Nextcloud Server 31.0.3 → 33.0.7
35 releases · 10 breaking changes · 53 security fixes · 5 advisories fixed
53security10breaking3deprecated117feature130fix
Vulnerabilities fixed by this upgrade
- 6.8 CVE-2026-45810 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
- 4.4 CVE-2026-45279 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
- 4.5 CVE-2025-66510 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
- 5.4 CVE-2025-66512 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
- 6.4 CVE-2025-59788 Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
Breaking changes
- breaking Remove unneeded sort when listing mail/federated shares (server#60356) in 33.0.4
- breaking Debt(files): Remove regular stats request (server#56822) in 33.0.3
- breaking Remove external shares from share list (server#58717) in 33.0.1
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8351) in 33.0.1
- breaking Chore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718) in 33.0.0
- breaking Remove stable30 from dependabot (server#56018) in 33.0.0
- breaking Debt(files): Remove regular stats request (server#56792) in 33.0.0
- breaking Enhancement(files): remove redundant success toast on file rename (server#57168) in 33.0.0
- breaking Refactor!: migrate files sidebar to Node API (server#57277) in 33.0.0
- breaking Remove custom handling for public share pages with single files (files_pdfviewer#1206) in 31.0.5
Security changes
- security Master] fix(security): Update code signing revocation list (server#62041) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62047) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62185) in 33.0.7
- security Master] fix(security): Update CA certificate bundle (server#62436) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#61002) in 33.0.6
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61134) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61238) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61284) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61430) in 33.0.6
- security Fix(security): Update Expires time (server#60396) in 33.0.4
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580) in 33.0.4
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 33.0.3
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 33.0.3
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 33.0.3
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 33.0.3
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 33.0.3
- security Fix(security): Update Expires time (server#54868) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#54982) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55051) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55445) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56209) in 33.0.3
- security Fix(security): Update code signing revocation list (server#56365) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56812) in 33.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 33.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58880) in 33.0.1
- security [master] fix(security): Update CA certificate bundle (server#54992) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55056) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55446) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56211) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#56363) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56811) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57031) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57262) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57380) in 33.0.0
- security Fix(security): Update Expires time (server#57688) in 33.0.0
- security Fix(security): Update code signing revocation list (server#57948) in 33.0.0
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 32.0.9
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 32.0.9
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 32.0.9
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 32.0.9
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 32.0.9
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 32.0.4
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 32.0.3
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 32.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 32.0.2
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 32.0.1
- security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 32.0.1
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 31.0.14
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 31.0.12
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 31.0.12
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 31.0.10
- security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 31.0.10
Deprecations
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1268) in 33.0.1
