Nextcloud Server 29.0.16 → 35.0.2
69 releases · 28 breaking changes · 123 security fixes · 0 advisories fixed
123security28breaking8deprecated330feature574fix
Breaking changes
- breaking Remove usage of static vars or properties (server#59002) in 35.0.0
- breaking Revert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773) in 35.0.0
- breaking [master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271) in 35.0.0
- breaking Chore!: drop jQuery UI and jQuery (server#57648) in 34.0.0
- breaking Remove external shares from share list (server#58204) in 34.0.0
- breaking Remove leftover useless path assignements in View (server#58835) in 34.0.0
- breaking Remove static vars, first batch (server#59159) in 34.0.0
- breaking Remove long-time deprecated methods (server#59544) in 34.0.0
- breaking Chore!(core): remove deprecated Handlebars globals (server#59748) in 34.0.0
- breaking Remove unneeded sort when listing mail/federated shares (server#60244) in 34.0.0
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8311) in 34.0.0
- breaking Remove unneeded sort when listing mail/federated shares (server#60356) in 33.0.4
- breaking Debt(files): Remove regular stats request (server#56822) in 33.0.3
- breaking Remove external shares from share list (server#58717) in 33.0.1
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8351) in 33.0.1
- breaking Chore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718) in 33.0.0
- breaking Remove stable30 from dependabot (server#56018) in 33.0.0
- breaking Debt(files): Remove regular stats request (server#56792) in 33.0.0
- breaking Enhancement(files): remove redundant success toast on file rename (server#57168) in 33.0.0
- breaking Refactor!: migrate files sidebar to Node API (server#57277) in 33.0.0
- breaking Remove custom handling for public share pages with single files (files_pdfviewer#1206) in 31.0.5
- breaking [stable31] test: Remove .only() calls in 31.0.2
- breaking [stable31] fix: remove caching in fetchListOfGroups in 31.0.1
- breaking [stable31] fix(l10n): Remove leading space from translation string in 31.0.1
- breaking [stable30] test: Remove .only() calls in 30.0.8
- breaking [stable30] fix(files): Ensure children are removed from folder and not duplicated in 30.0.2
- breaking [stable30] fix(filesexternal): Remove unneeded 3rdparty library use in 30.0.2
- breaking [stable30] fix(logger): Remove more parameters of other methods in 30.0.2
Security changes
- security [master] fix(security): Update code signing revocation list (server#60705) in 35.0.0
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#60992) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61088) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61227) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61268) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61423) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61900) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62019) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62166) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#62256) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62632) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62857) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63142) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#63231) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63335) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63485) in 35.0.0
- security Fix(security): Update code signing revocation list (server#64051) in 35.0.0
- security Master] fix(security): Update code signing revocation list (server#64464) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#64721) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#63358) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63364) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63370) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63521) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#64097) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#62652) in 34.0.3
- security Master] fix(security): Update code signing revocation list (server#62040) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62046) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62184) in 34.0.2
- security Master] fix(security): Update CA certificate bundle (server#62437) in 34.0.2
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61133) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61239) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61283) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61429) in 34.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58869) in 34.0.0
- security Fix(security): Update Expires time (server#60397) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#61001) in 34.0.0
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#64465) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#64720) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#63357) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63363) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63369) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63520) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#64098) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#62653) in 33.0.8
- security Master] fix(security): Update code signing revocation list (server#62041) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62047) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62185) in 33.0.7
- security Master] fix(security): Update CA certificate bundle (server#62436) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#61002) in 33.0.6
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61134) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61238) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61284) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61430) in 33.0.6
- security Fix(security): Update Expires time (server#60396) in 33.0.4
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580) in 33.0.4
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 33.0.3
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 33.0.3
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 33.0.3
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 33.0.3
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 33.0.3
- security Fix(security): Update Expires time (server#54868) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#54982) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55051) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55445) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56209) in 33.0.3
- security Fix(security): Update code signing revocation list (server#56365) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56812) in 33.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 33.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58880) in 33.0.1
- security [master] fix(security): Update CA certificate bundle (server#54992) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55056) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55446) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56211) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#56363) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56811) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57031) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57262) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57380) in 33.0.0
- security Fix(security): Update Expires time (server#57688) in 33.0.0
- security Fix(security): Update code signing revocation list (server#57948) in 33.0.0
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 32.0.9
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 32.0.9
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 32.0.9
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 32.0.9
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 32.0.9
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 32.0.4
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 32.0.3
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 32.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 32.0.2
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 32.0.1
- security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 32.0.1
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 31.0.14
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 31.0.12
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 31.0.12
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 31.0.10
- security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 31.0.10
- security Fixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3… in 31.0.3
- security Fixes CVE-2025-66547: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via… in 31.0.1
- security Fixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t… in 31.0.1
- security Fixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13… in 31.0.1
- security [stable31] fix(security): Update CA certificate bundle in 31.0.1
- security Fix A+ rating when checking with Nextcloud Security Scan. in 31.0.1
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 30.0.17
- security [stable30] fix(security): Update code signing revocation list in 30.0.10
- security Fixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3… in 30.0.9
- security Fixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t… in 30.0.9
- security Fixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13… in 30.0.7
- security [stable30] fix(security): Update CA certificate bundle in 30.0.7
- security Fixes CVE-2025-47791: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently… in 30.0.3
- security [stable30] fix(net/security): Handle IPv6 zone IDs in link-local addresses in 30.0.3
- security [stable30] fix(security): Update CA certificate bundle in 30.0.3
- security Fixes CVE-2024-52523: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the fronte… in 30.0.2
- security Fixes CVE-2024-52518: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external stor… in 30.0.2
- security Fixes CVE-2025-47793: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.… in 30.0.2
- security Fixes CVE-2024-52525: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved… in 30.0.2
- security [stable30] fix(security): Update code signing revocation list in 30.0.2
- security Fixes CVE-2024-52517: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain… in 30.0.1
- security Fixes CVE-2024-52513: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T… in 30.0.1
- security [stable30] fix(security): Update CA certificate bundle in 30.0.1
Deprecations
- deprecated Deprecate long, non-lazy app config and user config (server#65012) in 35.0.2
- deprecated Fix deprecations in tests (server#61140) in 35.0.0
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1264) in 34.0.0
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1268) in 33.0.1
- deprecated Port away from deprecated Doctrine APIs (server#55674) in 33.0.0
- deprecated Cleanup unused code and deprecated imports (text#7752) in 33.0.0
- deprecated [stable30] fix(repair): PHP8.3 deprecation warning in 30.0.7
- deprecated [stable30] fix(Middleware): log deprecation when annotation was actually used in 30.0.3
Every release in between
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64322)
fixFix(files_sharing): name the parent folder in inherited unshare actions (server#64349)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64482)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64485)
featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64609)
fixFix: forbid newline characters in filenames (server#64613)
fixFix: correct cast ttl to int in KeyValueCache (server#64615)
featureAdd API to generate system report section (server#64631)
fixFix(auth): keep remember-me cookies pointing at a live session token (server#64649)
fixFix: never block simple renames in SharesPlugin (server#64681)
featureFeat(upgrade): localize app names if available on upgrade page (server#64693)
fixFix(files): keep deleting live photo peers after a missing one (server#64699)
fixFix(files_sharing): render share suggestion avatar when provided (server#64704)
fixFix(setupcheck): Print verbose info to allow finding out memory issues (server#64751)
featureFeat: add additional metadata to node webhooks (server#64847)
fixFix(EmojiHelper): exclude non-latin letters from EmojiHelper (server#64866)
featureFeat: make comment events webhook compatible (server#64868)
fixFix(Sharing): Fix recipient IDs on 32-bits (server#64870)
fixFix(files_external): preserve boolean mount options (server#64879)
