Nextcloud Server 33.0.8 → 35.0.1
10 releases · 11 breaking changes · 46 security fixes · 0 advisories fixed
46security11breaking2deprecated118feature223fix
Breaking changes
- breaking Remove usage of static vars or properties (server#59002) in 35.0.0
- breaking Revert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773) in 35.0.0
- breaking [master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271) in 35.0.0
- breaking Chore!: drop jQuery UI and jQuery (server#57648) in 34.0.0
- breaking Remove external shares from share list (server#58204) in 34.0.0
- breaking Remove leftover useless path assignements in View (server#58835) in 34.0.0
- breaking Remove static vars, first batch (server#59159) in 34.0.0
- breaking Remove long-time deprecated methods (server#59544) in 34.0.0
- breaking Chore!(core): remove deprecated Handlebars globals (server#59748) in 34.0.0
- breaking Remove unneeded sort when listing mail/federated shares (server#60244) in 34.0.0
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8311) in 34.0.0
Security changes
- security [master] fix(security): Update code signing revocation list (server#60705) in 35.0.0
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#60992) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61088) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61227) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61268) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61423) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61900) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62019) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62166) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#62256) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62632) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62857) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63142) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#63231) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63335) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63485) in 35.0.0
- security Fix(security): Update code signing revocation list (server#64051) in 35.0.0
- security Master] fix(security): Update code signing revocation list (server#64464) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#64721) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#63358) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63364) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63370) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63521) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#64097) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#62652) in 34.0.3
- security Master] fix(security): Update code signing revocation list (server#62040) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62046) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62184) in 34.0.2
- security Master] fix(security): Update CA certificate bundle (server#62437) in 34.0.2
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61133) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61239) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61283) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61429) in 34.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58869) in 34.0.0
- security Fix(security): Update Expires time (server#60397) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#61001) in 34.0.0
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#64465) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#64720) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#63357) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63363) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63369) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63520) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#64098) in 33.0.9
Deprecations
- deprecated Fix deprecations in tests (server#61140) in 35.0.0
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1264) in 34.0.0
Every release in between
fixFix(Sharing): Prevent truncation of node IDs (server#64140)
fixFix(trashbin): properly unpause trashbin on error (server#64177)
fixFix: update left padding of public shares (server#64213)
fixFix: update shared resource calendar icon for different theme (server#64288)
fixFix(i18n): Remove ellipsis from search strings (server#64323)
fixFix: preserve link shares on ownership transfer (server#64332)
featureAllow quota write streams with unknown free space (server#64341)
fixFix: remove nested items from favorites view on unfavorite (server#64344)
fixFix(Sharing): Hide non-matching recipients instead of only their secrets (server#64353)
fixFix(encryption): cap and invalidate key-cache (server#64356)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64357)
fixFix(files_external): show that an unrestricted storage applies to all (server#64362)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64367)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64372)
fixFix: show custom permissions when share is removed from edit bundle (server#64375)
fixFix: logs can leak sensitive information.. (server#64386)
fixFix: skip copying skeleton if the user has 0 quota (server#64396)
fixFix(files): bring back ownership transfer of all files (server#64407)
fixFix: use correct mimetype for theming logo (server#64410)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64416)
fixFix: scope group share child permission updates to usergroup (server#64417)
