Nextcloud Server 34.0.0 → 35.0.2
8 releases · 3 breaking changes · 35 security fixes · 0 advisories fixed
35security3breaking2deprecated105feature175fix
Breaking changes
- breaking Remove usage of static vars or properties (server#59002) in 35.0.0
- breaking Revert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773) in 35.0.0
- breaking [master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271) in 35.0.0
Security changes
- security [master] fix(security): Update code signing revocation list (server#60705) in 35.0.0
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#60992) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61088) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61227) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61268) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61423) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61900) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62019) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62166) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#62256) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62632) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62857) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63142) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#63231) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63335) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63485) in 35.0.0
- security Fix(security): Update code signing revocation list (server#64051) in 35.0.0
- security Master] fix(security): Update code signing revocation list (server#64464) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#64721) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#63358) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63364) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63370) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63521) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#64097) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#62652) in 34.0.3
- security Master] fix(security): Update code signing revocation list (server#62040) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62046) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62184) in 34.0.2
- security Master] fix(security): Update CA certificate bundle (server#62437) in 34.0.2
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61133) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61239) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61283) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61429) in 34.0.1
Deprecations
- deprecated Deprecate long, non-lazy app config and user config (server#65012) in 35.0.2
- deprecated Fix deprecations in tests (server#61140) in 35.0.0
Every release in between
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64322)
fixFix(files_sharing): name the parent folder in inherited unshare actions (server#64349)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64482)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64485)
featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64609)
fixFix: forbid newline characters in filenames (server#64613)
fixFix: correct cast ttl to int in KeyValueCache (server#64615)
featureAdd API to generate system report section (server#64631)
fixFix(auth): keep remember-me cookies pointing at a live session token (server#64649)
fixFix: never block simple renames in SharesPlugin (server#64681)
featureFeat(upgrade): localize app names if available on upgrade page (server#64693)
fixFix(files): keep deleting live photo peers after a missing one (server#64699)
fixFix(files_sharing): render share suggestion avatar when provided (server#64704)
fixFix(setupcheck): Print verbose info to allow finding out memory issues (server#64751)
featureFeat: add additional metadata to node webhooks (server#64847)
fixFix(EmojiHelper): exclude non-latin letters from EmojiHelper (server#64866)
featureFeat: make comment events webhook compatible (server#64868)
fixFix(Sharing): Fix recipient IDs on 32-bits (server#64870)
fixFix(files_external): preserve boolean mount options (server#64879)
fixFix(SchemaChecker): don’t block on unexpected-table finding (server#64891)
fixFix(adminaudit): Allow named placeholders via CriticalActionPerformedEvent (server#64895)
fixFix(cache): Check if $entry[‘fileid’] exists (server#64902)
fixFix(user_ldap): show %uid instead of %%uid in the login filter hint (server#64913)
fixFix: Make all app versions stable (server#64915)
featurePerf(files): Only match search results against caches of their storage (server#64916)
featureFeat(files-search): Add push down negation optimizer (server#64923)
featureFeat: Add code integrity background job (server#64974)
deprecatedDeprecate long, non-lazy app config and user config (server#65012)
featurePerf: Optimize deleting the list of invalid shares (server#65137)
featureFeat: Add IAccountScopedSearchProvider (server#65313)
featureFeat: Build js after merge (activity#2998)
featurePerf: Cache public share (activity#3004)
featurePerf: Use startActivityTransaction in a few more places (activity#3016)
featureFeat: Build js after merge (circles#2978)