fixFix(SchemaChecker): don’t block on unexpected-table finding (server#64891)
fixFix(adminaudit): Allow named placeholders via CriticalActionPerformedEvent (server#64895)
fixFix(cache): Check if $entry[‘fileid’] exists (server#64902)
fixFix(user_ldap): show %uid instead of %%uid in the login filter hint (server#64913)
fixFix: Make all app versions stable (server#64915)
featurePerf(files): Only match search results against caches of their storage (server#64916)
featureFeat(files-search): Add push down negation optimizer (server#64923)
featureFeat: Add code integrity background job (server#64974)
deprecatedDeprecate long, non-lazy app config and user config (server#65012)
featurePerf: Optimize deleting the list of invalid shares (server#65137)
featureFeat: Add IAccountScopedSearchProvider (server#65313)
featureFeat: Build js after merge (activity#2998)
featurePerf: Cache public share (activity#3004)
featurePerf: Use startActivityTransaction in a few more places (activity#3016)
featureFeat: Build js after merge (circles#2978)
featureFeat(workflow): Add fixup block (circles#2989)
featureFeat: Bump pdf js (files_pdfviewer#1567)
featureFeat: expose Nextcloud AIO version in info API (serverinfo#1189)
featurePerf: get all markdown files in one SQL query (text#9291)
featurePerf(session): fetch document only once in SessionMiddleware (text#9295)
featureFeat(edit): collaborate in other apps(deck) (text#9325)
+102 more items in the release notesfixFix(Sharing): Prevent truncation of node IDs (server#64140)
fixFix(trashbin): properly unpause trashbin on error (server#64177)
fixFix: update left padding of public shares (server#64213)
fixFix: update shared resource calendar icon for different theme (server#64288)
fixFix(i18n): Remove ellipsis from search strings (server#64323)
fixFix: preserve link shares on ownership transfer (server#64332)
featureAllow quota write streams with unknown free space (server#64341)
fixFix: remove nested items from favorites view on unfavorite (server#64344)
fixFix(Sharing): Hide non-matching recipients instead of only their secrets (server#64353)
fixFix(encryption): cap and invalidate key-cache (server#64356)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64357)
fixFix(files_external): show that an unrestricted storage applies to all (server#64362)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64367)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64372)
fixFix: show custom permissions when share is removed from edit bundle (server#64375)
fixFix: logs can leak sensitive information.. (server#64386)
fixFix: skip copying skeleton if the user has 0 quota (server#64396)
fixFix(files): bring back ownership transfer of all files (server#64407)
fixFix: use correct mimetype for theming logo (server#64410)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64416)
fixFix: scope group share child permission updates to usergroup (server#64417)
fixFix(sharing): Hide Allow download and sync option for federated (server#64421)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64425)
fixFix(previews): set Content-Type header for Imaginary requests (server#64431)
featureImplement recommended recipient api for unified sharing (server#64433)
fixFix(CalDAV): extract data from occurance exemptions (server#64438)
featureAdd files:list command and fix auto completion (server#64439)
fixFix(config): Don’t print sensitive config when setting them (server#64442)
featureFeat: Add more debug output when checkTokenCredentials fails (server#64472)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64477)
fixFix(filecache): announce every removed entry so metadata is cleaned up (server#64498)
fixFix(files): validate dropped filenames before upload (server#64502)
fixFix: remove dead hook listener and replace with event listener (server#64509)
fixFix(CalDAV): set significant change flag properly (server#64520)
featureFeat(files): bring back the Sidebar API (server#64581)
featurePerf: Improve token exchange (server#64597)
featureFeat: let apps define the actor of an activity via the activity manager (activity#2930)
featureAdd a vitest harness for the front-end (files_pdfviewer#1564)
featureFeat(api): Allow to filter the API by app and object (notifications#3389)
featureFeat(menu): add Mermaid diagram entry to Blocks menu (text#9204)
+34 more items in the release notesfeatureAdd rel attribute for fediverse link to make verification possible. (server#43364)
featureFeat(deps): Upgrade phpseclib to v3 (server#48183)
featureFeat(occ): Better handling of disabled or unreacheable App store (server#49697)
featureFeat: Run setup checks by category or class (server#49978)
featureAdded parameter to disable web UI integration with local client (server#54191)
featureFeat: OCS Calendar Import (server#55178)
featureFeat(theming): add option for reduce animation (server#55406)
featureFeat(entity): Provide a new API for entities (server#56199)
featureAdded a exclude disabled option to last seen (server#57081)
featureFeat (2fa): Add IStatelessProvider interface (server#57216)
featureImplement token exchange from OCM (server#57234)
featureMove invite-accepted capability and implementation to contacts app. (server#57853)
featureFeat: delay fetching the display name of a share recipient untill we need it (server#58335)
featureFeat: frankenphp (server#58541)
featureFeat(lookup): search for local account only via lookupserver (server#58567)
breakingRemove usage of static vars or properties (server#59002)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#59271)
featureFeat(files_versions): allow to block version creation using WFE (server#59610)
featureFeat: allow setting custom login-name for occ generated app password (server#59680)
security[master] fix(security): Update code signing revocation list (server#60705)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735)
security[master] fix(security): Update code signing revocation list (server#60992)
security[master] fix(security): Update code signing revocation list (server#61088)
deprecatedFix deprecations in tests (server#61140)
security[master] fix(security): Update code signing revocation list (server#61227)
security[master] fix(security): Update code signing revocation list (server#61268)
security[master] fix(security): Update code signing revocation list (server#61423)
security[master] fix(security): Update code signing revocation list (server#61900)
security[master] fix(security): Update code signing revocation list (server#62019)
security[master] fix(security): Update code signing revocation list (server#62166)
security[master] fix(security): Update CA certificate bundle (server#62256)
security[master] fix(security): Update code signing revocation list (server#62632)
security[master] fix(security): Update code signing revocation list (server#62857)
security[master] fix(security): Update code signing revocation list (server#63142)
security[master] fix(security): Update CA certificate bundle (server#63231)
security[master] fix(security): Update code signing revocation list (server#63335)
security[master] fix(security): Update code signing revocation list (server#63485)
breakingRevert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773)
securityFix(security): Update code signing revocation list (server#64051)
breaking[master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271)
+2377 more items in the release notesfeatureFeat(search): Subdue header search input placeholder (server#60833)
fixFix(files_sharing): Use share id in file actions (server#62403)
fixFix(dashboard): update scrollbar contrast on background (server#62630)
fixFix(encryption): bind personal private key password inputs (server#62672)
fixFix: allow Enter on public share Download link (server#62770)
fixFix: multiple file selection on tab navigation (server#63214)
fixFix: Combined Calendar and Contacts Import (server#63334)
fixFix: fail uploads when uri does not match session/share token (server#63960)
fixFix(files_external): map display names for groups (server#64010)
fixFix(sharing): Hide Allow download and sync option for federated (server#64013)
fixFix(tags): broken tag deletion on user delete (server#64089)
fixFix(metadata): bind chunked file ids in dropMetadataForFiles (server#64092)
fixFix: protect share accept endpoint with CSRF token (server#64107)
fixFix: remove wrongly used system address book flag (server#64131)
fixFix(files_sharing): normalize share target on parent folder rename (server#64143)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64146)
fixFix: update left padding of public shares (server#64212)
fixFix(ci): Pin 32-bit (server#64304)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64321)
fixFix: preserve link shares on ownership transfer (server#64330)
featureAllow quota write streams with unknown free space (server#64342)
fixFix: remove nested items from favorites view on unfavorite (server#64345)
fixFix(encryption): cap and invalidate key-cache (server#64355)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64359)
fixFix(files_external): show that an unrestricted storage applies to all (server#64361)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64368)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64373)
fixFix: show custom permissions when share is removed from edit bundle (server#64376)
fixFix: logs can leak sensitive information.. (server#64385)
fixFix: skip copying skeleton if the user has 0 quota (server#64397)
fixFix: use correct mimetype for theming logo (server#64409)
securityMaster] fix(security): Update code signing revocation list (server#64464)
featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64610)
featureAdd API to generate system report section (server#64632)
securityMaster] fix(security): Update code signing revocation list (server#64721)
featureFeat: add additional metadata to node webhooks (server#64846)
featurePerf(files): Only match search results against caches of their storage (server#64917)
featureFeat: Add code integrity background job (server#64973)
featureFeat(workflow): Add fixup block (circles#2988)
featurePerf(session): fetch document only once in SessionMiddleware (text#9296)
+106 more items in the release notesfixFix(theming): mark background button text as English (server#62252)
fixFix(ocm): Move invite-accepted capability and implementation to contacts app (server#62486)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63155)
fixFix: make unified filter chip accessible (server#63224)
fixFix(preview): delete version metadata by preview ID (server#63290)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63310)
fixFix(group): Set the display name on every backends that supports it (server#63321)
fixFix(jobs): don’t overwrite the –stop_after baseline in background-job:worker (server#63328)
fixFix(config): mask the Euro-Office jwt_secret as sensitive (server#63332)
fixFix(preview): order previews by ID during pagination (server#63345)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63347)
securityMaster] fix(security): Update code signing revocation list (server#63358)
securityMaster] fix(security): Update code signing revocation list (server#63364)
securityMaster] fix(security): Update code signing revocation list (server#63370)
fixFix: Creating shares with multiple mount permissions (server#63372)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63378)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63379)
fixFix: Public link with multiple mounts (server#63384)
featureFeat: Mark 32 bits support as removed for Nextcloud Hub 27 Winter (server#63387)
fixFix(preview): keep the local file when losing the insert race (server#63390)
fixFix(files_sharing): Use share password policy for password generation (server#63397)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63404)
featureFeat(dav): add IRoomMetadata::BUILDING_NAME (server#63419)
fixFix(files_reminder): passed reminder handling (server#63425)
fixFix: enhance name splitting to handle “Lastname, Firstname” format (server#63426)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63456)
securityMaster] fix(security): Update code signing revocation list (server#63521)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63523)
fixFix(LocalStorage): Clear realpath cache on fopen failure and re-try access (server#63530)
fixFix(dav): Handle correctly not found while streaming output (server#63533)
fixFix(provisioning_api): let sub-admins change group memberships (server#63534)
fixFix(files): hide download action in link shares for newly created folders (server#63552)
