⚠️ Authentication changes in Rocket.Chat 9.0.0

LDAP, SAML, and Custom OAuth now require a premium plan, and Drupal, Facebook, LinkedIn, Meteor, X (formerly Twitter), WordPress, and Dolphin logins are removed. Community workspaces that use any of these must upgrade their plan or move users to a supported login method before updating, or those users won't be able to log in.

Supported on every plan, including Community

• Local login (username or email and password)
• Google, GitHub, GitLab, Apple, and Nextcloud

Premium plans only (Starter, Commercial, Government, and Defense)

• LDAP, SAML, and Custom OAuth

Eligible organizations with up to 50 users can switch to the free Starter plan.

Before you update: make sure at least one administrator can log in with a local username and password.

Preparation steps and how to recover access: Prepare for Authentication Changes in 9.0.0

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.68.0-rc.0

Major Changes

• (#41054) Removes /ufs legacy endpoint for downloading files

• (#42477) Makes Custom OAuth authentication a Premium feature, gated by the oauth-enterprise license module. On workspaces without it, the enable setting of every Custom OAuth service falls back to false, Custom OAuth logins are refused, and settings.addCustomOAuth and the addOAuthService method return error-action-not-allowed. Built-in OAuth providers (GitHub, GitLab, Google, …) are not affected.

• (#41382) Indexes the push token string by storing each token as a flat tokenValue/tokenType pair, with VoIP tokens now kept in their own document instead of as an extra field on the device token. Changes the POST /v1/push.token response to return flat tokenValue and tokenType fields instead of the nested token object.

• (#43038) Enforce channel membership checks in /rooms.createDiscussion API for creating discussions in public channels.

• (#40142) Breaking: Stopped transpiling webhook integration scripts with Babel. Scripts now run as-is inside isolated-vm (modern V8).

  Class method bodies are now in strict mode per the ES2015 spec. Scripts that relied on sloppy-mode behaviors provided by the previous Babel transpilation must be updated:

  • Implicit globals — msg = buildMessage(...) inside a class method now throws ReferenceError. Add let, const, or var.
  • this in nested regular functions — function helper() { this.JSON.stringify(...) } now has this === undefined instead of globalThis. Use arrow functions or pass the dependency explicitly.
  • arguments.callee — Throws TypeError. Use a named function expression instead.
  • Octal literals — 0777 is now a SyntaxError. Use 0o777.
  • Duplicate parameter names — function(a, a) {} is now a SyntaxError.

• (#40697 by @aleksandernsilva) Adds support for registering multiple phone numbers with labels per user. Breaking: the phone user field is replaced by the phones array ({ number, label? }[]); existing numbers are migrated automatically on upgrade.

• (#42573) Changes the default value of the MESSAGE_MAX_PARSE_LENGTH environment variable from 0 (no limit) to 10000 characters. Messages longer than that are no longer parsed for markdown and render as plain text, which keeps a single very large message from blocking the server and producing a stored markdown tree larger than the message itself. Workspaces using the default Message_MaxAllowedSize (5000) are not affected. To keep parsing longer messages, set MESSAGE_MAX_PARSE_LENGTH to a higher value, or to 0 to restore the previous unlimited behavior.

• (#41948) Removes the deprecated query and fields REST API parameters, along with the ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS environment variable that re-enabled them. Deprecated in 6.3.0 and disabled by default since 7.0.0, they let callers run raw MongoDB queries and projections against the database.

  Endpoints that validate their query string now reject both with 400 error-invalid-params instead of ignoring them; the few without validation keep accepting and ignoring them. users.create likewise rejects a fields property in its body. channels.online and groups.online now require _id. On users.list, fields outside the default projection — customFields, utcOffset, nickname, bio, statusText, federated and freeSwitchExtension — are no longer reachable in bulk; use users.info instead. Callers should move to the dedicated filter parameters each endpoint exposes, such as name, type, _id and text.

• (#42469) Changes the default value of the Omnichannel enabled setting (Livechat_enabled) to false. New workspaces must now enable Omnichannel explicitly in Administration > Settings > Omnichannel. Existing workspaces keep their current value on upgrade, whether Omnichannel was enabled or disabled.