featureFeat(workflow): Add fixup block (circles#2989)
featureFeat: Bump pdf js (files_pdfviewer#1567)
featureFeat: expose Nextcloud AIO version in info API (serverinfo#1189)
featurePerf: get all markdown files in one SQL query (text#9291)
featurePerf(session): fetch document only once in SessionMiddleware (text#9295)
featureFeat(edit): collaborate in other apps(deck) (text#9325)
+102 more items in the release notesfixFix(Sharing): Prevent truncation of node IDs (server#64140)
fixFix(trashbin): properly unpause trashbin on error (server#64177)
fixFix: update left padding of public shares (server#64213)
fixFix: update shared resource calendar icon for different theme (server#64288)
fixFix(i18n): Remove ellipsis from search strings (server#64323)
fixFix: preserve link shares on ownership transfer (server#64332)
featureAllow quota write streams with unknown free space (server#64341)
fixFix: remove nested items from favorites view on unfavorite (server#64344)
fixFix(Sharing): Hide non-matching recipients instead of only their secrets (server#64353)
fixFix(encryption): cap and invalidate key-cache (server#64356)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64357)
fixFix(files_external): show that an unrestricted storage applies to all (server#64362)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64367)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64372)
fixFix: show custom permissions when share is removed from edit bundle (server#64375)
fixFix: logs can leak sensitive information.. (server#64386)
fixFix: skip copying skeleton if the user has 0 quota (server#64396)
fixFix(files): bring back ownership transfer of all files (server#64407)
fixFix: use correct mimetype for theming logo (server#64410)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64416)
fixFix: scope group share child permission updates to usergroup (server#64417)
fixFix(sharing): Hide Allow download and sync option for federated (server#64421)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64425)
fixFix(previews): set Content-Type header for Imaginary requests (server#64431)
featureImplement recommended recipient api for unified sharing (server#64433)
fixFix(CalDAV): extract data from occurance exemptions (server#64438)
featureAdd files:list command and fix auto completion (server#64439)
fixFix(config): Don’t print sensitive config when setting them (server#64442)
featureFeat: Add more debug output when checkTokenCredentials fails (server#64472)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64477)
fixFix(filecache): announce every removed entry so metadata is cleaned up (server#64498)
fixFix(files): validate dropped filenames before upload (server#64502)
fixFix: remove dead hook listener and replace with event listener (server#64509)
fixFix(CalDAV): set significant change flag properly (server#64520)
featureFeat(files): bring back the Sidebar API (server#64581)
featurePerf: Improve token exchange (server#64597)
featureFeat: let apps define the actor of an activity via the activity manager (activity#2930)
featureAdd a vitest harness for the front-end (files_pdfviewer#1564)
featureFeat(api): Allow to filter the API by app and object (notifications#3389)
featureFeat(menu): add Mermaid diagram entry to Blocks menu (text#9204)
+34 more items in the release notesfeatureAdd rel attribute for fediverse link to make verification possible. (server#43364)
featureFeat(deps): Upgrade phpseclib to v3 (server#48183)
featureFeat(occ): Better handling of disabled or unreacheable App store (server#49697)
featureFeat: Run setup checks by category or class (server#49978)
featureAdded parameter to disable web UI integration with local client (server#54191)
featureFeat: OCS Calendar Import (server#55178)
featureFeat(theming): add option for reduce animation (server#55406)
featureFeat(entity): Provide a new API for entities (server#56199)
featureAdded a exclude disabled option to last seen (server#57081)
featureFeat (2fa): Add IStatelessProvider interface (server#57216)
featureImplement token exchange from OCM (server#57234)
featureMove invite-accepted capability and implementation to contacts app. (server#57853)
featureFeat: delay fetching the display name of a share recipient untill we need it (server#58335)
featureFeat: frankenphp (server#58541)
featureFeat(lookup): search for local account only via lookupserver (server#58567)
breakingRemove usage of static vars or properties (server#59002)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#59271)
featureFeat(files_versions): allow to block version creation using WFE (server#59610)
featureFeat: allow setting custom login-name for occ generated app password (server#59680)
security[master] fix(security): Update code signing revocation list (server#60705)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735)
security[master] fix(security): Update code signing revocation list (server#60992)
security[master] fix(security): Update code signing revocation list (server#61088)
deprecatedFix deprecations in tests (server#61140)
security[master] fix(security): Update code signing revocation list (server#61227)
security[master] fix(security): Update code signing revocation list (server#61268)