featureFeat(updater): clear app_install_overwrite on major upgrades (server#63633)
fixFix(appconfig): make type-conflict error self-explanatory (server#63643)
fixFix(dav): scope contact photo export to local address books (server#63645)
fixFix cancelling the customization of a share (server#63658)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63668)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63678)
securityMaster] fix(security): Update code signing revocation list (server#64097)
featureAdd a vitest harness for the front-end (files_pdfviewer#1565)
+67 more items in the release notesfeaturePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62223)
fixFix: Output shape validation will delete keys when there is a list of files (server#62237)
fixFix(jobs): resolve portability issues with background job cleanup (server#62279)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62281)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62337)
fixFix(preview): Handle unique constraints violation exception (server#62363)
fixFix(files_version): mtime confusion on milliseconds (server#62372)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62418)
fixFix(SetupChecks): Link to task processing worker docs (server#62443)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62451)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62457)
fixFix: harden object store against copying a file to itself (server#62461)
fixFix: Use PHP_AUTH_PW for strict password confirmation (server#62537)
featurePerf: Use hash map to check if path was already checked (server#62588)
fixFix(TaskProcessing): Claim tasks atomically in both SynchronousBackgr… (server#62608)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62611)
fixFix(unified-search): catch errors in response (server#62616)
securityMaster] fix(security): Update code signing revocation list (server#62652)
fixFix(search): Add end date for last 7 and last 30 days (server#62685)
fixFix(caldav): Expand recurring events for principal calendar search (server#62693)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62702)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62714)
fixFix(imip): add context to imip log messages (server#62723)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62733)
fixFix(jobs): compute memory usage after clean-up (server#62768)
fixFix(metadata): bind chunked file ids (server#62771)
featurePerf(user-display-name): Check memory cache before trying redis (server#62778)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62780)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62784)
fixFix(encryption): handle decryption exception with outdated passwords (server#62788)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62792)
fixFix(share): Avoid crash when share owner is not found (server#62798)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62908)
featureFeat: Allow to check user existence outside specific user backends (server#62917)
featureFeat(lookup): search for local account only via lookupserver (server#62934)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62949)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63113)
featurePerf(files): compute move/rename activity settings once (activity#2794)
featureFeat: adding an option to exclude users from the acitivity log (activity#2808)
featurePerf(push): Send push notifications async to proxies (notifications#3246)
+83 more items in the release notesfixFix(cypress): disable unsupported-browser redirect in test container (server#60807)
featureFeat(UserManager): Add getters for avatar URLs (server#60811)
fixFix(core): public share download icon color and theme filter scope (server#61211)
fixFix: use card interface instead of object (server#61252)
fixFix: properly mark CleanupShareTarget as expensive (server#61498)
fixFix: update cached mounts when moving share in repair step (server#61500)
fixFix(files_trashbin): create folder if missing when expiring trash (server#61523)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61528)
fixFix: stop calling DI container in SharedStorage (server#61529)
fixFix(preview): First cleanup from filecache and then from preview table (server#61531)
featurePerf(View): don’t sort twice the same array (server#61535)
featurePerf: block more properties from using the custom properties backend (server#61540)
fixFix(settings): correct heading order in account management sidebar (server#61546)
fixFix: Make the IProvideUserSecretBackend usable (server#61550)
fixFix: track time spent in recursive markOrRun calls (server#61553)
featurePerf(log): normalize log data only when logging (server#61557)
featurePerf: avoid DIing IRootFolder at every shared storage init (server#61558)
featurePerf: Only sort wrappers when adding them (server#61700)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61852)
featureFeat(OCP): Add Interaction API (server#61867)
featureFeat: Disable callable serialization in sabre/xml (server#61923)
featureFeat: Fetch groups in batch in getUserGroups (server#61936)
featureFeat(login): clean remember me tokens (server#61972)
securityMaster] fix(security): Update code signing revocation list (server#62040)
securityMaster] fix(security): Update code signing revocation list (server#62046)
featurePerf(carddav): reduce disk usage of photocache (server#62054)
featurePerf(workflow): Implement result cache for IP checks (server#62057)
featureFeat: KV cache based on predis (server#62070)
featureFeat(share): add public share-review API under OCP\Share\ShareReview (server#62132)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62180)
securityMaster] fix(security): Update code signing revocation list (server#62184)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62197)
featurePerf(dav): Stream PROPFIND output (server#62224)
securityMaster] fix(security): Update CA certificate bundle (server#62437)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2513)
featureFeat: add predis as a dependency for Valkey cluster support (3rdparty#2518)
featureFeat: make amount of items sent on email configurable via occ (activity#2708)
featureFeat: add release relay gh workflow (app_api#924)
featureEnh: allow file owner to unlock TYPE_TOKEN locks (files_lock#1169)
featureFeat: Add login output when password policy fails (password_policy#966)
+351 more items in the release notesfixFix: folder tree selection after any action in main content (server#60478)
fixFix(files): show proper information when a move will override the target (server#60963)
featurePerf(user_ldap): chunk oracle queries for lower bind cost (server#60978)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60983)
fixFix(theming): read cachebuster as int in manifest endpoint (server#61010)
fixFix(dav): finalize upload metadata before post-write hooks (server#61072)
fixFix(comments): load comments styles when the comments app is loaded (server#61076)
fixFix(dav): properly handle files metadata (server#61078)
fixFix(settings): Fix appstore icon color in settings menu (server#61093)
fixFix(comments): Use capped memory cache for comments (server#61097)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61106)
fixFix: Correctly detect appid for dist css files (server#61113)
fixFix: use correct permissions mask for non-home storage public links (server#61118)
fixFix(settings): Show loading spinner while searching accounts (server#61122)
securityMaster] fix(security): Update code signing revocation list (server#61133)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61157)
fixFix(core): keep app menu settings icon legible on light backgrounds (server#61161)
fixFix(previews): ffprobe hangs (server#61182)
fixFix(files_versions): guard null path in event listeners (server#61189)
fixFix(repair): restrict unserialize() in RemoveBrokenProperties (server#61203)
fixFix(appstore): bring back “update all” button (server#61212)
fixFix(settings): clear NcAppNavigation toggle overhang (server#61234)
securityMaster] fix(security): Update code signing revocation list (server#61239)
featureFeat(settings): Require 8.3 for 35 (server#61241)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61243)
fixFix: Fix PHP Warning foreach() argument must be of type array|object, null given (server#61258)
securityMaster] fix(security): Update code signing revocation list (server#61283)
fixFix(twofactor_backupcodes): Add a clean helper to set code as used (server#61296)
fixFix(theming): preserve uploaded favicon and touch icon (server#61302)
fixFix: Use token expiration for ephemeral sessions (server#61305)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61309)
fixFix(user_ldap): Escape filter part when searching for group members (server#61325)
featureAdd OCM Notification Received Event (server#61337)
fixFix: trim duplicate search results for external share (server#61340)
fixFix: Do not set last-password-confirm for apptoken sessions (server#61342)
fixFix(team-manager): ensure team resources are only retrived for members (server#61351)
securityMaster] fix(security): Update code signing revocation list (server#61429)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2636)
featurePerf: Avoir calling Server::get for each share mounts (files_lock#1123)
+50 more items in the release notesfeatureFeat(filecache): Scale DB query created when deleting file from filecache (server#54277)
featureFeat: add oc-ownerid and oc-permissions headers on PUT DAV requests (server#54542)
featureAdd some missing attributes (server#55474)
featureFeat(preview): Expire previews (server#55632)
featureFeat(preview): On demand preview migration (server#55649)
featureAdd configs for strict PHP checks (server#56522)
featureFeat(app): allow removing installed-but-disabled apps; improve help & logging (server#56720)
featureFeat: improve calendar migrator (server#57112)
featureFeat: perform share mount validation on share instead of on mount (server#57295)
featureFeat(http-client): add option to add instance URL to HTTP client user-agent (server#57376)
featureFeat(mimetypes): Add mimetype aliases/mapping/names for .toml and .ovpn (server#57480)
featureFeat(external-storage): Implement IPartialMountPoint (server#57497)
featureAdd InstallationCompletedEvent for post-installation actions (server#57522)
featureFeat(user_picker): Move the profile picker to server (server#57539)
featureFeat: Add office switcher with feature comparison (server#57555)
featurePerf(normalization): Optimize path normalization (server#57570)
featureFeat(objectstore): Add AWS SSE-KMS encryption support for S3 storage (server#57623)
breakingChore!: drop jQuery UI and jQuery (server#57648)
featureFeat(files): render file list filters in top bar and allow to collapse into overflow menu (server#57664)
featureFeat: allow to filter contacts by team (server#57676)
featureFeat: Add twofactor applications to most of the presets (server#57737)
featureFeat(sharing): Make share permission in bundled edit configurable (server#57741)
featureFeat(openmetrics): add log level (server#57759)
featureFeat(contacts): support federated users/groups search when adding team members (server#57782)
featureFeat(flake): Add reuse cli (server#57800)
featureFeat: optimize user mount cache (server#57815)
featureFeat(OCP): Expose setup manager to OCP (server#57826)
featureFeat: Add SetupCheck to warn about missing second factor provider (server#57854)
breakingRemove external shares from share list (server#58204)
breakingRemove leftover useless path assignements in View (server#58835)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58869)
breakingRemove static vars, first batch (server#59159)
breakingRemove long-time deprecated methods (server#59544)
breakingChore!(core): remove deprecated Handlebars globals (server#59748)
breakingRemove unneeded sort when listing mail/federated shares (server#60244)
securityFix(security): Update Expires time (server#60397)
securityMaster] fix(security): Update code signing revocation list (server#61001)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1264)
breakingRemove unneeded max-height from text-menubar which caused a bug (text#8311)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476)
+949 more items in the release notesfixFix: track time spent in recursive markOrRun calls (server#61552)
fixFix(dashboard): update scrollbar contrast on background (server#62629)
fixFix(encryption): bind personal private key password inputs (server#62671)
fixFix: allow Enter on public share Download link (server#62769)
fixFix: multiple file selection on tab navigation (server#63213)
fixFix(cardDav): Only update user card on actual mapped propreties changes (server#63769)
