Rock RMS Developer Changelog

A running digest of notable developer-facing changes on Rock RMS’s current pre-alpha branch and the two most recent hotfix branches, cross-referenced against the public pre-alpha and release notes pages to surface changes that are in the code but not yet written up for administrators.

v21 (pre-alpha)

⚠️ In code, not in release notes

• 2026-09-09 — Obsidian block conversions: added the SignUpDetail, ConnectionOpportunitySearch, and ContributionStatementListLava Obsidian blocks, each chopping (removing) the corresponding legacy WebForms block. 8b47a49
• 2026-09-09 — Consolidated Obsidian attribute filtering into a shared helper, fixing filters that were being silently dropped. 6f47204
• 2026-09-09 — MigrationHelper.DeleteEntityType now removes referencing [Auth] records before deleting the [EntityType], preventing FK_dbo.Auth_dbo.EntityType_EntityTypeId violations on future EntityType deletions. Useful pattern for plugin migrations that delete entity types. f5beae1
• 2026-09-09 — Improved Lava test suite performance by 2-3x. 02d1b48
• 2026-09-08 — Added the Obsidian DataAutomationSettings block and chopped the legacy WebForms version. abf35fb
• 2026-09-08 — Converted usages of new RockContext() to the new RockApp.Current.CreateRockContext() pattern across the codebase — the preferred way to obtain a RockContext going forward. 4746cfd
• 2026-09-04 — Fixed the Edit Person block not actually enforcing its “Require Full Birthdate” block attribute. 76ef734
• 2026-09-04 — Group Member Detail block converted to Obsidian. 29b09ad
• 2026-09-03 — Added an opt-in Select All to the Obsidian GroupPicker (via treeItemPicker) and enabled it on the Check-in Manager En Route block, matching the WebForms picker’s behavior. b910be4
• 2026-09-02 — Improved the RedirectConnectionRequestDetailToHub migration to seed attribute values with the Hub’s default page route for any values that were missing. 6dd8e52
• 2026-09-02 — Improved the Obsidian Group Type Map block’s rendering in dark/light mode. ee51b72
• 2026-09-01 — Fixed a migration issue that was preventing clean databases from being created successfully, which was also causing integration tests to fail. 053c1c1
• 2026-09-01 — Expanded the Rock AI Agent framework: added ListWorkflow/GetWorkflow tools to the WorkflowSkill and roughly 45 additional AI tools across existing skills (notably the CMS skill). 43facba
• 2026-09-01 — Improved user-agent parser cache-hit performance by moving the size-cap check off the hot path, avoiding a locking ConcurrentDictionary.Count call on every parse. Also fixed a null-reference exception in the same parser when a request had no User-Agent header. 3483353
• 2026-08-31 — Fixed the Markdown attribute field to allow basic HTML. 66cb7a5
• 2026-08-30 — Fixed several Connection Request Entry block issues found in QA. cb2963e
• 2026-08-28 — Restored legacy parity in the Obsidian Mobile Check-in Launcher block: kiosks configured to print from the server now print immediately when check-in completes on the phone, before any QR code is scanned. 642561c
• 2026-08-28 — Chopped the legacy Communication Entry Wizard block and obsoleted the legacy New Communication page guid. 641531a
• 2026-08-28 — Added Event Personalization Filtering for Calendar surfaces. c4db487
• 2026-08-28 — Added the Obsidian GroupTypeMap block and chopped the legacy WebForms version. 115b77f
• 2026-08-28 — Redirected core Connection Request links to the new Connections Hub, and taught the legacy Connection Request Detail page to accept the Hub’s page parameter names. Also added support for deep-linking to the Hub with the Add Connection Request modal pre-opened and preselected by Connection Type or Opportunity. d7c608e

