageListAsBlocks Lava template rendering an empty <ul> when a page has no child or included pages. ed3982e
• 2026-09-13 — API Made Rock.Tests.Shared packable (IsPackable=True) so it now publishes to NuGet, letting plugin projects consume Rock’s shared test helpers as a package dependency instead of a project reference. 1630d47
• 2026-09-11 — Updated the Obsidian captcha control to reuse a single solved token across forms within the same workflow, caching it in sessionStorage and re-challenging slightly before real expiry to absorb clock skew. 8dceaa5
• 2026-09-11 — (Connection) Fixed the Connections Hub docked panel reopening on a previously drilled-into Additional Request after being closed and the same row re-selected. (Fixes #7035) 8cd639e
• 2026-09-11 — Added Connection Type and Limit to Assigned Connections block settings to the Connections Hub block. 4d112ee
• 2026-09-11 — (Communication) Fixed the Email Designer allowing sections to be nested deeply enough that Apple Mail on iOS drops the content, by warning the author whenever a section is placed inside another and highlighting the affected sections so they can be flattened. (Fixes #6995) b236c3b
• 2026-09-11 — Fixed the Email Designer leaving an orphaned gap after deleting a column from a section with a Gap Between Columns, and omitting the gap before a newly added column. 4f3ebf9
• 2026-09-11 — BREAKING API Tightened the Obsidian audit detail REST endpoint (ControlsController) to require EDIT access to the secured entity itself (or VIEW via a security grant token) instead of plain VIEW — covers entity types with no default security applied that would otherwise be open to all users. 6e01267
• 2026-09-10 — Removed references to the New Communication (Legacy) page: repointed the Connection Request Detail block’s SMS Link Page default to the current New Communication page, removed obsolete legacy detail-page routing and dead template-version plumbing from the Communication List block, and corrected a stale doc comment. 57e752e
• 2026-09-10 — (Communication) Fixed One-Time Communication Flows ignoring changes to the flow’s start date made before the first communication is sent. The flow’s instance now updates as soon as it’s saved, and the Process Communication Flows job also realigns it. (Fixes #7006) 3b12d9b
• 2026-09-10 — Fixed Group Type Detail hiding the Edit button on system group types even though some properties on them remain editable. 650ad13
• 2026-09-10 — API Added a self-provisioning Orphaned Pages system page, and updated MigrationHelper.DeletePage to re-parent child pages to it before deleting a parent — page deletions no longer fail on the ParentPageId foreign key. Relevant for any plugin migration that deletes pages with children. d383fe2
• 2026-09-09 — API Added an experimental Code Composer Agent, building on the new ForgeContent/CMS AI skill work — includes Lava Application and Lava Endpoint management results and a security-role matching result for the agent. 532774d
• 2026-09-09 — Fixed the Connection Request Entry block offering connection opportunities that the visitor was not authorized to view. (Fixes #7030) 074e2e3
• 2026-09-09 — Fixed the PMM v1 sunset migration to remove [Auth] records referencing the PMM EntityType before deleting it, preventing an FK violation on installs with per-component Auth rows. d2f02e5
• 2026-09-08 — Fixed the HTML Editor endlessly resizing when edited in a browser with the Grammarly extension active. (Fixes #7013) 2ee93ae
• 2026-09-08 — (CRM) Fixed the Bulk Update block not accepting a value for Matrix attributes — the “add item” form opened with no fields to complete, so it could only save an empty item. Affected the Person, Group Member, and Step attribute sections of the block. (Fixes #7024) a1b3c81
• 2026-09-08 — SCHEMA Added an IsSystem property to AI Agents so Rock-provided agents cannot be deleted and their instructions cannot be edited. b827644
• 2026-09-08 — (CMS) Fixed UTM interaction data not being recorded on the Content Channel Item View block when the request came in on a domain not registered for the Website. (Fixes #7026) b3e52d8
• 2026-09-04 — (CRM) Fixed the Bulk Update block not adding anyone to the selected group when the Group Role was left blank — the Role dropdown now pre-selects the Group Type’s default or first Role. (Fixes #7023) eb0374a

v19 (hotfixes)

