Rock RMS Developer Changelog

A running digest of notable developer-facing changes across Rock RMS’s currently-active major versions — the pre-alpha branch plus every hotfix branch from the current General-release floor up through the newest — cross-referenced against the public pre-alpha and release notes pages to surface changes that are in the code but not yet written up for administrators.

What the tags mean

: May require action on upgrade — a behavior, API, or default changed in a way that can affect existing code or configuration.
: A database table, column, or index was added or changed — relevant if you query or report against Rock’s database directly.
: A new or changed REST endpoint, block action, or public helper method that plugin and integration developers call directly.

Click a tag to filter the list to just those entries. An entry can carry more than one tag; untagged entries are routine fixes or improvements that shouldn't require any action on your part.

v21 (pre-alpha)

⚠️ In code, not in release notes

2026-09-09 — BREAKING Obsidian block conversions: added the SignUpDetail, ConnectionOpportunitySearch, and ContributionStatementListLava Obsidian blocks, each chopping (removing) the corresponding legacy WebForms block. 8b47a49
2026-09-09 — Consolidated Obsidian attribute filtering into a shared helper, fixing filters that were being silently dropped. 6f47204
2026-09-09 — API MigrationHelper.DeleteEntityType now removes referencing [Auth] records before deleting the [EntityType], preventing FK_dbo.Auth_dbo.EntityType_EntityTypeId violations on future EntityType deletions. Useful pattern for plugin migrations that delete entity types. f5beae1
2026-09-09 — Improved Lava test suite performance by 2-3x. 02d1b48
2026-09-08 — BREAKING Added the Obsidian DataAutomationSettings block and chopped the legacy WebForms version. abf35fb
2026-09-08 — API Converted usages of new RockContext() to the new RockApp.Current.CreateRockContext() pattern across the codebase — the preferred way to obtain a RockContext going forward. 4746cfd
2026-09-04 — Fixed the Edit Person block not actually enforcing its “Require Full Birthdate” block attribute. 76ef734
2026-09-04 — BREAKING Group Member Detail block converted to Obsidian. 29b09ad
2026-09-03 — Added an opt-in Select All to the Obsidian GroupPicker (via treeItemPicker) and enabled it on the Check-in Manager En Route block, matching the WebForms picker’s behavior. b910be4
2026-09-02 — Improved the RedirectConnectionRequestDetailToHub migration to seed attribute values with the Hub’s default page route for any values that were missing. 6dd8e52
2026-09-02 — Improved the Obsidian Group Type Map block’s rendering in dark/light mode. ee51b72
2026-09-01 — Fixed a migration issue that was preventing clean databases from being created successfully, which was also causing integration tests to fail. 053c1c1
2026-09-01 — API Expanded the Rock AI Agent framework: added ListWorkflow/GetWorkflow tools to the WorkflowSkill and roughly 45 additional AI tools across existing skills (notably the CMS skill). 43facba
2026-09-01 — Improved user-agent parser cache-hit performance by moving the size-cap check off the hot path, avoiding a locking ConcurrentDictionary.Count call on every parse. Also fixed a null-reference exception in the same parser when a request had no User-Agent header. 3483353
2026-08-31 — Fixed the Markdown attribute field to allow basic HTML. 66cb7a5
2026-08-30 — Fixed several Connection Request Entry block issues found in QA. cb2963e
2026-08-28 — Restored legacy parity in the Obsidian Mobile Check-in Launcher block: kiosks configured to print from the server now print immediately when check-in completes on the phone, before any QR code is scanned. 642561c
2026-08-28 — BREAKING Chopped the legacy Communication Entry Wizard block and obsoleted the legacy New Communication page guid. 641531a
2026-08-28 — Added Event Personalization Filtering for Calendar surfaces. c4db487
2026-08-28 — BREAKING Added the Obsidian GroupTypeMap block and chopped the legacy WebForms version. 115b77f
2026-08-28 — API Redirected core Connection Request links to the new Connections Hub, and taught the legacy Connection Request Detail page to accept the Hub’s page parameter names. Also added support for deep-linking to the Hub with the Add Connection Request modal pre-opened and preselected by Connection Type or Opportunity. d7c608e