fixFix: fail uploads when uri does not match session/share token (server#63961)
fixFix(files_external): map display names for groups (server#64009)
fixFix: Unknown cli option (server#64012)
fixFix(sharing): Hide Allow download and sync option for federated (server#64014)
fixFix(tags): broken tag deletion on user delete (server#64088)
fixFix: protect share accept endpoint with CSRF token (server#64108)
fixFix: remove wrongly used system address book flag (server#64130)
fixFix(files_sharing): normalize share target on parent folder rename (server#64142)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64147)
fixFix: update left padding of public shares (server#64211)
fixFix(ci): Pin 32-bit (server#64305)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64320)
fixFix: preserve link shares on ownership transfer (server#64329)
fixFix: remove nested items from favorites view on unfavorite (server#64346)
fixFix(encryption): cap and invalidate key-cache (server#64354)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64358)
fixFix(files_external): show that an unrestricted storage applies to all (server#64360)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64366)
fixFix: show custom permissions when share is removed from edit bundle (server#64377)
fixFix: logs can leak sensitive information.. (server#64384)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64414)
fixFix: scope group share child permission updates to usergroup (server#64418)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64423)
fixFix(config): Don’t print sensitive config when setting them (server#64463)
securityMaster] fix(security): Update code signing revocation list (server#64465)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64475)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64480)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64483)
fixFix(dav): keep tags on hidden files when setting tag object ids (server#64561)
featureAdd API to generate system report section (server#64633)
securityMaster] fix(security): Update code signing revocation list (server#64720)
featureFeat: add additional metadata to node webhooks (server#64845)
featurePerf(files): Only match search results against caches of their storage (server#64918)
featureFeat(workflow): Add fixup block (circles#2987)
+76 more items in the release notesfixFix(ocm): Move invite-accepted capability and implementati… (server#62460)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)
fixFix(CalDAV): iTipBroker message generation and testing (server#63187)
fixFix(preview): delete version metadata by preview ID (server#63289)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)
fixFix: make unified filter chip accessible (server#63319)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)
securityMaster] fix(security): Update code signing revocation list (server#63357)
securityMaster] fix(security): Update code signing revocation list (server#63363)
securityMaster] fix(security): Update code signing revocation list (server#63369)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63380)
fixFix: Public link with multiple mounts (server#63383)
fixFix(preview): keep the local file when losing the insert race (server#63391)
fixFix(files_sharing): Use share password policy for password generation (server#63396)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)
fixFix(files_reminder): passed reminder handling (server#63424)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63457)
securityMaster] fix(security): Update code signing revocation list (server#63520)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63522)
fixFix(files): hide download action in link shares for newly created folders (server#63553)
fixFix(appconfig): make type-conflict error self-explanatory (server#63642)
fixFix(dav): scope contact photo export to local address books (server#63644)
fixFix cancelling the customization of a share (server#63657)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63667)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63677)
fixFix(settings): Fix AI regex (server#63692)
fixFix: Check that password matches in occ user:auth-tokens:add (server#63696)
fixFix(contactsmenu): restore avatars for non-user contacts (server#63716)
fixFix: Check rememberme cookie previous session id matches uid (server#63720)
fixFix(2fa): Add missing BruteForceProtection attribute (server#63733)
fixFix(core): accept deprecated IANA timezone aliases (server#63757)
fixFix(group): pass previous display name in GroupChangedEvent (server#63780)
fixFix(files_external): guard optional S3 key in storage id computation (server#63818)
fixFix(webauthn): Throw on uid mismatch when updating registration (server#63833)
fixFix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)
fixFix: Ensure we don’t get share by empty name (server#63851)
securityMaster] fix(security): Update code signing revocation list (server#64098)
featureAdd a vitest harness for the front-end (files_pdfviewer#1566)
+40 more items in the release notesfixFix(files_sharing): preserve unmasked permissions as scan_permissions (server#62217)
featurePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62222)
fixFix: Output shape validation will delete keys when there is a list of files (server#62238)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62280)
fixFix(files): properly handle folders without permissions (server#62319)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62338)
fixFix(files_version): mtime confusion on milliseconds (server#62371)
fixFix(files_sharing): Use share id in file actions (server#62402)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62419)
fixFix(SetupChecks): Link to task processing worker docs (server#62442)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62452)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62456)
fixFix: harden object store against copying a file to itself (server#62462)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62603)
fixFix(unified-search): catch errors in response (server#62614)
securityMaster] fix(security): Update code signing revocation list (server#62653)
fixFix(search): Add end date for last 7 and last 30 days (server#62684)
fixFix(caldav): Expand recurring events for principal calendar search (server#62692)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62703)
fixFix(imip): add context to imip log messages (server#62721)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62732)
featurePerf(user-display-name): Check memory cache before trying redis (server#62777)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62779)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62785)
fixFix(encryption): handle decryption exception with outdated passwords (server#62787)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62793)
fixFix(systemTags): setObjectIdsForTag() dispatches once (server#62800)
fixFix: handle sftp private key as password (server#62823)
fixFix: disable direct link if link shares are disabled (server#62831)
fixFix: clear key password after loading key (server#62849)
fixFix(direct editing): cleanup tokens on user deletion (server#62863)
fixFix(dav): properly finalize with MOVE only (server#62875)
fixFix(share): do not re-accept rejected shares (server#62890)
fixFix: throw better error message if a user doesn’t have a key even though it should have (server#62892)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62907)
featureFeat: Allow to check user existence outside specific user backends (server#62916)
featureFeat(lookup): search for local account only via lookupserver (server#62935)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62948)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63115)
featureFeat: adding an option to exclude users from the acitivity log (activity#2809)
+62 more items in the release notesfixFix(files_sharing): Drop trailing ‘?’ from public download redirect URL (server#59885)
fixFix(settings): sort app list by app name instead of app objects (server#59992)
fixFix(cypress): disable unsupported-browser redirect in test container (server#60805)
fixFix(core): public share download icon color and theme filter scope (server#61210)
fixFix: update cached mounts when moving share in repair step (server#61499)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61527)
featurePerf: block more properties from using the custom properties backend (server#61541)
fixFix(settings): correct heading order in account management sidebar (server#61547)
fixFix: Make the IProvideUserSecretBackend usable (server#61549)
featurePerf(log): normalize log data only when logging (server#61556)
fixFix(Collaborators): Fix matching emails to remote users if no remote results are present (server#61570)
fixFix(dav): Handle GenericFileException when reading default contact file (server#61595)
fixFix(a11y): label account QR code button (server#61603)
fixFix(files): Open the sidebar for the current folder, not a stale child (server#61605)
fixFix(user_status): stabilise the user_status (server#61619)
fixFix(dav): Load ProfilerPlugin only when profiler is enabled (server#61644)
fixFix(config): Decrypt sensitive appconfigs when requested (server#61661)
fixFix(files_external): ignore deprecated backends (server#61692)
fixFix(files_external): properly apply default mount options (server#61701)
fixFix(settings): in absence form avoid shifting dates to browsers timezone (server#61711)
featurePerf: Only sort wrappers when adding them (server#61718)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61851)
featureFeat: Disable callable serialization in sabre/xml (server#61924)
featureFeat: Fetch groups in batch in getUserGroups (server#61935)
featureFeat(login): clean remember me tokens (server#61971)
securityMaster] fix(security): Update code signing revocation list (server#62041)
securityMaster] fix(security): Update code signing revocation list (server#62047)
featurePerf(carddav): reduce disk usage of photocache (server#62053)
featurePerf(workflow): Implement result cache for IP checks (server#62056)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62179)
securityMaster] fix(security): Update code signing revocation list (server#62185)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62198)
featurePerf(dav): Stream PROPFIND output (server#62225)
securityMaster] fix(security): Update CA certificate bundle (server#62436)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2512)
featureFeat: make amount of items sent on email configurable via occ (activity#2709)
featurePerf(files): compute move/rename activity settings once (activity#2795)
featureFeat: add release relay gh workflow (app_api#923)
featureFeat: Show request time to the push proxy (notifications#3155)
featureFeat: Add login output when password policy fails (password_policy#967)
+249 more items in the release notesfixDav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)
fixFix(files,files_sharing): swallow redirected navigation errors (server#59887)
fixFix(caldav): grant sharee Acls to the delegate (server#60646)
fixFix(http): avoid iconv for header ascii fallback (server#60722)
fixFix(DB): Enforce foreign key constraints in SQLite (server#60792)
fixFix(encryption): recovery keys should be shown when user keys are used (server#60799)
fixFix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)
fixFix(files): Chromium-based browsers drag-and-drop (server#60899)
fixFix: actually register listener for updating stored external storage credentials (server#60905)
fixFix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)
fixFix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)
fixFix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)
fixFix(psalm): Update psalm baseline (server#60933)
fixFix(Storage): use `proxyexclude` parameter in DAV client (server#60939)
fixFix(files_sharing): clear the password after saving (server#60951)
fixFix(files): show proper information when a move will override the target (server#60962)
fixFix: access shared and delegated trashbin objects (server#60967)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)
securityMaster] fix(security): Update code signing revocation list (server#61002)
fixFix(dav): finalize upload metadata before post-write hooks (server#61070)
fixFix(dav): properly handle files metadata (server#61079)
fixFix(comments): Use capped memory cache for comments (server#61096)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61107)
fixFix: Correctly detect appid for dist css files (server#61112)
fixFix: use correct permissions mask for non-home storage public links (server#61117)