- deprecated Port away from deprecated Doctrine APIs (server#55674) in 33.0.0
- deprecated Cleanup unused code and deprecated imports (text#7752) in 33.0.0
Every release in between
fixFix(files_sharing): Drop trailing ‘?’ from public download redirect URL (server#59885)
fixFix(settings): sort app list by app name instead of app objects (server#59992)
fixFix(cypress): disable unsupported-browser redirect in test container (server#60805)
fixFix(core): public share download icon color and theme filter scope (server#61210)
fixFix: update cached mounts when moving share in repair step (server#61499)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61527)
featurePerf: block more properties from using the custom properties backend (server#61541)
fixFix(settings): correct heading order in account management sidebar (server#61547)
fixFix: Make the IProvideUserSecretBackend usable (server#61549)
featurePerf(log): normalize log data only when logging (server#61556)
fixFix(Collaborators): Fix matching emails to remote users if no remote results are present (server#61570)
fixFix(dav): Handle GenericFileException when reading default contact file (server#61595)
fixFix(a11y): label account QR code button (server#61603)
fixFix(files): Open the sidebar for the current folder, not a stale child (server#61605)
fixFix(user_status): stabilise the user_status (server#61619)
fixFix(dav): Load ProfilerPlugin only when profiler is enabled (server#61644)
fixFix(config): Decrypt sensitive appconfigs when requested (server#61661)
fixFix(files_external): ignore deprecated backends (server#61692)
fixFix(files_external): properly apply default mount options (server#61701)
fixFix(settings): in absence form avoid shifting dates to browsers timezone (server#61711)
featurePerf: Only sort wrappers when adding them (server#61718)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61851)
featureFeat: Disable callable serialization in sabre/xml (server#61924)
featureFeat: Fetch groups in batch in getUserGroups (server#61935)
featureFeat(login): clean remember me tokens (server#61971)
securityMaster] fix(security): Update code signing revocation list (server#62041)
securityMaster] fix(security): Update code signing revocation list (server#62047)
featurePerf(carddav): reduce disk usage of photocache (server#62053)
featurePerf(workflow): Implement result cache for IP checks (server#62056)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62179)
securityMaster] fix(security): Update code signing revocation list (server#62185)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62198)
featurePerf(dav): Stream PROPFIND output (server#62225)
securityMaster] fix(security): Update CA certificate bundle (server#62436)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2512)
featureFeat: make amount of items sent on email configurable via occ (activity#2709)
featurePerf(files): compute move/rename activity settings once (activity#2795)
featureFeat: add release relay gh workflow (app_api#923)
featureFeat: Show request time to the push proxy (notifications#3155)
featureFeat: Add login output when password policy fails (password_policy#967)
+249 more items in the release notesfixDav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)
fixFix(files,files_sharing): swallow redirected navigation errors (server#59887)
fixFix(caldav): grant sharee Acls to the delegate (server#60646)
fixFix(http): avoid iconv for header ascii fallback (server#60722)
fixFix(DB): Enforce foreign key constraints in SQLite (server#60792)
fixFix(encryption): recovery keys should be shown when user keys are used (server#60799)
fixFix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)
fixFix(files): Chromium-based browsers drag-and-drop (server#60899)
fixFix: actually register listener for updating stored external storage credentials (server#60905)
fixFix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)
fixFix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)
fixFix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)
fixFix(psalm): Update psalm baseline (server#60933)
fixFix(Storage): use `proxyexclude` parameter in DAV client (server#60939)
fixFix(files_sharing): clear the password after saving (server#60951)
fixFix(files): show proper information when a move will override the target (server#60962)
fixFix: access shared and delegated trashbin objects (server#60967)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)
securityMaster] fix(security): Update code signing revocation list (server#61002)
fixFix(dav): finalize upload metadata before post-write hooks (server#61070)
fixFix(dav): properly handle files metadata (server#61079)
fixFix(comments): Use capped memory cache for comments (server#61096)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61107)
fixFix: Correctly detect appid for dist css files (server#61112)
fixFix: use correct permissions mask for non-home storage public links (server#61117)