hotfix-19.5

⚠️ In code, not in release notes

• 2026-09-18 — (Housekeeping) hotfix-19.5 merged forward the accumulated hotfix-17.6–hotfix-17.9 and hotfix-18.5 fix lines, which weren’t previously part of this branch’s ancestry; that merge then flowed into hotfix-20.1 via release-20.0. Those older fixes already shipped in their original hotfix releases months ago and aren’t re-listed here — noted so the sudden SHA jump in this file’s tracked history is explained. 6e702aa
• 2026-09-18 — (Security) Fixed the legacy Group Detail Lava block’s group-member postback handlers (save, delete, and other member actions) so they require the current person to have Edit or Manage Members authorization on the specific group, and scope the member lookup to that group — previously the handlers acted on an unscoped member Id with no authorization check, letting any user who could reach the block edit or delete a GroupMember in an arbitrary group. 04a6cd3
• 2026-09-18 — (Security) GroupCache.IsAuthorized now applies the same group-role-based authorization fallback (CanView/CanEdit/CanManageMembers/CanTakeAttendance) that the Group entity already applied, fixing cases where authorization checks made through the cached GroupCache (instead of the live Group) incorrectly denied access to a group member whose role should have granted it. d471d13
• 2026-09-18 — (Security) Fixed the legacy (WebForms) Communication List Subscribe block trusting a posted group Id without verifying it was actually a communication list the person is authorized to view — a new IsAuthorizedCommunicationList check now gates both the visible list and the subscribe/unsubscribe action, matching the equivalent fix already made to the Obsidian version of this block. b1b8e7f
• 2026-09-17 — BREAKING API (API) Closed an authorization bypass in the base v1 REST POST (insert) endpoint: ApiController<T> only re-checked EDIT authorization by reloading the entity by Id, which is 0 for a brand-new record, so the check silently no-opped for every insert. A new IsAuthorizedForNewModel helper builds a scratch proxy from the posted values so parent-authority checks now evaluate before an insert is allowed. faf80da
• 2026-09-17 — BREAKING API (API) GroupMembersController now overrides Post to explicitly authorize a new GroupMember against its target Group via GroupMember.IsAuthorized, and to reject inserts into security-role groups outright — previously the base controller’s Id-based reload check was skipped for new records, so any authenticated caller could add members (including to security roles) to any group through this endpoint. a369577
• 2026-09-17 — BREAKING (Security) GetFile.ashx and GetImage.ashx now send Content-Security-Policy: default-src 'none'; sandbox allow-downloads and X-Content-Type-Options: nosniff on every response, and GetImage.ashx rejects any BinaryFile whose stored MIME type isn’t image/*. Closes a stored-XSS path where a file uploaded with an attacker-controlled MIME type (e.g. text/html or image/svg+xml) could execute script in the Rock origin when viewed inline. 9f651a0
• 2026-09-17 — (Communication) Reworked CommunicationListSubscribe to resolve the authorized Communication Lists a person can subscribe to through the entity cache instead of re-querying and re-authorizing entities directly, and consolidated several separate queries into fewer round-trips. 02b46d1
• 2026-09-16 — (CMS) Fixed the Public Profile Edit block so the server now blocks email address and email-preference changes to a family member whose Account Protection Profile is High or Extreme — the disabled client-side control didn’t stop the value from arriving on postback, so the restriction could previously be bypassed. d96a9dd
• 2026-09-16 — (CMS) Fixed the Public Profile Edit block so a save is limited to groups that are actually the current person’s own families — IsFamilyGroupForCurrentPerson now checks Person.GetFamilies() instead of merely checking group membership, closing a path where a group merely shared with the person being edited (not a family of the editor) could be saved. 0ee19f3
• 2026-09-16 — (CRM) Fixed the Photo Upload block so the server enforces whose photos an individual may upload — UpdatePersonProfilePhoto now re-derives the eligible candidate list (self, plus family members when enabled, minus staff members when disallowed) instead of trusting any personIdKey passed to the block action. e63fc7e
• 2026-09-14 — Updated the RockInstaller’s Start.aspx and Install.aspx pages, stale since v16.x, to match the current installer output; the 2_9_5 installer folder itself is unchanged and remains in use. ac1b78f
• 2026-09-11 — BREAKING API Tightened the Obsidian audit detail REST endpoint (ControlsController) to require EDIT access to the secured entity itself (or VIEW via a security grant token) instead of plain VIEW — covers entity types with no default security applied that would otherwise be open to all users. 63ca17e
• 2026-09-01 — (Reporting) Fixed the Total Giving report field so the Amount box appears when using Obsidian components, instead of only appearing after disabling them on the block. (Fixes DEV-15310) ba65c04
• 2026-08-31 — Fixed the Markdown attribute field to allow basic HTML. 66cb7a5
• 2026-08-28 — Fixed the Page Debug Timings modal so closing it removes the ShowDebugTimings query string parameter, which had been causing the modal to reappear unintentionally on every page refresh. 25bdf49

v18 (hotfixes)

hotfix-18.5

⚠️ In code, not in release notes

• 2026-09-22 — (Housekeeping) Started tracking hotfix-18.5 as part of extending coverage down to the current General-release floor (v17, per rockrms.com/releasenotes). Every commit found in its last ~14 days of history was already merged forward into and documented under hotfix-19.5 (see the v19 section) or is a duplicate cherry-pick of an entry already listed there, so no new bullets were needed on this first pass. Given this branch’s topology — fixes typically land on the oldest maintained hotfix branch first and merge forward through 18.5 → 19.5 → 20.1 — expect most future hotfix-18.5 entries to already be covered by the newer branches’ sections; only genuinely 18.5-exclusive changes will get their own bullet here. fa160bb

v17 (hotfixes)

hotfix-17.9

⚠️ In code, not in release notes

• 2026-09-22 — (Housekeeping) Started tracking hotfix-17.9, the current General-release branch (v17.8 per rockrms.com/releasenotes) and the new floor for this changelog’s coverage. Every commit found in its last ~14 days of history was already merged forward into and documented under hotfix-19.5/hotfix-18.5 (see the v19 section) or is a duplicate cherry-pick of an entry already listed there, so no new bullets were needed on this first pass. Expect the same going forward: this branch mostly originates fixes that later show up merged into the newer hotfix branches, so entries here should be rare and specific to v17. 04a6cd3