v20 (hotfixes)

hotfix-20.1

⚠️ In code, not in release notes

2026-09-21 — Fixed the Obsidian Workflow Entry block masking a workflow-processing error with a carried-over “submitted successfully” message from an earlier form action: a workflow error (e.g. a Send Email action failing on a bad SMTP server) now always takes precedence and is shown as a bulleted list, matching WebForms’ behavior instead of hiding the failure behind a false success message. ea00325
2026-09-21 — (Event) Fixed the Calendar Event Item Occurrence List block omitting Event Item Occurrence attributes marked “Show in Grid” when the attribute wasn’t qualified to a specific Calendar/Event Item. (Fixes #7053) a3b6231
2026-09-21 — Fixed the Dynamic Report block persisting a normalized version of a filter selection back to its underlying Data View, which could silently change the filter’s comparison type (e.g. “Starts With” becoming “Contains”) every time the report was viewed. 7b992d8
2026-09-18 — (Event/Group) Fixed the Registration Detail and Group Member Detail blocks erroring or showing a blank link when a registrant’s group had been archived: Registration Detail now hides the group link once its group is archived, Group Detail treats an archived group as not found (with a warning) instead of rendering it, and Group Member Detail shows a warning rather than throwing when the member’s group is archived. This supersedes an initial same-day fix that only patched the symptom without hiding the archived group. (Fixes #7047) 247672a
2026-09-18 — SCHEMA (Core) Improved the Update Persisted Attribute Values job: fixed a SQL index so its lookups actually use it and fixed a bug that could cause it to update the wrong attribute’s persisted values, then further reduced the number of database queries the job issues per run so it finishes faster with less database load. b0c0fc8
2026-09-18 — (Event) Fixed the Obsidian Registration Entry block letting a paid registration submit with no payment method selected when the async cost-calculation request failed after the payment step had already rendered — the block now blocks submission and surfaces an error instead of silently proceeding. (Fixes #7048) 0c2fc65
2026-09-17 — API (AI) Continued the experimental Code Composer Agent work: extended LavaApplicationBuilderSkill’s Lava-authoring tools and the AudienceMatchResult/LavaEndpointDetailResult/SecurityRoleResult payloads, and added a configurable Agent reasoning-level setting to ChatAgentImplementation/RockIntelligence. f852ca1
2026-09-17 — (CMS) Fixed the Content Channel Navigation Obsidian block not updating the browser URL when a channel or category is selected, so the current filtered view can now be shared as a link. 9db9821
2026-09-17 — Fixed the Rock installer’s Install.aspx so a ?Version= query-string override also controls which version folder the Rock payload itself downloads from (previously it only affected which installer-script folder was used), by introducing a separate installerVersion that both paths read from. 1ce2f2a
2026-09-17 — Modernized the Rock installer pages (Start.aspx, Install.aspx, Complete.aspx) to restore an external-CDN update from 2019 that had never reached Install.aspx: Bootstrap 3.4.1 and jQuery 1.12.4 now load from cdnjs with SRI integrity hashes, external links use HTTPS, and Complete.aspx’s hard-coded baseVersion is corrected from 2_9_0 to 2_9_5. Per the commit, these page changes still need to be manually copied into the 2_9_5 blob-storage folder the published installer downloads from. 6b57770
2026-09-16 — (CMS) Fixed the tree picker (treeListItem.obs, used by the Page Map picker among others) wrapping long item labels onto a second line instead of overflowing/truncating horizontally. d5fbba7
2026-09-16 — (CMS) Fixed the Content Channel Item List block taking minutes to load channels with many items: eager-loads the shared ContentChannel/ContentChannelType (and item slugs when an Item URL is configured) instead of lazy-loading them per row, and batches event-occurrence existence checks into a single query instead of one per item — eliminating an N+1 query pattern. (Fixes #7044) fb2adfc
2026-09-16 — Renamed the Activate Communication Flow workflow action’s “Communication Flow” setting to “Communication Flow Attribute” and clarified its description. 9a46f0b
2026-09-15 — (CRM) Fixed the Reminder List Reassign flyout dismissing itself when a person was selected in the PersonPicker search dialog — the flyout’s outside-click handler now also exempts clicks inside .person-picker-popup, matching the existing datepicker exemption. (Fixes #7040) 573a749
2026-09-15 — API (AI) Added FindNearbyGroups and FindNearbyGroupsForMe tools to the AI Agent GroupSkill, letting agents locate groups near a location or near a person’s family, sorted by distance. eeca4db
2026-09-15 — API (AI) Fixed the MCP endpoint erroring on a string JSON-RPC id (JSON-RPC 2.0 permits either a string or a number). JsonRpcRequest.Id and JsonRpcResult.Id now hold the raw JsonElement instead of a long? so the identifier’s original type is echoed back unchanged, and a malformed or non-object payload now produces a proper JSON-RPC error response instead of throwing. (Fixes #7039) 7d9a0c6
2026-09-15 — Fixed a null-reference exception in the Obsidian tooltip directive’s updated/beforeUnmount hooks when they ran on an element whose tooltip state had already been cleared. f509a7d
2026-09-14 — (Finance) Fixed the Print Statement button on Contribution Statements failing silently, by restoring print support to the Contribution Statement Generator’s statement display. (Fixes #7038) 230354b