fixFix(settings): Show loading spinner while searching accounts (server#61121)
securityMaster] fix(security): Update code signing revocation list (server#61134)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)
fixFix(previews): ffprobe hangs (server#61183)
fixFix(files_versions): guard null path in event listeners (server#61188)
fixFix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)
fixFix(search-query): fix psalm type error (server#61196)
securityMaster] fix(security): Update code signing revocation list (server#61238)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)
securityMaster] fix(security): Update code signing revocation list (server#61284)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61362)
securityMaster] fix(security): Update code signing revocation list (server#61430)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2637)
featureFeat: Add role-based filtering for circle member queries (circles#2504)
+48 more items in the release notesotherRefactor: move release changelog workflow to releases repo (server#60831)
fixFix: Add missing DI for IAppConfig to Push.php (notifications#3039)
fixFix(folderDescription): always use ‘Readme.md’ as filename (text#8658)
fixFix(headings): skip headings in details in table of contents (text#8660)
otherTest(playwright): add summary job so we can add it to merge rules (text#8663)
fixFix: allow renaming files with just update permissions (server#59241)
fixFix(encryption): limit oprhaned keys scan to one user (server#59808)
fixFix(s3): ignore prefixes with repeating delimiters (server#59829)
fixFix removed address book items not being synced between federated instances (server#59894)
fixFix(files): fix custom client-side error messages on move/copy actions (server#59954)
featureFeat: Better reporting if something is wrong with taskprocessing (server#59991)
fixFix: Harmonize login and passwordless login redirect behavior (server#60007)
fixFix(core): provide valid initial state also on public templates (server#60015)
fixFix(navigation): Fix default app icon (server#60133)
fixFix(files): escape html entities in dav search requests (server#60140)
fixFix(LocalPreviewStorage): Use correct regex to detect files in nested directory format (server#60143)
fixFix(comments): register event listener for typed comment events (server#60149)
fixFix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60157)
fixFix: Dispatch old comment events (server#60168)
fixFix(comments): Add an action to comment notification that dismisses it (server#60175)
fixFix(core): prompt for password once when installing recommended apps (server#60184)
featureFeat(updatenotification): handle files_lock (server#60203)
fixFix(public.scss): increase footer width (server#60208)
fixFix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60210)
fixFix since checker (server#60219)
fixFix(settings): Fix admin delegation for hidden sections (server#60222)
fixFix: Fix permission issue when uploading a chunked file (server#60240)
featureFeat(app-licenses): Add further compatible licenses for apps to use (server#60296)
fixFix(Setup): Ensure instanceid is generated during installation (server#60301)
fixFix(http-client): detect brotli support via libcurl, not PHP extension (server#60309)
fixFix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60322)
fixFix(snowflake): fix wrong documentation about serverId (server#60328)
featurePerf(share): Remove useless order by id (server#60345)
breakingRemove unneeded sort when listing mail/federated shares (server#60356)
featurePerf: remove unneeded sort in getFolderContentsById (server#60357)
securityFix(security): Update Expires time (server#60396)
featureFeat(users): Check assertion when enabling user (server#60516)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#60601)
featureFeat(openmetrics): export more resilient if exception happens (server#60627)
featureFeat: add search and limit support for team members list (circles#2460)
featureFeat: Remove unnecessary whitespaces (logreader#2027)
featureFeat(push): Optionally use OAEP padding (notifications#2986)
featurePerf(rich_workspace): only add property for parent (text#8498)
featureFeat: add support for wiki-style link and image Markdown syntax (text#8576)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580)
+86 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
featureFeat(migration-attributes): add DataCleansing (server#54861)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54863)
securityFix(security): Update Expires time (server#54868)
featureAdd task processing manager method to get the list of available task type IDs (server#54917)
featureFeat(file_sharing): Provide template creator list in public shares (server#54948)
featureFeat: show object store instance in info:file (server#54961)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#54967)