security[master] fix(security): Update code signing revocation list (server#61423)
security[master] fix(security): Update code signing revocation list (server#61900)
security[master] fix(security): Update code signing revocation list (server#62019)
security[master] fix(security): Update code signing revocation list (server#62166)
security[master] fix(security): Update CA certificate bundle (server#62256)
security[master] fix(security): Update code signing revocation list (server#62632)
security[master] fix(security): Update code signing revocation list (server#62857)
security[master] fix(security): Update code signing revocation list (server#63142)
security[master] fix(security): Update CA certificate bundle (server#63231)
security[master] fix(security): Update code signing revocation list (server#63335)
security[master] fix(security): Update code signing revocation list (server#63485)
breakingRevert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773)
securityFix(security): Update code signing revocation list (server#64051)
breaking[master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271)
+2377 more items in the release notesfeatureFeat(search): Subdue header search input placeholder (server#60833)
fixFix(files_sharing): Use share id in file actions (server#62403)
fixFix(dashboard): update scrollbar contrast on background (server#62630)
fixFix(encryption): bind personal private key password inputs (server#62672)
fixFix: allow Enter on public share Download link (server#62770)
fixFix: multiple file selection on tab navigation (server#63214)
fixFix: Combined Calendar and Contacts Import (server#63334)
fixFix: fail uploads when uri does not match session/share token (server#63960)
fixFix(files_external): map display names for groups (server#64010)
fixFix(sharing): Hide Allow download and sync option for federated (server#64013)
fixFix(tags): broken tag deletion on user delete (server#64089)
fixFix(metadata): bind chunked file ids in dropMetadataForFiles (server#64092)
fixFix: protect share accept endpoint with CSRF token (server#64107)
fixFix: remove wrongly used system address book flag (server#64131)
fixFix(files_sharing): normalize share target on parent folder rename (server#64143)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64146)
fixFix: update left padding of public shares (server#64212)
fixFix(ci): Pin 32-bit (server#64304)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64321)
fixFix: preserve link shares on ownership transfer (server#64330)
featureAllow quota write streams with unknown free space (server#64342)
fixFix: remove nested items from favorites view on unfavorite (server#64345)
fixFix(encryption): cap and invalidate key-cache (server#64355)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64359)
fixFix(files_external): show that an unrestricted storage applies to all (server#64361)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64368)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64373)
fixFix: show custom permissions when share is removed from edit bundle (server#64376)
fixFix: logs can leak sensitive information.. (server#64385)
fixFix: skip copying skeleton if the user has 0 quota (server#64397)
fixFix: use correct mimetype for theming logo (server#64409)
securityMaster] fix(security): Update code signing revocation list (server#64464)
featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64610)
featureAdd API to generate system report section (server#64632)
securityMaster] fix(security): Update code signing revocation list (server#64721)
featureFeat: add additional metadata to node webhooks (server#64846)
featurePerf(files): Only match search results against caches of their storage (server#64917)
featureFeat: Add code integrity background job (server#64973)
featureFeat(workflow): Add fixup block (circles#2988)
featurePerf(session): fetch document only once in SessionMiddleware (text#9296)
+106 more items in the release notesfixFix(theming): mark background button text as English (server#62252)
fixFix(ocm): Move invite-accepted capability and implementation to contacts app (server#62486)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63155)
fixFix: make unified filter chip accessible (server#63224)
fixFix(preview): delete version metadata by preview ID (server#63290)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63310)
fixFix(group): Set the display name on every backends that supports it (server#63321)
fixFix(jobs): don’t overwrite the –stop_after baseline in background-job:worker (server#63328)
fixFix(config): mask the Euro-Office jwt_secret as sensitive (server#63332)
fixFix(preview): order previews by ID during pagination (server#63345)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63347)
securityMaster] fix(security): Update code signing revocation list (server#63358)
securityMaster] fix(security): Update code signing revocation list (server#63364)
securityMaster] fix(security): Update code signing revocation list (server#63370)
fixFix: Creating shares with multiple mount permissions (server#63372)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63378)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63379)