2026-09-14 — (Communication) Fixed the color picker popup appearing behind the full-screen Email Builder in Communication Templates. (Fixes #6994) 0bc85e4
2026-09-14 — (Connection) Fixed the Connections Hub Additional Requests list so requests are ordered newest first instead of arbitrary database order. (Fixes #7018) c28539e
2026-09-14 — (Connection) Added a Workflows panel to the Connections Hub docked view listing the persisted workflows launched from the selected connection request (trigger, current activity, start date, status), with row click opening the workflow entry form or detail page. (Fixes #7036) 8b523d9
2026-09-14 — API (Event) Fixed expired registration sessions blocking a registration from being deleted for up to 30 days after an abandoned redirect-gateway payment — the new RegistrationSessionService.RemoveExpiredSessionsForRegistration clears timed-out sessions before the delete’s CanDelete check runs. (Fixes #7033) 2252421
2026-09-14 — Fixed the Registration Instance Registrant List block throwing an error when a duplicate registrant existed and a Group Member or Person attribute value was displayed in the grid. 0b437fd
2026-09-14 — Fixed the PageListAsBlocks Lava template rendering an empty <ul> when a page has no child or included pages. ed3982e
2026-09-13 — API Made Rock.Tests.Shared packable (IsPackable=True) so it now publishes to NuGet, letting plugin projects consume Rock’s shared test helpers as a package dependency instead of a project reference. 1630d47
2026-09-11 — Updated the Obsidian captcha control to reuse a single solved token across forms within the same workflow, caching it in sessionStorage and re-challenging slightly before real expiry to absorb clock skew. 8dceaa5
2026-09-11 — (Connection) Fixed the Connections Hub docked panel reopening on a previously drilled-into Additional Request after being closed and the same row re-selected. (Fixes #7035) 8cd639e
2026-09-11 — Added Connection Type and Limit to Assigned Connections block settings to the Connections Hub block. 4d112ee
2026-09-11 — (Communication) Fixed the Email Designer allowing sections to be nested deeply enough that Apple Mail on iOS drops the content, by warning the author whenever a section is placed inside another and highlighting the affected sections so they can be flattened. (Fixes #6995) b236c3b
2026-09-11 — Fixed the Email Designer leaving an orphaned gap after deleting a column from a section with a Gap Between Columns, and omitting the gap before a newly added column. 4f3ebf9
2026-09-11 — BREAKING API Tightened the Obsidian audit detail REST endpoint (ControlsController) to require EDIT access to the secured entity itself (or VIEW via a security grant token) instead of plain VIEW — covers entity types with no default security applied that would otherwise be open to all users. 6e01267
2026-09-10 — Removed references to the New Communication (Legacy) page: repointed the Connection Request Detail block’s SMS Link Page default to the current New Communication page, removed obsolete legacy detail-page routing and dead template-version plumbing from the Communication List block, and corrected a stale doc comment. 57e752e
2026-09-10 — (Communication) Fixed One-Time Communication Flows ignoring changes to the flow’s start date made before the first communication is sent. The flow’s instance now updates as soon as it’s saved, and the Process Communication Flows job also realigns it. (Fixes #7006) 3b12d9b
2026-09-10 — Fixed Group Type Detail hiding the Edit button on system group types even though some properties on them remain editable. 650ad13
2026-09-10 — API Added a self-provisioning Orphaned Pages system page, and updated MigrationHelper.DeletePage to re-parent child pages to it before deleting a parent — page deletions no longer fail on the ParentPageId foreign key. Relevant for any plugin migration that deletes pages with children. d383fe2
2026-09-09 — API Added an experimental Code Composer Agent, building on the new ForgeContent/CMS AI skill work — includes Lava Application and Lava Endpoint management results and a security-role matching result for the agent. 532774d
2026-09-09 — Fixed the Connection Request Entry block offering connection opportunities that the visitor was not authorized to view. (Fixes #7030) 074e2e3
2026-09-09 — Fixed the PMM v1 sunset migration to remove [Auth] records referencing the PMM EntityType before deleting it, preventing an FK violation on installs with per-component Auth rows. d2f02e5
2026-09-08 — Fixed the HTML Editor endlessly resizing when edited in a browser with the Grammarly extension active. (Fixes #7013) 2ee93ae
2026-09-08 — (CRM) Fixed the Bulk Update block not accepting a value for Matrix attributes — the “add item” form opened with no fields to complete, so it could only save an empty item. Affected the Person, Group Member, and Step attribute sections of the block. (Fixes #7024) a1b3c81
2026-09-08 — SCHEMA Added an IsSystem property to AI Agents so Rock-provided agents cannot be deleted and their instructions cannot be edited. b827644
2026-09-08 — (CMS) Fixed UTM interaction data not being recorded on the Content Channel Item View block when the request came in on a domain not registered for the Website. (Fixes #7026) b3e52d8
2026-09-04 — (CRM) Fixed the Bulk Update block not adding anyone to the selected group when the Group Role was left blank — the Role dropdown now pre-selects the Group Type’s default or first Role. (Fixes #7023) eb0374a