fixFix(sharing): Hide Allow download and sync option for federated (server#64421)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64425)
fixFix(previews): set Content-Type header for Imaginary requests (server#64431)
featureImplement recommended recipient api for unified sharing (server#64433)
fixFix(CalDAV): extract data from occurance exemptions (server#64438)
featureAdd files:list command and fix auto completion (server#64439)
fixFix(config): Don’t print sensitive config when setting them (server#64442)
featureFeat: Add more debug output when checkTokenCredentials fails (server#64472)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64477)
fixFix(filecache): announce every removed entry so metadata is cleaned up (server#64498)
fixFix(files): validate dropped filenames before upload (server#64502)
fixFix: remove dead hook listener and replace with event listener (server#64509)
fixFix(CalDAV): set significant change flag properly (server#64520)
featureFeat(files): bring back the Sidebar API (server#64581)
featurePerf: Improve token exchange (server#64597)
featureFeat: let apps define the actor of an activity via the activity manager (activity#2930)
featureAdd a vitest harness for the front-end (files_pdfviewer#1564)
featureFeat(api): Allow to filter the API by app and object (notifications#3389)
featureFeat(menu): add Mermaid diagram entry to Blocks menu (text#9204)
+34 more items in the release notesfeatureAdd rel attribute for fediverse link to make verification possible. (server#43364)
featureFeat(deps): Upgrade phpseclib to v3 (server#48183)
featureFeat(occ): Better handling of disabled or unreacheable App store (server#49697)
featureFeat: Run setup checks by category or class (server#49978)
featureAdded parameter to disable web UI integration with local client (server#54191)
featureFeat: OCS Calendar Import (server#55178)
featureFeat(theming): add option for reduce animation (server#55406)
featureFeat(entity): Provide a new API for entities (server#56199)
featureAdded a exclude disabled option to last seen (server#57081)
featureFeat (2fa): Add IStatelessProvider interface (server#57216)
featureImplement token exchange from OCM (server#57234)
featureMove invite-accepted capability and implementation to contacts app. (server#57853)
featureFeat: delay fetching the display name of a share recipient untill we need it (server#58335)
featureFeat: frankenphp (server#58541)
featureFeat(lookup): search for local account only via lookupserver (server#58567)
breakingRemove usage of static vars or properties (server#59002)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#59271)
featureFeat(files_versions): allow to block version creation using WFE (server#59610)
featureFeat: allow setting custom login-name for occ generated app password (server#59680)
security[master] fix(security): Update code signing revocation list (server#60705)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735)
security[master] fix(security): Update code signing revocation list (server#60992)
security[master] fix(security): Update code signing revocation list (server#61088)
deprecatedFix deprecations in tests (server#61140)
security[master] fix(security): Update code signing revocation list (server#61227)
security[master] fix(security): Update code signing revocation list (server#61268)
security[master] fix(security): Update code signing revocation list (server#61423)
security[master] fix(security): Update code signing revocation list (server#61900)
security[master] fix(security): Update code signing revocation list (server#62019)
security[master] fix(security): Update code signing revocation list (server#62166)
security[master] fix(security): Update CA certificate bundle (server#62256)
security[master] fix(security): Update code signing revocation list (server#62632)
security[master] fix(security): Update code signing revocation list (server#62857)
security[master] fix(security): Update code signing revocation list (server#63142)
security[master] fix(security): Update CA certificate bundle (server#63231)
security[master] fix(security): Update code signing revocation list (server#63335)
security[master] fix(security): Update code signing revocation list (server#63485)
breakingRevert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773)
securityFix(security): Update code signing revocation list (server#64051)
breaking[master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271)
+2377 more items in the release notesfeatureFeat(search): Subdue header search input placeholder (server#60833)
fixFix(files_sharing): Use share id in file actions (server#62403)
fixFix(dashboard): update scrollbar contrast on background (server#62630)
fixFix(encryption): bind personal private key password inputs (server#62672)
fixFix: allow Enter on public share Download link (server#62770)
fixFix: multiple file selection on tab navigation (server#63214)
fixFix: Combined Calendar and Contacts Import (server#63334)
fixFix: fail uploads when uri does not match session/share token (server#63960)
fixFix(files_external): map display names for groups (server#64010)
fixFix(sharing): Hide Allow download and sync option for federated (server#64013)
fixFix(tags): broken tag deletion on user delete (server#64089)
fixFix(metadata): bind chunked file ids in dropMetadataForFiles (server#64092)
fixFix: protect share accept endpoint with CSRF token (server#64107)
fixFix: remove wrongly used system address book flag (server#64131)