fixFix: Public link with multiple mounts (server#63384)
featureFeat: Mark 32 bits support as removed for Nextcloud Hub 27 Winter (server#63387)
fixFix(preview): keep the local file when losing the insert race (server#63390)
fixFix(files_sharing): Use share password policy for password generation (server#63397)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63404)
featureFeat(dav): add IRoomMetadata::BUILDING_NAME (server#63419)
fixFix(files_reminder): passed reminder handling (server#63425)
fixFix: enhance name splitting to handle “Lastname, Firstname” format (server#63426)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63456)
securityMaster] fix(security): Update code signing revocation list (server#63521)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63523)
fixFix(LocalStorage): Clear realpath cache on fopen failure and re-try access (server#63530)
fixFix(dav): Handle correctly not found while streaming output (server#63533)
fixFix(provisioning_api): let sub-admins change group memberships (server#63534)
fixFix(files): hide download action in link shares for newly created folders (server#63552)
featureFeat(updater): clear app_install_overwrite on major upgrades (server#63633)
fixFix(appconfig): make type-conflict error self-explanatory (server#63643)
fixFix(dav): scope contact photo export to local address books (server#63645)
fixFix cancelling the customization of a share (server#63658)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63668)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63678)
securityMaster] fix(security): Update code signing revocation list (server#64097)
featureAdd a vitest harness for the front-end (files_pdfviewer#1565)
+67 more items in the release notesfeaturePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62223)
fixFix: Output shape validation will delete keys when there is a list of files (server#62237)
fixFix(jobs): resolve portability issues with background job cleanup (server#62279)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62281)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62337)
fixFix(preview): Handle unique constraints violation exception (server#62363)
fixFix(files_version): mtime confusion on milliseconds (server#62372)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62418)
fixFix(SetupChecks): Link to task processing worker docs (server#62443)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62451)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62457)
fixFix: harden object store against copying a file to itself (server#62461)
fixFix: Use PHP_AUTH_PW for strict password confirmation (server#62537)
featurePerf: Use hash map to check if path was already checked (server#62588)
fixFix(TaskProcessing): Claim tasks atomically in both SynchronousBackgr… (server#62608)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62611)
fixFix(unified-search): catch errors in response (server#62616)
securityMaster] fix(security): Update code signing revocation list (server#62652)
fixFix(search): Add end date for last 7 and last 30 days (server#62685)
fixFix(caldav): Expand recurring events for principal calendar search (server#62693)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62702)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62714)
fixFix(imip): add context to imip log messages (server#62723)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62733)
fixFix(jobs): compute memory usage after clean-up (server#62768)
fixFix(metadata): bind chunked file ids (server#62771)
featurePerf(user-display-name): Check memory cache before trying redis (server#62778)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62780)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62784)
fixFix(encryption): handle decryption exception with outdated passwords (server#62788)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62792)
fixFix(share): Avoid crash when share owner is not found (server#62798)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62908)
featureFeat: Allow to check user existence outside specific user backends (server#62917)
featureFeat(lookup): search for local account only via lookupserver (server#62934)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62949)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63113)
featurePerf(files): compute move/rename activity settings once (activity#2794)
featureFeat: adding an option to exclude users from the acitivity log (activity#2808)
featurePerf(push): Send push notifications async to proxies (notifications#3246)
+83 more items in the release notesfixFix(cypress): disable unsupported-browser redirect in test container (server#60807)
featureFeat(UserManager): Add getters for avatar URLs (server#60811)
fixFix(core): public share download icon color and theme filter scope (server#61211)
fixFix: use card interface instead of object (server#61252)
fixFix: properly mark CleanupShareTarget as expensive (server#61498)
fixFix: update cached mounts when moving share in repair step (server#61500)
fixFix(files_trashbin): create folder if missing when expiring trash (server#61523)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61528)