featurePerf(mounts): avoid array_merge in mounts loop (server#54976)
securityFix(security): Update CA certificate bundle (server#54982)
featureFeat(ZipFolderPlugin): always use the parent folder name as archive name (server#55020)
securityFix(security): Update code signing revocation list (server#55051)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#55060)
featureFeat(files_sharing): provide web components based API for sidebar (server#55174)
featureFeat(db): add SSL/TLS support for PostgreSQL (server#55256)
featureFeat(Unified search): Use existing min search length setting (server#55301)
featureFeat: Mark OC.SystemTags as deprecated (server#55323)
featureAdmin-delegation occ – add output option for show command to support JSON formats (server#55430)
securityFix(security): Update code signing revocation list (server#55445)
featureFeat: add header with user id in response (server#55502)
featureAllow to remove a website in the user profile (server#55523)
featureFeat(test-case): allow to use PHPUnit Group attributes to mark tests requiring database (server#55571)
featureFeat(settings): Introduce TaskProcessingSuccessRate setup check (server#55778)
featureFeat: add new link endpoint when using globalscale (server#55798)
featureFeat(route): globalsiteselector as root url generator (server#55817)
featureFeat: locally cache frequently requested LDAP mapping data (server#55823)
featureAdd font-variant-numeric to selected files list (server#55873)
featureAdd unit tests for AdminDelegation command and AuthorizedGroupService (server#56044)
securityFix(security): Update CA certificate bundle (server#56209)
featureFeat(EphemeralSessions): Introduce lax period (server#56232)
featureFeat(cloud-federation-api): accept folder shares (server#56336)
featureFeat: add occ command to scan and delete orphaned keys (server#56347)
securityFix(security): Update code signing revocation list (server#56365)
featureAdd AI input limits (server#56369)
featureFeat(rate-limit): Allow overwriting the rate limit (server#56382)
featureAdd rememberme checkbox (server#56423)
+732 more items in the release notesotherserver
featureFeat(recent-files): add recent_files_limit config on files settings (server#59216)
other33.0.2 RC0 (server#59259)
fixFix(files_sharing): do not prevent share creation if password is enabled but not supported by the current share type (server#59263)
fixFix(sharing): Don’t redirect when accepting a share failed (server#59305)
other33.0.2 RC1 (server#59306)
other33.0.2 (server#59392)
otheractivity
otherChore(branchoff): Set version on stable33 to a stable one (activity#2480)
otherbruteforcesettings
otherChore(branchoff): Set version on stable33 to a stable one (bruteforcesettings#1032)
otherUpdate nextcloud/ocp dependency (bruteforcesettings#1038)
otherfiles_downloadlimit
otherChore(branchoff): Set version on stable33 to a stable one (files_downloadlimit#756)
otherfiles_pdfviewer
otherChore(branchoff): Set version on stable33 to a stable one (files_pdfviewer#1401)
otherfirstrunwizard
otherChore(branchoff): Set version on stable33 to a stable one (firstrunwizard#2020)
otherpassword_policy
otherChore(branchoff): Set version on stable33 to a stable one (password_policy#914)
otherphotos
otherChore(branchoff): Set version on stable33 to a stable one (photos#3459)
otherprivacy
otherChore(branchoff): Set version on stable33 to a stable one (privacy#1289)
otherrecommendations
otherChore(branchoff): Set version on stable33 to a stable one (recommendations#1004)
otherrelated_resources
otherChore(branchoff): Set version on stable33 to a stable one (related_resources#907)
otherserverinfo
otherChore(branchoff): Set version on stable33 to a stable one (serverinfo#967)
othersurvey_client
otherChore(branchoff): Set version on stable33 to a stable one (survey_client#391)
othersuspicious_login
otherChore(branchoff): Set version on stable33 to a stable one (suspicious_login#1092)
othertext
fixFix(deps): update dependency yjs to ^13.6.30 (text#8394)
otherChore(branchoff): Set version on stable33 to a stable one (text#8407)
othertwofactor_totp
otherChore(branchoff): Set version on stable33 to a stable one (twofactor_totp#1751)
fixFix(deps): align composer-lock and checked-in vendor/ (updater#727)
+3 more items in the release notessecurityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
fixFix(docs): Fix dead documentation link for Windows file names (server#58291)
fixFix(comments): properly handle opening the sidebar when Activity integration is used (server#58294)
fixFix(theming): display error messages on image upload and delete previous image only after validation (server#58323)
fixFix: don’t try to create preview folder if it already exists (server#58328)
fixFix: obey x-nc-scheduling flag on delete (server#58341)
fixFix(sftp): Handle empty port parameter to allow host-defined ports (server#58358)