fixFix(files_sharing): normalize share target on parent folder rename (server#64143)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64146)
fixFix: update left padding of public shares (server#64212)
fixFix(ci): Pin 32-bit (server#64304)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64321)
fixFix: preserve link shares on ownership transfer (server#64330)
featureAllow quota write streams with unknown free space (server#64342)
fixFix: remove nested items from favorites view on unfavorite (server#64345)
fixFix(encryption): cap and invalidate key-cache (server#64355)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64359)
fixFix(files_external): show that an unrestricted storage applies to all (server#64361)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64368)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64373)
fixFix: show custom permissions when share is removed from edit bundle (server#64376)
fixFix: logs can leak sensitive information.. (server#64385)
fixFix: skip copying skeleton if the user has 0 quota (server#64397)
fixFix: use correct mimetype for theming logo (server#64409)
securityMaster] fix(security): Update code signing revocation list (server#64464)
featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64610)
featureAdd API to generate system report section (server#64632)
securityMaster] fix(security): Update code signing revocation list (server#64721)
featureFeat: add additional metadata to node webhooks (server#64846)
featurePerf(files): Only match search results against caches of their storage (server#64917)
featureFeat: Add code integrity background job (server#64973)
featureFeat(workflow): Add fixup block (circles#2988)
featurePerf(session): fetch document only once in SessionMiddleware (text#9296)
+106 more items in the release notesfixFix(theming): mark background button text as English (server#62252)
fixFix(ocm): Move invite-accepted capability and implementation to contacts app (server#62486)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63155)
fixFix: make unified filter chip accessible (server#63224)
fixFix(preview): delete version metadata by preview ID (server#63290)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63310)
fixFix(group): Set the display name on every backends that supports it (server#63321)
fixFix(jobs): don’t overwrite the –stop_after baseline in background-job:worker (server#63328)
fixFix(config): mask the Euro-Office jwt_secret as sensitive (server#63332)
fixFix(preview): order previews by ID during pagination (server#63345)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63347)
securityMaster] fix(security): Update code signing revocation list (server#63358)
securityMaster] fix(security): Update code signing revocation list (server#63364)
securityMaster] fix(security): Update code signing revocation list (server#63370)
fixFix: Creating shares with multiple mount permissions (server#63372)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63378)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63379)
fixFix: Public link with multiple mounts (server#63384)
featureFeat: Mark 32 bits support as removed for Nextcloud Hub 27 Winter (server#63387)
fixFix(preview): keep the local file when losing the insert race (server#63390)
fixFix(files_sharing): Use share password policy for password generation (server#63397)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63404)
featureFeat(dav): add IRoomMetadata::BUILDING_NAME (server#63419)
fixFix(files_reminder): passed reminder handling (server#63425)
fixFix: enhance name splitting to handle “Lastname, Firstname” format (server#63426)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63456)
securityMaster] fix(security): Update code signing revocation list (server#63521)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63523)
fixFix(LocalStorage): Clear realpath cache on fopen failure and re-try access (server#63530)
fixFix(dav): Handle correctly not found while streaming output (server#63533)
fixFix(provisioning_api): let sub-admins change group memberships (server#63534)
fixFix(files): hide download action in link shares for newly created folders (server#63552)
featureFeat(updater): clear app_install_overwrite on major upgrades (server#63633)
fixFix(appconfig): make type-conflict error self-explanatory (server#63643)
fixFix(dav): scope contact photo export to local address books (server#63645)
fixFix cancelling the customization of a share (server#63658)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63668)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63678)
securityMaster] fix(security): Update code signing revocation list (server#64097)
featureAdd a vitest harness for the front-end (files_pdfviewer#1565)
+67 more items in the release notesfeaturePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62223)
fixFix: Output shape validation will delete keys when there is a list of files (server#62237)
fixFix(jobs): resolve portability issues with background job cleanup (server#62279)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62281)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62337)
fixFix(preview): Handle unique constraints violation exception (server#62363)
fixFix(files_version): mtime confusion on milliseconds (server#62372)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62418)
fixFix(SetupChecks): Link to task processing worker docs (server#62443)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62451)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62457)