fixFix: stop calling DI container in SharedStorage (server#61529)
fixFix(preview): First cleanup from filecache and then from preview table (server#61531)
featurePerf(View): don’t sort twice the same array (server#61535)
featurePerf: block more properties from using the custom properties backend (server#61540)
fixFix(settings): correct heading order in account management sidebar (server#61546)
fixFix: Make the IProvideUserSecretBackend usable (server#61550)
fixFix: track time spent in recursive markOrRun calls (server#61553)
featurePerf(log): normalize log data only when logging (server#61557)
featurePerf: avoid DIing IRootFolder at every shared storage init (server#61558)
featurePerf: Only sort wrappers when adding them (server#61700)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61852)
featureFeat(OCP): Add Interaction API (server#61867)
featureFeat: Disable callable serialization in sabre/xml (server#61923)
featureFeat: Fetch groups in batch in getUserGroups (server#61936)
featureFeat(login): clean remember me tokens (server#61972)
securityMaster] fix(security): Update code signing revocation list (server#62040)
securityMaster] fix(security): Update code signing revocation list (server#62046)
featurePerf(carddav): reduce disk usage of photocache (server#62054)
featurePerf(workflow): Implement result cache for IP checks (server#62057)
featureFeat: KV cache based on predis (server#62070)
featureFeat(share): add public share-review API under OCP\Share\ShareReview (server#62132)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62180)
securityMaster] fix(security): Update code signing revocation list (server#62184)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62197)
featurePerf(dav): Stream PROPFIND output (server#62224)
securityMaster] fix(security): Update CA certificate bundle (server#62437)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2513)
featureFeat: add predis as a dependency for Valkey cluster support (3rdparty#2518)
featureFeat: make amount of items sent on email configurable via occ (activity#2708)
featureFeat: add release relay gh workflow (app_api#924)
featureEnh: allow file owner to unlock TYPE_TOKEN locks (files_lock#1169)
featureFeat: Add login output when password policy fails (password_policy#966)
+351 more items in the release notesfixFix: folder tree selection after any action in main content (server#60478)
fixFix(files): show proper information when a move will override the target (server#60963)
featurePerf(user_ldap): chunk oracle queries for lower bind cost (server#60978)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60983)
fixFix(theming): read cachebuster as int in manifest endpoint (server#61010)
fixFix(dav): finalize upload metadata before post-write hooks (server#61072)
fixFix(comments): load comments styles when the comments app is loaded (server#61076)
fixFix(dav): properly handle files metadata (server#61078)
fixFix(settings): Fix appstore icon color in settings menu (server#61093)
fixFix(comments): Use capped memory cache for comments (server#61097)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61106)
fixFix: Correctly detect appid for dist css files (server#61113)
fixFix: use correct permissions mask for non-home storage public links (server#61118)
fixFix(settings): Show loading spinner while searching accounts (server#61122)
securityMaster] fix(security): Update code signing revocation list (server#61133)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61157)
fixFix(core): keep app menu settings icon legible on light backgrounds (server#61161)
fixFix(previews): ffprobe hangs (server#61182)
fixFix(files_versions): guard null path in event listeners (server#61189)
fixFix(repair): restrict unserialize() in RemoveBrokenProperties (server#61203)
fixFix(appstore): bring back “update all” button (server#61212)
fixFix(settings): clear NcAppNavigation toggle overhang (server#61234)
securityMaster] fix(security): Update code signing revocation list (server#61239)
featureFeat(settings): Require 8.3 for 35 (server#61241)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61243)
fixFix: Fix PHP Warning foreach() argument must be of type array|object, null given (server#61258)
securityMaster] fix(security): Update code signing revocation list (server#61283)
fixFix(twofactor_backupcodes): Add a clean helper to set code as used (server#61296)
fixFix(theming): preserve uploaded favicon and touch icon (server#61302)
fixFix: Use token expiration for ephemeral sessions (server#61305)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61309)
fixFix(user_ldap): Escape filter part when searching for group members (server#61325)
featureAdd OCM Notification Received Event (server#61337)
fixFix: trim duplicate search results for external share (server#61340)
fixFix: Do not set last-password-confirm for apptoken sessions (server#61342)
fixFix(team-manager): ensure team resources are only retrived for members (server#61351)
securityMaster] fix(security): Update code signing revocation list (server#61429)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2636)
featurePerf: Avoir calling Server::get for each share mounts (files_lock#1123)
+50 more items in the release notes