Nextcloud Server 33.0.8 → 34.0.1
4 releases · 8 breaking changes · 16 security fixes · 0 advisories fixed
16security8breaking1deprecated40feature95fix
Breaking changes
- breaking Chore!: drop jQuery UI and jQuery (server#57648) in 34.0.0
- breaking Remove external shares from share list (server#58204) in 34.0.0
- breaking Remove leftover useless path assignements in View (server#58835) in 34.0.0
- breaking Remove static vars, first batch (server#59159) in 34.0.0
- breaking Remove long-time deprecated methods (server#59544) in 34.0.0
- breaking Chore!(core): remove deprecated Handlebars globals (server#59748) in 34.0.0
- breaking Remove unneeded sort when listing mail/federated shares (server#60244) in 34.0.0
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8311) in 34.0.0
Security changes
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61133) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61239) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61283) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61429) in 34.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58869) in 34.0.0
- security Fix(security): Update Expires time (server#60397) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#61001) in 34.0.0
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#64465) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#64720) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#63357) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63363) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63369) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63520) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#64098) in 33.0.9
Deprecations
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1264) in 34.0.0
Every release in between
fixFix: folder tree selection after any action in main content (server#60478)
fixFix(files): show proper information when a move will override the target (server#60963)
featurePerf(user_ldap): chunk oracle queries for lower bind cost (server#60978)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60983)
fixFix(theming): read cachebuster as int in manifest endpoint (server#61010)
fixFix(dav): finalize upload metadata before post-write hooks (server#61072)
fixFix(comments): load comments styles when the comments app is loaded (server#61076)
fixFix(dav): properly handle files metadata (server#61078)
fixFix(settings): Fix appstore icon color in settings menu (server#61093)
fixFix(comments): Use capped memory cache for comments (server#61097)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61106)
fixFix: Correctly detect appid for dist css files (server#61113)
fixFix: use correct permissions mask for non-home storage public links (server#61118)
fixFix(settings): Show loading spinner while searching accounts (server#61122)
securityMaster] fix(security): Update code signing revocation list (server#61133)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61157)
fixFix(core): keep app menu settings icon legible on light backgrounds (server#61161)
fixFix(previews): ffprobe hangs (server#61182)
fixFix(files_versions): guard null path in event listeners (server#61189)
fixFix(repair): restrict unserialize() in RemoveBrokenProperties (server#61203)
fixFix(appstore): bring back “update all” button (server#61212)
fixFix(settings): clear NcAppNavigation toggle overhang (server#61234)
securityMaster] fix(security): Update code signing revocation list (server#61239)
featureFeat(settings): Require 8.3 for 35 (server#61241)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61243)
fixFix: Fix PHP Warning foreach() argument must be of type array|object, null given (server#61258)
securityMaster] fix(security): Update code signing revocation list (server#61283)
fixFix(twofactor_backupcodes): Add a clean helper to set code as used (server#61296)
fixFix(theming): preserve uploaded favicon and touch icon (server#61302)
fixFix: Use token expiration for ephemeral sessions (server#61305)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61309)
fixFix(user_ldap): Escape filter part when searching for group members (server#61325)
featureAdd OCM Notification Received Event (server#61337)
fixFix: trim duplicate search results for external share (server#61340)
fixFix: Do not set last-password-confirm for apptoken sessions (server#61342)
fixFix(team-manager): ensure team resources are only retrived for members (server#61351)
securityMaster] fix(security): Update code signing revocation list (server#61429)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2636)
featurePerf: Avoir calling Server::get for each share mounts (files_lock#1123)
+50 more items in the release notesfeatureFeat(filecache): Scale DB query created when deleting file from filecache (server#54277)
featureFeat: add oc-ownerid and oc-permissions headers on PUT DAV requests (server#54542)
featureAdd some missing attributes (server#55474)
featureFeat(preview): Expire previews (server#55632)
featureFeat(preview): On demand preview migration (server#55649)
featureAdd configs for strict PHP checks (server#56522)
featureFeat(app): allow removing installed-but-disabled apps; improve help & logging (server#56720)
featureFeat: improve calendar migrator (server#57112)
featureFeat: perform share mount validation on share instead of on mount (server#57295)
featureFeat(http-client): add option to add instance URL to HTTP client user-agent (server#57376)
featureFeat(mimetypes): Add mimetype aliases/mapping/names for .toml and .ovpn (server#57480)
featureFeat(external-storage): Implement IPartialMountPoint (server#57497)
featureAdd InstallationCompletedEvent for post-installation actions (server#57522)
featureFeat(user_picker): Move the profile picker to server (server#57539)
featureFeat: Add office switcher with feature comparison (server#57555)
featurePerf(normalization): Optimize path normalization (server#57570)
featureFeat(objectstore): Add AWS SSE-KMS encryption support for S3 storage (server#57623)
breakingChore!: drop jQuery UI and jQuery (server#57648)
featureFeat(files): render file list filters in top bar and allow to collapse into overflow menu (server#57664)
featureFeat: allow to filter contacts by team (server#57676)
featureFeat: Add twofactor applications to most of the presets (server#57737)
featureFeat(sharing): Make share permission in bundled edit configurable (server#57741)
featureFeat(openmetrics): add log level (server#57759)
featureFeat(contacts): support federated users/groups search when adding team members (server#57782)