fixFix: harden object store against copying a file to itself (server#62461)
fixFix: Use PHP_AUTH_PW for strict password confirmation (server#62537)
featurePerf: Use hash map to check if path was already checked (server#62588)
fixFix(TaskProcessing): Claim tasks atomically in both SynchronousBackgr… (server#62608)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62611)
fixFix(unified-search): catch errors in response (server#62616)
securityMaster] fix(security): Update code signing revocation list (server#62652)
fixFix(search): Add end date for last 7 and last 30 days (server#62685)
fixFix(caldav): Expand recurring events for principal calendar search (server#62693)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62702)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62714)
fixFix(imip): add context to imip log messages (server#62723)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62733)
fixFix(jobs): compute memory usage after clean-up (server#62768)
fixFix(metadata): bind chunked file ids (server#62771)
featurePerf(user-display-name): Check memory cache before trying redis (server#62778)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62780)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62784)
fixFix(encryption): handle decryption exception with outdated passwords (server#62788)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62792)
fixFix(share): Avoid crash when share owner is not found (server#62798)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62908)
featureFeat: Allow to check user existence outside specific user backends (server#62917)
featureFeat(lookup): search for local account only via lookupserver (server#62934)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62949)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63113)
featurePerf(files): compute move/rename activity settings once (activity#2794)
featureFeat: adding an option to exclude users from the acitivity log (activity#2808)
featurePerf(push): Send push notifications async to proxies (notifications#3246)
+83 more items in the release notesfixFix(cypress): disable unsupported-browser redirect in test container (server#60807)
featureFeat(UserManager): Add getters for avatar URLs (server#60811)
fixFix(core): public share download icon color and theme filter scope (server#61211)
fixFix: use card interface instead of object (server#61252)
fixFix: properly mark CleanupShareTarget as expensive (server#61498)
fixFix: update cached mounts when moving share in repair step (server#61500)
fixFix(files_trashbin): create folder if missing when expiring trash (server#61523)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61528)
fixFix: stop calling DI container in SharedStorage (server#61529)
fixFix(preview): First cleanup from filecache and then from preview table (server#61531)
featurePerf(View): don’t sort twice the same array (server#61535)
featurePerf: block more properties from using the custom properties backend (server#61540)
fixFix(settings): correct heading order in account management sidebar (server#61546)
fixFix: Make the IProvideUserSecretBackend usable (server#61550)
fixFix: track time spent in recursive markOrRun calls (server#61553)
featurePerf(log): normalize log data only when logging (server#61557)
featurePerf: avoid DIing IRootFolder at every shared storage init (server#61558)
featurePerf: Only sort wrappers when adding them (server#61700)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61852)
featureFeat(OCP): Add Interaction API (server#61867)
featureFeat: Disable callable serialization in sabre/xml (server#61923)
featureFeat: Fetch groups in batch in getUserGroups (server#61936)
featureFeat(login): clean remember me tokens (server#61972)
securityMaster] fix(security): Update code signing revocation list (server#62040)
securityMaster] fix(security): Update code signing revocation list (server#62046)
featurePerf(carddav): reduce disk usage of photocache (server#62054)
featurePerf(workflow): Implement result cache for IP checks (server#62057)
featureFeat: KV cache based on predis (server#62070)
featureFeat(share): add public share-review API under OCP\Share\ShareReview (server#62132)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62180)
securityMaster] fix(security): Update code signing revocation list (server#62184)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62197)
featurePerf(dav): Stream PROPFIND output (server#62224)
securityMaster] fix(security): Update CA certificate bundle (server#62437)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2513)
featureFeat: add predis as a dependency for Valkey cluster support (3rdparty#2518)
featureFeat: make amount of items sent on email configurable via occ (activity#2708)
featureFeat: add release relay gh workflow (app_api#924)
featureEnh: allow file owner to unlock TYPE_TOKEN locks (files_lock#1169)
featureFeat: Add login output when password policy fails (password_policy#966)
+351 more items in the release notesfixFix: folder tree selection after any action in main content (server#60478)
fixFix(files): show proper information when a move will override the target (server#60963)
featurePerf(user_ldap): chunk oracle queries for lower bind cost (server#60978)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60983)
fixFix(theming): read cachebuster as int in manifest endpoint (server#61010)