Published

• 2026-09-04 — (AI) Replaced the experimental AI Provider components with the Rock Intelligence service across the chat completion Lava shortcode, workflow action, and prayer request AI moderation. No custom configuration is required beyond enabling the service — a breaking change for anyone with custom AI Provider configuration. 53194a3 (notes: v21.0.1, 2026-09-10)
• 2026-08-31 — (Core) Added FlexibleDocument, a new extensible JSON document store: a registry of document types with type-level security and a document table holding JSON payloads with five typed, indexed filter columns. aa448d2 (notes: v21.0.1, 2026-09-10)
• 2026-08-31 — (CMS) Added the ForgeContent data model and a new CMS AI agent skill (CmsSkill) for exploring and managing sites, pages, and blocks — the foundation for AI-assisted site building. 8c5c369 (notes: v21.0.1, 2026-09-10)
• 2026-08-28 — (Core) Improved the performance of the Exception List, Exception Occurrence List, and Exception Detail blocks. b72400d (notes: v20.0, 2026-09-02)

v20 (hotfixes)

hotfix-20.1

⚠️ In code, not in release notes

• 2026-09-18 — (Event/Group) Fixed the Registration Detail and Group Member Detail blocks erroring or showing a blank link when a registrant’s group had been archived: Registration Detail now hides the group link once its group is archived, Group Detail treats an archived group as not found (with a warning) instead of rendering it, and Group Member Detail shows a warning rather than throwing when the member’s group is archived. This supersedes an initial same-day fix that only patched the symptom without hiding the archived group. (Fixes #7047) 247672a
• 2026-09-18 — (Core) Improved the Update Persisted Attribute Values job: fixed a SQL index so its lookups actually use it and fixed a bug that could cause it to update the wrong attribute’s persisted values, then further reduced the number of database queries the job issues per run so it finishes faster with less database load. b0c0fc8
• 2026-09-18 — (Event) Fixed the Obsidian Registration Entry block letting a paid registration submit with no payment method selected when the async cost-calculation request failed after the payment step had already rendered — the block now blocks submission and surfaces an error instead of silently proceeding. (Fixes #7048) 0c2fc65
• 2026-09-17 — (AI) Continued the experimental Code Composer Agent work: extended LavaApplicationBuilderSkill’s Lava-authoring tools and the AudienceMatchResult/LavaEndpointDetailResult/SecurityRoleResult payloads, and added a configurable Agent reasoning-level setting to ChatAgentImplementation/RockIntelligence. f852ca1
• 2026-09-17 — (CMS) Fixed the Content Channel Navigation Obsidian block not updating the browser URL when a channel or category is selected, so the current filtered view can now be shared as a link. 9db9821
• 2026-09-17 — Fixed the Rock installer’s Install.aspx so a ?Version= query-string override also controls which version folder the Rock payload itself downloads from (previously it only affected which installer-script folder was used), by introducing a separate installerVersion that both paths read from. 1ce2f2a
• 2026-09-17 — Modernized the Rock installer pages (Start.aspx, Install.aspx, Complete.aspx) to restore an external-CDN update from 2019 that had never reached Install.aspx: Bootstrap 3.4.1 and jQuery 1.12.4 now load from cdnjs with SRI integrity hashes, external links use HTTPS, and Complete.aspx’s hard-coded baseVersion is corrected from 2_9_0 to 2_9_5. Per the commit, these page changes still need to be manually copied into the 2_9_5 blob-storage folder the published installer downloads from. 6b57770
• 2026-09-16 — (CMS) Fixed the tree picker (treeListItem.obs, used by the Page Map picker among others) wrapping long item labels onto a second line instead of overflowing/truncating horizontally. d5fbba7
• 2026-09-16 — (CMS) Fixed the Content Channel Item List block taking minutes to load channels with many items: eager-loads the shared ContentChannel/ContentChannelType (and item slugs when an Item URL is configured) instead of lazy-loading them per row, and batches event-occurrence existence checks into a single query instead of one per item — eliminating an N+1 query pattern. (Fixes #7044) fb2adfc
• 2026-09-16 — Renamed the Activate Communication Flow workflow action’s “Communication Flow” setting to “Communication Flow Attribute” and clarified its description. 9a46f0b
• 2026-09-15 — (CRM) Fixed the Reminder List Reassign flyout dismissing itself when a person was selected in the PersonPicker search dialog — the flyout’s outside-click handler now also exempts clicks inside .person-picker-popup, matching the existing datepicker exemption. (Fixes #7040) 573a749
• 2026-09-15 — (AI) Added FindNearbyGroups and FindNearbyGroupsForMe tools to the AI Agent GroupSkill, letting agents locate groups near a location or near a person’s family, sorted by distance. eeca4db
• 2026-09-15 — (AI) Fixed the MCP endpoint erroring on a string JSON-RPC id (JSON-RPC 2.0 permits either a string or a number). JsonRpcRequest.Id and JsonRpcResult.Id now hold the raw JsonElement instead of a long? so the identifier’s original type is echoed back unchanged, and a malformed or non-object payload now produces a proper JSON-RPC error response instead of throwing. (Fixes #7039) 7d9a0c6
• 2026-09-15 — Fixed a null-reference exception in the Obsidian tooltip directive’s updated/beforeUnmount hooks when they ran on an element whose tooltip state had already been cleared. f509a7d