fixFix(settings): Show loading spinner while searching accounts (server#61121)
securityMaster] fix(security): Update code signing revocation list (server#61134)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)
fixFix(previews): ffprobe hangs (server#61183)
fixFix(files_versions): guard null path in event listeners (server#61188)
fixFix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)
fixFix(search-query): fix psalm type error (server#61196)
securityMaster] fix(security): Update code signing revocation list (server#61238)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)
securityMaster] fix(security): Update code signing revocation list (server#61284)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61362)
securityMaster] fix(security): Update code signing revocation list (server#61430)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2637)
featureFeat: Add role-based filtering for circle member queries (circles#2504)
+48 more items in the release notesotherRefactor: move release changelog workflow to releases repo (server#60831)
fixFix: Add missing DI for IAppConfig to Push.php (notifications#3039)
fixFix(folderDescription): always use ‘Readme.md’ as filename (text#8658)
fixFix(headings): skip headings in details in table of contents (text#8660)
otherTest(playwright): add summary job so we can add it to merge rules (text#8663)
fixFix: allow renaming files with just update permissions (server#59241)
fixFix(encryption): limit oprhaned keys scan to one user (server#59808)
fixFix(s3): ignore prefixes with repeating delimiters (server#59829)
fixFix removed address book items not being synced between federated instances (server#59894)
fixFix(files): fix custom client-side error messages on move/copy actions (server#59954)
featureFeat: Better reporting if something is wrong with taskprocessing (server#59991)
fixFix: Harmonize login and passwordless login redirect behavior (server#60007)
fixFix(core): provide valid initial state also on public templates (server#60015)
fixFix(navigation): Fix default app icon (server#60133)
fixFix(files): escape html entities in dav search requests (server#60140)
fixFix(LocalPreviewStorage): Use correct regex to detect files in nested directory format (server#60143)
fixFix(comments): register event listener for typed comment events (server#60149)
fixFix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60157)
fixFix: Dispatch old comment events (server#60168)
fixFix(comments): Add an action to comment notification that dismisses it (server#60175)
fixFix(core): prompt for password once when installing recommended apps (server#60184)
featureFeat(updatenotification): handle files_lock (server#60203)
fixFix(public.scss): increase footer width (server#60208)
fixFix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60210)
fixFix since checker (server#60219)
fixFix(settings): Fix admin delegation for hidden sections (server#60222)
fixFix: Fix permission issue when uploading a chunked file (server#60240)
featureFeat(app-licenses): Add further compatible licenses for apps to use (server#60296)
fixFix(Setup): Ensure instanceid is generated during installation (server#60301)
fixFix(http-client): detect brotli support via libcurl, not PHP extension (server#60309)
fixFix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60322)
fixFix(snowflake): fix wrong documentation about serverId (server#60328)
featurePerf(share): Remove useless order by id (server#60345)
breakingRemove unneeded sort when listing mail/federated shares (server#60356)
featurePerf: remove unneeded sort in getFolderContentsById (server#60357)
securityFix(security): Update Expires time (server#60396)
featureFeat(users): Check assertion when enabling user (server#60516)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#60601)
featureFeat(openmetrics): export more resilient if exception happens (server#60627)
featureFeat: add search and limit support for team members list (circles#2460)
featureFeat: Remove unnecessary whitespaces (logreader#2027)
featureFeat(push): Optionally use OAEP padding (notifications#2986)
featurePerf(rich_workspace): only add property for parent (text#8498)
featureFeat: add support for wiki-style link and image Markdown syntax (text#8576)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580)
+86 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
featureFeat(migration-attributes): add DataCleansing (server#54861)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54863)
securityFix(security): Update Expires time (server#54868)
featureAdd task processing manager method to get the list of available task type IDs (server#54917)
featureFeat(file_sharing): Provide template creator list in public shares (server#54948)
featureFeat: show object store instance in info:file (server#54961)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#54967)
featurePerf(mounts): avoid array_merge in mounts loop (server#54976)
securityFix(security): Update CA certificate bundle (server#54982)
featureFeat(ZipFolderPlugin): always use the parent folder name as archive name (server#55020)
securityFix(security): Update code signing revocation list (server#55051)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#55060)
featureFeat(files_sharing): provide web components based API for sidebar (server#55174)
featureFeat(db): add SSL/TLS support for PostgreSQL (server#55256)
featureFeat(Unified search): Use existing min search length setting (server#55301)
featureFeat: Mark OC.SystemTags as deprecated (server#55323)
featureAdmin-delegation occ – add output option for show command to support JSON formats (server#55430)
securityFix(security): Update code signing revocation list (server#55445)
featureFeat: add header with user id in response (server#55502)
featureAllow to remove a website in the user profile (server#55523)
featureFeat(test-case): allow to use PHPUnit Group attributes to mark tests requiring database (server#55571)
featureFeat(settings): Introduce TaskProcessingSuccessRate setup check (server#55778)
featureFeat: add new link endpoint when using globalscale (server#55798)
featureFeat(route): globalsiteselector as root url generator (server#55817)
featureFeat: locally cache frequently requested LDAP mapping data (server#55823)
featureAdd font-variant-numeric to selected files list (server#55873)
featureAdd unit tests for AdminDelegation command and AuthorizedGroupService (server#56044)
securityFix(security): Update CA certificate bundle (server#56209)
featureFeat(EphemeralSessions): Introduce lax period (server#56232)
featureFeat(cloud-federation-api): accept folder shares (server#56336)
featureFeat: add occ command to scan and delete orphaned keys (server#56347)
securityFix(security): Update code signing revocation list (server#56365)
featureAdd AI input limits (server#56369)
featureFeat(rate-limit): Allow overwriting the rate limit (server#56382)
featureAdd rememberme checkbox (server#56423)
+732 more items in the release notesotherserver
featureFeat(recent-files): add recent_files_limit config on files settings (server#59216)
other33.0.2 RC0 (server#59259)
fixFix(files_sharing): do not prevent share creation if password is enabled but not supported by the current share type (server#59263)
fixFix(sharing): Don’t redirect when accepting a share failed (server#59305)
other33.0.2 RC1 (server#59306)
other33.0.2 (server#59392)
otheractivity
otherChore(branchoff): Set version on stable33 to a stable one (activity#2480)
otherbruteforcesettings
otherChore(branchoff): Set version on stable33 to a stable one (bruteforcesettings#1032)
otherUpdate nextcloud/ocp dependency (bruteforcesettings#1038)
otherfiles_downloadlimit
otherChore(branchoff): Set version on stable33 to a stable one (files_downloadlimit#756)
otherfiles_pdfviewer
otherChore(branchoff): Set version on stable33 to a stable one (files_pdfviewer#1401)
otherfirstrunwizard
otherChore(branchoff): Set version on stable33 to a stable one (firstrunwizard#2020)
otherpassword_policy
otherChore(branchoff): Set version on stable33 to a stable one (password_policy#914)
otherphotos
otherChore(branchoff): Set version on stable33 to a stable one (photos#3459)
otherprivacy
otherChore(branchoff): Set version on stable33 to a stable one (privacy#1289)
otherrecommendations
otherChore(branchoff): Set version on stable33 to a stable one (recommendations#1004)
otherrelated_resources
otherChore(branchoff): Set version on stable33 to a stable one (related_resources#907)
otherserverinfo
otherChore(branchoff): Set version on stable33 to a stable one (serverinfo#967)
othersurvey_client
otherChore(branchoff): Set version on stable33 to a stable one (survey_client#391)
othersuspicious_login
otherChore(branchoff): Set version on stable33 to a stable one (suspicious_login#1092)
othertext
fixFix(deps): update dependency yjs to ^13.6.30 (text#8394)
otherChore(branchoff): Set version on stable33 to a stable one (text#8407)
othertwofactor_totp
otherChore(branchoff): Set version on stable33 to a stable one (twofactor_totp#1751)
fixFix(deps): align composer-lock and checked-in vendor/ (updater#727)
+3 more items in the release notessecurityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
fixFix(docs): Fix dead documentation link for Windows file names (server#58291)
fixFix(comments): properly handle opening the sidebar when Activity integration is used (server#58294)
fixFix(theming): display error messages on image upload and delete previous image only after validation (server#58323)
fixFix: don’t try to create preview folder if it already exists (server#58328)
fixFix: obey x-nc-scheduling flag on delete (server#58341)
fixFix(sftp): Handle empty port parameter to allow host-defined ports (server#58358)
featureFeat: add upload_time support to file search and recent files (server#58374)
fixFix(files): correctly sort views (server#58375)
fixFix(cache): filter out invalid entries in `OC\Files\Cache\Wrapper\CacheWrapper::getFolderContentsById` (server#58378)
fixFix(setup): add index properties_name_path_user by default on new installs (server#58418)
fixFix(external_storage): hide local storage as an option for users (server#58424)
fixFix(user_status): mount emoji picker outside of dialog (server#58429)
fixFix(perf): use index when deleting old previews (server#58431)
fixFix(Propagator): Skip groupfolders root entries (server#58433)
fixFix/more missing userid cases (server#58440)
fixFix(files_sharing): ensure the server share API errors are shown (server#58441)
fixFix(TransferOwnershipService): Remove groupfolders size (server#58449)
fixFix(Propagator): Also skip groupfolders versions and trash entries (server#58450)
fixFix(View): Handle ICacheEntry returned by FileInfo->getData() (server#58455)
fixFix(files): fix tab navigation from select all checkbox to batch actions (server#58462)
fixFix(files_sharing): make legacy `downloadShare` endpoint compatible with legacy behavior (server#58468)
fixFix(dav): Use an exhaustive list for allowed serialized classes (server#58511)
featureFeat: calendar read and write federation (server#58590)
featurePerf(sharing): Avoid loading all shares from all users when unsharing (server#58658)
featureFeat: set creation_time on file creation and render recently created icon (server#58694)
breakingRemove external shares from share list (server#58717)
featurePerf(preview): bulk process preview regeneration (server#58796)
featureFeat: Add memcache_customprefix (server#58810)
featureFeat(routing): add files_sharing_raw to rootUrlApps (server#58838)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58880)
featureFeat: improve calendar migrator (server#58907)
featureFeat(CalDAV): Add function to get the token of a publicly shared calendar (server#59080)
featureFeat(taskprocessing): add worker command for synchronous task processing (server#59082)
featurePerf: Replace getById call with getFirstNodeById (activity#2388)
featurePerf: add new index to serve a full WHERE clause (activity#2447)
featureFeat: make Docker API version configurable via app config (app_api#798)
featureAvoid cropping logo in About & New slideshow (firstrunwizard#1964)
featureFeat(api): Add context parameter to generate and validate endpoints (password_policy#900)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1268)
+137 more items in the release notesfeatureAdd UserConfigChangedEvent to fire whenever a user config value is changed (server#42039)
featureFeat: Add appconfig to disable fixed userfolder permissions optimization (server#51145)
featureFeat: add an option to filter what paths get checked for updates (server#52442)