fixFix(dav): finalize upload metadata before post-write hooks (server#61072)
fixFix(comments): load comments styles when the comments app is loaded (server#61076)
fixFix(dav): properly handle files metadata (server#61078)
fixFix(settings): Fix appstore icon color in settings menu (server#61093)
fixFix(comments): Use capped memory cache for comments (server#61097)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61106)
fixFix: Correctly detect appid for dist css files (server#61113)
fixFix: use correct permissions mask for non-home storage public links (server#61118)
fixFix(settings): Show loading spinner while searching accounts (server#61122)
securityMaster] fix(security): Update code signing revocation list (server#61133)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61157)
fixFix(core): keep app menu settings icon legible on light backgrounds (server#61161)
fixFix(previews): ffprobe hangs (server#61182)
fixFix(files_versions): guard null path in event listeners (server#61189)
fixFix(repair): restrict unserialize() in RemoveBrokenProperties (server#61203)
fixFix(appstore): bring back “update all” button (server#61212)
fixFix(settings): clear NcAppNavigation toggle overhang (server#61234)
securityMaster] fix(security): Update code signing revocation list (server#61239)
featureFeat(settings): Require 8.3 for 35 (server#61241)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61243)
fixFix: Fix PHP Warning foreach() argument must be of type array|object, null given (server#61258)
securityMaster] fix(security): Update code signing revocation list (server#61283)
fixFix(twofactor_backupcodes): Add a clean helper to set code as used (server#61296)
fixFix(theming): preserve uploaded favicon and touch icon (server#61302)
fixFix: Use token expiration for ephemeral sessions (server#61305)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61309)
fixFix(user_ldap): Escape filter part when searching for group members (server#61325)
featureAdd OCM Notification Received Event (server#61337)
fixFix: trim duplicate search results for external share (server#61340)
fixFix: Do not set last-password-confirm for apptoken sessions (server#61342)
fixFix(team-manager): ensure team resources are only retrived for members (server#61351)
securityMaster] fix(security): Update code signing revocation list (server#61429)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2636)
featurePerf: Avoir calling Server::get for each share mounts (files_lock#1123)
+50 more items in the release notesfeatureFeat(filecache): Scale DB query created when deleting file from filecache (server#54277)
featureFeat: add oc-ownerid and oc-permissions headers on PUT DAV requests (server#54542)
featureAdd some missing attributes (server#55474)
featureFeat(preview): Expire previews (server#55632)
featureFeat(preview): On demand preview migration (server#55649)
featureAdd configs for strict PHP checks (server#56522)
featureFeat(app): allow removing installed-but-disabled apps; improve help & logging (server#56720)
featureFeat: improve calendar migrator (server#57112)
featureFeat: perform share mount validation on share instead of on mount (server#57295)
featureFeat(http-client): add option to add instance URL to HTTP client user-agent (server#57376)
featureFeat(mimetypes): Add mimetype aliases/mapping/names for .toml and .ovpn (server#57480)
featureFeat(external-storage): Implement IPartialMountPoint (server#57497)
featureAdd InstallationCompletedEvent for post-installation actions (server#57522)
featureFeat(user_picker): Move the profile picker to server (server#57539)
featureFeat: Add office switcher with feature comparison (server#57555)
featurePerf(normalization): Optimize path normalization (server#57570)
featureFeat(objectstore): Add AWS SSE-KMS encryption support for S3 storage (server#57623)
breakingChore!: drop jQuery UI and jQuery (server#57648)
featureFeat(files): render file list filters in top bar and allow to collapse into overflow menu (server#57664)
featureFeat: allow to filter contacts by team (server#57676)
featureFeat: Add twofactor applications to most of the presets (server#57737)
featureFeat(sharing): Make share permission in bundled edit configurable (server#57741)
featureFeat(openmetrics): add log level (server#57759)
featureFeat(contacts): support federated users/groups search when adding team members (server#57782)
featureFeat(flake): Add reuse cli (server#57800)
featureFeat: optimize user mount cache (server#57815)
featureFeat(OCP): Expose setup manager to OCP (server#57826)
featureFeat: Add SetupCheck to warn about missing second factor provider (server#57854)
breakingRemove external shares from share list (server#58204)
breakingRemove leftover useless path assignements in View (server#58835)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58869)
breakingRemove static vars, first batch (server#59159)
breakingRemove long-time deprecated methods (server#59544)
breakingChore!(core): remove deprecated Handlebars globals (server#59748)
breakingRemove unneeded sort when listing mail/federated shares (server#60244)
securityFix(security): Update Expires time (server#60397)
securityMaster] fix(security): Update code signing revocation list (server#61001)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1264)
breakingRemove unneeded max-height from text-menubar which caused a bug (text#8311)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476)