• 2026-09-14 — (Finance) Fixed the Print Statement button on Contribution Statements failing silently, by restoring print support to the Contribution Statement Generator’s statement display. (Fixes #7038) 230354b
• 2026-09-14 — (Communication) Fixed the color picker popup appearing behind the full-screen Email Builder in Communication Templates. (Fixes #6994) 0bc85e4
• 2026-09-14 — (Connection) Fixed the Connections Hub Additional Requests list so requests are ordered newest first instead of arbitrary database order. (Fixes #7018) c28539e
• 2026-09-14 — (Connection) Added a Workflows panel to the Connections Hub docked view listing the persisted workflows launched from the selected connection request (trigger, current activity, start date, status), with row click opening the workflow entry form or detail page. (Fixes #7036) 8b523d9
• 2026-09-14 — (Event) Fixed expired registration sessions blocking a registration from being deleted for up to 30 days after an abandoned redirect-gateway payment — the new RegistrationSessionService.RemoveExpiredSessionsForRegistration clears timed-out sessions before the delete’s CanDelete check runs. (Fixes #7033) 2252421
• 2026-09-14 — Fixed the Registration Instance Registrant List block throwing an error when a duplicate registrant existed and a Group Member or Person attribute value was displayed in the grid. 0b437fd
• 2026-09-14 — Fixed the PageListAsBlocks Lava template rendering an empty <ul> when a page has no child or included pages. ed3982e
• 2026-09-13 — Made Rock.Tests.Shared packable (IsPackable=True) so it now publishes to NuGet, letting plugin projects consume Rock’s shared test helpers as a package dependency instead of a project reference. 1630d47
• 2026-09-11 — Updated the Obsidian captcha control to reuse a single solved token across forms within the same workflow, caching it in sessionStorage and re-challenging slightly before real expiry to absorb clock skew. 8dceaa5
• 2026-09-11 — (Connection) Fixed the Connections Hub docked panel reopening on a previously drilled-into Additional Request after being closed and the same row re-selected. (Fixes #7035) 8cd639e
• 2026-09-11 — Added Connection Type and Limit to Assigned Connections block settings to the Connections Hub block. 4d112ee
• 2026-09-11 — (Communication) Fixed the Email Designer allowing sections to be nested deeply enough that Apple Mail on iOS drops the content, by warning the author whenever a section is placed inside another and highlighting the affected sections so they can be flattened. (Fixes #6995) b236c3b
• 2026-09-11 — Fixed the Email Designer leaving an orphaned gap after deleting a column from a section with a Gap Between Columns, and omitting the gap before a newly added column. 4f3ebf9
• 2026-09-11 — Tightened the Obsidian audit detail REST endpoint (ControlsController) to require EDIT access to the secured entity itself (or VIEW via a security grant token) instead of plain VIEW — covers entity types with no default security applied that would otherwise be open to all users. 6e01267
• 2026-09-10 — Removed references to the New Communication (Legacy) page: repointed the Connection Request Detail block’s SMS Link Page default to the current New Communication page, removed obsolete legacy detail-page routing and dead template-version plumbing from the Communication List block, and corrected a stale doc comment. 57e752e
• 2026-09-10 — (Communication) Fixed One-Time Communication Flows ignoring changes to the flow’s start date made before the first communication is sent. The flow’s instance now updates as soon as it’s saved, and the Process Communication Flows job also realigns it. (Fixes #7006) 3b12d9b
• 2026-09-10 — Fixed Group Type Detail hiding the Edit button on system group types even though some properties on them remain editable. 650ad13
• 2026-09-10 — Added a self-provisioning Orphaned Pages system page, and updated MigrationHelper.DeletePage to re-parent child pages to it before deleting a parent — page deletions no longer fail on the ParentPageId foreign key. Relevant for any plugin migration that deletes pages with children. d383fe2
• 2026-09-09 — Added an experimental Code Composer Agent, building on the new ForgeContent/CMS AI skill work — includes Lava Application and Lava Endpoint management results and a security-role matching result for the agent. 532774d
• 2026-09-09 — Fixed the Connection Request Entry block offering connection opportunities that the visitor was not authorized to view. (Fixes #7030) 074e2e3
• 2026-09-09 — Fixed the PMM v1 sunset migration to remove [Auth] records referencing the PMM EntityType before deleting it, preventing an FK violation on installs with per-component Auth rows. d2f02e5
• 2026-09-08 — Fixed the HTML Editor endlessly resizing when edited in a browser with the Grammarly extension active. (Fixes #7013) 2ee93ae
• 2026-09-08 — (CRM) Fixed the Bulk Update block not accepting a value for Matrix attributes — the “add item” form opened with no fields to complete, so it could only save an empty item. Affected the Person, Group Member, and Step attribute sections of the block. (Fixes #7024) a1b3c81
• 2026-09-08 — Added an IsSystem property to AI Agents so Rock-provided agents cannot be deleted and their instructions cannot be edited. b827644
• 2026-09-08 — (CMS) Fixed UTM interaction data not being recorded on the Content Channel Item View block when the request came in on a domain not registered for the Website. (Fixes #7026) b3e52d8
• 2026-09-04 — (CRM) Fixed the Bulk Update block not adding anyone to the selected group when the Group Role was left blank — the Role dropdown now pre-selects the Group Type’s default or first Role. (Fixes #7023) eb0374a