v19 (hotfixes)

hotfix-19.5

⚠️ In code, not in release notes

2026-09-18 — (Housekeeping) hotfix-19.5 merged forward the accumulated hotfix-17.6–hotfix-17.9 and hotfix-18.5 fix lines, which weren’t previously part of this branch’s ancestry; that merge then flowed into hotfix-20.1 via release-20.0. Those older fixes already shipped in their original hotfix releases months ago and aren’t re-listed here — noted so the sudden SHA jump in this file’s tracked history is explained. 6e702aa
2026-09-18 — (Security) Fixed the legacy Group Detail Lava block’s group-member postback handlers (save, delete, and other member actions) so they require the current person to have Edit or Manage Members authorization on the specific group, and scope the member lookup to that group — previously the handlers acted on an unscoped member Id with no authorization check, letting any user who could reach the block edit or delete a GroupMember in an arbitrary group. 04a6cd3
2026-09-18 — (Security) GroupCache.IsAuthorized now applies the same group-role-based authorization fallback (CanView/CanEdit/CanManageMembers/CanTakeAttendance) that the Group entity already applied, fixing cases where authorization checks made through the cached GroupCache (instead of the live Group) incorrectly denied access to a group member whose role should have granted it. d471d13
2026-09-18 — (Security) Fixed the legacy (WebForms) Communication List Subscribe block trusting a posted group Id without verifying it was actually a communication list the person is authorized to view — a new IsAuthorizedCommunicationList check now gates both the visible list and the subscribe/unsubscribe action, matching the equivalent fix already made to the Obsidian version of this block. b1b8e7f
2026-09-17 — BREAKING API (API) Closed an authorization bypass in the base v1 REST POST (insert) endpoint: ApiController<T> only re-checked EDIT authorization by reloading the entity by Id, which is 0 for a brand-new record, so the check silently no-opped for every insert. A new IsAuthorizedForNewModel helper builds a scratch proxy from the posted values so parent-authority checks now evaluate before an insert is allowed. faf80da
2026-09-17 — BREAKING API (API) GroupMembersController now overrides Post to explicitly authorize a new GroupMember against its target Group via GroupMember.IsAuthorized, and to reject inserts into security-role groups outright — previously the base controller’s Id-based reload check was skipped for new records, so any authenticated caller could add members (including to security roles) to any group through this endpoint. a369577
2026-09-17 — BREAKING (Security) GetFile.ashx and GetImage.ashx now send Content-Security-Policy: default-src 'none'; sandbox allow-downloads and X-Content-Type-Options: nosniff on every response, and GetImage.ashx rejects any BinaryFile whose stored MIME type isn’t image/*. Closes a stored-XSS path where a file uploaded with an attacker-controlled MIME type (e.g. text/html or image/svg+xml) could execute script in the Rock origin when viewed inline. 9f651a0
2026-09-17 — (Communication) Reworked CommunicationListSubscribe to resolve the authorized Communication Lists a person can subscribe to through the entity cache instead of re-querying and re-authorizing entities directly, and consolidated several separate queries into fewer round-trips. 02b46d1