• (#42201) Fixes a security vulnerability in the Livechat trigger external service

• (#41898) Removes unsafe selector parameter from livechat autocomplete endpoints

• (#41828) Removes the "Allow Anonymous Write" setting (Accounts_AllowAnonymousWrite), the "Or talk as anonymous" composer action, and the anonymous branch of the registerUser method. Anonymous read remains available. The anonymous role is removed along with its default permissions and the afterVerifyEmail method. On upgrade the setting and role are deleted from the database and any existing users holding the anonymous role are deactivated and logged out.

• (#41986) Removes the Atlassian Crowd integration. Atlassian has announced the end-of-life of Crowd, and workspaces that need directory-backed authentication can use the LDAP integration instead — Crowd itself exposes an LDAP interface. All CROWD_* settings, the Crowd login handler, the background user-sync job, and the Admin > Settings > Atlassian Crowd section are removed; on upgrade the settings and any scheduled sync job are deleted from the database. Users previously provisioned through Crowd keep their accounts, profile data, roles, and room memberships, but must sign in through another authentication method (such as LDAP or local password, using the "Forgot password" flow if needed).

• (#41977) Removes the deprecated DELETE /v1/canned-responses endpoint, which received the canned response id in the request body. Use DELETE /v1/canned-responses/:_id instead.

• (#41908) Removes the deprecated checkFederationConfiguration Meteor method, which verified the configuration of the no-longer-supported Matrix bridge federation.

• (#41940) Removes dead code left behind by the old Matrix bridge federation: the Federation/FederationEE service proxies and IFederationService/IFederationServiceEE interfaces (no service implemented them anymore), the never-implemented /v1/federation/* REST endpoint typings (searchPublicRooms, joinExternalPublicRoom, listServersByUser, addServerByUser, removeServerByUser), the listener-less federation.userRoleChanged event, unused federation v1 statistics fields and types, the old two-server federation E2E test suite, and orphaned translation keys.

• (#41974) Removes unused indexes: activity on rocketchat_livechat_visitor, ip_1_loginAt_-1 on rocketchat_sessions, desktopNotifications, mobilePushNotifications and emailNotifications on rocketchat_subscription, roomId_1_userId_1_messageId_1 on rocketchat_read_receipts and ts_1_reports.ts_1, message.u._id_1_ts_1, reportedUser._id_1_ts_1, message.rid_1_ts_1, message._id_1_ts_1 and userId_1_ts_1 on rocketchat_moderation_reports.

• (#42011) Removes the built-in Gravatar integration. New users and users setting their username for the first time no longer get an avatar silently fetched from gravatar.com based on their email address — a default-on outbound request that conflicted with privacy expectations on clean workspaces. Avatar resolution is now deterministic: an uploaded or OAuth-provided avatar is used when available, otherwise the initials avatar is shown. Users whose current avatar came from Gravatar keep their already-stored avatar image. Workspaces that still want Gravatar-based avatars can install the Gravatar app from the Marketplace as a replacement.

• (#41908) Removes the deprecated legacy (non-native) federation and Matrix bridge settings: FEDERATION_Enabled, FEDERATION_Status, FEDERATION_Domain, FEDERATION_Public_Key, FEDERATION_Discovery_Method, FEDERATION_Test_Setup, Federation_Matrix_enabled, Federation_Matrix_serve_well_known, `Federation_Matrix_enable_ephem...

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.64.1

Patch Changes

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#42128 by @dionisio-bot) Fixes an issue that would cause apps to fail with 'Module not found' errors in some cases

• (#42225 by @dionisio-bot) Fixes app startup failing with EACCES errors in docker deployments running with specified UIDs

• Updated dependencies [c9ce427, 9a83a3e]:

  • @rocket.chat/apps@0.7.2
  • @rocket.chat/core-typings@8.6.3
  • @rocket.chat/rest-typings@8.6.3

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.63.0

Patch Changes

• (#42466 by @dionisio-bot) Fixes the message list scroll drifting position after switching channels and returning

• Bump @rocket.chat/meteor version.