Published

• 2026-09-09 — (Communication) Fixed the Communication Entry Wizard preview not resolving additional merge fields for the sample recipient (Fixes #7028), and fixed the wizard’s Next button doing nothing on the Choose Template step when the individual’s preferred SMS or Push Notification template was already selected. (Fixes #7025) c8364eb (notes: v21.0.1, 2026-09-10)
• 2026-09-09 — (Finance) Fixed newly added adults defaulting to individual giving instead of combined family giving when added to a family through check-in or event registration. (Fixes #7021) 3252c9f (notes: v21.0.1, 2026-09-10)
• 2026-09-08 — (Group) Fixed Group Schedule Confirmations and Reminders failing to send when an attendance was marked “Scheduled to Attend” on an occurrence that had no schedule. (Fixes #7032) fb0b2bf (notes: v21.0.1, 2026-09-10)
• 2026-09-08 — (Communication) Fixed the Email Builder producing emails with a blank scrollable area below the content in some mobile mail clients such as iOS Mail. (Fixes #7004) 2236738 (notes: v21.0.1, 2026-09-10)
• 2026-09-04 — (Group) Fixed the Group Attendance Detail block getting stuck on today’s date when opened from a link that pre-selects a Location or Schedule. (Fixes #7009) 7c78d70 (notes: v21.0.1, 2026-09-10)
• 2026-09-03 — (Core) Fixed the Image Browser and File Browser buttons on HTML field type attributes opening an empty, unresponsive pop-up when used on Obsidian-based blocks, which prevented choosing an image or file. (Fixes #7020) f258774 (notes: v21.0.1, 2026-09-10)
• 2026-09-03 — (Finance) Fixed Benevolence Type Workflow triggers being ignored until the Rock Cache was cleared, and improved the Benevolence Request Detail block to show Benevolence Result Attributes marked “Show in Grid” as grid columns and to allow editing existing Benevolence Results. (Fixes #7019) 7996f49 (notes: v21.0.1, 2026-09-10)
• 2026-09-03 — (Check-in) Added a Skip Screen Behavior kiosk setting to control when the area skip screen is shown during check-in. (Fixes #6964) 3facd56 (notes: v21.0.1, 2026-09-10)
• 2026-09-03 — (Lava) Fixed the Address Lava filter returning nothing for a person marked as deceased. (Fixes #7017) 294b3e1 (notes: v21.0.1, 2026-09-10)
• 2026-09-03 — (Core) Fixed plugin loading so a single incompatible plugin component is skipped and logged instead of preventing Rock from starting. 654cb8a (notes: v20.0, 2026-09-02)
• 2026-09-02 — (Event) Fixed the Event Wizard requiring a Financial Account for registration templates that have no financial gateway configured. (Fixes #7015) 16546a1 (notes: v21.0.1, 2026-09-10)
• 2026-09-02 — (Finance) Fixed the Benevolence Request Detail block so Benevolence Result Entity Attributes are shown and saved when adding a Result. (Fixes #7008) a721c03 (notes: v21.0.1, 2026-09-10)
• 2026-09-02 — (Check-in) Fixed an issue in Next-Gen Check-in where the override option allowed a Location’s absolute attendance threshold to be exceeded by one person. (Fixes #7012) 4316c09 (notes: v21.0.1, 2026-09-10)

