LoginSign Up
← Back to all sparks
G

Greenlight

MEETINGS
Velocity2.5

Simple front-end for managing BigBlueButton web conferencing rooms

docs.bigbluebutton.org/greenlight/v3/install ↗

Greenlight 3.9.1 fixes a critical upload flaw and tells admins to rotate secrets.

video-conferencingbigbluebuttonself-hostedsecurityopen-source
◆Current state
Greenlight, the BigBlueButton web frontend, released 3.9.1 on Nov 5 to fix a critical flaw: through a Rails Active Storage issue, a user able to upload an avatar or presentation could read or write files on the server. The fix comes from Rails 8.0.5.2's stricter ImageMagick policy, and instances storing uploads on local disk are told to rotate SECRET_KEY_BASE, database, BigBlueButton and other credentials.
◆Where it's heading
The project remains in security maintenance: gem updates, a breaking URL_HOST requirement in 3.9.0 and now an urgent patch. Feature work has been rare since the invitation changes in April.
◆Prediction
Expect more dependency-driven security releases; new features look unlikely from the recent pattern.

◆Recent moves

  1. 8d ago

    Greenlight 3.9.1 fixes critical file read/write via uploads

    A critical fix for arbitrary file read and write through image uploads, with instructions to rotate secrets on local-disk installs. It is the most urgent release in the maintenance run that began with 3.9.0.

    View source ↗
  2. 2mo ago

    Greenlight 3.9.0.1: startup crash hotfix

    A missing library that caused application crashes on startup after the 3.9.0 release was patched hours later. This is a reactive hotfix — the kind that follows a release that shipped with insufficient startup testing. No new functionality.

    View source ↗
  3. 2mo ago

    Greenlight 3.9.0: mandatory URL_HOST and undisclosed security fixes

    Greenlight 3.9.0 introduces a breaking change requiring URL_HOST in the deployment environment, multiple undisclosed security fixes, and several bug fixes including maintenance banner display and email server timeout handling. The URL_HOST requirement is the most operationally significant change — self-hosted operators must update their configuration before upgrading or the app will not start.

    View source ↗
  4. 3mo ago

    Greenlight 3.8.2.4: security gem updates

    Security gem updates and language translations. Routine maintenance with no user-visible functional changes.

    View source ↗
  5. 6mo ago

    Greenlight 3.8.2.3: security updates and translations

    Security gem updates and language translation updates. Another iteration of the recurring maintenance pattern in the 3.8.x series.

    View source ↗
  6. 6mo ago

    Greenlight 3.8.2.2: HTML support in maintenance banner

    HTML tag support added to the maintenance banner text. A minor UX improvement for operators who want formatted maintenance notices — no impact on end users or core functionality.

    View source ↗