• Bump @rocket.chat/meteor version.

• (#42458 by @dionisio-bot) Fixes the issue where the message list kept jumping to the latest messages instead of restoring the previous position when switching channels.

• Updated dependencies [753f1f0, a67cff9]:

  • @rocket.chat/apps@0.7.1
  • @rocket.chat/core-typings@8.5.4
  • @rocket.chat/rest-typings@8.5.4

Release Date: October 5, 2026
Support Window: Supported until October 31, 2027 (LTS, 12 months from the release date)

🟢 Long-Term Support release

8.9.0 is a Long-Term Support (LTS) release, supported until October 31, 2027, 12 months from the release date, compared to 6 months for standard releases. Security fixes and critical updates are backported to the 8.9.x line for the full window; new features continue to ship in standard releases.

Upgrading from 7.10.x (previous LTS)? Support for 7.10.x ended on September 30, 2026. 8.9.0 is the direct upgrade target. Check the breaking changes between 7.10 and 8.9 and the upgrade guide before you start.

Summary

Security and Compliance

Security improvements, authentication changes, data protection, and vulnerability fixes.

This release ships a security hotfix for the Omnichannel agent and manager management endpoints and the data returned for Omnichannel contacts and chat history; it applies on upgrade with no configuration change. Two-Factor Authentication now works reliably for SAML sign-in, so a wrong code can be retried instead of failing.

Messaging and Collaboration

Features and fixes related to messaging, channels, discussions, and communication workflows.

Users can organize the sidebar with custom categories (Commercial, Government, and Defense plans), and three feature previews land under My Account > Feature Preview: a compact sidebar rail, a Realtime message composer, and a configurable room toolbox layout. AI Search adds hybrid keyword and semantic search, video conferences get an optional dedicated call window with preflight, chat, and participants, and external voice calls show caller names and avatars. Federation moves to Matrix room version 11 with broader specification support. A large set of fixes improves the voice call widget, desktop and mobile notifications, message list scrolling, federation presence and typing, user status, login sessions, auto-translate provider switching, and Omnichannel agent replies.

Platform and Extensibility

Developer platform, APIs, integrations, and application framework improvements.

New REST endpoints such as GET /v1/rooms.history and POST /v1/chat.getMessages replace the matching Realtime API methods, which are deprecated along with getRoomJoinCode, raix:push-setuser, and checkFederationConfiguration ahead of removal in 9.0.0. The Apps Engine adds media call events so apps can observe or block voice calls and read call history with the media-call.history permission. The Deno runtime is removed; Marketplace and private apps now run on Node.js, and installed apps keep working without changes.

Data, Storage, and Infrastructure

Database, performance, storage, and system-level improvements.

The runtime baseline moves to Node.js 24.15.0 and Meteor 3.5.2, with official Docker images on Alpine 3.23; manual installs must use Node.js 24.15.0. Startup, message sending, and discussion updates are faster. Fixes cover the official Docker image crashing on arm64 hosts and DDP Streamer workspaces serving stale login options after an OAuth change.

Admin, Configuration, and Workspace Management

Administrative controls, configuration settings, and workspace management improvements.

The Gravatar integration in the Set default avatar setting is deprecated and will be removed in 9.0.0.

For further details, check out the release notes.

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.67.0

Minor Changes

• (#41020) Adds a Realtime Message Composer, available as an opt-in Feature Preview (My Account → Feature Preview → Message → Realtime message composer). While the feature preview is off, the message composer keeps its current plain-text behavior.

• (#42150) Adds a new GET /v1/autotranslate.getProviderUiMetadata endpoint that lists the registered auto-translate providers and their display names, and deprecates the autoTranslate.getProviderUiMetadata real-time API method in its favor. The method keeps working until it is removed in 9.0.0.

• (#42476) Deprecates Custom OAuth authentication on workspaces without a Premium plan. Custom OAuth services keep working as they are today, but their admin settings now warn that version 9.0.0 will require a license including the oauth-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through one of them.