+949 more items in the release notesfixFix: track time spent in recursive markOrRun calls (server#61552)
fixFix(dashboard): update scrollbar contrast on background (server#62629)
fixFix(encryption): bind personal private key password inputs (server#62671)
fixFix: allow Enter on public share Download link (server#62769)
fixFix: multiple file selection on tab navigation (server#63213)
fixFix(cardDav): Only update user card on actual mapped propreties changes (server#63769)
fixFix: fail uploads when uri does not match session/share token (server#63961)
fixFix(files_external): map display names for groups (server#64009)
fixFix: Unknown cli option (server#64012)
fixFix(sharing): Hide Allow download and sync option for federated (server#64014)
fixFix(tags): broken tag deletion on user delete (server#64088)
fixFix: protect share accept endpoint with CSRF token (server#64108)
fixFix: remove wrongly used system address book flag (server#64130)
fixFix(files_sharing): normalize share target on parent folder rename (server#64142)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64147)
fixFix: update left padding of public shares (server#64211)
fixFix(ci): Pin 32-bit (server#64305)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64320)
fixFix: preserve link shares on ownership transfer (server#64329)
fixFix: remove nested items from favorites view on unfavorite (server#64346)
fixFix(encryption): cap and invalidate key-cache (server#64354)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64358)
fixFix(files_external): show that an unrestricted storage applies to all (server#64360)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64366)
fixFix: show custom permissions when share is removed from edit bundle (server#64377)
fixFix: logs can leak sensitive information.. (server#64384)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64414)
fixFix: scope group share child permission updates to usergroup (server#64418)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64423)
fixFix(config): Don’t print sensitive config when setting them (server#64463)
securityMaster] fix(security): Update code signing revocation list (server#64465)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64475)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64480)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64483)
fixFix(dav): keep tags on hidden files when setting tag object ids (server#64561)
featureAdd API to generate system report section (server#64633)
securityMaster] fix(security): Update code signing revocation list (server#64720)
featureFeat: add additional metadata to node webhooks (server#64845)
featurePerf(files): Only match search results against caches of their storage (server#64918)
featureFeat(workflow): Add fixup block (circles#2987)
+76 more items in the release notesfixFix(ocm): Move invite-accepted capability and implementati… (server#62460)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)
fixFix(CalDAV): iTipBroker message generation and testing (server#63187)
fixFix(preview): delete version metadata by preview ID (server#63289)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)
fixFix: make unified filter chip accessible (server#63319)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)
securityMaster] fix(security): Update code signing revocation list (server#63357)
securityMaster] fix(security): Update code signing revocation list (server#63363)
securityMaster] fix(security): Update code signing revocation list (server#63369)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63380)
fixFix: Public link with multiple mounts (server#63383)
fixFix(preview): keep the local file when losing the insert race (server#63391)
fixFix(files_sharing): Use share password policy for password generation (server#63396)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)
fixFix(files_reminder): passed reminder handling (server#63424)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63457)
securityMaster] fix(security): Update code signing revocation list (server#63520)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63522)
fixFix(files): hide download action in link shares for newly created folders (server#63553)
fixFix(appconfig): make type-conflict error self-explanatory (server#63642)
fixFix(dav): scope contact photo export to local address books (server#63644)
fixFix cancelling the customization of a share (server#63657)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63667)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63677)
fixFix(settings): Fix AI regex (server#63692)
fixFix: Check that password matches in occ user:auth-tokens:add (server#63696)
fixFix(contactsmenu): restore avatars for non-user contacts (server#63716)
fixFix: Check rememberme cookie previous session id matches uid (server#63720)
fixFix(2fa): Add missing BruteForceProtection attribute (server#63733)
fixFix(core): accept deprecated IANA timezone aliases (server#63757)
fixFix(group): pass previous display name in GroupChangedEvent (server#63780)
fixFix(files_external): guard optional S3 key in storage id computation (server#63818)
fixFix(webauthn): Throw on uid mismatch when updating registration (server#63833)
fixFix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)
fixFix: Ensure we don’t get share by empty name (server#63851)
securityMaster] fix(security): Update code signing revocation list (server#64098)
featureAdd a vitest harness for the front-end (files_pdfviewer#1566)
+40 more items in the release notes