featureFeat(CertificateManager): Add option to specify the default certificates bundle path (server#52749)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#52825)
featureFeat(previews): allow ffmpeg to connect direct for AWS S3 buckets (server#53634)
featureFeat(login): hide password on form submit (server#53869)
featureFeat(previews): previews for large remote files without full file download (server#53952)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#54316)
featureFeat: locally cache frequently requested LDAP mapping data (server#54429)
featurePerf(s3): Provide direct pre-signed download link (server#54436)
featureAdd INodeByPath to Directory (server#54441)
featureFeat(config): Add common audio and video MIME type aliases (server#54447)
featurePerf(preview): Split preview data to new table (server#54543)
featureFeat(file_sharing): Provide template creator list in public shares (server#54565)
featureFeat(comments): add Markdown support (server#54685)
featureFeat(files_sharing): provide web components based API for sidebar (server#54788)
featureFeat(ObjectStore): Add option to limit the total size (server#54797)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54810)
featureFeat(migration-attributes): add DataCleansing (server#54842)
featureFeat(migration-attributes): missing attributes (server#54846)
featureAdd task processing manager method to get the list of available task type IDs (server#54848)
security[master] fix(security): Update CA certificate bundle (server#54992)
security[master] fix(security): Update code signing revocation list (server#55056)
security[master] fix(security): Update code signing revocation list (server#55446)
deprecatedPort away from deprecated Doctrine APIs (server#55674)
breakingChore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718)
breakingRemove stable30 from dependabot (server#56018)
security[master] fix(security): Update CA certificate bundle (server#56211)
security[master] fix(security): Update code signing revocation list (server#56363)
breakingDebt(files): Remove regular stats request (server#56792)
security[master] fix(security): Update CA certificate bundle (server#56811)
security[master] fix(security): Update code signing revocation list (server#57031)
breakingEnhancement(files): remove redundant success toast on file rename (server#57168)
security[master] fix(security): Update code signing revocation list (server#57262)
breakingRefactor!: migrate files sidebar to Node API (server#57277)
security[master] fix(security): Update code signing revocation list (server#57380)
securityFix(security): Update Expires time (server#57688)
securityFix(security): Update code signing revocation list (server#57948)
deprecatedCleanup unused code and deprecated imports (text#7752)
+2364 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
securityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
featureFeat: add logging to preview generation (server#52300)
featureFeat: handle hide-download DAV property (viewer#2807)
featureFeat: lowercase headers to exclude in exapp proxy (app_api#569)
featureFeat(profile): Add an API to get the profile field data (server#52372)
featureFeat(security): add configurable IPv6 subnet for BFP and throttling (server#52233)
fixFix multiple cypress issues (activity#1994)
fixFix saving annotations in paths with special characters (files_pdfviewer#1194)
fixFix task processing registration validation (app_api#573)
fixFix: Adjust padding in table cell and header components (text#7189)
fixFix: adjust webpack nonce generation (server#52003)
fixFix: Apply storage checks in addition to share (text#7192)
fixFix: Check that user actually can validate password for js (server#52237)
fixFix: don't check node access again for listing reminders in dav (server#52504)
fixFix: don't setup the filesystem to check if a user is blocked by ACLs (activity#1985)
fixFix: exclude vendor-bin from release artifacts (suspicious_login#989)
fixFix: fix preloading files with no custom properties (server#52101)
fixFix: Flaky samba kerberos tests (server#52578)
fixFix: Forward attributes to the sidebar (server#52566)
fixFix: Open PDF file in "richdocuments" if it is not downloadable (files_pdfviewer#1204)
fixFix: Proper order for checking path prefix for getting file by id from cache (server#52039)
fixFix: submit button on file picker dialog (text#7190)
fixFix: Transfer ownership with S3 as primary (server#52185)
fixFix: try to avoid memory exhaustion (suspicious_login#988)
fixFix(apps): Sort names separately from active/update state (server#52653)
fixFix(blurhash): Use preview API to generate the previews (server#52661)
fixFix(build): avoid double load of the app (notifications#2309)
fixFix(CalDAV): do not ignore move command object target uri (server#52562)
fixFix(CI): disable RateLimiting for Nextcloud in the CI (app_api#565)
fixFix(config): Censor more app configs in system report (server#52433)
fixFix(dav): allow uploading of files with long filenames (server#52302)
fixFix(dav): check the owner displayName scope before giving attribute (server#52554)
fixFix(db): Create replacement index where original index is missing (server#52394)
fixFix(exAppMapper): init missing headers_to_exclude (app_api#564)
featurePerf: Log requests using high amount of memory as warning (server#52219)
featurePerf(caldav): increase chunk size in RemoveOrphanEventsAndContacts repair step (server#52548)
featurePerf(cloud_federation_api): only provide capabilities if needed (server#52030)
featurePerf(db): Extend index on cards_properties to cover name and value (server#52415)
featurePerf(files_reminders): Reduce db queries on propfind (server#51736)
featurePerf(files_sharing): do not emit second propfind for account filter (server#52001)
breakingRemove custom handling for public share pages with single files (files_pdfviewer#1206)
+51 more items in the release notesother[stable31] fix(taskprocessing): use the event for AppAPI to get list of AI providers
other[stable31] fix(dav): Really only run the chunk cleanup once
fix[stable31] fix(files_sharing): fix share creation error handling
fix[stable31] feat(bulk-upload): change the default to disabled as there are still some bugs present
other[stable31] fix(federation): Don't load the addressbook when resolving a cloud ID
other[stable31] ignore missing theming app
other[stable31] fix(ContextAgent): Do not translate the name ContextAgent
otherbuild(deps): bump marked from 15.0.7 to 15.0.8
feature[stable31] chore(files_trashbin): Add user details in log from Trashbin
other[stable31] fix: Handle missing share providers when promoting reshares
otherbuild(deps): bump @nextcloud/event-bus from 3.3.1 to 3.3.2
otherbuild(deps): bump dompurify from 3.2.4 to 3.2.5
other[stable31] fix(files_sharing): rate limit share creation 20 times per 10 minutes
other[stable31] fix(files_sharing): Apply default password setting in SharingDetailsTab
other31.0.4 RC1
other31.0.4
securityFixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3…
fixFix(files): also show file list headers on empty views (server#51275)
fixFix(dav): Create SAB at installation (server#51316)
fixFix: remote account activity translation (server#51326)
fixFix: Do not build encrypted password if there is none (server#51330)
featureFeat(dav): add webhook compatibility for calendar object events (server#51331)
fixFix disabled user list for SAML group subadmin (server#51376)
fixFix(files_external): Stop building path twice when checking if file exists on case insensitive SMB storage (server#51388)
fixFix(CalDav): alter invitation attachment filename and type (server#51466)
fixFix(files_sharing): ensure share status action works also in grid view (server#51474)
fixFix(profile): allow to unset phone number (server#51511)
fixFix: skip caching lastSeenQuotaUsage for remote shares (server#51522)
fixFix(cardav): only show users from enabled addressBooks in contacts menu (server#51539)
fixFix(unified-search): do not overlap search bar with button (server#51566)
fixFix(webauthn): adjust for updated library and add tests (server#51578)
fixFix: pass hide download attribute while creating the share to fix github issue 50788 (server#51582)
fixFix(files_sharing): skip expiration notify for invalid share record (server#51616)
fixFix(ocm): publicKey can be disabled so capabilities do not match (server#51653)
fixFix(files): Ensure actions never overflow filename (server#51659)
fixFix(IFilenameValidator): correctly handle case insensitivity (server#51662)
fixFix(user): Some strings not being translated (server#51666)
fixFix(provisioning_api): Pass on translated hint if password change fails (server#51672)
fixFix(setupchecks): Treat information messages as success (server#51678)
fixFix(database): Cast users count to integer (server#51688)
fixFix(systemtags): Dispatch events when bulk assigning system tags (server#51690)
featurePerf(sharing): Use oc_share.item_type IN instead of OR equals (server#51691)
fixFix(dav): filter user files when updating tags (server#51693)
fixFix files_sorting cypress tests (server#51695)
fixFix(login): Improve CSRF error message for better user understanding (server#51699)
fixFix public download activity (server#51704)
fixFix: filter out contacts with empty email addresses in sharee completion (server#51708)
fixFix(GenerateBlurhashMetadata): Suppress imagescale errors (server#51718)
fixFix(occ): Suppress errors when checking config.php fileowner (server#51720)
fixFix(files_versions): correctly show version author also for shared files (server#51723)
fixFix(files_reminders): Fix reminder actions being displayed on invalid nodes (server#51738)
featureFeat: Limit ExpireTrash job to 30 minutes (server#51808)
featurePerf(cron): Delay (re)checking timed jobs (server#51820)
featureRevert "refactor: add migration for email setting" (server#51987)
featureFeat(ip): use larger IPv6 range by default (server#52033)
featureFeat: skip expire sharing notify if node deleted (activity#1937)
+57 more items in the release notesother[stable31] fix(mime-types): adjust compiled mime types and sign
other[stable31] fix(encryption): Listen for user login and logout to set encryption key
feature[stable31] Allow to delete files without trashbin + add unit tests + some refactoring
fix[stable31] fix(dav): Fix share token pattern for base uri extraction
other[stable31] fix(RichObjectStrings): Make exception messages for invalid parameters more useful for debugging
breaking[stable31] test: Remove .only() calls
other[stable31] ci: Update 3rdparty actions
fix[stable31] fix(comments): Fix activity rich subject parameters
other[stable31] fix(base.php): Correct order for booting \OC\Server
other[stable31] fix(files): Make sure file pointer exists
feature[stable31] fix(auth): Allow 2FA challenges for Ephemeral sessions
other31.0.2 RC1
other31.0.2
securityFixes CVE-2025-66547: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via…
securityFixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t…
securityFixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13…
other[stable31] ci(autochecks): Run some autochecks also on non-PHP files
other[stable31] fix(cron): Ignore time sensitivity when a class was explicitely scheduled
other[stable31] fix: Initialize lastConnectionCheck after first connection
other[stable31] fix(files_versions): Do not expire versions newer than min age
other[stable31] fix: wipe local storages on log out
other[stable31] fix: Change UserAgent to *cloud
other[stable31] Fix: NotFoundException for anonymous users
other[stable31] Spelling standardization
fix[stable31] fix(admin_audit): Fix incorrect truncation of files path in admin audit log
other[stable31] chore(deps-dev): bump ts-loader from 9.5.1 to 9.5.2
security[stable31] fix(security): Update CA certificate bundle
other[stable31] fix(systemtags): Use literal strings for i18n in showSuccess
other[stable31] feat: support migrating an instance to sharding
other[stable31] fix: Report duplicated extra files in integrity check
fix[stable31] fix(translation): Fix string concatenation in LDAP endpoint
fix[stable31] files: fix exception when share-attributes is undefined
other[stable31] fix(l10n): Improve english source strings
other[stable31] make it possible to run occ as root
other[stable31] fix(cypress): wait for toast to appear
other[stable31] fix(dav): Handle end of stream in File::put
otherchore(deps-dev): bump @nextcloud/eslint-config from 8.4.1 to 8.4.2
otherchore(deps): bump @nextcloud/files from 3.10.1 to 3.10.2
otherchore(deps): bump marked from 15.0.6 to 15.0.7
securityFix A+ rating when checking with Nextcloud Security Scan.