• (#41978) Deprecates the Gravatar integration. Default avatars fetched from Gravatar on user creation and Gravatar-based avatar suggestions in the profile settings will be removed in a future major release; a warning is now logged when they are used.

• (#40484 by @aleksandernsilva) Adds name and avatar resolution for external voice calls

• (#42102) Adds hybrid retrieval to AI Search. A single search balance setting decides how much semantic retrieval contributes relative to keyword search, so a workspace can find messages by meaning without losing exact matches on error codes, ticket ids or function names. An optional recency boost, disabled by default, promotes newer messages after relevance ranking.

• (#42054) Improves draft handling by discarding the stored draft as soon as a message is sent, instead of keeping it until the room is changed

• (#42108) Improves the sidebar to keep the room currently open listed under its category even while that category is collapsed, so it stays clear which room is being viewed

• (#41681) Adds media call lifecycle events to the Apps-Engine: an app implementing the new IMediaCallHandler interface can now observe calls starting, being answered and ending, and can block a call or change the features it was requested with before it is created

• (#41539) Introduces custom, user-defined categories to the sidebar (Enterprise only). Users can create, rename, delete and reorder categories (menu-driven), and move rooms into them via the room context menu or the room header.

• (#42229) Adds a read-only call history accessor for apps. An app that declares the new media-call.history permission can read a user's call history through read.getCallHistoryReader(), which exposes getById, getByCallId and a paginated search.

• (#40500) Started storing SIP Call Id on the media calls model
  Added an endpoint to retrieve media calls data

• (#41961) Adds a new POST /v1/chat.getMessages endpoint to fetch several messages at once by id, including messages from different rooms. The request fails if any of the messages belongs to a room the caller cannot read.

• (#42023) Adds a new GET /v1/cloud.workspaceRegisterData endpoint returning the base64 encoded workspace registration payload used by the offline cloud registration flow. It requires the manage-cloud permission.

• (#41991) Adds an aroundId parameter to GET /v1/rooms.history, returning a window of messages centered on a given message instead of a page from one end of the room. This is what jumping to a quoted message, a search result or a thread message uses to load the surrounding conversation.

• (#41947) Adds a new GET /v1/rooms.history endpoint to load a room's message history. Unlike the existing channels.history, groups.history, im.history and dm.history endpoints, it works with any room type through a single route, and can be used to read public channels anonymously when Accounts_AllowAnonymousRead is enabled.

• (#42023) Adds a new GET /v1/setupWizard.parameters endpoint returning the settings flagged for the setup wizard along with a serverAlreadyRegistered flag.

• (#41088) Adds a configurable Room Toolbox Layout, available as an opt-in Feature Preview (My Account → Feature Preview → Room → Room Toolbox Layout). While the feature preview is off, the room header toolbox keeps its current behavior and the setting has no effect.

  Admins can define the layout through the new workspace setting Room Toolbox Layout (Room_Toolbox_Layout) under Admin → Settings → Layout → Room Header, which is itself only shown when Feature Preview is enabled for the workspace. The setting value is validated against a JSON schema when saved, so a malformed configuration is rejected with an error instead of being silently ignored

• (#41657) Gives a video conference a chat that outlives it, and a window of its own to hold both — behind a new Premium setting, VideoConf_Conference_Window_Enabled, which is off by default.

  Nothing below happens until an administrator t...

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.67.0-rc.0

Patch Changes

• Bump @rocket.chat/meteor version.

• Updated dependencies []:

  - @rocket.chat/core-typings@8.9.0-rc.5 - @rocket.chat/rest-typings@8.9.0-rc.5

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.67.0-rc.0

Minor Changes

• (#42476) Deprecates Custom OAuth authentication on workspaces without a Premium plan. Custom OAuth services keep working as they are today, but their admin settings now warn that version 9.0.0 will require a license including the oauth-enterprise module, and a warning is logged when an unlicensed workspace authenticates a user through one of them.

Patch Changes

• Bump @rocket.chat/meteor version.