v19 (hotfixes)

hotfix-19.5

⚠️ In code, not in release notes

• 2026-09-18 — (Housekeeping) hotfix-19.5 merged forward the accumulated hotfix-17.6–hotfix-17.9 and hotfix-18.5 fix lines, which weren’t previously part of this branch’s ancestry; that merge then flowed into hotfix-20.1 via release-20.0. Those older fixes already shipped in their original hotfix releases months ago and aren’t re-listed here — noted so the sudden SHA jump in this file’s tracked history is explained. 6e702aa
• 2026-09-18 — (Security) Fixed the legacy Group Detail Lava block’s group-member postback handlers (save, delete, and other member actions) so they require the current person to have Edit or Manage Members authorization on the specific group, and scope the member lookup to that group — previously the handlers acted on an unscoped member Id with no authorization check, letting any user who could reach the block edit or delete a GroupMember in an arbitrary group. 04a6cd3
• 2026-09-18 — (Security) GroupCache.IsAuthorized now applies the same group-role-based authorization fallback (CanView/CanEdit/CanManageMembers/CanTakeAttendance) that the Group entity already applied, fixing cases where authorization checks made through the cached GroupCache (instead of the live Group) incorrectly denied access to a group member whose role should have granted it. d471d13
• 2026-09-18 — (Security) Fixed the legacy (WebForms) Communication List Subscribe block trusting a posted group Id without verifying it was actually a communication list the person is authorized to view — a new IsAuthorizedCommunicationList check now gates both the visible list and the subscribe/unsubscribe action, matching the equivalent fix already made to the Obsidian version of this block. b1b8e7f
• 2026-09-17 — (API) Closed an authorization bypass in the base v1 REST POST (insert) endpoint: ApiController<T> only re-checked EDIT authorization by reloading the entity by Id, which is 0 for a brand-new record, so the check silently no-opped for every insert. A new IsAuthorizedForNewModel helper builds a scratch proxy from the posted values so parent-authority checks now evaluate before an insert is allowed. faf80da
• 2026-09-17 — (API) GroupMembersController now overrides Post to explicitly authorize a new GroupMember against its target Group via GroupMember.IsAuthorized, and to reject inserts into security-role groups outright — previously the base controller’s Id-based reload check was skipped for new records, so any authenticated caller could add members (including to security roles) to any group through this endpoint. a369577
• 2026-09-17 — (Security) GetFile.ashx and GetImage.ashx now send Content-Security-Policy: default-src 'none'; sandbox allow-downloads and X-Content-Type-Options: nosniff on every response, and GetImage.ashx rejects any BinaryFile whose stored MIME type isn’t image/*. Closes a stored-XSS path where a file uploaded with an attacker-controlled MIME type (e.g. text/html or image/svg+xml) could execute script in the Rock origin when viewed inline. 9f651a0
• 2026-09-17 — (Communication) Reworked CommunicationListSubscribe to resolve the authorized Communication Lists a person can subscribe to through the entity cache instead of re-querying and re-authorizing entities directly, and consolidated several separate queries into fewer round-trips. 02b46d1
• 2026-09-16 — (CMS) Fixed the Public Profile Edit block so the server now blocks email address and email-preference changes to a family member whose Account Protection Profile is High or Extreme — the disabled client-side control didn’t stop the value from arriving on postback, so the restriction could previously be bypassed. d96a9dd
• 2026-09-16 — (CMS) Fixed the Public Profile Edit block so a save is limited to groups that are actually the current person’s own families — IsFamilyGroupForCurrentPerson now checks Person.GetFamilies() instead of merely checking group membership, closing a path where a group merely shared with the person being edited (not a family of the editor) could be saved. 0ee19f3
• 2026-09-16 — (CRM) Fixed the Photo Upload block so the server enforces whose photos an individual may upload — UpdatePersonProfilePhoto now re-derives the eligible candidate list (self, plus family members when enabled, minus staff members when disallowed) instead of trusting any personIdKey passed to the block action. e63fc7e
• 2026-09-14 — Updated the RockInstaller’s Start.aspx and Install.aspx pages, stale since v16.x, to match the current installer output; the 2_9_5 installer folder itself is unchanged and remains in use. ac1b78f
• 2026-09-11 — Tightened the Obsidian audit detail REST endpoint (ControlsController) to require EDIT access to the secured entity itself (or VIEW via a security grant token) instead of plain VIEW — covers entity types with no default security applied that would otherwise be open to all users. 63ca17e
• 2026-09-01 — (Reporting) Fixed the Total Giving report field so the Amount box appears when using Obsidian components, instead of only appearing after disabling them on the block. (Fixes DEV-15310) ba65c04
• 2026-08-31 — Fixed the Markdown attribute field to allow basic HTML. 66cb7a5
• 2026-08-28 — Fixed the Page Debug Timings modal so closing it removes the ShowDebugTimings query string parameter, which had been causing the modal to reappear unintentionally on every page refresh. 25bdf49