featureFeat: add upload_time support to file search and recent files (server#58374)
fixFix(files): correctly sort views (server#58375)
fixFix(cache): filter out invalid entries in `OC\Files\Cache\Wrapper\CacheWrapper::getFolderContentsById` (server#58378)
fixFix(setup): add index properties_name_path_user by default on new installs (server#58418)
fixFix(external_storage): hide local storage as an option for users (server#58424)
fixFix(user_status): mount emoji picker outside of dialog (server#58429)
fixFix(perf): use index when deleting old previews (server#58431)
fixFix(Propagator): Skip groupfolders root entries (server#58433)
fixFix/more missing userid cases (server#58440)
fixFix(files_sharing): ensure the server share API errors are shown (server#58441)
fixFix(TransferOwnershipService): Remove groupfolders size (server#58449)
fixFix(Propagator): Also skip groupfolders versions and trash entries (server#58450)
fixFix(View): Handle ICacheEntry returned by FileInfo->getData() (server#58455)
fixFix(files): fix tab navigation from select all checkbox to batch actions (server#58462)
fixFix(files_sharing): make legacy `downloadShare` endpoint compatible with legacy behavior (server#58468)
fixFix(dav): Use an exhaustive list for allowed serialized classes (server#58511)
featureFeat: calendar read and write federation (server#58590)
featurePerf(sharing): Avoid loading all shares from all users when unsharing (server#58658)
featureFeat: set creation_time on file creation and render recently created icon (server#58694)
breakingRemove external shares from share list (server#58717)
featurePerf(preview): bulk process preview regeneration (server#58796)
featureFeat: Add memcache_customprefix (server#58810)
featureFeat(routing): add files_sharing_raw to rootUrlApps (server#58838)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58880)
featureFeat: improve calendar migrator (server#58907)
featureFeat(CalDAV): Add function to get the token of a publicly shared calendar (server#59080)
featureFeat(taskprocessing): add worker command for synchronous task processing (server#59082)
featurePerf: Replace getById call with getFirstNodeById (activity#2388)
featurePerf: add new index to serve a full WHERE clause (activity#2447)
featureFeat: make Docker API version configurable via app config (app_api#798)
featureAvoid cropping logo in About & New slideshow (firstrunwizard#1964)
featureFeat(api): Add context parameter to generate and validate endpoints (password_policy#900)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1268)
+137 more items in the release notesfeatureAdd UserConfigChangedEvent to fire whenever a user config value is changed (server#42039)
featureFeat: Add appconfig to disable fixed userfolder permissions optimization (server#51145)
featureFeat: add an option to filter what paths get checked for updates (server#52442)
featureFeat(CertificateManager): Add option to specify the default certificates bundle path (server#52749)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#52825)
featureFeat(previews): allow ffmpeg to connect direct for AWS S3 buckets (server#53634)
featureFeat(login): hide password on form submit (server#53869)
featureFeat(previews): previews for large remote files without full file download (server#53952)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#54316)
featureFeat: locally cache frequently requested LDAP mapping data (server#54429)
featurePerf(s3): Provide direct pre-signed download link (server#54436)
featureAdd INodeByPath to Directory (server#54441)
featureFeat(config): Add common audio and video MIME type aliases (server#54447)
featurePerf(preview): Split preview data to new table (server#54543)
featureFeat(file_sharing): Provide template creator list in public shares (server#54565)
featureFeat(comments): add Markdown support (server#54685)
featureFeat(files_sharing): provide web components based API for sidebar (server#54788)
featureFeat(ObjectStore): Add option to limit the total size (server#54797)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54810)
featureFeat(migration-attributes): add DataCleansing (server#54842)
featureFeat(migration-attributes): missing attributes (server#54846)
featureAdd task processing manager method to get the list of available task type IDs (server#54848)
security[master] fix(security): Update CA certificate bundle (server#54992)
security[master] fix(security): Update code signing revocation list (server#55056)
security[master] fix(security): Update code signing revocation list (server#55446)
deprecatedPort away from deprecated Doctrine APIs (server#55674)
breakingChore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718)
breakingRemove stable30 from dependabot (server#56018)
security[master] fix(security): Update CA certificate bundle (server#56211)
security[master] fix(security): Update code signing revocation list (server#56363)