2026-09-16 — (CMS) Fixed the Public Profile Edit block so the server now blocks email address and email-preference changes to a family member whose Account Protection Profile is High or Extreme — the disabled client-side control didn’t stop the value from arriving on postback, so the restriction could previously be bypassed. d96a9dd
2026-09-16 — (CMS) Fixed the Public Profile Edit block so a save is limited to groups that are actually the current person’s own families — IsFamilyGroupForCurrentPerson now checks Person.GetFamilies() instead of merely checking group membership, closing a path where a group merely shared with the person being edited (not a family of the editor) could be saved. 0ee19f3
2026-09-16 — (CRM) Fixed the Photo Upload block so the server enforces whose photos an individual may upload — UpdatePersonProfilePhoto now re-derives the eligible candidate list (self, plus family members when enabled, minus staff members when disallowed) instead of trusting any personIdKey passed to the block action. e63fc7e
2026-09-14 — Updated the RockInstaller’s Start.aspx and Install.aspx pages, stale since v16.x, to match the current installer output; the 2_9_5 installer folder itself is unchanged and remains in use. ac1b78f
2026-09-11 — BREAKING API Tightened the Obsidian audit detail REST endpoint (ControlsController) to require EDIT access to the secured entity itself (or VIEW via a security grant token) instead of plain VIEW — covers entity types with no default security applied that would otherwise be open to all users. 63ca17e
2026-09-01 — (Reporting) Fixed the Total Giving report field so the Amount box appears when using Obsidian components, instead of only appearing after disabling them on the block. (Fixes DEV-15310) ba65c04
2026-08-31 — Fixed the Markdown attribute field to allow basic HTML. 66cb7a5
2026-08-28 — Fixed the Page Debug Timings modal so closing it removes the ShowDebugTimings query string parameter, which had been causing the modal to reappear unintentionally on every page refresh. 25bdf49

v18 (hotfixes)

hotfix-18.5

⚠️ In code, not in release notes

2026-09-22 — (Housekeeping) Started tracking hotfix-18.5 as part of extending coverage down to the current General-release floor (v17, per rockrms.com/releasenotes). Every commit found in its last ~14 days of history was already merged forward into and documented under hotfix-19.5 (see the v19 section) or is a duplicate cherry-pick of an entry already listed there, so no new bullets were needed on this first pass. Given this branch’s topology — fixes typically land on the oldest maintained hotfix branch first and merge forward through 18.5 → 19.5 → 20.1 — expect most future hotfix-18.5 entries to already be covered by the newer branches’ sections; only genuinely 18.5-exclusive changes will get their own bullet here. fa160bb

v17 (hotfixes)

hotfix-17.9

⚠️ In code, not in release notes

2026-09-22 — (Housekeeping) Started tracking hotfix-17.9, the current General-release branch (v17.8 per rockrms.com/releasenotes) and the new floor for this changelog’s coverage. Every commit found in its last ~14 days of history was already merged forward into and documented under hotfix-19.5/hotfix-18.5 (see the v19 section) or is a duplicate cherry-pick of an entry already listed there, so no new bullets were needed on this first pass. Expect the same going forward: this branch mostly originates fixes that later show up merged into the newer hotfix branches, so entries here should be rare and specific to v17. 04a6cd3