otherchore(deps): bump focus-trap from 7.6.0 to 7.6.4
otherchore(deps-dev): bump @types/dockerode from 3.3.34 to 3.3.35
other[stable31] fix(files_reminders): Do not attempt to send reminders after a user has left a share
other[stable31] Remove space
other[stable31] chore(deps): bump webdav from 5.7.1 to 5.8.0
breaking[stable31] fix: remove caching in fetchListOfGroups
other[stable31] feat: Close sessions created for login flow v2
other[stable31] fix(files_external): Move definition parameter to the correct place
other[stable31] fix(files): Ensure the filter instance is mounted
other[stable31] fix(files_trashbin): disable bulk download for trashbin
feature[stable31] refactor(TempManager): Simplify and unify implementations and remove legacy behavior
feature[stable31] feat: Add bases and gidNumber attribute to ldap:test-user-settings output
feature[stable31] feat(files): allow to ignore warning to change file type
+29 more items in the release notesother[stable31] fix: validate account properties as a repair step
other31.0.0
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
featureFeat: lowercase headers to exclude in exapp proxy (app_api#570)
featureFeat(admin_audit): write admin audit log for login failed (server#51107)
featureFeat(security): add configurable IPv6 subnet for BFP and throttling (server#52232)
fixFix saving annotations in paths with special characters (files_pdfviewer#1193)
fixFix task processing registration validation (app_api#574)
fixFix: Adjust padding in table cell and header components (text#7187)
fixFix: Apply storage checks in addition to share (text#7193)
fixFix: Check that user actually can validate password for js (server#52238)
fixFix: don't setup the filesystem to check if a user is blocked by ACLs (activity#1986)
fixFix: exclude vendor-bin from release artifacts (suspicious_login#990)
fixFix: Fix copying to the root of another mountpoint (server#52499)
fixFix: fix preloading files with no custom properties (server#52102)
fixFix: Flaky samba kerberos tests (server#52580)
fixFix: Open PDF file in "richdocuments" if it is not downloadable (files_pdfviewer#1205)
fixFix: Transfer ownership with S3 as primary (server#52184)
fixFix: try to avoid memory exhaustion (suspicious_login#987)
fixFix(apps): Sort names separately from active/update state (server#52652)
fixFix(blurhash): Use preview API to generate the previews (server#52660)
fixFix(build): avoid double load of the app (notifications#2308)
fixFix(CalDAV): do not ignore move command object target uri (server#52561)
fixFix(CI): disable RateLimiting for Nextcloud in the CI (app_api#566)
fixFix(config): Censor more app configs in system report (server#52432)
fixFix(dav): allow uploading of files with long filenames (server#52377)
fixFix(dav): check the owner displayName scope before giving attribute (server#52553)
fixFix(db): Create replacement index where original index is missing (server#52393)
fixFix(deps): Bump symfony/process (twofactor_totp#1582)
fixFix(exAppMapper): init missing headers_to_exclude (app_api#563)
fixFix(federation): allows equal signs in federation id (server#52386)
fixFix(files_external): Mark password fields for LoginCredentials and SessionCredentials as hidden and optional (server#52645)
fixFix(files_sharing): file request pass empty string if password or expiration is disabled (server#52196)
fixFix(files_sharing): Improve expiration date input change handling (server#52408)
fixFix(files_sharing): Prevent create/delete permissions on file shares (server#52530)
fixFix(files_versions): create version if previous does not exist (server#52412)
fixFix(files): Ensure the filter instance is mounted (server#52557)
fixFix(files): prevent dragging preview when drag-drop (server#52362)
fixFix(info.xml): correct developer docs link (typo) (app_api#559)
fixFix(JSResourceLocator) fix incorrect parameter being used (server#52523)
featurePerf(caldav): increase chunk size in RemoveOrphanEventsAndContacts repair step (server#52547)
featurePerf(db): Extend index on cards_properties to cover name and value (server#52414)
featurePerf(files_sharing): do not emit second propfind for account filter (server#52002)
+24 more items in the release notesother[stable30] Fix(TaskProcessing): for validation for taskprocessing EShapeType
security[stable30] fix(security): Update code signing revocation list
other[stable30] fix(federation): Don't load the addressbook when resolving a cloud ID
other[stable30] fix(dav): Really only run the chunk cleanup once
fix[stable30] feat(bulk-upload): change the default to disabled as there are still some bugs present
fix[stable30] fix(files_sharing): fix share creation error handling
feature[stable30] chore(files_trashbin): Add user details in log from Trashbin
other[stable30] fix: Handle missing share providers when promoting reshares
other[stable30] fix(tests): Share manager error message from #52076
otherbuild(deps): bump dompurify from 3.2.4 to 3.2.5
other[stable30] ignore missing theming app
other[stable30] fix: Proper order for checking path prefix for getting file by id from cache
other[stable30] fix(files_sharing): rate limit share creation 20 times per 10 minutes
other[stable30] fix(files_sharing): Apply default password setting in SharingDetailsTab
other30.0.10 RC1
other[stable30] fix: only do cache copy in updater if the parent folder should be in cache
other30.0.10
securityFixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3…
securityFixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t…
fixFix(dav): Create SAB at installation (server#51315)
fixFix: remote account activity translation (server#51325)
fixFix: Do not build encrypted password if there is none (server#51327)
fixFix disabled user list for SAML group subadmin (server#51375)
fixFix(files_external): Stop building path twice when checking if file exists on case insensitive SMB storage (server#51387)
fixFix(CalDav): alter invitation attachment filename and type (server#51467)
fixFix(files_sharing): ensure share status action works also in grid view (server#51473)
fixFix(profile): allow to unset phone number (server#51510)
fixFix: skip caching lastSeenQuotaUsage for remote shares (server#51523)
fixFix(cardav): only show users from enabled addressBooks in contacts menu (server#51538)
fixFix(unified-search): do not overlap search bar with button (server#51565)
fixFix: skip transfering shares that we can't find (server#51570)
fixFix: pass hide download attribute while creating the share to fix github issue 50788 (server#51581)
fixFix: log which file cannot be opened (server#51584)
fixFix(files_sharing): skip expiration notify for invalid share record (server#51614)
fixFix(files): Ensure actions never overflow filename (server#51658)
fixFix(IFilenameValidator): correctly handle case insensitivity (server#51661)
fixFix(user): Some strings not being translated (server#51665)
fixFix(provisioning_api): Pass on translated hint if password change fails (server#51671)
fixFix(setupchecks): Treat information messages as success (server#51679)
fixFix(admin_audit): Fix incorrect truncation of files path in admin audit log (server#51681)
featurePerf(sharing): Use oc_share.item_type IN instead of OR equals (server#51692)
fixFix(login): Improve CSRF error message for better user understanding (server#51700)
fixFix: filter out contacts with empty email addresses in sharee completion (server#51709)
fixFix(GenerateBlurhashMetadata): Suppress imagescale errors (server#51717)
fixFix(occ): Suppress errors when checking config.php fileowner (server#51719)
fixFix(files_versions): correctly show version author also for shared files (server#51722)
featureAdd occ user:welcome command to send user welcome email from CLI (server#51731)
fixFix(files_reminders): Fix reminder actions being displayed on invalid nodes (server#51739)
fixFix(files_versions): Rely on server mime fallback icons (server#51747)
fixFix(theming): enforce theme also for login (server#51754)
fixFix: task type translations (server#51756)
fixFix: resolve typo in authMethod enum cases (server#51757)
fixFix(cs-fixer): Correctly ignore files ignored by git (server#51775)
fixFix(settings): Fix infinitely loading account management page with pagination of groups (server#51782)
featureFeat: Limit ExpireTrash job to 30 minutes (server#51807)
featureRevert "refactor: add migration for email setting" (server#51986)
featureFeat(ip): use larger IPv6 range by default (server#52032)
+40 more items in the release notesother[stable30] fix(mime-types): adjust compiled mime types and sign
breaking[stable30] test: Remove .only() calls
other[stable30] ci: Update 3rdparty actions
other[stable30] fix(base.php): Correct order for booting \OC\Server
other[stable30] fix(files): Make sure file pointer exists
other[stable30] fix(files): also show file list headers on empty views
feature[stable30] fix(auth): Allow 2FA challenges for Ephemeral sessions
other30.0.8 RC1
other30.0.8
securityFixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13…
other[stable30] fix(files): Do not download files with openfile query flag
other[stable30] fix: make sure we process mime extensions as string
other[stable30] fix: don't use cached root info from shared cache if the watcher has detected an update
other[stable30] fix(TaskProcessing\Manager): Always use distributed cache and use PHP serialize
feature[stable30] test: re-add object store primary storage phpunit tests
other[stable30] fix(files): Correctly copy the cache information during copy operations
fix[stable30] Fix incorrect permissions when copying shared files
deprecated[stable30] fix(repair): PHP8.3 deprecation warning
fix[stable30] Bug/48678/restore dav error response
otherchore(deps-dev): bump cypress-split from 1.24.9 to 1.24.11
otherchore(deps): bump @nextcloud/files from 3.10.1 to 3.10.2
fix[stable30] fix: Fix regression in calendar invitation sending
other[stable30] fix(SharedStorage): Check if storage ID is set on cache
other[stable30] fix(login): only show error state on login box if user interacted
feature[stable30] fix(transferownership): Allow searching new owner by email
other[stable30] perf(files): faster query to fetch incomplete directories
other[stable30] fix(files): Properly reset all file list filters on view change
other[stable30] fix(systemtags): do not hide if no tags
fix[stable30] fix(activity): Fix activity parameter types
fix[stable30] fix(files_sharing): Fix public share expiration being set when toggle is not enabled
other[stable30] fix(files): properly forward open params from short urls
other[stable30] fix(cron): Keep job class limitation when searching for the next job
other[stable30] fix(files_sharing): Also list deleted team shares
other[stable30] fix(files_external): request strict password auth on credentials enter action
fix[stable30] fix(l10n): Fix triple dot in translation
other[stable30] fix: Change UserAgent to *cloud
other[stable30] Update @nextcloud/vue to v8.23.1
other[stable30] fix(cypress): opendetails tests
other[stable30] ci(autochecks): Run some autochecks also on non-PHP files
other[stable30] fix(files): handle failed node properly
otherchore(deps): bump libphonenumber-js from 1.11.19 to 1.11.20
other[stable30] fix: validate account properties as a repair step
otherchore(deps-dev): bump @nextcloud/eslint-config from 8.4.1 to 8.4.2
security[stable30] fix(security): Update CA certificate bundle
feature[stable30] refactor(TempManager): Simplify and unify implementations and remove legacy behavior
feature[stable30] fix(test): Add missing data-cy attribute for file actions
fix[stable30] fix(translation): Fix string concatenation in LDAP endpoint
feature[stable30] Add LDAP test settings command
fix[stable30] fix(external_storage): fix settings save
+38 more items in the release notesother[stable30] fix: template field title
fix[stable30] fix(Mailer): Fix sendmail binary fallback
other30.0.6
fixFix metadata storage with sharding (server#49165)
fixFix(files): virtual scroller item size computation (server#49561)
fixFIX WebDav MacOS failed uploads php-fpm and big files (-36 error) (server#49562)
fixFix(maintenance): Show a success message on data-fingerprint command (server#49591)