breakingDebt(files): Remove regular stats request (server#56792)
security[master] fix(security): Update CA certificate bundle (server#56811)
security[master] fix(security): Update code signing revocation list (server#57031)
breakingEnhancement(files): remove redundant success toast on file rename (server#57168)
security[master] fix(security): Update code signing revocation list (server#57262)
breakingRefactor!: migrate files sidebar to Node API (server#57277)
security[master] fix(security): Update code signing revocation list (server#57380)
securityFix(security): Update Expires time (server#57688)
securityFix(security): Update code signing revocation list (server#57948)
deprecatedCleanup unused code and deprecated imports (text#7752)
+2364 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
securityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
featureFeat: add logging to preview generation (server#52300)
featureFeat: handle hide-download DAV property (viewer#2807)
featureFeat: lowercase headers to exclude in exapp proxy (app_api#569)
featureFeat(profile): Add an API to get the profile field data (server#52372)
featureFeat(security): add configurable IPv6 subnet for BFP and throttling (server#52233)
fixFix multiple cypress issues (activity#1994)
fixFix saving annotations in paths with special characters (files_pdfviewer#1194)
fixFix task processing registration validation (app_api#573)
fixFix: Adjust padding in table cell and header components (text#7189)
fixFix: adjust webpack nonce generation (server#52003)
fixFix: Apply storage checks in addition to share (text#7192)
fixFix: Check that user actually can validate password for js (server#52237)
fixFix: don't check node access again for listing reminders in dav (server#52504)
fixFix: don't setup the filesystem to check if a user is blocked by ACLs (activity#1985)
fixFix: exclude vendor-bin from release artifacts (suspicious_login#989)
fixFix: fix preloading files with no custom properties (server#52101)
fixFix: Flaky samba kerberos tests (server#52578)
fixFix: Forward attributes to the sidebar (server#52566)
fixFix: Open PDF file in "richdocuments" if it is not downloadable (files_pdfviewer#1204)
fixFix: Proper order for checking path prefix for getting file by id from cache (server#52039)
fixFix: submit button on file picker dialog (text#7190)
fixFix: Transfer ownership with S3 as primary (server#52185)
fixFix: try to avoid memory exhaustion (suspicious_login#988)
fixFix(apps): Sort names separately from active/update state (server#52653)
fixFix(blurhash): Use preview API to generate the previews (server#52661)
fixFix(build): avoid double load of the app (notifications#2309)
fixFix(CalDAV): do not ignore move command object target uri (server#52562)
fixFix(CI): disable RateLimiting for Nextcloud in the CI (app_api#565)
fixFix(config): Censor more app configs in system report (server#52433)
fixFix(dav): allow uploading of files with long filenames (server#52302)
fixFix(dav): check the owner displayName scope before giving attribute (server#52554)
fixFix(db): Create replacement index where original index is missing (server#52394)
fixFix(exAppMapper): init missing headers_to_exclude (app_api#564)
featurePerf: Log requests using high amount of memory as warning (server#52219)
featurePerf(caldav): increase chunk size in RemoveOrphanEventsAndContacts repair step (server#52548)
featurePerf(cloud_federation_api): only provide capabilities if needed (server#52030)
featurePerf(db): Extend index on cards_properties to cover name and value (server#52415)
featurePerf(files_reminders): Reduce db queries on propfind (server#51736)
featurePerf(files_sharing): do not emit second propfind for account filter (server#52001)
breakingRemove custom handling for public share pages with single files (files_pdfviewer#1206)
+51 more items in the release notesother[stable31] fix(taskprocessing): use the event for AppAPI to get list of AI providers
other[stable31] fix(dav): Really only run the chunk cleanup once
fix[stable31] fix(files_sharing): fix share creation error handling
fix[stable31] feat(bulk-upload): change the default to disabled as there are still some bugs present
other[stable31] fix(federation): Don't load the addressbook when resolving a cloud ID
other[stable31] ignore missing theming app
other[stable31] fix(ContextAgent): Do not translate the name ContextAgent
otherbuild(deps): bump marked from 15.0.7 to 15.0.8
feature[stable31] chore(files_trashbin): Add user details in log from Trashbin
other[stable31] fix: Handle missing share providers when promoting reshares
otherbuild(deps): bump @nextcloud/event-bus from 3.3.1 to 3.3.2
otherbuild(deps): bump dompurify from 3.2.4 to 3.2.5
other[stable31] fix(files_sharing): rate limit share creation 20 times per 10 minutes
other[stable31] fix(files_sharing): Apply default password setting in SharingDetailsTab
other31.0.4 RC1
other31.0.4