Published

• 2026-09-02 — (Communication) Fixed the Internal Communication View block so the Previous button pages through all older items instead of stopping at the second-newest item and hiding the Previous arrow. (Fixes #7014) d9e099c (notes: v21.0.1, 2026-09-10)
• 2026-09-01 — (Communication) Fixed communications with no recipients being missing from the Communication List block, leaving drafts saved before any recipients were added with no way to return to them. (Fixes #6979) 7298503 (notes: v21.0.1, 2026-09-10)
• 2026-09-01 — (Workflow) Fixed the SMS Opt-In consent checkbox still appearing on the Person Entry block in Obsidian Workflow Entry even when that setting is set to Hide. When SMS Opt-In is hidden, new mobile numbers entered on the form are now saved with messaging enabled by default, matching the WebForms block’s behavior. (Fixes #7010) 8c8e460 (notes: v21.0.1, 2026-09-10)
• 2026-09-01 — (Core) Fixed the Obsidian Grid’s Merge Template and other Entity Set actions ignoring the grid’s displayed row order — merged output now matches the order shown in the grid. (Fixes #6997) beac2a5 (notes: v21.0.1, 2026-09-10)
• 2026-08-31 — (Group) Fixed copying a group also copying its chat channel key, causing both groups to share one chat conversation and send new members to the wrong group’s roster (and causing the Chat Sync job to error on every run). Affected copies have their chat channel keys cleared automatically during the update — a data-fix migration ships with this hotfix. (Fixes #7007) 4821425 (notes: v21.0.1, 2026-09-10)
• 2026-08-31 — (Workflow) Fixed the Campus dropdown on the Obsidian Workflow Entry block’s Person Entry step listing campuses by ID instead of their configured order. (Fixes #7000) 612cf8e (notes: v21.0.1, 2026-09-10)
• 2026-08-31 — (CMS) Fixed missing source map (.map) file requests redirecting to the site’s Page Not Found page, which could flood the Interaction and Exception Logs with unwanted entries. (Fixes #7005) bbc7f16 (notes: v21.0.1, 2026-09-10)
• 2026-08-31 — (Lava) Fixed the Defined Value Picker and Campus Picker Lava shortcodes truncating any value containing an apostrophe. (Fixes #7003) e271b95 (notes: v21.0.1, 2026-09-10)
• 2026-08-28 — (Lava) Fixed an error that prevented non-administrators from running a Lava Application endpoint when the “RSR - Lava Application Developer” security role was inactive — previously, an inactive role caused an error before permissions were even checked, blocking access for everyone except Rock Administrators. (Fixes #7002) 0f9cc16 (notes: v21.0.1, 2026-09-10)
• 2026-08-28 — (Engagement) Fixed Sign-Up pages showing an error screen instead of loading when a group’s schedule was set to repeat with no end date and was also marked inactive, which left Rock looking ahead through an endless series of dates. (Fixes #6999) b6838a5 (notes: v21.0.1, 2026-09-10)