featureFeat(flake): Add reuse cli (server#57800)
featureFeat: optimize user mount cache (server#57815)
featureFeat(OCP): Expose setup manager to OCP (server#57826)
featureFeat: Add SetupCheck to warn about missing second factor provider (server#57854)
breakingRemove external shares from share list (server#58204)
breakingRemove leftover useless path assignements in View (server#58835)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58869)
breakingRemove static vars, first batch (server#59159)
breakingRemove long-time deprecated methods (server#59544)
breakingChore!(core): remove deprecated Handlebars globals (server#59748)
breakingRemove unneeded sort when listing mail/federated shares (server#60244)
securityFix(security): Update Expires time (server#60397)
securityMaster] fix(security): Update code signing revocation list (server#61001)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1264)
breakingRemove unneeded max-height from text-menubar which caused a bug (text#8311)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476)
+949 more items in the release notesfixFix: track time spent in recursive markOrRun calls (server#61552)
fixFix(dashboard): update scrollbar contrast on background (server#62629)
fixFix(encryption): bind personal private key password inputs (server#62671)
fixFix: allow Enter on public share Download link (server#62769)
fixFix: multiple file selection on tab navigation (server#63213)
fixFix(cardDav): Only update user card on actual mapped propreties changes (server#63769)
fixFix: fail uploads when uri does not match session/share token (server#63961)
fixFix(files_external): map display names for groups (server#64009)
fixFix: Unknown cli option (server#64012)
fixFix(sharing): Hide Allow download and sync option for federated (server#64014)
fixFix(tags): broken tag deletion on user delete (server#64088)
fixFix: protect share accept endpoint with CSRF token (server#64108)
fixFix: remove wrongly used system address book flag (server#64130)
fixFix(files_sharing): normalize share target on parent folder rename (server#64142)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64147)
fixFix: update left padding of public shares (server#64211)
fixFix(ci): Pin 32-bit (server#64305)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64320)
fixFix: preserve link shares on ownership transfer (server#64329)
fixFix: remove nested items from favorites view on unfavorite (server#64346)
fixFix(encryption): cap and invalidate key-cache (server#64354)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64358)
fixFix(files_external): show that an unrestricted storage applies to all (server#64360)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64366)
fixFix: show custom permissions when share is removed from edit bundle (server#64377)
fixFix: logs can leak sensitive information.. (server#64384)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64414)
fixFix: scope group share child permission updates to usergroup (server#64418)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64423)
fixFix(config): Don’t print sensitive config when setting them (server#64463)
securityMaster] fix(security): Update code signing revocation list (server#64465)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64475)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64480)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64483)
fixFix(dav): keep tags on hidden files when setting tag object ids (server#64561)
featureAdd API to generate system report section (server#64633)
securityMaster] fix(security): Update code signing revocation list (server#64720)
featureFeat: add additional metadata to node webhooks (server#64845)
featurePerf(files): Only match search results against caches of their storage (server#64918)
featureFeat(workflow): Add fixup block (circles#2987)
+76 more items in the release notesfixFix(ocm): Move invite-accepted capability and implementati… (server#62460)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)
fixFix(CalDAV): iTipBroker message generation and testing (server#63187)
fixFix(preview): delete version metadata by preview ID (server#63289)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)
fixFix: make unified filter chip accessible (server#63319)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)
securityMaster] fix(security): Update code signing revocation list (server#63357)
securityMaster] fix(security): Update code signing revocation list (server#63363)
securityMaster] fix(security): Update code signing revocation list (server#63369)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63380)
fixFix: Public link with multiple mounts (server#63383)
fixFix(preview): keep the local file when losing the insert race (server#63391)
fixFix(files_sharing): Use share password policy for password generation (server#63396)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)
fixFix(files_reminder): passed reminder handling (server#63424)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63457)
securityMaster] fix(security): Update code signing revocation list (server#63520)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63522)
fixFix(files): hide download action in link shares for newly created folders (server#63553)
fixFix(appconfig): make type-conflict error self-explanatory (server#63642)
fixFix(dav): scope contact photo export to local address books (server#63644)
fixFix cancelling the customization of a share (server#63657)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63667)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63677)
fixFix(settings): Fix AI regex (server#63692)
fixFix: Check that password matches in occ user:auth-tokens:add (server#63696)
fixFix(contactsmenu): restore avatars for non-user contacts (server#63716)
fixFix: Check rememberme cookie previous session id matches uid (server#63720)
fixFix(2fa): Add missing BruteForceProtection attribute (server#63733)
fixFix(core): accept deprecated IANA timezone aliases (server#63757)
fixFix(group): pass previous display name in GroupChangedEvent (server#63780)
fixFix(files_external): guard optional S3 key in storage id computation (server#63818)
fixFix(webauthn): Throw on uid mismatch when updating registration (server#63833)
fixFix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)
fixFix: Ensure we don’t get share by empty name (server#63851)
securityMaster] fix(security): Update code signing revocation list (server#64098)
featureAdd a vitest harness for the front-end (files_pdfviewer#1566)
+40 more items in the release notes