fixFix(setupcheck): Make the Memcache setupcheck use the cache (server#49594)
fixFix(files): properly update paths and folder children on node move (server#49610)
fixFix: Add command to update re-share if shared-by user has been revoked (server#49612)
featurePerf: improve performance of SharedStorage::getWatcher (server#49615)
featureAdd an error log message that notifications app isn't enabled at file… (server#49618)
fixFix(external_storage): Cast id to int (server#49624)
fixFix: promote re-shares when deleting the parent share (server#49629)
fixFix: Handle copy of folders containing live photos (server#49650)
fixFix: smb: don't fail hard if we can't load acls for a file (server#49651)
fixFix: don't propagate future mtimes (server#49656)
fixFix(migration): Check if table exists (server#49690)
fixFix(CalDav): add support for Microsoft time zones (server#49741)
fixFix(files): cancel renaming on enter if no file name changes (server#49752)
fixFix(CalDAV): disable both iTip and iMip messages (server#49780)
fixFix(files): failsafe when executing actions methods (server#49792)
fixFix mimetype not being updated when changing file extention on objectstore (server#49794)
fixFix: Fix ServiceWorker scope when Nextcloud installed in subfolder (server#49798)
fixFix(files): throttle favorite with max 5 simultaneous requests (server#49805)
fixFix(files_sharing): Fix error messages from password policy (server#49822)
fixFix(files_external): wrong type for external mount id (server#49846)
fixFix: return 204 instead of 404 (server#49851)
fixFix: replace null character when serializing (server#49855)
fixFix(TemplateManager): Make sure TemplateFolder is a Folder (server#49877)
fixFix(share): Don't print twice the same text on emails (server#49878)
fixFix(ReferenceApiController): Bump rate limit for public resolve endpoint (server#49884)
fixFix(View): Catch exceptions when executing mkdir for non-existent parents (server#49894)
fixFix: make sure we have a valid scheme when testing ocm urls (server#49900)
fixFix(files): Only register preview service worker once when the instance is hosted at the root path (server#49918)
fixFix(share): render conflict modal in public shares (server#49924)
fixFix: Create empty file instead of file with a space (server#49936)
fixFix(shares): Remove noisy text from email (server#49994)
fixFix(federatedfilesharing): fix notification typo (server#50014)
fixFix: remove references to non-existent ShareTypes (server#50021)
fixFix(cypress): flaky live photo test grid_view trigger issue (server#50028)
fixFix(logger): Prevent infinite recursion with log.condition => users or matches (server#50031)
fixFix(app-store): add missing exApps list items to search filter (server#50032)
+39 more items in the release notesfeature[stable30] fix(app-store): Add back legacy store API used for update and removal
other[stable30] fix(activity): make emails for link share uploads true by default
otherchore(deps-dev): bump @nextcloud/cypress from 1.0.0-beta.8 to 1.0.0-beta.12
otherchore(deps-dev): bump @babel/node from 7.25.0 to 7.25.9
otherchore(deps-dev): bump cypress-split from 1.24.0 to 1.24.7
otherchore(deps): bump pinia from 2.2.6 to 2.2.8
otherchore(deps): bump @nextcloud/sharing from 0.2.3 to 0.2.4
other[stable30] fix(files_sharing): Stop infinite loop blocking link share requests
other30.0.4 RC1
other[stable30] fix(files_sharing): Correct property enforced property names
feature[stable30] fix(files_sharing): also submit new share on password submit
other30.0.4
securityFixes CVE-2025-47791: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently…
other[stable30] fix(files): multiselect and filters store declaration
other[stable30] fix(theming): Return default theme if the user never selected a theme
other[stable30] fix(TaskProcessingApiController): Don't use + to merge non-assoc. arrays
security[stable30] fix(net/security): Handle IPv6 zone IDs in link-local addresses
other[stable30] fix(files_sharing): note icon color on public pages
other[stable30] fix(SharingEntryLink): Show default password before create if any
other[stable30] fix(files): edit locally buttons and description
other[stable30] fix(files): open sidebar on sharing tab by default for files
otherchore(deps-dev): Bump @pinia/testing from 0.1.5 to 0.1.7
feature[stable30] feat(testing): Add a fake summary task provider
other[stable30] fix: undefined variable $response in DAV storage
other[stable30] fix(files_external): cast storage id int
other[stable30] fix: log a warning when we can't build a background job
other[stable30] docs: Adjust taiwan translators
other[stable30] fix(files): view-in-folder enabled conditions
feature[stable30] feat: Add X-NC-Disable-Scheduling property to allow skipping scheduling
other[stable30] fx(dav): file request guest nickname encoding
deprecated[stable30] fix(Middleware): log deprecation when annotation was actually used
other[stable30] Fix remaining readdir() calls in loops with undesirable false evaluation potential
other[stable30] Clear pending two factor tokens also from configuration
otherbuild(deps-dev): bump cypress from 13.13.2 to 13.13.3
other[stable30] chore: Update @nextcloud/upload and @nextcloud/files
other[stable30] chore(github): Update groupware code owners
other[stable30] [textprocessing] Fix: Accept scheduling a task if there are equivalent taskprocessing providers only
other[stable30] DNS: do not query CNAME if A succeeded already
feature[stable30] chore(deps): Add SabreDav Patch for iTip Broker
other[stable30] fix: override iTip Broker to fix several issues
other[stable30] fix: use invokePrivate for test
other[stable30] fix(caldav): duration handling in the event reader class
other[stable30] feat: mail provider settings
other[stable30] fix: RDATE and EXDATE property instances
other[stable30] fix: Do not check for strict cookie when running webcron
other[stable30] fix: Move cloud id into readonly input
otherbuild(deps-dev): bump jsdoc from 4.0.3 to 4.0.4
feature[stable30] test(fakeAI): Allow to specify whether the fake providers should fail
feature[stable30] feat(settings): add big file upload setup checks
feature[stable30] fix(files): Allow downloading multiple nodes not from same base
fixfix(SetupChecks): Make sure array key is set
security[stable30] fix(security): Update CA certificate bundle
+23 more items in the release notessecurityFixes CVE-2024-52523: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the fronte…
securityFixes CVE-2024-52518: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external stor…
securityFixes CVE-2025-47793: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.…
securityFixes CVE-2024-52525: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved…
other[stable30] fix: Make user removal more resilient
other[stable30] fix(files): Reset context menu position on close
feature[stable30] fix(files): Add more visual move / copy notification
other[stable30] fix: get rid of denied notification when accept
other[stable30] fix(share): Return empty string if no label is set
breaking[stable30] fix(files): Ensure children are removed from folder and not duplicated
other[stable30] feat(comments): Support mentioning emails
other[stable30] fix(appstore): Hide last modified information for shipped apps
security[stable30] fix(security): Update code signing revocation list
fix[stable30] fix(activity): Fix download activity parameters
feature[stable30] fix(AppConfig): Add external JWT private key to sensitive keys
other[stable30] build: Bump symfony/* to 6.4
feature[stable30] fix(files_sharing): Add proper user facing messages on success
other[stable30] ci: Update list of installed PHP extensions (as some are not default …
other[stable30] fix(files): Ensure renaming state is correctly reset
breaking[stable30] fix(filesexternal): Remove unneeded 3rdparty library use
breaking[stable30] fix(logger): Remove more parameters of other methods
feature[stable30] fix: add PasswordConfirmationRequired to create user storages endpoint
other[stable30] fix(app-store): Also proxy images of locally installed apps
other[stable30] fix(app-store): Ensure the groups property is always an array
other[stable30] fix(files): Adjust NavigationQuota for Nextcloud 30 design
feature[stable30] fix(files_sharing): Add correct context to translation
other[stable30] [TextProcessing] Fix: Also list types that are available in task processing
other[stable30] fix(app-store): Correctly render Markdown in app description
other[stable30] build: Print RTL limited characters in translation-checker
other[stable30] fix(ShareAPI): Send mails for mail shares by default
other[stable30] refactor(ShareApiController): Check for null and empty strings with e…
other[stable30] fix(files): handle empty view with error
feature[stable30] fix(files): add title for files list table header button
feature[stable30] fix: Allow overriding shouldApplyQuota check from child classes
other[stable30] fix(dav): Cleanup view-only check
feature[stable30] ci(psalm): Add missing imagick extension
fix[stable30] fix: Fix "Unknown path" error when source user files folder has not been initialized
feature[stable30] fix: add PasswordConfirmationRequired to the external storages mentioned in review
fix[stable30] fix: Fix empty sections appearing in search results
fix[stable30] fix: Fix "Reasons to use Nextcloud" design
+35 more items in the release notessecurityFixes CVE-2024-52517: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain…
securityFixes CVE-2024-52513: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T…
other[stable30] fix(files_external): broken credentials dialog
other[stable30] fix(files): Adjust Cache::searchQuery() parameter name to match interface
other[stable30] fix(files_external): Check key exists before accessing it
other[stable30] fix(files_external): Handling in SFTP UI for custom ports
other[stable30] fix: Do not try to set HTTP response code on already closed connection
other[stable30] fix(Storage\Local): Do not call getSourcePath() on SplFileInfo
other[stable30] fix(Comment): Initialize childrenCount as integer
other[stable30] fix(Tags): Return boolean for userHasTags()
other[stable30] fix(BaseResponse): Cast XML element values to string
feature[stable30] fix(S3ConfigTrait): Allow proxy field to take false
other[stable30] fix: correct link to trademark
other[stable30] Update psalm-baseline.xml
otherchore(deps-dev): bump cypress-if from 1.12.5 to 1.12.6
otherchore(deps-dev): bump @pinia/testing from 0.1.4 to 0.1.5
other[stable30] chore(i18n): adapted lowercase
other[stable30] fix(LDAP): check index before accessing it
other[stable30] fix(files): Check if target path is a descendant of the shared folder
other[stable30] fix(config): Throw PreconditionException always when it didn't match
other[stable30] fix: Display 'Leave share' instead of 'Delete'
feature[stable30] fix(caldav, carddav): also allow unsharing of circle shares
other[stable30] fix(TaskProcessing): increase error_message column length
feature[stable30] fix(settings): Add back create group icon
feature[stable30] fix(a11y): Add OTF font loading check
fix[stable30] fix(weather_status): Fix search address errors when offline
feature[stable30] fix(config): Add missing handling for envCache in getKeys()
fix[stable30] fix(Entity): Fix magic setter call for custom strong typed setters
feature[stable30] ci: Bump phpunit to 9.6.19 and add dependabot
fix[stable30] fix(user_ldap): Use %n in plural translation to avoid a crash in L10N
feature[stable30] chore: add .git-blame-ignore-revs
fix[stable30] fix: Don't crash if disabled user is missing in the database
feature[stable30] Add bidirectional text support - Backend
security[stable30] fix(security): Update CA certificate bundle
fix[stable30] fix(tests): Fix test selection and run unit tests of DAV and user_status
fix[stable30] fix(files): Fix having to resolve conflicts twice when dropping files
fix[stable30] fix: Prevent crash when refreshing metadata for files without an owner
fix[stable30] fix(files): Fix folders not being selectable in the smart picker
feature[stable30] fix(caldav): add missing handlers
fix[stable30] fix(dav): don't crash subscription on invalid calendar object
+64 more items in the release notesother30.0.0