• (#42429) Fixes audio and video attachments served through the Amazon S3 or Google Cloud Storage proxy not showing their duration or progress until playback ended, and not being seekable, by honoring byte-range requests in the proxy.

• Updated dependencies []:

  - @rocket.chat/core-typings@8.9.0-rc.4 - @rocket.chat/rest-typings@8.9.0-rc.4

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.67.0-rc.0

Patch Changes

• Bump @rocket.chat/meteor version.

• Updated dependencies []:

  - @rocket.chat/core-typings@8.9.0-rc.3 - @rocket.chat/rest-typings@8.9.0-rc.3

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.67.0-rc.0

Patch Changes

• Bump @rocket.chat/meteor version.

• (#42360) Restores the room list sidebar rows and group headers to their previous look, undoing the restyle introduced by the Fuselage upgrade

• Updated dependencies []:

  - @rocket.chat/core-typings@8.9.0-rc.2 - @rocket.chat/rest-typings@8.9.0-rc.2

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.67.0-rc.0

Patch Changes

• Bump @rocket.chat/meteor version.

• Updated dependencies []:

  - @rocket.chat/core-typings@8.9.0-rc.1 - @rocket.chat/rest-typings@8.9.0-rc.1

Engine versions

• Node: >=22.22.3 <23 || >=24.15.0 <25
• MongoDB: 8.0
• Apps-Engine: 1.67.0-rc.0

Minor Changes

• (#41020) Adds a Realtime Message Composer, available as an opt-in Feature Preview (My Account → Feature Preview → Message → Realtime message composer). While the feature preview is off, the message composer keeps its current plain-text behavior.

• (#42150) Adds a new GET /v1/autotranslate.getProviderUiMetadata endpoint that lists the registered auto-translate providers and their display names, and deprecates the autoTranslate.getProviderUiMetadata real-time API method in its favor. The method keeps working until it is removed in 9.0.0.

• (#41978) Deprecates the Gravatar integration. Default avatars fetched from Gravatar on user creation and Gravatar-based avatar suggestions in the profile settings will be removed in a future major release; a warning is now logged when they are used.

• (#40484 by @aleksandernsilva) Adds name and avatar resolution for external voice calls

• (#42102) Adds hybrid retrieval to AI Search. A single search balance setting decides how much semantic retrieval contributes relative to keyword search, so a workspace can find messages by meaning without losing exact matches on error codes, ticket ids or function names. An optional recency boost, disabled by default, promotes newer messages after relevance ranking.

• (#42054) Improves draft handling by discarding the stored draft as soon as a message is sent, instead of keeping it until the room is changed

• (#42108) Improves the sidebar to keep the room currently open listed under its category even while that category is collapsed, so it stays clear which room is being viewed

• (#41681) Adds media call lifecycle events to the Apps-Engine: an app implementing the new IMediaCallHandler interface can now observe calls starting, being answered and ending, and can block a call or change the features it was requested with before it is created

• (#41539) Introduces custom, user-defined categories to the sidebar (Enterprise only). Users can create, rename, delete and reorder categories (menu-driven), and move rooms into them via the room context menu or the room header.

• (#42229) Adds a read-only call history accessor for apps. An app that declares the new media-call.history permission can read a user's call history through read.getCallHistoryReader(), which exposes getById, getByCallId and a paginated search.

• (#40500) Started storing SIP Call Id on the media calls model
  Added an endpoint to retrieve media calls data

• (#41961) Adds a new POST /v1/chat.getMessages endpoint to fetch several messages at once by id, including messages from different rooms. The request fails if any of the messages belongs to a room the caller cannot read.

• (#42023) Adds a new GET /v1/cloud.workspaceRegisterData endpoint returning the base64 encoded workspace registration payload used by the offline cloud registration flow. It requires the manage-cloud permission.

• (#41991) Adds an aroundId parameter to GET /v1/rooms.history, returning a window of messages centered on a given message instead of a page from one end of the room. This is what jumping to a quoted message, a search result or a thread message uses to load the surrounding conversation.

• (#41947) Adds a new GET /v1/rooms.history endpoint to load a room's message history. Unlike the existing channels.history, groups.history, im.history and dm.history endpoints, it works with any room type through a single route, and can be used to read public channels anonymously when Accounts_AllowAnonymousRead is enabled.

• (#42023) Adds a new GET /v1/setupWizard.parameters endpoint returning the settings flagged for the setup wizard along with a serverAlreadyRegistered flag.

• (#41088) Adds a configurable Room Toolbox Layout, available as an opt-in Feature Preview (My Account → Feature Preview → Room → Room Toolbox Layout). While the feature preview is off, the room header toolbox keeps its current behavior and the setting has no effect.

  Admins can define the layout through the new workspace setting Room Toolbox Layout (Room_Toolbox_Layout) under Admin → Settings → Layout → Room Header, which is itself only shown when Feature Preview is enabled for the workspace. The setting value is validated against a JSON schema when saved, so a malformed configuration is rejected with an error instead of being silently ignored

• (#41657) Gives a video conference a chat that outlives it, and a window of its own to hold both — behind a new Premium setting, VideoConf_Conference_Window_Enabled, which is off by default.

  Nothing below happens until an administrator turns that setting on. With it off, calls behave exactly as they did before: the provider's own page opens in a tab, an incoming call is a popup over the screen, a direct call rings from the room and waits there, and no new request is made of the server. The setting is also independent of VideoConf_Enable_Persistent_Chat, which keeps meaning only what it always meant — a discussion or thread per call — so a workspace already running persistent chat sees no change either until the new setting is turned on.

  With it on:

  Joining a conference opens a dedicated call window at /conference/:id — the provider's call beside the conference's chat, with the people on the call in a panel of their own — instead of handing the user off to the provider's page. A preflight screen opens first: it is where the camera and microphone are chosen, where whoever started a group call can name it, and where confirming is what actually creates the call, so a call nobody confirmed leaves no message, no ring and no history behind. Closing the window reports leaving, and a call nobody is left in ends by itself.

  Where a call's chat lives becomes a choice. VideoConf_Persistent_Chat_Mode, editable only with both the call window and persistent chat on, either puts the chat in a thread off the call's message — listed under the call's name — or leaves it in the room, with the discussion per call that persistent chat has always created. The thread is Rocket.Chat's own chat panel rather than anything the provider supplies, so it applies whoever runs the media, an iframed provider included. Turning the window off puts the answer back to the discussion whatever the mode was left at, so a workspace already running persistent chat is left exactly where it was.

  Adding someone to a conference makes them a member of the conference rather than putting them in a room. Membership authorizes joining the call alongside room access, so a person from outside the conference's room can join without being handed the room's history — and whether they can read the chat becomes a separate question, surfaced once it matters with a choice of how to resolve it: bring them into the room, or move the chat to a discussion. video-conference.info reports the members who can't read it and POST /v1/video-conference.share-chat applies the remedy; video-conference.add-participants takes the call and the usernames to add, and returns the ids it added.

  An incoming call is no longer a popup demanding an answer. It is the first item of a list of the calls running now — behind a navigation-bar button — where it can be accepted, turned down, or silenced and left ringing while the user finishes what they were doing. That list is also how a call is reached when its ring was missed entirely, which a one-shot ring in a room of more than ten people always is (GET /v1/video-conference.joinable).

  Conferences appear in the personal Call History from the moment they start, as ongoing, settling per member into ended or not-answered when the call stops — so a call that was declined or never answered is still in the log, and still joinable from it. The room's own call list stops counting members who were added but never joined.

  New endpoints: video-conference.decline (recorded against the caller's own membership, never ending the call for anyone else), .leave, .ring (to try someone again — a ring is one-shot, so there was previously no second attempt), .rename and .share-chat. A single video-conference.updated stream event tells an open call window that the conference it is showing has changed.

• (#41718) Use federation room version 11 by default

Patch Changes

• (#42167) Fixes the message list scroll drifting position after switching channels and returning

• (#42136) Fixes the Docker image crashing at boot on arm64 with Error loading shared library ld-linux-aarch64.so.1 while loading argon2.node. The...